@hasna/todos 0.15.52 → 0.16.0

package/dist/contracts.js

@@ -39,6 +39,84 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
+// src/lib/env.ts
+var alias = (canonical, legacy) => process.env[canonical] ?? process.env[legacy], env;
+var init_env = __esm(() => {
+  env = {
+    profile: () => alias("HASNA_TODOS_PROFILE", "TODOS_PROFILE"),
+    toolGroups: () => alias("HASNA_TODOS_TOOL_GROUPS", "TODOS_TOOL_GROUPS"),
+    machineId: () => alias("HASNA_TODOS_MACHINE_ID", "TODOS_MACHINE_ID"),
+    machineName: () => alias("HASNA_TODOS_MACHINE_NAME", "TODOS_MACHINE_NAME"),
+    rateLimitMax: () => alias("HASNA_TODOS_RATE_LIMIT_MAX", "TODOS_RATE_LIMIT_MAX"),
+    trustProxy: () => alias("HASNA_TODOS_TRUST_PROXY", "TODOS_TRUST_PROXY"),
+    autoProject: () => alias("HASNA_TODOS_AUTO_PROJECT", "TODOS_AUTO_PROJECT"),
+    aiFormat: () => alias("HASNA_TODOS_AI_FORMAT", "TODOS_AI_FORMAT"),
+    syncAgents: () => alias("HASNA_TODOS_SYNC_AGENTS", "TODOS_SYNC_AGENTS"),
+    taskListId: () => alias("HASNA_TODOS_TASK_LIST_ID", "TODOS_TASK_LIST_ID"),
+    claudeTaskList: () => alias("HASNA_TODOS_CLAUDE_TASK_LIST", "TODOS_CLAUDE_TASK_LIST"),
+    sandboxProfilesPath: () => alias("HASNA_TODOS_SANDBOX_PROFILES_PATH", "TODOS_SANDBOX_PROFILES_PATH"),
+    seatRosterPath: () => alias("HASNA_TODOS_SEAT_ROSTER_PATH", "TODOS_SEAT_ROSTER_PATH"),
+    delegateNoticeChannel: () => alias("HASNA_TODOS_DELEGATE_NOTICE_CHANNEL", "TODOS_DELEGATE_NOTICE_CHANNEL"),
+    delegateNotifyBin: () => alias("HASNA_TODOS_DELEGATE_NOTIFY_BIN", "TODOS_DELEGATE_NOTIFY_BIN")
+  };
+});
+
+// src/lib/local-opt-in.ts
+import {
+  clientTransportEnvKeys,
+  credentialOverrideEnvKey,
+  credentialPointerEnvKey,
+  CREDENTIAL_PROFILE_ENV_KEY
+} from "@hasna/contracts/client";
+function isTodosLocalOptIn(env2 = process.env) {
+  return TODOS_LOCAL_OPT_IN_ENV_KEYS.some((key) => (env2[key] ?? "").trim() !== "");
+}
+function todosAuthorityEnvKeys() {
+  const keys = clientTransportEnvKeys("todos");
+  return [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey("todos"),
+    credentialPointerEnvKey("todos"),
+    CREDENTIAL_PROFILE_ENV_KEY
+  ];
+}
+function hasTodosEnvAuthorityIntent(env2 = process.env) {
+  return todosAuthorityEnvKeys().some((key) => (env2[key] ?? "").trim() !== "");
+}
+function selectsTodosLocalStore(env2 = process.env) {
+  return !hasTodosEnvAuthorityIntent(env2) && isTodosLocalOptIn(env2);
+}
+function todosResolverEnv(env2) {
+  const blanks = todosAuthorityEnvKeys().filter((key) => (key in env2) && (env2[key] ?? "").trim() === "");
+  if (blanks.length === 0)
+    return env2;
+  const next = { ...env2 };
+  for (const key of blanks)
+    delete next[key];
+  return next;
+}
+function isAmbientTodosEnv(env2) {
+  if (typeof process !== "undefined" && env2 === process.env)
+    return true;
+  return env2[CONTRACTS_AMBIENT_ENVIRONMENT] === true;
+}
+function todosResolverInputs(env2, credentials = {}) {
+  const normalised = todosResolverEnv(env2);
+  if (normalised === env2)
+    return { env: normalised, credentials };
+  const keychain = { ...credentials.keychain };
+  if (keychain.enabled === undefined && keychain.run === undefined) {
+    keychain.enabled = isAmbientTodosEnv(env2);
+  }
+  return { env: normalised, credentials: { ...credentials, keychain } };
+}
+var TODOS_LOCAL_OPT_IN_ENV_KEYS, CONTRACTS_AMBIENT_ENVIRONMENT;
+var init_local_opt_in = __esm(() => {
+  TODOS_LOCAL_OPT_IN_ENV_KEYS = ["HASNA_TODOS_LOCAL", "TODOS_LOCAL"];
+  CONTRACTS_AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+});
+
 // src/project-registration/schema.ts
 function sqliteTodosProjectRegistrationSchemaSql() {
   return `
@@ -1608,16 +1686,18 @@ var init_migrations = __esm(() => {
   SET leaf_task_id = COALESCE(leaf_task_id, (
         SELECT attempt.leaf_task_id
         FROM pr_group_attempts AS attempt
+        JOIN pr_groups AS owner ON owner.id = attempt.group_id
         WHERE attempt.group_id = pr_groups.id
-        ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+        ORDER BY CASE WHEN attempt.id = owner.active_attempt_id THEN 0 ELSE 1 END,
                  attempt.created_at ASC, attempt.id ASC
         LIMIT 1
       )),
       branch = COALESCE(branch, (
         SELECT attempt.branch
         FROM pr_group_attempts AS attempt
+        JOIN pr_groups AS owner ON owner.id = attempt.group_id
         WHERE attempt.group_id = pr_groups.id
-        ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+        ORDER BY CASE WHEN attempt.id = owner.active_attempt_id THEN 0 ELSE 1 END,
                  attempt.created_at ASC, attempt.id ASC
         LIMIT 1
       ));
@@ -1640,16 +1720,18 @@ var init_migrations = __esm(() => {
   SET pr_number = COALESCE(pr_number, (
         SELECT attempt.pr_number
         FROM pr_group_attempts AS attempt
+        JOIN pr_groups AS owner ON owner.id = attempt.group_id
         WHERE attempt.group_id = pr_groups.id AND attempt.pr_number IS NOT NULL
-        ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+        ORDER BY CASE WHEN attempt.id = owner.active_attempt_id THEN 0 ELSE 1 END,
                  attempt.created_at ASC, attempt.id ASC
         LIMIT 1
       )),
       base_sha = COALESCE(base_sha, (
         SELECT attempt.base_sha
         FROM pr_group_attempts AS attempt
+        JOIN pr_groups AS owner ON owner.id = attempt.group_id
         WHERE attempt.group_id = pr_groups.id AND attempt.base_sha IS NOT NULL
-        ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+        ORDER BY CASE WHEN attempt.id = owner.active_attempt_id THEN 0 ELSE 1 END,
                  attempt.created_at ASC, attempt.id ASC
         LIMIT 1
       ));
@@ -1688,7 +1770,7 @@ var init_migrations = __esm(() => {
       ));
 
   INSERT OR IGNORE INTO _migrations (id)
-  SELECT 66
+  SELECT 67
   WHERE NOT EXISTS (
     SELECT 1 FROM pr_groups WHERE leaf_task_id IS NULL OR branch IS NULL
   )
@@ -1893,32 +1975,52 @@ var init_migrations = __esm(() => {
 });
 
 // src/db/schema.ts
+function runPrGroupLineageMigration(db, migration, rebuild) {
+  if (db.inTransaction)
+    throw new Error("PR-group migration requires its own transaction");
+  const priorForeignKeys = db.query("PRAGMA foreign_keys").get().foreign_keys;
+  try {
+    if (rebuild)
+      db.exec("PRAGMA foreign_keys = OFF");
+    db.exec("BEGIN IMMEDIATE");
+    for (const statement of migration.split(/;\s*(?:\n|$)/).map((value) => value.trim()).filter(Boolean)) {
+      if (/^(?:PRAGMA foreign_keys\s*=|BEGIN IMMEDIATE$|COMMIT$)/i.test(statement))
+        continue;
+      db.run(statement);
+    }
+    const completed = db.query("SELECT id FROM _migrations WHERE id = ?").get(rebuild ? 68 : 67);
+    if (!completed)
+      throw new Error("PR-group lineage backfill is incomplete; migration rolled back");
+    if (rebuild && db.query("PRAGMA foreign_key_check").all().length) {
+      throw new Error("PR-group migration failed foreign-key integrity verification");
+    }
+    db.exec("COMMIT");
+  } catch (error) {
+    if (db.inTransaction)
+      db.exec("ROLLBACK");
+    throw error;
+  } finally {
+    db.exec(`PRAGMA foreign_keys = ${priorForeignKeys ? "ON" : "OFF"}`);
+  }
+}
 function runMigrations(db) {
-  let strictMigrationFailure = null;
-  const executeMigration = (migration, index) => {
+  let currentLevel = 0;
+  try {
+    currentLevel = db.query("SELECT MAX(id) as max_id FROM _migrations").get()?.max_id ?? 0;
+  } catch {}
+  for (let index = currentLevel;index < MIGRATIONS.length; index++) {
     try {
-      db.exec(migration);
+      if (index === 66 || index === 67)
+        runPrGroupLineageMigration(db, MIGRATIONS[index], index === 67);
+      else
+        db.exec(MIGRATIONS[index]);
     } catch (error) {
-      try {
+      if (db.inTransaction)
         db.exec("ROLLBACK");
-      } catch {}
-      if (index + 1 >= 68)
-        strictMigrationFailure = error;
-    }
-  };
-  try {
-    const result = db.query("SELECT MAX(id) as max_id FROM _migrations").get();
-    const currentLevel = result?.max_id ?? 0;
-    for (let i = currentLevel;i < MIGRATIONS.length; i++) {
-      executeMigration(MIGRATIONS[i], i);
-    }
-  } catch {
-    for (const [index, migration] of MIGRATIONS.entries()) {
-      executeMigration(migration, index);
+      if (index + 1 >= 67)
+        throw error;
     }
   }
-  if (strictMigrationFailure)
-    throw strictMigrationFailure;
   ensureSchema(db);
 }
 function planSlugBase(value) {
@@ -3230,16 +3332,18 @@ function ensureSchema(db) {
       SET leaf_task_id = COALESCE(leaf_task_id, (
             SELECT attempt.leaf_task_id
             FROM pr_group_attempts AS attempt
+            JOIN pr_groups AS owner ON owner.id = attempt.group_id
             WHERE attempt.group_id = pr_groups.id
-            ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+            ORDER BY CASE WHEN attempt.id = owner.active_attempt_id THEN 0 ELSE 1 END,
                      attempt.created_at ASC, attempt.id ASC
             LIMIT 1
           )),
           branch = COALESCE(branch, (
             SELECT attempt.branch
             FROM pr_group_attempts AS attempt
+            JOIN pr_groups AS owner ON owner.id = attempt.group_id
             WHERE attempt.group_id = pr_groups.id
-            ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+            ORDER BY CASE WHEN attempt.id = owner.active_attempt_id THEN 0 ELSE 1 END,
                      attempt.created_at ASC, attempt.id ASC
             LIMIT 1
           ));
@@ -3260,16 +3364,18 @@ function ensureSchema(db) {
       SET pr_number = COALESCE(pr_number, (
             SELECT attempt.pr_number
             FROM pr_group_attempts AS attempt
+            JOIN pr_groups AS owner ON owner.id = attempt.group_id
             WHERE attempt.group_id = pr_groups.id AND attempt.pr_number IS NOT NULL
-            ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+            ORDER BY CASE WHEN attempt.id = owner.active_attempt_id THEN 0 ELSE 1 END,
                      attempt.created_at ASC, attempt.id ASC
             LIMIT 1
           )),
           base_sha = COALESCE(base_sha, (
             SELECT attempt.base_sha
             FROM pr_group_attempts AS attempt
+            JOIN pr_groups AS owner ON owner.id = attempt.group_id
             WHERE attempt.group_id = pr_groups.id AND attempt.base_sha IS NOT NULL
-            ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+            ORDER BY CASE WHEN attempt.id = owner.active_attempt_id THEN 0 ELSE 1 END,
                      attempt.created_at ASC, attempt.id ASC
             LIMIT 1
           ));
@@ -3443,7 +3549,7 @@ function extractTopology(machine) {
 }
 function getOrCreateLocalMachine(db) {
   const d = db || getDatabase();
-  const name = process.env["TODOS_MACHINE_NAME"] || osHostname();
+  const name = env.machineName() || osHostname();
   const host = osHostname();
   const plat = osPlatform();
   const existing = d.query("SELECT * FROM machines WHERE name = ?").get(name);
@@ -3512,7 +3618,7 @@ function registerMachine(name, opts, db) {
 }
 function updateMachineHeartbeat(idOrName, opts = {}, db) {
   const d = db || getDatabase();
-  const key = idOrName || process.env["TODOS_MACHINE_NAME"] || osHostname();
+  const key = idOrName || env.machineName() || osHostname();
   const row = d.query("SELECT * FROM machines WHERE id = ? OR name = ?").get(key, key);
   if (!row) {
     return registerMachine(key, {
@@ -3664,6 +3770,7 @@ function backfillMachineId(db, force = false) {
 var _machineId = null, TABLES_WITH_MACHINE_ID;
 var init_machines = __esm(() => {
   init_database();
+  init_env();
   TABLES_WITH_MACHINE_ID = [
     "projects",
     "tasks",
@@ -3695,7 +3802,7 @@ function isBlockingDependencyStatus(status) {
 function isTerminalStatus(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
 }
-var TASK_STATUSES, TASK_PRIORITIES, PLAN_STATUSES, VersionConflictError, TaskNotFoundError, TaskNotStartableError, TaskReferenceAmbiguousError, ProjectNotFoundError, ResourceConflictError, PlanRevisionConflictError, PlanNotFoundError, LockError, StaleLockHandoffError, AgentNotFoundError, IdentityAliasAmbiguousError, IdentityIdImmutableError, TaskListNotFoundError, DependencyCycleError, CompletionGuardError, DISPATCH_STATUSES, DispatchNotFoundError;
+var TASK_STATUSES, TASK_PRIORITIES, PLAN_STATUSES, VersionConflictError, TaskNotFoundError, TaskNotStartableError, TaskReferenceAmbiguousError, ProjectNotFoundError, ResourceConflictError, PlanRevisionConflictError, PlanNotFoundError, LockError, StaleLockHandoffError, AgentNotFoundError, IdentityAliasAmbiguousError, IdentityIdImmutableError, TaskListNotFoundError, DependencyCycleError, CompletionGuardError, DISPATCH_STATUSES, DispatchNotFoundError, InputValidationError;
 var init_types = __esm(() => {
   TASK_STATUSES = [
     "pending",
@@ -3710,7 +3817,7 @@ var init_types = __esm(() => {
     "high",
     "critical"
   ];
-  PLAN_STATUSES = ["active", "completed", "archived"];
+  PLAN_STATUSES = ["active", "completed", "archived", "planning", "cancelled"];
   VersionConflictError = class VersionConflictError extends Error {
     taskId;
     expectedVersion;
@@ -3899,6 +4006,16 @@ var init_types = __esm(() => {
       this.name = "DispatchNotFoundError";
     }
   };
+  InputValidationError = class InputValidationError extends Error {
+    static code = "INVALID_INPUT";
+    code = InputValidationError.code;
+    suggestion;
+    constructor(message, suggestion) {
+      super(message);
+      this.name = "InputValidationError";
+      this.suggestion = suggestion;
+    }
+  };
 });
 
 // src/db/identity-mapping.ts
@@ -4075,108 +4192,100 @@ var init_identity_mapping = __esm(() => {
   });
 });
 
-// node_modules/.bun/@hasna+paths@0.1.0/node_modules/@hasna/paths/dist/index.js
+// src/lib/paths.ts
+import { existsSync as existsSync2 } from "fs";
 import { homedir } from "os";
-import { join } from "path";
-function assertApp(app) {
+import { join, resolve as resolve2 } from "path";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+function pathsResolverAssertApp(app) {
   if (typeof app !== "string" || app.length === 0) {
     throw new TypeError("paths: app must be a non-empty string");
   }
-  if (!APP_SLUG_RE.test(app)) {
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
     throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
   }
 }
-function envOf(options) {
-  return options.env ?? process.env;
-}
-function envValue(options, kind) {
-  const value = envOf(options)[KIND_ENV[kind]];
-  return typeof value === "string" && value.length > 0 ? value : undefined;
-}
-function isMacOS(platform) {
-  return platform === "darwin";
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
 }
-function baseDir(kind, options) {
-  const override = envValue(options, kind);
-  if (override)
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env2 = options.env ?? process.env;
+  const override = env2[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
     return override;
-  const home = options.home ?? homedir();
+  const home = options.home ?? pathsResolverHomedir();
   const platform = options.platform ?? process.platform;
-  if (isMacOS(platform)) {
+  if (platform === "darwin") {
     switch (kind) {
       case "config":
       case "data":
-        return join(home, "Library", "Application Support", "Hasna");
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
       case "cache":
-        return join(home, "Library", "Caches", "Hasna");
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
       case "state":
-        return join(home, "Library", "Logs", "Hasna");
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
     }
   }
   switch (kind) {
     case "config":
-      return join(home, ".config", "hasna");
+      return pathsResolverJoin(home, ".config", "hasna");
     case "data":
-      return join(home, ".local", "share", "hasna");
+      return pathsResolverJoin(home, ".local", "share", "hasna");
     case "state":
-      return join(home, ".local", "state", "hasna");
+      return pathsResolverJoin(home, ".local", "state", "hasna");
     case "cache":
-      return join(home, ".cache", "hasna");
+      return pathsResolverJoin(home, ".cache", "hasna");
   }
 }
-function resolvePath(kind, options) {
-  assertApp(options.app);
-  const appSegment = options.internal === true ? join("internal", options.app) : options.app;
-  return join(baseDir(kind, options), appSegment);
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
 }
 function dataDir(options) {
-  return resolvePath("data", options);
+  return pathsResolverResolve("data", options);
 }
-var KIND_ENV, APP_SLUG_RE;
-var init_dist = __esm(() => {
-  KIND_ENV = {
-    config: "HASNA_CONFIG_HOME",
-    data: "HASNA_DATA_HOME",
-    state: "HASNA_STATE_HOME",
-    cache: "HASNA_CACHE_HOME"
-  };
-  APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-});
-
-// src/lib/paths.ts
-import { existsSync as existsSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2, resolve as resolve2 } from "path";
-function effectiveHome(env = process.env) {
-  return env.HOME || env.USERPROFILE || homedir2();
+function effectiveHome(env2 = process.env) {
+  return env2.HOME || env2.USERPROFILE || homedir();
 }
-function legacyHomeDir(env = process.env) {
-  return join2(effectiveHome(env), ".hasna", "todos");
+function legacyHomeDir(env2 = process.env) {
+  return join(effectiveHome(env2), ".hasna", "todos");
 }
-function resolverHome(env = process.env) {
-  return dataDir({ app: "todos", home: effectiveHome(env), env });
+function resolverHome(env2 = process.env) {
+  return dataDir({ app: "todos", home: effectiveHome(env2), env: env2 });
 }
-function adoptResolverHome(resolved, env = process.env) {
-  const dataOverride = env.HASNA_DATA_HOME;
+function adoptResolverHome(resolved, env2 = process.env) {
+  const dataOverride = env2.HASNA_DATA_HOME;
   if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
     return true;
-  return existsSync2(join2(resolved, "todos.db")) || existsSync2(join2(resolved, "config.json"));
+  return existsSync2(join(resolved, "todos.db")) || existsSync2(join(resolved, "config.json"));
 }
-function getTodosDir(env = process.env) {
-  const resolved = resolverHome(env);
-  return resolve2(adoptResolverHome(resolved, env) ? resolved : legacyHomeDir(env));
+function getTodosDir(env2 = process.env) {
+  const resolved = resolverHome(env2);
+  return resolve2(adoptResolverHome(resolved, env2) ? resolved : legacyHomeDir(env2));
 }
+var PATHS_RESOLVER_KIND_ENV, PATHS_RESOLVER_APP_SLUG_RE;
 var init_paths = __esm(() => {
-  init_dist();
+  PATHS_RESOLVER_KIND_ENV = {
+    config: "HASNA_CONFIG_HOME",
+    data: "HASNA_DATA_HOME",
+    state: "HASNA_STATE_HOME",
+    cache: "HASNA_CACHE_HOME"
+  };
+  PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 });
 
 // src/lib/sync-utils.ts
 import { existsSync as existsSync3, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
 import { createHash } from "crypto";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
 function getHomeDir() {
-  return process.env["HOME"] || process.env["USERPROFILE"] || homedir3();
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir2();
 }
 function getTodosGlobalDir() {
   return getTodosDir();
@@ -4202,14 +4311,14 @@ function writeJsonFile(path, data) {
 `);
 }
 function readHighWaterMark(dir) {
-  const path = join3(dir, ".highwatermark");
+  const path = join2(dir, ".highwatermark");
   if (!existsSync3(path))
     return 1;
   const val = parseInt(readFileSync(path, "utf-8").trim(), 10);
   return isNaN(val) ? 1 : val;
 }
 function writeHighWaterMark(dir, value) {
-  writeFileSync(join3(dir, ".highwatermark"), String(value));
+  writeFileSync(join2(dir, ".highwatermark"), String(value));
 }
 function getFileMtimeMs(path) {
   try {
@@ -4294,23 +4403,23 @@ __export(exports_config, {
   CANONICAL_TODOS_RDS_DATABASE: () => CANONICAL_TODOS_RDS_DATABASE,
   CANONICAL_TODOS_RDS_CLUSTER_ENV: () => CANONICAL_TODOS_RDS_CLUSTER_ENV
 });
-function getCanonicalTodosRdsConfig(env = process.env) {
+function getCanonicalTodosRdsConfig(env2 = process.env) {
   return {
-    cluster: clean(env[CANONICAL_TODOS_RDS_CLUSTER_ENV]) ?? null,
+    cluster: clean(env2[CANONICAL_TODOS_RDS_CLUSTER_ENV]) ?? null,
     database: CANONICAL_TODOS_RDS_DATABASE,
-    runtimeSecretPath: clean(env[CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV]) ?? null,
+    runtimeSecretPath: clean(env2[CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV]) ?? null,
     primaryEnv: TODOS_STORAGE_ENV.databaseUrl,
     fallbackEnv: TODOS_STORAGE_FALLBACK_ENV.databaseUrl
   };
 }
-function loadTodosStorageConfig(env = process.env) {
-  const mode = getTodosStorageBackend(env);
-  const databaseUrl = getTodosStorageDatabaseUrl(env);
-  const bucket = readStorageEnv(env, "s3Bucket").value;
-  const prefix = readStorageEnv(env, "s3Prefix").value ?? "todos/";
-  const region = readStorageEnv(env, "awsRegion").value;
-  const endpoint = readStorageEnv(env, "s3Endpoint").value;
-  const schema = readStorageEnv(env, "databaseSchema").value;
+function loadTodosStorageConfig(env2 = process.env) {
+  const mode = getTodosStorageBackend(env2);
+  const databaseUrl = getTodosStorageDatabaseUrl(env2);
+  const bucket = readStorageEnv(env2, "s3Bucket").value;
+  const prefix = readStorageEnv(env2, "s3Prefix").value ?? "todos/";
+  const region = readStorageEnv(env2, "awsRegion").value;
+  const endpoint = readStorageEnv(env2, "s3Endpoint").value;
+  const schema = readStorageEnv(env2, "databaseSchema").value;
   return {
     service: "todos",
     mode,
@@ -4318,7 +4427,7 @@ function loadTodosStorageConfig(env = process.env) {
       database: {
         provider: "postgres",
         url: databaseUrl,
-        ssl: parseBoolean(readStorageEnv(env, "databaseSsl").value, true),
+        ssl: parseBoolean(readStorageEnv(env2, "databaseSsl").value, true),
         ...schema ? { schema } : {}
       }
     } : {},
@@ -4329,17 +4438,17 @@ function loadTodosStorageConfig(env = process.env) {
         prefix,
         ...region ? { region } : {},
         ...endpoint ? { endpoint } : {},
-        forcePathStyle: parseBoolean(readStorageEnv(env, "s3ForcePathStyle").value, false)
+        forcePathStyle: parseBoolean(readStorageEnv(env2, "s3ForcePathStyle").value, false)
       }
     } : {},
     sync: {
-      batchSize: parsePositiveInteger(readStorageEnv(env, "syncBatchSize").value, 500),
-      dryRun: parseBoolean(readStorageEnv(env, "syncDryRun").value, false)
+      batchSize: parsePositiveInteger(readStorageEnv(env2, "syncBatchSize").value, 500),
+      dryRun: parseBoolean(readStorageEnv(env2, "syncDryRun").value, false)
     }
   };
 }
-function loadStorageConfig(env = process.env) {
-  return loadTodosStorageConfig(env);
+function loadStorageConfig(env2 = process.env) {
+  return loadTodosStorageConfig(env2);
 }
 function isTodosPostgresBackend(config) {
   return config.mode === "postgres";
@@ -4361,51 +4470,51 @@ function parseStorageBackend(value) {
     return "postgres";
   throw new Error(`Storage backend must be sqlite or postgres`);
 }
-function getTodosStorageBackend(env = process.env) {
-  if (!getTodosStorageDatabaseUrl(env))
+function getTodosStorageBackend(env2 = process.env) {
+  if (!getTodosStorageDatabaseUrl(env2))
     return "sqlite";
-  if (isTodosShadowEnabled(env))
+  if (isTodosShadowEnabled(env2))
     return "sqlite";
   return "postgres";
 }
-function isTodosShadowEnabled(env = process.env) {
-  return parseBoolean(readStorageEnv(env, "shadow").value, false);
+function isTodosShadowEnabled(env2 = process.env) {
+  return parseBoolean(readStorageEnv(env2, "shadow").value, false);
 }
-function getTodosStorageShadowEnvName(env = process.env) {
-  return readStorageEnv(env, "shadow").name;
+function getTodosStorageShadowEnvName(env2 = process.env) {
+  return readStorageEnv(env2, "shadow").name;
 }
-function assertTodosShadowConfig(config, env = process.env) {
-  if (!isTodosShadowEnabled(env))
+function assertTodosShadowConfig(config, env2 = process.env) {
+  if (!isTodosShadowEnabled(env2))
     return;
   if (config.mode !== "sqlite") {
-    throw new Error(`${readStorageEnv(env, "shadow").name} shadow mirror requires the sqlite backend (got ${config.mode})`);
+    throw new Error(`${readStorageEnv(env2, "shadow").name} shadow mirror requires the sqlite backend (got ${config.mode})`);
   }
   if (!config.database?.url) {
-    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${readStorageEnv(env, "shadow").name} is enabled`);
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${readStorageEnv(env2, "shadow").name} is enabled`);
   }
 }
-function getTodosStorageDatabaseEnv(env = process.env) {
-  return readStorageEnv(env, "databaseUrl").name;
+function getTodosStorageDatabaseEnv(env2 = process.env) {
+  return readStorageEnv(env2, "databaseUrl").name;
 }
-function getStorageDatabaseEnv(env = process.env) {
-  return getTodosStorageDatabaseEnv(env);
+function getStorageDatabaseEnv(env2 = process.env) {
+  return getTodosStorageDatabaseEnv(env2);
 }
-function getTodosStorageDatabaseUrl(env = process.env) {
-  return readStorageEnv(env, "databaseUrl").value;
+function getTodosStorageDatabaseUrl(env2 = process.env) {
+  return readStorageEnv(env2, "databaseUrl").value;
 }
-function getStorageDatabaseUrl(env = process.env) {
-  return getTodosStorageDatabaseUrl(env);
+function getStorageDatabaseUrl(env2 = process.env) {
+  return getTodosStorageDatabaseUrl(env2);
 }
-function getTodosStorageEnvName(env, key) {
-  return readStorageEnv(env, key).name;
+function getTodosStorageEnvName(env2, key) {
+  return readStorageEnv(env2, key).name;
 }
-function readStorageEnv(env, key) {
+function readStorageEnv(env2, key) {
   const primaryName = TODOS_STORAGE_ENV[key];
-  const primaryValue = clean(env[primaryName]);
+  const primaryValue = clean(env2[primaryName]);
   if (primaryValue !== undefined)
     return { name: primaryName, value: primaryValue };
   const fallbackName = TODOS_STORAGE_FALLBACK_ENV[key];
-  const fallbackValue = clean(env[fallbackName]);
+  const fallbackValue = clean(env2[fallbackName]);
   if (fallbackValue !== undefined)
     return { name: fallbackName, value: fallbackValue };
   return { name: primaryName };
@@ -4576,7 +4685,7 @@ __export(exports_database, {
 });
 import { Database } from "bun:sqlite";
 import { existsSync as existsSync4, mkdirSync as mkdirSync2 } from "fs";
-import { dirname, join as join4, resolve as resolve3 } from "path";
+import { dirname, join as join3, resolve as resolve3 } from "path";
 function isInMemoryDb(path) {
   return path === ":memory:" || path.startsWith("file::memory:");
 }
@@ -4585,7 +4694,7 @@ function findNearestProjectDb(startDir) {
   const stopAt = gitRoot ? resolve3(gitRoot) : resolve3(startDir);
   let dir = resolve3(startDir);
   while (true) {
-    const candidate = join4(dir, ".hasna", "todos", "todos.db");
+    const candidate = join3(dir, ".hasna", "todos", "todos.db");
     if (existsSync4(candidate))
       return candidate;
     if (dir === stopAt)
@@ -4600,7 +4709,7 @@ function findNearestProjectDb(startDir) {
 function findGitRoot(startDir) {
   let dir = resolve3(startDir);
   while (true) {
-    if (existsSync4(join4(dir, ".git")))
+    if (existsSync4(join3(dir, ".git")))
       return dir;
     const parent = dirname(dir);
     if (parent === dir)
@@ -4610,7 +4719,7 @@ function findGitRoot(startDir) {
   return null;
 }
 function getGlobalDbPath() {
-  return join4(getTodosGlobalDir(), "todos.db");
+  return join3(getTodosGlobalDir(), "todos.db");
 }
 function hasExplicitProjectArg(args = process.argv.slice(2)) {
   return args.some((arg) => arg === "--project" || arg.startsWith("--project="));
@@ -4648,7 +4757,7 @@ function getDbPath() {
   if (process.env["TODOS_DB_SCOPE"] === "project") {
     const gitRoot = findGitRoot(cwd);
     if (gitRoot && canCreateScopedProjectDb()) {
-      return join4(gitRoot, ".hasna", "todos", "todos.db");
+      return join3(gitRoot, ".hasna", "todos", "todos.db");
     }
   }
   return getGlobalDbPath();
@@ -4689,6 +4798,9 @@ function maybeInstallShadowCapture(db) {
   }
 }
 function getDatabase(dbPath) {
+  if (dbPath === undefined && !selectsTodosLocalStore()) {
+    throw new Error("API_DATABASE_FALLBACK_FORBIDDEN: this operation must use the shared Todos API; implicit SQLite access is unavailable");
+  }
   const path = dbPath || getDbPath();
   if (_db && _dbPath === path)
     return _db;
@@ -4828,6 +4940,7 @@ function lowerInClause(column, values, params) {
 }
 var LOCK_EXPIRY_MINUTES = 30, _db = null, _dbPath = null, ALLOWED_TABLES;
 var init_database = __esm(() => {
+  init_local_opt_in();
   init_schema();
   init_machines();
   init_identity_mapping();
@@ -4838,9 +4951,9 @@ var init_database = __esm(() => {
 
 // src/lib/config.ts
 import { existsSync as existsSync5, readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname2, join as join5 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 function getConfigPath() {
-  return join5(getTodosGlobalDir(), "config.json");
+  return join4(getTodosGlobalDir(), "config.json");
 }
 function normalizeAgent(agent) {
   return agent.trim().toLowerCase();
@@ -4891,21 +5004,6 @@ function normalizeApiUrl(value) {
     return null;
   return trimmed.replace(/\/+$/, "");
 }
-function getLocalApiConfig(env = process.env) {
-  const config = loadConfig();
-  const envApiUrl = normalizeApiUrl(env["TODOS_URL"]);
-  const configApiUrl = normalizeApiUrl(config.apiUrl);
-  const apiUrl = envApiUrl ?? configApiUrl;
-  const apiKey = env["TODOS_API_KEY"] || config.apiKey || null;
-  return {
-    apiUrl,
-    apiKey,
-    source: {
-      apiUrl: envApiUrl ? "TODOS_URL" : configApiUrl ? "config" : "none",
-      apiKey: env["TODOS_API_KEY"] ? "TODOS_API_KEY" : config.apiKey ? "config" : "none"
-    }
-  };
-}
 function getSyncAgentsFromConfig() {
   const config = loadConfig();
   const agents = config.sync_agents;
@@ -5756,11 +5854,11 @@ function writeAllowed(profile, root, writePath) {
     return isPathInside(scopeRoot, target);
   });
 }
-function redactedEnvKeys(profile, env) {
-  if (!env)
+function redactedEnvKeys(profile, env2) {
+  if (!env2)
     return [];
   const patterns = unique2([...DEFAULT_ENV_REDACTIONS, ...profile.env_redactions]).map((item) => item.toUpperCase());
-  return Object.keys(env).filter((key) => patterns.some((pattern) => key.toUpperCase().includes(pattern)));
+  return Object.keys(env2).filter((key) => patterns.some((pattern) => key.toUpperCase().includes(pattern)));
 }
 function checkWorkspacePermission(input = {}) {
   const status = getWorkspaceTrustStatus(input.path || process.cwd());
@@ -5898,18 +5996,18 @@ function profileByName(name, path) {
   const resolved = normalizePath2(path);
   return profiles.find((profile) => isPathInside2(profile.root, resolved)) || defaultProfile2("default", resolved);
 }
-function redactedEnvKeys2(profile, env) {
-  if (!env)
+function redactedEnvKeys2(profile, env2) {
+  if (!env2)
     return [];
   const patterns = unique3([...DEFAULT_ENV_REDACTIONS2, ...profile.env_redactions]).map((item) => item.toUpperCase());
-  return Object.keys(env).filter((key) => patterns.some((pattern) => key.toUpperCase().includes(pattern)));
+  return Object.keys(env2).filter((key) => patterns.some((pattern) => key.toUpperCase().includes(pattern)));
 }
-function omittedEnvKeys(profile, env) {
-  if (!env)
+function omittedEnvKeys(profile, env2) {
+  if (!env2)
     return [];
   if (profile.env_allowlist.includes("*"))
     return [];
-  return Object.keys(env).filter((key) => !profile.env_allowlist.some((pattern) => matchesPattern2(key, pattern)));
+  return Object.keys(env2).filter((key) => !profile.env_allowlist.some((pattern) => matchesPattern2(key, pattern)));
 }
 function resolveFromCwd(cwd, path) {
   return normalizePath2(path.startsWith("/") ? path : `${cwd}/${path}`);
@@ -6292,15 +6390,23 @@ var init_event_hooks = __esm(() => {
   VALID_TARGETS = new Set(["stdout", "file", "socket", "script"]);
 });
 
-// node_modules/.bun/@hasna+events@0.1.16/node_modules/@hasna/events/dist/index.js
+// node_modules/.bun/@hasna+events@0.1.17/node_modules/@hasna/events/dist/index.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { Buffer as Buffer2 } from "buffer";
+import { existsSync as existsSync22 } from "fs";
+import { join as join32 } from "path";
 import { existsSync as existsSync6 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join6 } from "path";
+import { homedir as homedir22 } from "os";
+import { join as join22, resolve as resolve8 } from "path";
+import { homedir as homedir3 } from "os";
+import { join as join5 } from "path";
 import { createHmac, timingSafeEqual } from "crypto";
+import { lookup as dnsLookup } from "dns/promises";
+import { isIP } from "net";
 import { randomUUID as randomUUID2 } from "crypto";
 import { spawn } from "child_process";
+import { request as nodeHttpRequest } from "http";
+import { request as nodeHttpsRequest } from "https";
 import { randomUUID as randomUUID22 } from "crypto";
 function getPathValue(input, path) {
   return path.split(".").reduce((value, part) => {
@@ -6397,8 +6503,93 @@ function channelMatchesEvent(channel, event) {
     return true;
   return channel.filters.some((filter) => eventMatchesFilter(event, filter));
 }
+function assertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function envOf(options) {
+  return options.env ?? process.env;
+}
+function envValue(options, kind) {
+  const value = envOf(options)[KIND_ENV[kind]];
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function isMacOS(platform) {
+  return platform === "darwin";
+}
+function baseDir(kind, options) {
+  const override = envValue(options, kind);
+  if (override)
+    return override;
+  const home = options.home ?? homedir3();
+  const platform = options.platform ?? process.platform;
+  if (isMacOS(platform)) {
+    switch (kind) {
+      case "config":
+      case "data":
+        return join5(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return join5(home, "Library", "Caches", "Hasna");
+      case "state":
+        return join5(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return join5(home, ".config", "hasna");
+    case "data":
+      return join5(home, ".local", "share", "hasna");
+    case "state":
+      return join5(home, ".local", "state", "hasna");
+    case "cache":
+      return join5(home, ".cache", "hasna");
+  }
+}
+function resolvePath(kind, options) {
+  assertApp(options.app);
+  const appSegment = options.internal === true ? join5("internal", options.app) : options.app;
+  return join5(baseDir(kind, options), appSegment);
+}
+function dataDir2(options) {
+  return resolvePath("data", options);
+}
+function effectiveHome2() {
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir22();
+}
+function legacyHomeDir2() {
+  return join22(effectiveHome2(), ".hasna", "events");
+}
+function resolverHome2() {
+  return dataDir2({ app: "events", home: effectiveHome2() || undefined });
+}
+function adoptResolverHome2(resolved, env2 = process.env) {
+  const dataOverride = env2.HASNA_DATA_HOME;
+  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
+    return true;
+  return existsSync6(join22(resolved, EVENTS_STORE_SENTINEL_FILE));
+}
+function exactEventsHome() {
+  const dir = process.env[HASNA_EVENTS_DIR_ENV];
+  if (dir && dir.trim())
+    return dir.trim();
+  const home = process.env[HASNA_EVENTS_HOME_ENV];
+  if (home && home.trim())
+    return home.trim();
+  return;
+}
+function getEventsHome() {
+  const exact = exactEventsHome();
+  if (exact)
+    return resolve8(exact);
+  const resolved = resolverHome2();
+  return adoptResolverHome2(resolved) ? resolve8(resolved) : resolve8(legacyHomeDir2());
+}
 function getEventsDataDir(override) {
-  return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join6(homedir4(), ".hasna", "events");
+  return override || getEventsHome();
 }
 
 class JsonEventsStore {
@@ -6407,12 +6598,12 @@ class JsonEventsStore {
   channelsPath;
   eventsPath;
   deliveriesPath;
-  constructor(dataDir2 = getEventsDataDir()) {
-    this.dataDir = dataDir2;
-    this.runtime = localJsonRuntime(dataDir2);
-    this.channelsPath = join6(dataDir2, "channels.json");
-    this.eventsPath = join6(dataDir2, "events.json");
-    this.deliveriesPath = join6(dataDir2, "deliveries.json");
+  constructor(dataDir22 = getEventsDataDir()) {
+    this.dataDir = dataDir22;
+    this.runtime = localJsonRuntime(dataDir22);
+    this.channelsPath = join32(dataDir22, "channels.json");
+    this.eventsPath = join32(dataDir22, "events.json");
+    this.deliveriesPath = join32(dataDir22, "deliveries.json");
   }
   async init() {
     await mkdir(this.dataDir, { recursive: true, mode: 448 });
@@ -6529,7 +6720,7 @@ class JsonEventsStore {
     };
   }
   async ensureArrayFile(path) {
-    if (!existsSync6(path)) {
+    if (!existsSync22(path)) {
       await writeFile(path, `[]
 `, { encoding: "utf-8", mode: 384 });
     }
@@ -6559,7 +6750,7 @@ class JsonEventsStore {
     });
   }
 }
-function localJsonRuntime(dataDir2 = getEventsDataDir()) {
+function localJsonRuntime(dataDir22 = getEventsDataDir()) {
   return {
     mode: "local-files",
     name: "json-events-store",
@@ -6572,7 +6763,7 @@ function localJsonRuntime(dataDir2 = getEventsDataDir()) {
     durable: true,
     idempotency: "best-effort-local",
     replayCursors: true,
-    description: `Local JSON files in ${dataDir2}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
+    description: `Local JSON files in ${dataDir22}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
   };
 }
 function encodeLocalJsonEventCursor(offset, options = {}) {
@@ -6643,6 +6834,177 @@ function signPayload(secret, timestamp2, body) {
   const digest = createHmac("sha256", secret).update(buildSignatureBase(timestamp2, body)).digest("hex");
   return `sha256=${digest}`;
 }
+function isPrivateAddress(address) {
+  const normalized = stripZoneId(address);
+  const version = isIP(normalized);
+  if (version === 4) {
+    const integer = ipv4ToInt(normalized);
+    if (integer === undefined)
+      return true;
+    return IPV4_PRIVATE_RANGES.some(([low, high]) => integer >= low && integer <= high);
+  }
+  if (version === 6) {
+    const groups = ipv6Groups(normalized);
+    if (!groups)
+      return true;
+    for (const prefix of IPV6_SPECIAL_PREFIXES) {
+      if (!ipv6MatchesPrefix(groups, prefix.groups, prefix.bits))
+        continue;
+      if (prefix.bits === 96 && groups[5] === 65535) {
+        return isPrivateAddress(ipv4IntToString(groups[6] << 16 | groups[7]));
+      }
+      if (prefix.bits === 16 && groups[0] === 8194) {
+        return isPrivateAddress(ipv4IntToString(groups[1] << 16 | groups[2]));
+      }
+      return true;
+    }
+    return false;
+  }
+  return true;
+}
+async function resolveWebhookTarget(url, policy = {}) {
+  const hostname = normalizeHostname(url.hostname);
+  const allowlist = (policy.allowPrivateHosts ?? []).map((entry) => normalizeHostname(entry.toLowerCase()));
+  if (allowlist.includes(hostname)) {
+    const version2 = isIP(hostname);
+    if (version2 === 4 || version2 === 6) {
+      return { hostname, addresses: [hostname] };
+    }
+    const lookup2 = policy.lookup ?? defaultTargetLookup;
+    let resolved2;
+    try {
+      resolved2 = await lookup2(hostname);
+    } catch {
+      throw new Error(`Webhook target ${hostname} could not be resolved`);
+    }
+    if (!Array.isArray(resolved2) || resolved2.length === 0) {
+      throw new Error(`Webhook target ${hostname} resolved to no addresses`);
+    }
+    const addresses = resolved2.map((entry) => normalizeHostname(entry.address));
+    return { hostname, addresses };
+  }
+  const version = isIP(hostname);
+  if (version === 4 || version === 6) {
+    if (isPrivateAddress(hostname)) {
+      throw new Error(`Webhook target ${hostname} is a private or special-use address`);
+    }
+    return { hostname, addresses: [hostname] };
+  }
+  const lookup = policy.lookup ?? defaultTargetLookup;
+  let resolved;
+  try {
+    resolved = await lookup(hostname);
+  } catch {
+    throw new Error(`Webhook target ${hostname} could not be resolved`);
+  }
+  if (!Array.isArray(resolved) || resolved.length === 0) {
+    throw new Error(`Webhook target ${hostname} resolved to no addresses`);
+  }
+  const allowed = [];
+  for (const entry of resolved) {
+    const address = normalizeHostname(entry.address);
+    if (isPrivateAddress(address)) {
+      if (allowlist.includes(address)) {
+        allowed.push(address);
+        continue;
+      }
+      throw new Error(`Webhook target ${hostname} resolves to private or special-use address ${address}`);
+    }
+    allowed.push(address);
+  }
+  if (allowed.length === 0) {
+    throw new Error(`Webhook target ${hostname} resolved to no public addresses`);
+  }
+  return { hostname, addresses: allowed };
+}
+function normalizeMaxRedirects(value) {
+  if (value === undefined)
+    return DEFAULT_MAX_REDIRECTS;
+  if (!Number.isInteger(value) || value < 0)
+    throw new Error("webhookTargetPolicy.maxRedirects must be a non-negative integer");
+  return value;
+}
+function normalizeHostname(hostname) {
+  const lower = hostname.toLowerCase();
+  if (lower.startsWith("[") && lower.endsWith("]"))
+    return lower.slice(1, -1);
+  return lower;
+}
+function stripZoneId(address) {
+  const percent = address.indexOf("%");
+  return percent === -1 ? address : address.slice(0, percent);
+}
+function ipv4ToInt(address) {
+  const parts = address.split(".");
+  if (parts.length !== 4)
+    return;
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part))
+      return;
+    const octet = Number(part);
+    if (octet > 255)
+      return;
+    value = value << 8 | octet;
+  }
+  return value >>> 0;
+}
+function ipv4IntToString(integer) {
+  return [
+    integer >>> 24 & 255,
+    integer >>> 16 & 255,
+    integer >>> 8 & 255,
+    integer & 255
+  ].join(".");
+}
+function ipv6Groups(address) {
+  const raw = stripZoneId(address);
+  const doubleColon = raw.indexOf("::");
+  const headText = doubleColon === -1 ? raw : raw.slice(0, doubleColon);
+  const tailText = doubleColon === -1 ? "" : raw.slice(doubleColon + 2);
+  const parseGroups = (text) => {
+    if (text === "")
+      return [];
+    const out = [];
+    for (const part of text.split(":")) {
+      if (part.includes(".")) {
+        const v4 = ipv4ToInt(part);
+        if (v4 === undefined)
+          return;
+        out.push(v4 >>> 16 & 65535, v4 & 65535);
+      } else {
+        if (!/^[0-9a-fA-F]{1,4}$/.test(part))
+          return;
+        out.push(parseInt(part, 16));
+      }
+    }
+    return out;
+  };
+  const head = parseGroups(headText);
+  if (!head)
+    return;
+  const tail = parseGroups(tailText);
+  if (!tail)
+    return;
+  const total = head.length + tail.length;
+  if (doubleColon === -1) {
+    return total === 8 ? head : undefined;
+  }
+  if (total >= 8)
+    return;
+  return [...head, ...new Array(8 - total).fill(0), ...tail];
+}
+function ipv6MatchesPrefix(groups, prefixGroups, prefixBits) {
+  let remaining = prefixBits;
+  for (let index = 0;index < prefixGroups.length && remaining > 0; index += 1) {
+    const take = Math.min(16, remaining);
+    const mask = 65535 << 16 - take & 65535;
+    if ((groups[index] & mask) !== (prefixGroups[index] & mask))
+      return false;
+    remaining -= take;
+  }
+  return true;
+}
 function now2() {
   return new Date().toISOString();
 }
@@ -6673,9 +7035,18 @@ function buildWebhookRequest(event, channel, options = {}) {
   }
   return { body, headers };
 }
+function normalizeWebhookUrl(raw) {
+  const url = new URL(raw);
+  if (url.username !== "" || url.password !== "") {
+    url.username = "";
+    url.password = "";
+  }
+  return url.toString();
+}
 async function dispatchWebhook(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
+  const webhookUrl = normalizeWebhookUrl(channel.webhook.url);
   const startedAt = now2();
   let secret = channel.webhook.secret;
   if (channel.webhook.secretRef) {
@@ -6692,10 +7063,14 @@ async function dispatchWebhook(event, channel, options = {}) {
   }
   const timestamp2 = (options.now?.() ?? new Date).toISOString();
   const { body, headers } = buildWebhookRequest(event, channel, { secret, timestamp: timestamp2 });
+  const validateTargets = options.webhookTargetPolicy !== undefined || options.fetchImpl === undefined;
+  if (validateTargets) {
+    return dispatchValidatedWebhook(event, channel, { body, headers, startedAt, options });
+  }
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
   try {
-    const response = await (options.fetchImpl ?? fetch)(channel.webhook.url, {
+    const response = await (options.fetchImpl ?? fetch)(webhookUrl, {
       method: "POST",
       headers,
       body,
@@ -6723,6 +7098,130 @@ async function dispatchWebhook(event, channel, options = {}) {
     clearTimeout(timeout);
   }
 }
+function isRedirectStatus(status) {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function redirectKeepsBody(status) {
+  return status === 307 || status === 308;
+}
+async function pinnedNativeRequest(target, addresses, method, headers, body, signal, tls) {
+  const isHttps = target.protocol === "https:";
+  if (!isHttps && target.protocol !== "http:") {
+    throw new Error(`Webhook target uses unsupported protocol ${target.protocol}`);
+  }
+  const defaultPort = isHttps ? 443 : 80;
+  const port = target.port ? Number(target.port) : defaultPort;
+  const requestOptions = {
+    hostname: target.hostname,
+    port,
+    path: `${target.pathname}${target.search}`,
+    method,
+    headers,
+    ...tls?.ca ? { ca: tls.ca } : {},
+    lookup: (hostname, _options, callback) => {
+      const entries = addresses.map((address) => ({
+        address,
+        family: address.includes(":") ? 6 : 4
+      }));
+      callback(null, entries);
+    }
+  };
+  return new Promise((resolve22, reject) => {
+    const request = isHttps ? nodeHttpsRequest(requestOptions, onResponse) : nodeHttpRequest(requestOptions, onResponse);
+    const onAbort = () => {
+      const error = new Error("The operation was aborted.");
+      error.name = "AbortError";
+      request.destroy(error);
+    };
+    if (signal.aborted)
+      onAbort();
+    else
+      signal.addEventListener("abort", onAbort, { once: true });
+    request.on("error", reject);
+    if (body !== undefined)
+      request.write(body);
+    request.end();
+    function onResponse(response) {
+      const chunks = [];
+      response.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+      response.on("error", reject);
+      response.on("end", () => {
+        const headersRecord = {};
+        for (const [name, value] of Object.entries(response.headers)) {
+          if (typeof value === "string")
+            headersRecord[name] = value;
+          else if (Array.isArray(value))
+            headersRecord[name] = value.join(", ");
+        }
+        resolve22(new Response(Buffer.concat(chunks), { status: response.statusCode ?? 200, headers: headersRecord }));
+      });
+    }
+  });
+}
+async function dispatchValidatedWebhook(event, channel, input) {
+  const { body, headers, startedAt, options } = input;
+  const webhook = channel.webhook;
+  if (!webhook)
+    throw new Error(`Channel ${channel.id} has no webhook config`);
+  const policy = options.webhookTargetPolicy ?? {};
+  const maxRedirects = normalizeMaxRedirects(policy.maxRedirects);
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), webhook.timeoutMs ?? 15000);
+  try {
+    let target = new URL(normalizeWebhookUrl(webhook.url));
+    let requestHeaders = headers;
+    let method = "POST";
+    let requestBody = body;
+    let redirectsFollowed = 0;
+    for (;; ) {
+      const resolved = await resolveWebhookTarget(target, policy).catch((error) => {
+        throw new Error(`Webhook target rejected by SSRF guard: ${error.message}`);
+      });
+      const response = options.fetchImpl ? await options.fetchImpl(target, {
+        method,
+        headers: requestHeaders,
+        body: requestBody,
+        signal: controller.signal,
+        redirect: "manual"
+      }) : await pinnedNativeRequest(target, resolved.addresses, method, requestHeaders, requestBody, controller.signal, options.tls);
+      const location = response.headers.get("location");
+      if (isRedirectStatus(response.status) && location) {
+        if (redirectsFollowed >= maxRedirects) {
+          return failedAttempt(startedAt, `Webhook target exceeded ${maxRedirects} redirects`);
+        }
+        redirectsFollowed += 1;
+        const next = new URL(location, target);
+        target = next;
+        if (!redirectKeepsBody(response.status)) {
+          method = "GET";
+          requestBody = undefined;
+          requestHeaders = Object.fromEntries(Object.entries(requestHeaders).filter(([name]) => name.toLowerCase() !== "content-type" && name.toLowerCase() !== "content-length"));
+        }
+        continue;
+      }
+      const responseBody = truncate(await response.text());
+      return {
+        attempt: 1,
+        status: response.ok ? "success" : "failed",
+        startedAt,
+        completedAt: now2(),
+        responseStatus: response.status,
+        responseBody,
+        error: response.ok ? undefined : `Webhook returned HTTP ${response.status}`
+      };
+    }
+  } catch (error) {
+    return {
+      attempt: 1,
+      status: "failed",
+      startedAt,
+      completedAt: now2(),
+      error: error instanceof Error ? error.message : String(error)
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 function failedAttempt(startedAt, error) {
   return {
     attempt: 1,
@@ -6737,7 +7236,7 @@ async function dispatchCommand(event, channel) {
     throw new Error(`Channel ${channel.id} has no command config`);
   const startedAt = now2();
   const eventJson = JSON.stringify(event);
-  const env = {
+  const env2 = {
     ...process.env,
     ...channel.command.env,
     HASNA_CHANNEL_ID: channel.id,
@@ -6751,10 +7250,10 @@ async function dispatchCommand(event, channel) {
     HASNA_EVENT_SCHEMA_VERSION: event.schemaVersion,
     HASNA_EVENT_JSON: eventJson
   };
-  return new Promise((resolve8) => {
+  return new Promise((resolve22) => {
     const child = spawn(channel.command.command, channel.command.args ?? [], {
       cwd: channel.command.cwd,
-      env,
+      env: env2,
       stdio: ["pipe", "pipe", "pipe"]
     });
     let stdout = "";
@@ -6769,7 +7268,7 @@ async function dispatchCommand(event, channel) {
     });
     child.on("error", (error) => {
       clearTimeout(timeout);
-      resolve8({
+      resolve22({
         attempt: 1,
         status: "failed",
         startedAt,
@@ -6782,7 +7281,7 @@ async function dispatchCommand(event, channel) {
     child.on("close", (code, signal) => {
       clearTimeout(timeout);
       const success = code === 0;
-      resolve8({
+      resolve22({
         attempt: 1,
         status: success ? "success" : "failed",
         startedAt,
@@ -6918,7 +7417,9 @@ class EventsClient {
     this.transportOptions = {
       fetchImpl: options.fetchImpl,
       secretResolver: options.secretResolver,
-      now: options.now
+      now: options.now,
+      tls: options.tls,
+      webhookTargetPolicy: options.webhookTargetPolicy
     };
     this.catalog = options.catalog ?? defaultEventTypeCatalog;
     this.validateCatalogTypes = options.validateCatalogTypes ?? false;
@@ -7123,9 +7624,51 @@ function normalizeRetryPolicy(policy) {
     multiplier: Math.max(1, policy?.multiplier ?? 2)
   };
 }
-var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:", DEFAULT_EVENT_PAGE_LIMIT = 100, MAX_EVENT_PAGE_LIMIT = 1000, DEFAULT_SIGNATURE_TOLERANCE_MS, EventValidationError, defaultEventTypeCatalog, APP_EVENT_V1_MAX_DATA_BYTES;
-var init_dist2 = __esm(() => {
+var KIND_ENV, APP_SLUG_RE, HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", EVENTS_STORE_SENTINEL_FILE = "events.json", LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:", DEFAULT_EVENT_PAGE_LIMIT = 100, MAX_EVENT_PAGE_LIMIT = 1000, DEFAULT_SIGNATURE_TOLERANCE_MS, DEFAULT_MAX_REDIRECTS = 5, IPV4_PRIVATE_RANGES, IPV6_SPECIAL_PREFIXES, defaultTargetLookup = async (hostname) => {
+  return dnsLookup(hostname, { all: true, verbatim: false });
+}, EventValidationError, defaultEventTypeCatalog, APP_EVENT_V1_MAX_DATA_BYTES;
+var init_dist = __esm(() => {
+  KIND_ENV = {
+    config: "HASNA_CONFIG_HOME",
+    data: "HASNA_DATA_HOME",
+    state: "HASNA_STATE_HOME",
+    cache: "HASNA_CACHE_HOME"
+  };
+  APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
   DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
+  IPV4_PRIVATE_RANGES = [
+    [0, 16777215],
+    [167772160, 184549375],
+    [1681915904, 1686110207],
+    [2130706432, 2147483647],
+    [2851995648, 2852061183],
+    [2886729728, 2887778303],
+    [3221225472, 3221225727],
+    [3221225984, 3221226239],
+    [3227017984, 3227018239],
+    [3232235520, 3232301055],
+    [3323068416, 3323199487],
+    [3325256704, 3325256959],
+    [3405803776, 3405804031],
+    [3758096384, 4294967295]
+  ];
+  IPV6_SPECIAL_PREFIXES = [
+    { groups: [0, 0, 0, 0, 0, 0, 0, 0], bits: 128 },
+    { groups: [0, 0, 0, 0, 0, 0, 0, 1], bits: 128 },
+    { groups: [0, 0, 0, 0, 0, 65535, 0, 0], bits: 96 },
+    { groups: [100, 65435, 0, 0, 0, 0, 0, 0], bits: 96 },
+    { groups: [256, 0, 0, 0, 0, 0, 0, 0], bits: 64 },
+    { groups: [8193, 0, 0, 0, 0, 0, 0, 0], bits: 32 },
+    { groups: [8193, 2, 0, 0, 0, 0, 0, 0], bits: 48 },
+    { groups: [8193, 16, 0, 0, 0, 0, 0, 0], bits: 28 },
+    { groups: [8193, 3512, 0, 0, 0, 0, 0, 0], bits: 32 },
+    { groups: [8194, 0, 0, 0, 0, 0, 0, 0], bits: 16 },
+    { groups: [16383, 0, 0, 0, 0, 0, 0, 0], bits: 20 },
+    { groups: [64512, 0, 0, 0, 0, 0, 0, 0], bits: 7 },
+    { groups: [65152, 0, 0, 0, 0, 0, 0, 0], bits: 10 },
+    { groups: [65216, 0, 0, 0, 0, 0, 0, 0], bits: 10 },
+    { groups: [65280, 0, 0, 0, 0, 0, 0, 0], bits: 8 }
+  ];
   EventValidationError = class EventValidationError extends Error {
     eventType;
     issues;
@@ -7149,6 +7692,8 @@ function rowToTaskList(row) {
   };
 }
 function createTaskList(input, db) {
+  if (input.status !== undefined)
+    throw new Error("The explicit SQLite storage cannot retain task-list status; use the shared API");
   const d = db || getDatabase();
   return d.transaction(() => {
     const id = uuid();
@@ -7190,6 +7735,8 @@ function listTaskLists(projectId, db) {
   return d.query("SELECT * FROM task_lists ORDER BY name").all().map(rowToTaskList);
 }
 function updateTaskList(id, input, db) {
+  if (input.status !== undefined)
+    throw new Error("The explicit SQLite storage cannot retain task-list status; use the shared API");
   const d = db || getDatabase();
   return d.transaction(() => {
     const existing = getTaskList(id, d);
@@ -7547,7 +8094,7 @@ function emitSharedTaskEventQuiet(input) {
 }
 var SOURCE = "todos";
 var init_shared_events = __esm(() => {
-  init_dist2();
+  init_dist();
   init_database();
   init_projects();
   init_task_lists();
@@ -11188,7 +11735,13 @@ function resolveCreateSlug(input, projectId, db) {
   }
   return nextPlanSlug(planSlugBase2(input.name), projectId, db);
 }
+function assertLegacyPlanInput(input) {
+  if (input.start_date !== undefined || input.end_date !== undefined || input.status === "planning" || input.status === "cancelled") {
+    throw new Error("Plan calendar dates and planning/cancelled statuses require the shared Todos API; explicit SQLite storage cannot retain them");
+  }
+}
 function createPlan(input, db) {
+  assertLegacyPlanInput(input);
   const d = db || getDatabase();
   const id = uuid();
   const timestamp2 = now();
@@ -11269,6 +11822,7 @@ function updatePlanStored(id, input, db) {
   return updated;
 }
 function updatePlan(id, input, db) {
+  assertLegacyPlanInput(input);
   const d = db || getDatabase();
   return d.transaction(() => {
     guardPlanRowsSqlite([id], d);
@@ -11743,27 +12297,27 @@ var init_boards = __esm(() => {
 // src/lib/artifact-store.ts
 import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync4, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
-import { basename, dirname as dirname4, join as join7, resolve as resolve8 } from "path";
+import { basename, dirname as dirname4, join as join6, resolve as resolve9 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 function isInMemoryDb2(path) {
   return path === ":memory:" || path.startsWith("file::memory:");
 }
 function artifactStoreRoot() {
   if (process.env["HASNA_TODOS_ARTIFACTS_DIR"])
-    return resolve8(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
+    return resolve9(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
   if (process.env["TODOS_ARTIFACTS_DIR"])
-    return resolve8(process.env["TODOS_ARTIFACTS_DIR"]);
+    return resolve9(process.env["TODOS_ARTIFACTS_DIR"]);
   const dbPath = getDatabasePath();
   if (isInMemoryDb2(dbPath))
-    return join7(tmpdir2(), "hasna-todos-artifacts");
-  return join7(dirname4(resolve8(dbPath)), "artifacts");
+    return join6(tmpdir2(), "hasna-todos-artifacts");
+  return join6(dirname4(resolve9(dbPath)), "artifacts");
 }
 function artifactStorePath(relativePath) {
   const normalized = relativePath.replace(/\\/g, "/");
   if (normalized.includes("..") || normalized.startsWith("/") || normalized.length === 0) {
     throw new Error("Invalid artifact store path");
   }
-  return join7(artifactStoreRoot(), normalized);
+  return join6(artifactStoreRoot(), normalized);
 }
 function sha256(buffer) {
   return createHash3("sha256").update(buffer).digest("hex");
@@ -11803,7 +12357,7 @@ function mediaTypeFor(path, textLike) {
   return "application/octet-stream";
 }
 function storeArtifactContent(input) {
-  const sourcePath = resolve8(input.path);
+  const sourcePath = resolve9(input.path);
   if (!existsSync8(sourcePath))
     return null;
   const sourceStat = statSync2(sourcePath);
@@ -11821,7 +12375,7 @@ function storeArtifactContent(input) {
       redactionStatus = "redacted";
   }
   const storedSha = sha256(storedBuffer);
-  const relativePath = join7("sha256", storedSha.slice(0, 2), storedSha).replace(/\\/g, "/");
+  const relativePath = join6("sha256", storedSha.slice(0, 2), storedSha).replace(/\\/g, "/");
   const destination = artifactStorePath(relativePath);
   if (!existsSync8(destination)) {
     mkdirSync4(dirname4(destination), { recursive: true });
@@ -11958,19 +12512,19 @@ function importStoredArtifactContent(content) {
 }
 function getArtifactStoreRoot(dbPath) {
   if (process.env["HASNA_TODOS_ARTIFACTS_DIR"])
-    return resolve8(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
+    return resolve9(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
   if (process.env["TODOS_ARTIFACTS_DIR"])
-    return resolve8(process.env["TODOS_ARTIFACTS_DIR"]);
+    return resolve9(process.env["TODOS_ARTIFACTS_DIR"]);
   const path = dbPath ?? getDatabasePath();
   if (isInMemoryDb2(path))
-    return join7(tmpdir2(), "hasna-todos-artifacts");
-  return join7(dirname4(resolve8(path)), "artifacts");
+    return join6(tmpdir2(), "hasna-todos-artifacts");
+  return join6(dirname4(resolve9(path)), "artifacts");
 }
 function computeContentHash(path) {
-  return sha256(readFileSync4(resolve8(path)));
+  return sha256(readFileSync4(resolve9(path)));
 }
 function storeArtifactFile(input) {
-  const sourcePath = resolve8(input.sourcePath);
+  const sourcePath = resolve9(input.sourcePath);
   if (!existsSync8(sourcePath)) {
     throw new Error(`Source file not found: ${input.sourcePath}`);
   }
@@ -11984,7 +12538,7 @@ function storeArtifactFile(input) {
   let localPath = sourcePath;
   if (storageMode === "copy") {
     const fileName = input.name && input.name.trim().length > 0 ? basename(input.name) : basename(sourcePath);
-    const destination = join7(getArtifactStoreRoot(input.dbPath), input.artifactId, fileName);
+    const destination = join6(getArtifactStoreRoot(input.dbPath), input.artifactId, fileName);
     mkdirSync4(dirname4(destination), { recursive: true });
     writeFileSync2(destination, buffer);
     localPath = destination;
@@ -12019,7 +12573,7 @@ function buildArtifactExportManifest(artifacts, dbPath) {
   };
 }
 function writeArtifactExportManifest(manifest, outputPath) {
-  const destination = resolve8(outputPath);
+  const destination = resolve9(outputPath);
   mkdirSync4(dirname4(destination), { recursive: true });
   writeFileSync2(destination, `${JSON.stringify(manifest, null, 2)}
 `);
@@ -12707,7 +13261,9 @@ function finishTaskRunTransaction(input, db) {
   const key = input.key ? normalizeTransactionKey({ key: input.key }) : "";
   const run = input.run_id ? getTaskRun(resolveTaskRunId(input.run_id, d), d) : key ? findTaskRunByTransactionKey(key, input.task_id, d) : null;
   if (!run) {
-    throw new Error(input.run_id ? `Run not found: ${input.run_id}` : "runs finish requires a run id or --key");
+    if (input.run_id)
+      throw new InputValidationError(`Run not found: ${input.run_id}`, "Pass an existing run id, or --key.");
+    throw new InputValidationError("runs finish requires a run id or --key", "Pass run_id, or key with task_id.");
   }
   if (input.task_id && run.task_id !== input.task_id) {
     throw new Error(`Run ${run.id} belongs to task ${run.task_id}, not ${input.task_id}`);
@@ -13176,7 +13732,7 @@ var init_tasks = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.52",
+  version: "0.16.0",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",
@@ -13229,37 +13785,40 @@ var package_default = {
     }
   },
   workspaces: [
-    "dashboard",
     "ai"
   ],
   files: [
     "dist",
-    "dashboard/dist",
     "postinstall.js",
     "LICENSE",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md",
+    "docs/PLAN_API.md",
+    "docs/TASK_LIST_API.md",
+    "docs/TEMPLATE_API.md",
+    "docs/TASK_QUERY_API.md",
+    "docs/native-storage.md"
   ],
   scripts: {
-    build: "rm -rf dist dashboard/dist && cd dashboard && bun install --frozen-lockfile && bun run build && cd .. && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts src/task-manifest.ts src/task-subtree-transfer.ts --outdir dist --root src --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && tsc --emitDeclarationOnly --outDir dist",
+    build: "cd ai && bun install --frozen-lockfile && cd .. && rm -rf dist && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts src/task-manifest.ts src/task-subtree-transfer.ts --outdir dist --root src --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && tsc --emitDeclarationOnly --outDir dist",
     "build:js": "rm -rf dist && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts src/task-manifest.ts src/task-subtree-transfer.ts --outdir dist --root src --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && tsc --emitDeclarationOnly --outDir dist",
     "build:server": "rm -rf dist && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts src/task-manifest.ts src/task-subtree-transfer.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*'",
     migrate: "bun run src/server/index.ts migrate",
     "backfill:comment-redaction": "bun run src/server/index.ts redact-comments",
     "generate:sdk": "bun run scripts/generate-sdk.ts",
-    "build:dashboard": "cd dashboard && bun install --frozen-lockfile && bun run build",
     typecheck: "tsc --noEmit -p tsconfig.typecheck.json",
-    test: "bun test",
-    "test:no-cloud": "bun test src/no-cloud-boundary.test.ts src/local-first.test.ts src/lib/public-release-gate.test.ts",
+    test: "bun test --timeout 120000",
+    "test:no-cloud": "bun test --timeout 120000 src/no-cloud-boundary.test.ts src/local-first.test.ts src/lib/public-release-gate.test.ts",
     "dev:cli": "bun run src/cli/index.tsx",
     "dev:mcp": "bun run src/mcp/index.ts",
     "dev:serve": "bun run src/server/index.ts",
     "verify:release": "bun run scripts/verify-public-release.ts --mode=review",
     "verify:release-review": "bun run scripts/verify-npm-release-agent-review.ts",
     "verify:attested-container-candidate": "bun run scripts/attested-container-candidate.ts verify",
-    "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts",
+    "test:attested-container-candidate": "bun test --timeout 120000 scripts/attested-container-candidate.test.ts",
     "emit:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts emit",
     "verify:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts verify",
-    "test:attested-container-compatibility-vector": "bun test scripts/attested-container-compatibility-vector.test.ts",
+    "test:attested-container-compatibility-vector": "bun test --timeout 120000 scripts/attested-container-compatibility-vector.test.ts",
     "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
     prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
     postinstall: "node postinstall.js"
@@ -13283,11 +13842,12 @@ var package_default = {
   },
   repository: {
     type: "git",
-    url: "https://github.com/hasna/todos.git"
+    url: "https://github.com/hasna/apps.git",
+    directory: "apps/todos"
   },
-  homepage: "https://github.com/hasna/todos",
+  homepage: "https://github.com/hasna/apps",
   bugs: {
-    url: "https://github.com/hasna/todos/issues"
+    url: "https://github.com/hasna/apps/issues"
   },
   engines: {
     bun: ">=1.0.0"
@@ -13296,9 +13856,8 @@ var package_default = {
   author: "Andrei Hasna <andrei@hasna.com>",
   license: "Apache-2.0",
   dependencies: {
-    "@hasna/contracts": "0.14.2",
+    "@hasna/contracts": "1.0.2",
     "@hasna/events": "^0.1.11",
-    "@hasna/paths": "0.1.0",
     "@modelcontextprotocol/sdk": "^1.12.1",
     chalk: "^5.4.1",
     commander: "^13.1.0",
@@ -13327,6 +13886,7 @@ function getPackageVersion(_fromUrl = import.meta.url) {
 }
 
 // src/mcp/token-utils.ts
+init_env();
 var CORE_MCP_TOOLS = new Set([
   "add_comment",
   "bootstrap",
@@ -13728,7 +14288,7 @@ function addGroupTools(toolNames, groupName) {
     toolNames.add(tool);
   return true;
 }
-function shouldRegisterToolForProfile(name, profileValue = process.env["TODOS_PROFILE"], groupValue = process.env["TODOS_TOOL_GROUPS"]) {
+function shouldRegisterToolForProfile(name, profileValue = env.profile(), groupValue = env.toolGroups()) {
   const profileTokens = splitTokens(profileValue || "minimal");
   const groupTokens = splitTokens(groupValue);
   if (profileTokens.includes("full") || profileTokens.includes("all"))
@@ -13800,8 +14360,8 @@ function createMcpManifest(options = {}) {
       name: "todos",
       binary: "todos-mcp",
       transport: "stdio",
-      profileEnvironmentVariable: "TODOS_PROFILE",
-      groupEnvironmentVariable: "TODOS_TOOL_GROUPS"
+      profileEnvironmentVariable: "HASNA_TODOS_PROFILE",
+      groupEnvironmentVariable: "HASNA_TODOS_TOOL_GROUPS"
     },
     groups: MCP_TOOL_GROUPS,
     profiles: MCP_PROFILE_GROUPS,
@@ -14781,7 +15341,7 @@ var TODOS_JSON_CONTRACTS = [
   contract({
     id: "tester_issue_report",
     name: "Tester Issue Report",
-    description: "Generic issue report payload emitted by @hasna/testers or compatible test runners for conversion into local tasks.",
+    description: "Generic issue report payload emitted by the testers QA CLI or compatible test runners for conversion into local tasks.",
     surfaces: ["cli", "sdk"],
     stability: "stable",
     required: {
@@ -16206,14 +16766,15 @@ function normalizeApprovalRefs(values) {
 function resolveTodosAiCommandOptions(input) {
   const cli = input.cli ?? {};
   const config = input.config ?? {};
-  const env = input.env ?? {};
-  const format = parseEnum(selectedString(cli.format, env["TODOS_AI_FORMAT"], config.format), TODOS_AI_FORMATS, "format", TODOS_AI_DEFAULTS.format);
-  const configuredWriteMode = parseEnum(selectedString(cli.writeMode, env["TODOS_AI_WRITE_MODE"], config.write_mode), TODOS_AI_WRITE_MODES, "write mode", TODOS_AI_DEFAULTS.write_mode);
+  const env2 = input.env ?? {};
+  const envFormat = env2["HASNA_TODOS_AI_FORMAT"] ?? env2["TODOS_AI_FORMAT"];
+  const format = parseEnum(selectedString(cli.format, envFormat, config.format), TODOS_AI_FORMATS, "format", TODOS_AI_DEFAULTS.format);
+  const configuredWriteMode = parseEnum(selectedString(cli.writeMode, env2["TODOS_AI_WRITE_MODE"], config.write_mode), TODOS_AI_WRITE_MODES, "write mode", TODOS_AI_DEFAULTS.write_mode);
   if (cli.dryRun && cli.writeMode === "execute") {
     throw new TodosAiContractError("invalid_configuration", "--dry-run cannot be combined with --write-mode execute");
   }
   const writeMode = cli.dryRun ? "plan" : configuredWriteMode;
-  const explicitApproval = cli.dryRun ? selectedString(cli.approvalMode) : selectedString(cli.approvalMode, env["TODOS_AI_APPROVAL_MODE"], config.approval_mode);
+  const explicitApproval = cli.dryRun ? selectedString(cli.approvalMode) : selectedString(cli.approvalMode, env2["TODOS_AI_APPROVAL_MODE"], config.approval_mode);
   const defaultApproval = writeMode === "execute" ? input.interactive ? "prompt" : "required" : "deny";
   const approvalMode = cli.dryRun ? parseEnum(explicitApproval, TODOS_AI_APPROVAL_MODES, "approval mode", "deny") : parseEnum(explicitApproval, TODOS_AI_APPROVAL_MODES, "approval mode", defaultApproval);
   const approvalRefs = normalizeApprovalRefs(cli.approvalRefs);
@@ -16236,12 +16797,12 @@ function resolveTodosAiCommandOptions(input) {
     throw new TodosAiContractError("invalid_configuration", "--approval references require --approval-mode existing");
   }
   return {
-    provider: selectedString(cli.provider, env["TODOS_AI_PROVIDER"], config.provider),
-    model: selectedString(cli.model, env["TODOS_AI_MODEL"], config.model),
-    profile: selectedString(cli.profile, env["TODOS_AI_PROFILE"], config.profile),
+    provider: selectedString(cli.provider, env2["TODOS_AI_PROVIDER"], config.provider),
+    model: selectedString(cli.model, env2["TODOS_AI_MODEL"], config.model),
+    profile: selectedString(cli.profile, env2["TODOS_AI_PROFILE"], config.profile),
     format,
-    max_steps: parseBoundedInteger(cli.maxSteps ?? env["TODOS_AI_MAX_STEPS"] ?? config.max_steps, "max steps", TODOS_AI_DEFAULTS.max_steps, TODOS_AI_LIMITS.min_steps, TODOS_AI_LIMITS.max_steps),
-    timeout_ms: parseBoundedInteger(cli.timeoutMs ?? env["TODOS_AI_TIMEOUT_MS"] ?? config.timeout_ms, "timeout", TODOS_AI_DEFAULTS.timeout_ms, TODOS_AI_LIMITS.min_timeout_ms, TODOS_AI_LIMITS.max_timeout_ms),
+    max_steps: parseBoundedInteger(cli.maxSteps ?? env2["TODOS_AI_MAX_STEPS"] ?? config.max_steps, "max steps", TODOS_AI_DEFAULTS.max_steps, TODOS_AI_LIMITS.min_steps, TODOS_AI_LIMITS.max_steps),
+    timeout_ms: parseBoundedInteger(cli.timeoutMs ?? env2["TODOS_AI_TIMEOUT_MS"] ?? config.timeout_ms, "timeout", TODOS_AI_DEFAULTS.timeout_ms, TODOS_AI_LIMITS.min_timeout_ms, TODOS_AI_LIMITS.max_timeout_ms),
     write_mode: writeMode,
     approval_mode: approvalMode,
     approval_refs: approvalRefs,
@@ -16539,7 +17100,7 @@ function todosAiExitCodeForResult(result) {
 }
 // src/lib/onboarding-fixtures.ts
 import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join8 } from "path";
+import { join as join7 } from "path";
 
 // src/lib/local-bridge.ts
 init_database();
@@ -17476,7 +18037,7 @@ function writeOnboardingFixtureFiles(directory) {
   mkdirSync5(directory, { recursive: true });
   const files = [];
   for (const fixture of allFixtures()) {
-    const path = join8(directory, `${fixture.summary.name}.bridge.json`);
+    const path = join7(directory, `${fixture.summary.name}.bridge.json`);
     writeFileSync3(path, `${JSON.stringify(fixture.bundle, null, 2)}
 `, "utf-8");
     files.push(path);
@@ -17494,7 +18055,7 @@ function importOnboardingFixture(options = {}) {
 init_database();
 import { createHash as createHash4 } from "crypto";
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname5, resolve as resolve9 } from "path";
+import { dirname as dirname5, resolve as resolve10 } from "path";
 import { mkdirSync as mkdirSync6 } from "fs";
 var TODOS_LOCAL_BACKUP_KIND = "hasna.todos.local-backup";
 var TODOS_LOCAL_BACKUP_SCHEMA_VERSION = 1;
@@ -17601,14 +18162,14 @@ function createLocalBackup(options = {}, db) {
   return backup;
 }
 function writeLocalBackupFile(backup, outputPath) {
-  const path = resolve9(outputPath);
+  const path = resolve10(outputPath);
   mkdirSync6(dirname5(path), { recursive: true });
   writeFileSync4(path, `${JSON.stringify(backup, null, 2)}
 `);
   return path;
 }
 function readLocalBackupFile(path) {
-  return JSON.parse(readFileSync5(resolve9(path), "utf-8"));
+  return JSON.parse(readFileSync5(resolve10(path), "utf-8"));
 }
 function verifyLocalBackup(value, options = {}, db) {
   const verifiedAt = options.verified_at ?? now();
@@ -18302,7 +18863,7 @@ function renderLocalSnapshotMarkdown(snapshot) {
 }
 // src/lib/sdk-integration-fixtures.ts
 import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync5 } from "fs";
-import { join as join9 } from "path";
+import { join as join8 } from "path";
 
 // src/cli-mcp-parity.ts
 function source4(version) {
@@ -20273,7 +20834,7 @@ function writeSdkIntegrationFixtures(directory, options = {}) {
   ];
   const written = [];
   for (const [name, payload] of files) {
-    const file = join9(directory, name);
+    const file = join8(directory, name);
     writeFileSync5(file, `${JSON.stringify(payload, null, 2)}
 `, "utf-8");
     written.push(file);
@@ -21556,11 +22117,11 @@ function renderLocalAuditLedgerMarkdown(ledger) {
 init_migrations();
 init_schema();
 import { readFileSync as readFileSync6 } from "fs";
-import { join as join10, resolve as resolve10 } from "path";
+import { join as join9, resolve as resolve11 } from "path";
 import { Database as Database2 } from "bun:sqlite";
 var LOCAL_RELEASE_COMPATIBILITY_SCHEMA_VERSION = 1;
 var EXPECTED_PACKAGE_NAME = "@hasna/todos";
-var EXPECTED_REPOSITORY = "https://github.com/hasna/todos.git";
+var EXPECTED_REPOSITORY = "https://github.com/hasna/apps.git";
 var EXPECTED_BINS = ["todos", "todos-mcp", "todos-serve"];
 var EXPECTED_EXPORTS = [".", "./sdk", "./mcp", "./registry", "./contracts", "./storage"];
 var REQUIRED_SCRIPTS = ["build", "test:no-cloud", "verify:release", "prepublishOnly"];
@@ -21602,7 +22163,7 @@ function warn(id, message, details) {
   return { id, status: "warning", message, details };
 }
 function readPackageJson(root) {
-  return JSON.parse(readFileSync6(join10(root, "package.json"), "utf8"));
+  return JSON.parse(readFileSync6(join9(root, "package.json"), "utf8"));
 }
 function sortedKeys(value) {
   return Object.keys(value ?? {}).sort((left, right) => left.localeCompare(right));
@@ -21664,7 +22225,7 @@ function checkPackage(packageJson) {
   const checks = [];
   checks.push(packageJson.name === EXPECTED_PACKAGE_NAME ? pass("package-name", "Package name is @hasna/todos.") : fail("package-name", "Package name must be @hasna/todos.", { actual: packageJson.name ?? null }));
   checks.push(packageJson.publishConfig?.access === "public" ? pass("publish-access", "Package publish access is public.") : fail("publish-access", "Package publish access must be public.", { actual: packageJson.publishConfig?.access ?? null }));
-  checks.push(packageJson.repository?.url === EXPECTED_REPOSITORY ? pass("repository", "Repository points at hasna/todos.") : fail("repository", "Repository must point at hasna/todos.", { actual: packageJson.repository?.url ?? null }));
+  checks.push(packageJson.repository?.url === EXPECTED_REPOSITORY ? pass("repository", "Repository points at hasna/apps.") : fail("repository", "Repository must point at hasna/apps.", { actual: packageJson.repository?.url ?? null }));
   const dependencyNames = Object.keys(packageJson.dependencies ?? {});
   const privateStudio = `hasna${"studio"}`;
   const privatePlatform = `platform${"-"}todos`;
@@ -21698,7 +22259,7 @@ function checkChangelog() {
   ];
 }
 function createReleaseCompatibilityReport(options = {}) {
-  const root = resolve10(options.root ?? process.cwd());
+  const root = resolve11(options.root ?? process.cwd());
   const packageJson = readPackageJson(root);
   const simulatedLevels = options.simulated_levels ?? defaultSimulationLevels();
   const checks = [
@@ -24028,22 +24589,22 @@ function millisBetween(start, end) {
     return 0;
   return endMs - startMs;
 }
-function addTaskScope(where, params, options, db, alias = "t") {
+function addTaskScope(where, params, options, db, alias2 = "t") {
   if (options.project_id) {
-    where.push(`${alias}.project_id = ?`);
+    where.push(`${alias2}.project_id = ?`);
     params.push(options.project_id);
   }
   if (options.agent_id) {
     params.push(options.agent_id);
-    const assignedInClause = lowerInClause(`${alias}.assigned_to`, resolveAssignedToAliases(db, options.agent_id), params);
-    where.push(`(${alias}.agent_id = ? OR ${assignedInClause})`);
+    const assignedInClause = lowerInClause(`${alias2}.assigned_to`, resolveAssignedToAliases(db, options.agent_id), params);
+    where.push(`(${alias2}.agent_id = ? OR ${assignedInClause})`);
   }
   if (options.since) {
-    where.push(`${alias}.created_at >= ?`);
+    where.push(`${alias2}.created_at >= ?`);
     params.push(options.since);
   }
   if (options.until) {
-    where.push(`${alias}.created_at <= ?`);
+    where.push(`${alias2}.created_at <= ?`);
     params.push(options.until);
   }
 }
@@ -24712,16 +25273,25 @@ var DEFAULT_ENCRYPTION_KEY_ENV = "TODOS_ENCRYPTION_KEY";
 class EncryptionKeyUnavailableError extends Error {
   keyEnv;
   profile;
+  static code = "ENCRYPTION_KEY_UNAVAILABLE";
+  code = EncryptionKeyUnavailableError.code;
+  suggestion;
   constructor(keyEnv, profile) {
     super(`Encryption key is locked: set ${keyEnv} to use profile ${profile}`);
     this.keyEnv = keyEnv;
     this.profile = profile;
+    this.name = "EncryptionKeyUnavailableError";
+    this.suggestion = `Set ${keyEnv} in the environment of the process serving this store, then retry.`;
   }
 }
 
 class EncryptedPayloadError extends Error {
+  static code = "ENCRYPTED_PAYLOAD_INVALID";
+  code = EncryptedPayloadError.code;
+  static suggestion = "Pass a value produced by encrypt_local_value for this profile; a plain value is not an encrypted envelope.";
   constructor(message) {
     super(message);
+    this.name = "EncryptedPayloadError";
   }
 }
 function now3() {
@@ -24793,17 +25363,17 @@ function removeEncryptionProfile(name) {
   saveConfig({ ...config, encryption_profiles: next });
   return true;
 }
-function encryptionProfileStatus(name = DEFAULT_ENCRYPTION_PROFILE, env = process.env) {
+function encryptionProfileStatus(name = DEFAULT_ENCRYPTION_PROFILE, env2 = process.env) {
   const profile = ensureEncryptionProfile(name);
   return {
     profile: redactValue(profile),
-    locked: !env[profile.key_env],
+    locked: !env2[profile.key_env],
     key_env: profile.key_env,
-    key_present: Boolean(env[profile.key_env])
+    key_present: Boolean(env2[profile.key_env])
   };
 }
-function keyForProfile(profile, env) {
-  const secret = env[profile.key_env];
+function keyForProfile(profile, env2) {
+  const secret = env2[profile.key_env];
   if (!secret)
     throw new EncryptionKeyUnavailableError(profile.key_env, profile.name);
   return deriveKey(secret, profile.salt);
@@ -24834,7 +25404,7 @@ function isEncryptedValue(value) {
   const record = value && typeof value === "object" && !Array.isArray(value) ? value : null;
   return Boolean(record && record.kind === TODOS_ENCRYPTED_VALUE_KIND && record.schemaVersion === TODOS_ENCRYPTION_SCHEMA_VERSION);
 }
-function decryptString(envelope, env = process.env) {
+function decryptString(envelope, env2 = process.env) {
   if (!isEncryptedValue(envelope))
     throw new EncryptedPayloadError("value is not a hasna/todos encrypted envelope");
   const profile = profileFromConfig(envelope.profile) ?? {
@@ -24844,7 +25414,7 @@ function decryptString(envelope, env = process.env) {
     key_env: envelope.key_env,
     salt: envelope.salt
   };
-  const key = keyForProfile(profile, env);
+  const key = keyForProfile(profile, env2);
   const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(envelope.iv, "base64"));
   decipher.setAuthTag(Buffer.from(envelope.auth_tag, "base64"));
   const plaintext = Buffer.concat([
@@ -24861,8 +25431,8 @@ function decryptString(envelope, env = process.env) {
 function encryptValue(value, options = {}) {
   return encryptString(JSON.stringify(value), options);
 }
-function decryptValue(envelope, env = process.env) {
-  return JSON.parse(decryptString(envelope, env));
+function decryptValue(envelope, env2 = process.env) {
+  return JSON.parse(decryptString(envelope, env2));
 }
 function looksSensitiveKey(key) {
   return /api[_-]?key|token|secret|password|credential|evidence|artifact|output|summary|metadata/i.test(key);
@@ -24920,7 +25490,7 @@ function isEncryptedBridgeBundle(value) {
   const record = value && typeof value === "object" && !Array.isArray(value) ? value : null;
   return Boolean(record && record.kind === TODOS_ENCRYPTED_BRIDGE_KIND && record.schemaVersion === TODOS_ENCRYPTION_SCHEMA_VERSION);
 }
-function decryptBridgeBundle(bundle, env = process.env) {
+function decryptBridgeBundle(bundle, env2 = process.env) {
   if (!isEncryptedBridgeBundle(bundle))
     throw new EncryptedPayloadError("bundle is not an encrypted hasna/todos bridge export");
   const plaintext = decryptString({
@@ -24936,7 +25506,7 @@ function decryptBridgeBundle(bundle, env = process.env) {
     auth_tag: bundle.encryption.auth_tag,
     ciphertext: bundle.encryption.ciphertext,
     plaintext_sha256: bundle.plaintext.sha256
-  }, env);
+  }, env2);
   return JSON.parse(plaintext);
 }
 function assertExportProfileAllowed(profile) {