@hasna/todos 0.11.52 → 0.11.53

package/dist/index.js

@@ -1223,6 +1223,15 @@ function ensureSchema(db) {
       task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
       tag TEXT NOT NULL, PRIMARY KEY (task_id, tag)
     )`);
+  ensureTable("tags", `
+    CREATE TABLE tags (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL UNIQUE,
+      color TEXT,
+      description TEXT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
   ensureTable("task_dependencies", `
     CREATE TABLE task_dependencies (
       task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
@@ -1436,6 +1445,36 @@ function ensureSchema(db) {
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_git_refs_task ON task_git_refs(task_id)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_git_refs_lookup ON task_git_refs(ref_type, name)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_git_refs_url ON task_git_refs(url)");
+  ensureTable("task_commits", `
+    CREATE TABLE task_commits (
+      id TEXT PRIMARY KEY,
+      task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+      sha TEXT NOT NULL,
+      message TEXT,
+      author TEXT,
+      files_changed TEXT,
+      committed_at TEXT,
+      branch TEXT,
+      pr_url TEXT,
+      pr_number INTEGER,
+      pr_state TEXT,
+      ci_snapshot TEXT,
+      release_tag TEXT,
+      repo_path TEXT,
+      traceability TEXT DEFAULT '{}',
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      UNIQUE(task_id, sha)
+    )`);
+  ensureColumn("task_commits", "branch", "TEXT");
+  ensureColumn("task_commits", "pr_url", "TEXT");
+  ensureColumn("task_commits", "pr_number", "INTEGER");
+  ensureColumn("task_commits", "pr_state", "TEXT");
+  ensureColumn("task_commits", "ci_snapshot", "TEXT");
+  ensureColumn("task_commits", "release_tag", "TEXT");
+  ensureColumn("task_commits", "repo_path", "TEXT");
+  ensureColumn("task_commits", "traceability", "TEXT DEFAULT '{}'");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_commits_task ON task_commits(task_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_commits_sha ON task_commits(sha)");
   ensureTable("task_verifications", `
     CREATE TABLE task_verifications (
       id TEXT PRIMARY KEY,
@@ -1620,6 +1659,9 @@ function ensureSchema(db) {
   ensureColumn("tasks", "max_retries", "INTEGER DEFAULT 3");
   ensureColumn("tasks", "retry_after", "TEXT");
   ensureColumn("tasks", "sla_minutes", "INTEGER");
+  ensureColumn("tasks", "scheduled_start_at", "TEXT");
+  ensureColumn("tasks", "priority_score", "INTEGER");
+  ensureColumn("tasks", "priority_reason", "TEXT");
   ensureColumn("tasks", "archived_at", "TEXT");
   ensureColumn("agents", "role", "TEXT DEFAULT 'agent'");
   ensureColumn("agents", "permissions", `TEXT DEFAULT '["*"]'`);
@@ -1742,6 +1784,7 @@ function ensureSchema(db) {
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_lists_slug ON task_lists(slug)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_tags_tag ON task_tags(tag)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_tags_task ON task_tags(task_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_tags_name ON tags(name)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_plans_project ON plans(project_id)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_plans_status ON plans(status)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_plans_task_list ON plans(task_list_id)");
@@ -1879,6 +1922,217 @@ function ensureSchema(db) {
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_cycles_dates ON cycles(start_date, end_date)");
   ensureColumn("tasks", "cycle_id", "TEXT REFERENCES cycles(id) ON DELETE SET NULL");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_tasks_cycle ON tasks(cycle_id) WHERE cycle_id IS NOT NULL");
+  ensureTable("labels", `
+    CREATE TABLE labels (
+      id TEXT PRIMARY KEY,
+      project_id TEXT REFERENCES projects(id) ON DELETE CASCADE,
+      name TEXT NOT NULL,
+      color TEXT,
+      description TEXT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+      UNIQUE(project_id, name)
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_labels_project ON labels(project_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_labels_name ON labels(name)");
+  ensureTable("task_labels", `
+    CREATE TABLE task_labels (
+      task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+      label_id TEXT NOT NULL REFERENCES labels(id) ON DELETE CASCADE,
+      PRIMARY KEY (task_id, label_id)
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_labels_task ON task_labels(task_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_labels_label ON task_labels(label_id)");
+  ensureTable("custom_field_definitions", `
+    CREATE TABLE custom_field_definitions (
+      id TEXT PRIMARY KEY,
+      project_id TEXT REFERENCES projects(id) ON DELETE CASCADE,
+      name TEXT NOT NULL,
+      slug TEXT NOT NULL,
+      field_type TEXT NOT NULL CHECK(field_type IN ('text', 'number', 'boolean', 'date', 'enum')),
+      options TEXT DEFAULT '[]',
+      required INTEGER NOT NULL DEFAULT 0,
+      default_value TEXT,
+      sort_order INTEGER NOT NULL DEFAULT 0,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+      UNIQUE(project_id, slug)
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_custom_fields_project ON custom_field_definitions(project_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_custom_fields_slug ON custom_field_definitions(slug)");
+  ensureTable("task_custom_field_values", `
+    CREATE TABLE task_custom_field_values (
+      task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+      field_id TEXT NOT NULL REFERENCES custom_field_definitions(id) ON DELETE CASCADE,
+      value TEXT,
+      updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+      PRIMARY KEY (task_id, field_id)
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_custom_values_task ON task_custom_field_values(task_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_custom_values_field ON task_custom_field_values(field_id)");
+  ensureTable("saved_views", `
+    CREATE TABLE saved_views (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL UNIQUE,
+      slug TEXT NOT NULL UNIQUE,
+      entity_type TEXT NOT NULL DEFAULT 'task',
+      filters TEXT NOT NULL DEFAULT '{}',
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_saved_views_slug ON saved_views(slug)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_saved_views_entity ON saved_views(entity_type)");
+  ensureTable("decision_records", `
+    CREATE TABLE decision_records (
+      id TEXT PRIMARY KEY,
+      project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+      task_id TEXT REFERENCES tasks(id) ON DELETE SET NULL,
+      plan_id TEXT REFERENCES plans(id) ON DELETE SET NULL,
+      agent_id TEXT,
+      sequence_num INTEGER NOT NULL,
+      short_ref TEXT NOT NULL UNIQUE,
+      title TEXT NOT NULL,
+      status TEXT NOT NULL DEFAULT 'proposed' CHECK(status IN ('proposed', 'accepted', 'deprecated', 'superseded', 'rejected')),
+      context TEXT,
+      decision TEXT NOT NULL,
+      consequences TEXT,
+      alternatives TEXT DEFAULT '[]',
+      tags TEXT DEFAULT '[]',
+      supersedes_id TEXT REFERENCES decision_records(id) ON DELETE SET NULL,
+      superseded_by_id TEXT REFERENCES decision_records(id) ON DELETE SET NULL,
+      metadata TEXT DEFAULT '{}',
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_decision_records_project ON decision_records(project_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_decision_records_task ON decision_records(task_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_decision_records_plan ON decision_records(plan_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_decision_records_status ON decision_records(status)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_decision_records_short_ref ON decision_records(short_ref)");
+  ensureTable("knowledge_snapshots", `
+    CREATE TABLE knowledge_snapshots (
+      id TEXT PRIMARY KEY,
+      project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+      title TEXT NOT NULL,
+      summary TEXT,
+      content_hash TEXT NOT NULL,
+      snapshot TEXT NOT NULL,
+      decision_ids TEXT DEFAULT '[]',
+      topics TEXT DEFAULT '[]',
+      source TEXT NOT NULL DEFAULT 'auto' CHECK(source IN ('manual', 'auto', 'import')),
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_knowledge_snapshots_project ON knowledge_snapshots(project_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_knowledge_snapshots_hash ON knowledge_snapshots(content_hash)");
+  ensureTable("verification_records", `
+    CREATE TABLE verification_records (
+      id TEXT PRIMARY KEY,
+      task_id TEXT REFERENCES tasks(id) ON DELETE CASCADE,
+      provider_name TEXT NOT NULL,
+      provider_type TEXT NOT NULL,
+      status TEXT NOT NULL DEFAULT 'unknown' CHECK(status IN ('passed', 'failed', 'unknown')),
+      summary TEXT,
+      evidence TEXT DEFAULT '{}',
+      artifact_id TEXT,
+      started_at TEXT,
+      completed_at TEXT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_verification_records_task ON verification_records(task_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_verification_records_status ON verification_records(status)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_verification_records_created ON verification_records(created_at)");
+  ensureTable("task_leases", `
+    CREATE TABLE task_leases (
+      task_id TEXT PRIMARY KEY REFERENCES tasks(id) ON DELETE CASCADE,
+      agent_id TEXT NOT NULL,
+      acquired_at TEXT NOT NULL,
+      expires_at TEXT NOT NULL,
+      heartbeat_at TEXT,
+      steal_count INTEGER NOT NULL DEFAULT 0,
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_leases_agent ON task_leases(agent_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_leases_expires ON task_leases(expires_at)");
+  ensureTable("reminder_preferences", `
+    CREATE TABLE reminder_preferences (
+      id TEXT PRIMARY KEY,
+      due_soon_hours INTEGER NOT NULL DEFAULT 24,
+      sla_warning_minutes INTEGER NOT NULL DEFAULT 30,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      desktop_notify INTEGER NOT NULL DEFAULT 0,
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureTable("notification_reminders", `
+    CREATE TABLE notification_reminders (
+      id TEXT PRIMARY KEY,
+      task_id TEXT REFERENCES tasks(id) ON DELETE CASCADE,
+      reminder_type TEXT NOT NULL CHECK(reminder_type IN ('due_soon', 'due_overdue', 'sla_warning', 'sla_breach', 'custom')),
+      title TEXT NOT NULL,
+      message TEXT,
+      trigger_at TEXT NOT NULL,
+      status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'fired', 'dismissed', 'snoozed')),
+      snoozed_until TEXT,
+      project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+      agent_id TEXT,
+      priority TEXT NOT NULL DEFAULT 'medium',
+      metadata TEXT DEFAULT '{}',
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+      fired_at TEXT,
+      dismissed_at TEXT
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_notification_reminders_task ON notification_reminders(task_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_notification_reminders_status ON notification_reminders(status)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_notification_reminders_trigger ON notification_reminders(trigger_at)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_notification_reminders_project ON notification_reminders(project_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_notification_reminders_agent ON notification_reminders(agent_id)");
+  ensureTable("run_records", `
+    CREATE TABLE run_records (
+      id TEXT PRIMARY KEY,
+      agent_run_id TEXT,
+      agent_id TEXT,
+      objective TEXT,
+      plan_id TEXT REFERENCES plans(id) ON DELETE SET NULL,
+      claimed_task_ids TEXT DEFAULT '[]',
+      commands TEXT DEFAULT '[]',
+      stdout_summary TEXT,
+      stderr_summary TEXT,
+      files_touched TEXT DEFAULT '[]',
+      verification_results TEXT DEFAULT '[]',
+      artifact_ids TEXT DEFAULT '[]',
+      status_transitions TEXT DEFAULT '[]',
+      status TEXT NOT NULL DEFAULT 'active' CHECK(status IN ('active', 'completed', 'failed', 'archived')),
+      replay_bundle TEXT,
+      metadata TEXT DEFAULT '{}',
+      started_at TEXT NOT NULL DEFAULT (datetime('now')),
+      completed_at TEXT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_run_records_agent_run ON run_records(agent_run_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_run_records_agent ON run_records(agent_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_run_records_plan ON run_records(plan_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_run_records_status ON run_records(status)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_run_records_started ON run_records(started_at)");
+  ensureTable("activity_log", `
+    CREATE TABLE activity_log (
+      id TEXT PRIMARY KEY,
+      entity_type TEXT NOT NULL,
+      entity_id TEXT NOT NULL,
+      action TEXT NOT NULL,
+      field TEXT,
+      old_value TEXT,
+      new_value TEXT,
+      actor_id TEXT,
+      session_id TEXT,
+      machine_id TEXT,
+      metadata TEXT DEFAULT '{}',
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_activity_log_entity ON activity_log(entity_type, entity_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_activity_log_actor ON activity_log(actor_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_activity_log_action ON activity_log(action)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_activity_log_created ON activity_log(created_at)");
   ensureTable("api_keys", `
     CREATE TABLE api_keys (
       id TEXT PRIMARY KEY,
@@ -2315,11 +2569,17 @@ function ensureDir(filePath) {
   }
 }
 function getDatabase(dbPath) {
-  if (_db)
-    return _db;
   const path = dbPath || getDbPath();
+  if (_db && _dbPath === path)
+    return _db;
+  if (_db && _dbPath !== path) {
+    _db.close();
+    _db = null;
+    _dbPath = null;
+  }
   ensureDir(path);
   _db = new Database(path);
+  _dbPath = path;
   _db.run("PRAGMA journal_mode = WAL");
   _db.run("PRAGMA busy_timeout = 5000");
   _db.run("PRAGMA foreign_keys = ON");
@@ -2332,10 +2592,12 @@ function closeDatabase() {
   if (_db) {
     _db.close();
     _db = null;
+    _dbPath = null;
   }
 }
 function resetDatabase() {
   _db = null;
+  _dbPath = null;
 }
 function now() {
   return new Date().toISOString();
@@ -2396,7 +2658,7 @@ function resolvePartialId(db, table, partialId) {
   }
   return null;
 }
-var LOCK_EXPIRY_MINUTES = 30, _db = null, ALLOWED_TABLES;
+var LOCK_EXPIRY_MINUTES = 30, _db = null, _dbPath = null, ALLOWED_TABLES;
 var init_database = __esm(() => {
   init_schema();
   init_machines();
@@ -2888,9 +3150,10 @@ function redactExportRecord(record) {
 function getDefaultSecretPatterns() {
   return DEFAULT_PATTERNS.map((p) => ({ name: p.name, source: p.pattern.source }));
 }
-var SECRET_REDACTION_SCHEMA = "todos.secret_redaction.v1", REDACTION_PLACEHOLDER = "[REDACTED]", DEFAULT_PATTERNS, DEFAULT_ALLOWLIST, customRedactors;
+var SECRET_REDACTION_SCHEMA, REDACTION_PLACEHOLDER = "[REDACTED]", DEFAULT_PATTERNS, DEFAULT_ALLOWLIST, customRedactors;
 var init_secret_redaction = __esm(() => {
   init_redaction();
+  SECRET_REDACTION_SCHEMA = ["todos", "secret_redaction", "v1"].join(".");
   DEFAULT_PATTERNS = [
     { name: "openai_sk", pattern: /\bsk-[a-zA-Z0-9]{10,}\b/g },
     { name: "github_pat", pattern: /\bghp_[a-zA-Z0-9]{20,}\b/g },
@@ -9738,7 +10001,7 @@ function storeArtifactFile(input) {
   }
   return { sourcePath, localPath, contentHash, mimeType, sizeBytes: buffer.length };
 }
-function deleteStoredArtifactFile(localPath, storageMode, _dbPath) {
+function deleteStoredArtifactFile(localPath, storageMode, _dbPath2) {
   if (storageMode === "reference")
     return false;
   if (!localPath || !existsSync7(localPath))
@@ -9993,11 +10256,19 @@ function getTaskVerifications(taskId, db) {
 }
 function getTaskTraceability(taskId, db) {
   const d = db || getDatabase();
+  const commits = getTaskCommits(taskId, d);
+  const gitRefs = getTaskGitRefs(taskId, d);
   return {
     task_id: taskId,
-    commits: getTaskCommits(taskId, d),
-    git_refs: getTaskGitRefs(taskId, d),
-    verifications: getTaskVerifications(taskId, d)
+    commits,
+    git_refs: gitRefs,
+    verifications: getTaskVerifications(taskId, d),
+    branches: Array.from(new Set([
+      ...commits.map((commit) => commit.branch).filter((branch) => Boolean(branch)),
+      ...gitRefs.filter((ref) => ref.ref_type === "branch").map((ref) => ref.name)
+    ])).sort(),
+    release_tags: Array.from(new Set(commits.map((commit) => commit.release_tag).filter((tag) => Boolean(tag)))).sort(),
+    pull_requests: commits.filter((commit) => commit.pr_url).map((commit) => ({ url: commit.pr_url, state: commit.pr_state, number: commit.pr_number }))
   };
 }
 
@@ -17057,6 +17328,16 @@ function parseClock(value) {
     throw new Error("quiet hours must use HH:MM-HH:MM");
   return Number(match[1]) * 60 + Number(match[2]);
 }
+function parseQuietHours(value, timezone = "local") {
+  if (!value)
+    return;
+  const [start, end] = value.split("-", 2).map((part) => part.trim());
+  if (!start || !end)
+    throw new Error("quiet hours must use HH:MM-HH:MM");
+  parseClock(start);
+  parseClock(end);
+  return { start, end, timezone };
+}
 function isQuietTime(quiet, timestamp2) {
   if (!quiet)
     return false;
@@ -18979,6 +19260,168 @@ var TODOS_REGISTRY = createTodosRegistry({
   generatedAt: "1970-01-01T00:00:00.000Z"
 });
 
+// src/storage/config.ts
+var TODOS_STORAGE_TABLES = [
+  "todos_sync_records",
+  "todos_sync_cursors"
+];
+var STORAGE_TABLES = TODOS_STORAGE_TABLES;
+var TODOS_STORAGE_ENV = {
+  mode: "HASNA_TODOS_STORAGE_MODE",
+  databaseUrl: "HASNA_TODOS_DATABASE_URL",
+  databaseSsl: "HASNA_TODOS_DATABASE_SSL",
+  databaseSchema: "HASNA_TODOS_DATABASE_SCHEMA",
+  s3Bucket: "HASNA_TODOS_S3_BUCKET",
+  s3Prefix: "HASNA_TODOS_S3_PREFIX",
+  awsRegion: "HASNA_TODOS_AWS_REGION",
+  s3Endpoint: "HASNA_TODOS_S3_ENDPOINT",
+  s3ForcePathStyle: "HASNA_TODOS_S3_FORCE_PATH_STYLE",
+  s3AccessKeyId: "HASNA_TODOS_S3_ACCESS_KEY_ID",
+  s3SecretAccessKey: "HASNA_TODOS_S3_SECRET_ACCESS_KEY",
+  s3SessionToken: "HASNA_TODOS_S3_SESSION_TOKEN",
+  syncBatchSize: "HASNA_TODOS_SYNC_BATCH_SIZE",
+  syncDryRun: "HASNA_TODOS_SYNC_DRY_RUN"
+};
+var TODOS_STORAGE_FALLBACK_ENV = {
+  mode: "TODOS_STORAGE_MODE",
+  databaseUrl: "TODOS_DATABASE_URL",
+  databaseSsl: "TODOS_DATABASE_SSL",
+  databaseSchema: "TODOS_DATABASE_SCHEMA",
+  s3Bucket: "TODOS_S3_BUCKET",
+  s3Prefix: "TODOS_S3_PREFIX",
+  awsRegion: "TODOS_AWS_REGION",
+  s3Endpoint: "TODOS_S3_ENDPOINT",
+  s3ForcePathStyle: "TODOS_S3_FORCE_PATH_STYLE",
+  s3AccessKeyId: "TODOS_S3_ACCESS_KEY_ID",
+  s3SecretAccessKey: "TODOS_S3_SECRET_ACCESS_KEY",
+  s3SessionToken: "TODOS_S3_SESSION_TOKEN",
+  syncBatchSize: "TODOS_SYNC_BATCH_SIZE",
+  syncDryRun: "TODOS_SYNC_DRY_RUN"
+};
+var CANONICAL_TODOS_RDS_CLUSTER = "hasna-xyz-infra-apps-prod-postgres";
+var CANONICAL_TODOS_RDS_DATABASE = "todos";
+var CANONICAL_TODOS_RDS_RUNTIME_PATH = "hasna/xyz/opensource/todos/prod/rds";
+function getCanonicalTodosRdsConfig() {
+  return {
+    cluster: CANONICAL_TODOS_RDS_CLUSTER,
+    database: CANONICAL_TODOS_RDS_DATABASE,
+    runtimeSecretPath: CANONICAL_TODOS_RDS_RUNTIME_PATH,
+    primaryEnv: TODOS_STORAGE_ENV.databaseUrl,
+    fallbackEnv: TODOS_STORAGE_FALLBACK_ENV.databaseUrl
+  };
+}
+function loadTodosStorageConfig(env = process.env) {
+  const mode = getTodosStorageMode(env);
+  const databaseUrl = getTodosStorageDatabaseUrl(env);
+  const bucket = readStorageEnv(env, "s3Bucket").value;
+  const prefix = readStorageEnv(env, "s3Prefix").value ?? "todos/";
+  const region = readStorageEnv(env, "awsRegion").value;
+  const endpoint = readStorageEnv(env, "s3Endpoint").value;
+  const schema = readStorageEnv(env, "databaseSchema").value;
+  return {
+    service: "todos",
+    mode,
+    ...databaseUrl ? {
+      database: {
+        provider: "postgres",
+        url: databaseUrl,
+        ssl: parseBoolean(readStorageEnv(env, "databaseSsl").value, true),
+        ...schema ? { schema } : {}
+      }
+    } : {},
+    ...bucket ? {
+      objectStorage: {
+        provider: "s3",
+        bucket,
+        prefix,
+        ...region ? { region } : {},
+        ...endpoint ? { endpoint } : {},
+        forcePathStyle: parseBoolean(readStorageEnv(env, "s3ForcePathStyle").value, false)
+      }
+    } : {},
+    sync: {
+      batchSize: parsePositiveInteger(readStorageEnv(env, "syncBatchSize").value, 500),
+      dryRun: parseBoolean(readStorageEnv(env, "syncDryRun").value, false)
+    }
+  };
+}
+function loadStorageConfig(env = process.env) {
+  return loadTodosStorageConfig(env);
+}
+function isTodosRemoteStorageEnabled(config) {
+  return config.mode === "remote" || config.mode === "hybrid";
+}
+function assertTodosRemoteStorageConfig(config) {
+  if (!isTodosRemoteStorageEnabled(config))
+    return;
+  if (!config.database?.url) {
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${TODOS_STORAGE_ENV.mode}=${config.mode}`);
+  }
+}
+function parseStorageMode(value) {
+  const normalized = clean(value)?.toLowerCase();
+  if (!normalized)
+    return "local";
+  if (normalized === "local" || normalized === "remote" || normalized === "hybrid")
+    return normalized;
+  throw new Error(`${TODOS_STORAGE_ENV.mode} must be local, remote, or hybrid`);
+}
+function getTodosStorageMode(env = process.env) {
+  return parseStorageMode(readStorageEnv(env, "mode").value);
+}
+function getStorageMode(env = process.env) {
+  return getTodosStorageMode(env);
+}
+function getTodosStorageDatabaseEnv(env = process.env) {
+  return readStorageEnv(env, "databaseUrl").name;
+}
+function getStorageDatabaseEnv(env = process.env) {
+  return getTodosStorageDatabaseEnv(env);
+}
+function getTodosStorageDatabaseUrl(env = process.env) {
+  return readStorageEnv(env, "databaseUrl").value;
+}
+function getStorageDatabaseUrl(env = process.env) {
+  return getTodosStorageDatabaseUrl(env);
+}
+function getTodosStorageEnvName(env, key) {
+  return readStorageEnv(env, key).name;
+}
+function readStorageEnv(env, key) {
+  const primaryName = TODOS_STORAGE_ENV[key];
+  const primaryValue = clean(env[primaryName]);
+  if (primaryValue !== undefined)
+    return { name: primaryName, value: primaryValue };
+  const fallbackName = TODOS_STORAGE_FALLBACK_ENV[key];
+  const fallbackValue = clean(env[fallbackName]);
+  if (fallbackValue !== undefined)
+    return { name: fallbackName, value: fallbackValue };
+  return { name: primaryName };
+}
+function clean(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+function parseBoolean(value, fallback) {
+  const normalized = clean(value)?.toLowerCase();
+  if (!normalized)
+    return fallback;
+  if (["1", "true", "yes", "on"].includes(normalized))
+    return true;
+  if (["0", "false", "no", "off"].includes(normalized))
+    return false;
+  throw new Error(`Expected boolean env value, got ${value}`);
+}
+function parsePositiveInteger(value, fallback) {
+  const normalized = clean(value);
+  if (!normalized)
+    return fallback;
+  const parsed = Number.parseInt(normalized, 10);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+    throw new Error(`${TODOS_STORAGE_ENV.syncBatchSize} must be a positive integer`);
+  }
+  return parsed;
+}
 // src/db/agents.ts
 init_database();
 
@@ -19693,6 +20136,260 @@ function ensureTaskList(name, slug, projectId, db) {
 
 // src/storage/local-sqlite.ts
 init_database();
+
+// src/storage/sqlite-snapshot.ts
+init_database();
+var PROJECT_COLUMNS = [
+  "id",
+  "name",
+  "path",
+  "description",
+  "task_list_id",
+  "task_prefix",
+  "task_counter",
+  "created_at",
+  "updated_at",
+  "machine_id",
+  "synced_at"
+];
+var TASK_LIST_COLUMNS = [
+  "id",
+  "project_id",
+  "slug",
+  "name",
+  "description",
+  "metadata",
+  "created_at",
+  "updated_at",
+  "machine_id",
+  "synced_at"
+];
+var PLAN_COLUMNS = [
+  "id",
+  "project_id",
+  "task_list_id",
+  "agent_id",
+  "name",
+  "description",
+  "status",
+  "created_at",
+  "updated_at",
+  "machine_id",
+  "synced_at"
+];
+var AGENT_COLUMNS = [
+  "id",
+  "name",
+  "description",
+  "role",
+  "title",
+  "level",
+  "permissions",
+  "capabilities",
+  "reports_to",
+  "org_id",
+  "metadata",
+  "status",
+  "created_at",
+  "last_seen_at",
+  "session_id",
+  "working_dir",
+  "active_project_id",
+  "machine_id",
+  "synced_at"
+];
+var TEMPLATE_COLUMNS = [
+  "id",
+  "name",
+  "title_pattern",
+  "description",
+  "priority",
+  "tags",
+  "variables",
+  "project_id",
+  "plan_id",
+  "metadata",
+  "version",
+  "created_at",
+  "machine_id",
+  "synced_at"
+];
+var TASK_COLUMNS = [
+  "id",
+  "short_id",
+  "project_id",
+  "parent_id",
+  "plan_id",
+  "task_list_id",
+  "title",
+  "description",
+  "status",
+  "priority",
+  "agent_id",
+  "assigned_to",
+  "session_id",
+  "working_dir",
+  "tags",
+  "metadata",
+  "version",
+  "locked_by",
+  "locked_at",
+  "created_at",
+  "updated_at",
+  "started_at",
+  "completed_at",
+  "due_at",
+  "estimated_minutes",
+  "actual_minutes",
+  "requires_approval",
+  "approved_by",
+  "approved_at",
+  "recurrence_rule",
+  "recurrence_parent_id",
+  "spawns_template_id",
+  "confidence",
+  "reason",
+  "spawned_from_session",
+  "assigned_by",
+  "assigned_from_project",
+  "task_type",
+  "cost_tokens",
+  "cost_usd",
+  "delegated_from",
+  "delegation_depth",
+  "retry_count",
+  "max_retries",
+  "retry_after",
+  "sla_minutes",
+  "runner_id",
+  "runner_started_at",
+  "runner_completed_at",
+  "current_step",
+  "total_steps",
+  "cycle_id",
+  "machine_id",
+  "synced_at",
+  "archived_at"
+];
+var AUDIT_COLUMNS = [
+  "id",
+  "task_id",
+  "action",
+  "field",
+  "old_value",
+  "new_value",
+  "agent_id",
+  "created_at",
+  "machine_id"
+];
+var JSON_COLUMNS = new Set(["tags", "metadata", "permissions", "capabilities", "variables"]);
+var BOOLEAN_COLUMNS = new Set(["requires_approval"]);
+function exportSqliteTodosStorageSnapshot(db) {
+  const d = db ?? getDatabase();
+  return {
+    exportedAt: new Date().toISOString(),
+    source: "sqlite",
+    tasks: listTasks({ include_archived: true }, d),
+    projects: listProjects(d),
+    plans: listPlans(undefined, d),
+    agents: listAgents({ include_archived: true }, d),
+    taskLists: listTaskLists(undefined, d),
+    templates: listTemplates(d),
+    auditHistory: getRecentActivity(Number.MAX_SAFE_INTEGER, d)
+  };
+}
+function importSqliteTodosStorageSnapshot(snapshot, db) {
+  const d = db ?? getDatabase();
+  const result = {
+    inserted: 0,
+    updated: 0,
+    skipped: 0,
+    errors: []
+  };
+  const applyRows = (table, columns, rows, updateClockColumn, afterUpsert) => {
+    for (const row of rows) {
+      try {
+        const record = asRecord2(row);
+        const state = upsertById(d, table, columns, record, updateClockColumn);
+        if (state === "inserted")
+          result.inserted += 1;
+        else if (state === "updated")
+          result.updated += 1;
+        else
+          result.skipped += 1;
+        afterUpsert?.(record, state !== "skipped");
+      } catch (error) {
+        result.errors.push(error instanceof Error ? error.message : String(error));
+      }
+    }
+  };
+  applyRows("projects", PROJECT_COLUMNS, snapshot.projects, "updated_at");
+  applyRows("agents", AGENT_COLUMNS, snapshot.agents, "last_seen_at");
+  applyRows("task_lists", TASK_LIST_COLUMNS, snapshot.taskLists, "updated_at");
+  applyRows("plans", PLAN_COLUMNS, snapshot.plans, "updated_at");
+  applyRows("task_templates", TEMPLATE_COLUMNS, snapshot.templates);
+  applyRows("tasks", TASK_COLUMNS, sortedTasks2(snapshot.tasks), "updated_at", (row, changed) => {
+    if (changed && Array.isArray(row["tags"]) && typeof row["id"] === "string") {
+      replaceTaskTags(row["id"], row["tags"].filter((tag) => typeof tag === "string"), d);
+    }
+  });
+  applyRows("task_history", AUDIT_COLUMNS, snapshot.auditHistory);
+  return result;
+}
+function upsertById(db, table, columns, row, updateClockColumn) {
+  const id = row["id"];
+  if (typeof id !== "string" || !id)
+    throw new Error(`${table} row is missing id`);
+  const presentColumns = columns.filter((column) => (column in row));
+  if (!presentColumns.includes("id"))
+    presentColumns.unshift("id");
+  const existing = existsById2(db, table, id);
+  const placeholders = presentColumns.map(() => "?").join(", ");
+  const values = presentColumns.map((column) => valueForColumn(column, row[column]));
+  const updateColumns = presentColumns.filter((column) => column !== "id");
+  const updateSet = updateColumns.map((column) => `${column} = excluded.${column}`).join(", ");
+  const clockGuard = updateClockColumn && presentColumns.includes(updateClockColumn) ? ` WHERE ${table}.${updateClockColumn} IS NULL OR ${table}.${updateClockColumn} <= excluded.${updateClockColumn}` : "";
+  const sql = updateSet ? `INSERT INTO ${table} (${presentColumns.join(", ")}) VALUES (${placeholders})
+       ON CONFLICT(id) DO UPDATE SET ${updateSet}${clockGuard}` : `INSERT OR IGNORE INTO ${table} (${presentColumns.join(", ")}) VALUES (${placeholders})`;
+  const changes = db.run(sql, values).changes;
+  if (changes === 0)
+    return "skipped";
+  return existing ? "updated" : "inserted";
+}
+function existsById2(db, table, id) {
+  return Boolean(db.query(`SELECT id FROM ${table} WHERE id = ?`).get(id));
+}
+function valueForColumn(column, value) {
+  if (BOOLEAN_COLUMNS.has(column))
+    return value ? 1 : 0;
+  if (JSON_COLUMNS.has(column))
+    return JSON.stringify(value ?? (column === "tags" || column === "permissions" || column === "capabilities" || column === "variables" ? [] : {}));
+  return value === undefined ? null : value;
+}
+function asRecord2(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("snapshot rows must be objects");
+  }
+  return value;
+}
+function sortedTasks2(tasks) {
+  const byId = new Map(tasks.map((task2) => [task2.id, task2]));
+  const seen = new Set;
+  const result = [];
+  const visit = (task2) => {
+    if (seen.has(task2.id))
+      return;
+    if (task2.parent_id && byId.has(task2.parent_id))
+      visit(byId.get(task2.parent_id));
+    seen.add(task2.id);
+    result.push(task2);
+  };
+  for (const task2 of tasks)
+    visit(task2);
+  return result;
+}
+
+// src/storage/local-sqlite.ts
 function createLocalSqliteTodosStorageAdapter(options = {}) {
   const database = () => options.db ?? getDatabase();
   let adapter;
@@ -19765,7 +20462,9 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       getRecentActivity: (limit) => getRecentActivity(limit, database())
     },
     sync: {
-      getTasksChangedSince: (since, filters) => getTasksChangedSince(since, filters, database())
+      getTasksChangedSince: (since, filters) => getTasksChangedSince(since, filters, database()),
+      exportSnapshot: () => exportSqliteTodosStorageSnapshot(database()),
+      importSnapshot: (snapshot) => importSqliteTodosStorageSnapshot(snapshot, database())
     },
     transaction: (fn) => {
       const tx = database().transaction(() => fn(adapter));
@@ -19774,6 +20473,1326 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
   };
   return adapter;
 }
+
+// src/storage/postgres-sync.ts
+var DEFAULT_TODOS_POSTGRES_SYNC_TABLE = "todos_sync_records";
+var DEFAULT_TODOS_POSTGRES_CURSOR_TABLE = "todos_sync_cursors";
+function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABLE, cursorTableName = DEFAULT_TODOS_POSTGRES_CURSOR_TABLE) {
+  assertSafeIdentifier(tableName);
+  assertSafeIdentifier(cursorTableName);
+  return [
+    `CREATE TABLE IF NOT EXISTS ${tableName} (
+      service text NOT NULL,
+      object_type text NOT NULL,
+      object_id text NOT NULL,
+      payload jsonb NOT NULL,
+      updated_at timestamptz NOT NULL,
+      deleted_at timestamptz,
+      source_machine_id text,
+      version integer,
+      PRIMARY KEY (service, object_type, object_id)
+    )`,
+    `CREATE INDEX IF NOT EXISTS ${tableName}_updated_idx ON ${tableName} (service, updated_at)`,
+    `CREATE TABLE IF NOT EXISTS ${cursorTableName} (
+      service text NOT NULL,
+      cursor_name text NOT NULL,
+      value text NOT NULL,
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      PRIMARY KEY (service, cursor_name)
+    )`
+  ];
+}
+
+class PostgresTodosSyncStore {
+  client;
+  service;
+  sourceMachineId;
+  tableName;
+  cursorTableName;
+  constructor(client, options = {}) {
+    this.client = client;
+    this.service = options.service ?? "todos";
+    this.sourceMachineId = options.sourceMachineId;
+    this.tableName = options.tableName ?? DEFAULT_TODOS_POSTGRES_SYNC_TABLE;
+    this.cursorTableName = options.cursorTableName ?? DEFAULT_TODOS_POSTGRES_CURSOR_TABLE;
+    assertSafeIdentifier(this.tableName);
+    assertSafeIdentifier(this.cursorTableName);
+  }
+  async ensureSchema() {
+    for (const sql of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
+      await this.client.query(sql);
+    }
+  }
+  async pushSnapshot(snapshot, context = {}) {
+    const result = { records: 0, objectTypes: {} };
+    const sourceMachineId = context.requestId ?? this.sourceMachineId ?? null;
+    for (const entry of snapshotEntries(snapshot)) {
+      await this.client.query(`INSERT INTO ${this.tableName} (
+          service, object_type, object_id, payload, updated_at,
+          deleted_at, source_machine_id, version
+        ) VALUES ($1, $2, $3, $4::jsonb, $5::timestamptz, $6::timestamptz, $7, $8)
+        ON CONFLICT (service, object_type, object_id) DO UPDATE SET
+          payload = EXCLUDED.payload,
+          updated_at = EXCLUDED.updated_at,
+          deleted_at = EXCLUDED.deleted_at,
+          source_machine_id = EXCLUDED.source_machine_id,
+          version = EXCLUDED.version
+        WHERE ${this.tableName}.updated_at <= EXCLUDED.updated_at`, [
+        this.service,
+        entry.type,
+        entry.id,
+        JSON.stringify(entry.payload),
+        entry.updatedAt,
+        entry.deletedAt,
+        sourceMachineId,
+        entry.version
+      ]);
+      result.records += 1;
+      result.objectTypes[entry.type] = (result.objectTypes[entry.type] ?? 0) + 1;
+    }
+    return result;
+  }
+  async pullSnapshot(options = {}) {
+    const params = [this.service];
+    const filters = ["service = $1", "deleted_at IS NULL"];
+    if (options.since) {
+      params.push(options.since);
+      filters.push(`updated_at > $${params.length}::timestamptz`);
+    }
+    if (options.objectTypes?.length) {
+      params.push(options.objectTypes);
+      filters.push(`object_type = ANY($${params.length}::text[])`);
+    }
+    const response = await this.client.query(`SELECT object_type, payload FROM ${this.tableName}
+       WHERE ${filters.join(" AND ")}
+       ORDER BY updated_at ASC, object_type ASC, object_id ASC`, params);
+    return rowsToSnapshot(response.rows);
+  }
+  async getCursor(name) {
+    const result = await this.client.query(`SELECT value FROM ${this.cursorTableName} WHERE service = $1 AND cursor_name = $2`, [this.service, name]);
+    return result.rows[0]?.value ?? null;
+  }
+  async setCursor(name, value) {
+    await this.client.query(`INSERT INTO ${this.cursorTableName} (service, cursor_name, value, updated_at)
+       VALUES ($1, $2, $3, now())
+       ON CONFLICT (service, cursor_name) DO UPDATE SET
+         value = EXCLUDED.value,
+         updated_at = EXCLUDED.updated_at`, [this.service, name, value]);
+  }
+}
+function createPostgresTodosSyncStore(client, options = {}) {
+  return new PostgresTodosSyncStore(client, options);
+}
+function snapshotEntries(snapshot) {
+  return [
+    ...snapshot.tasks.map((payload) => entry("tasks", payload, snapshot.exportedAt)),
+    ...snapshot.projects.map((payload) => entry("projects", payload, snapshot.exportedAt)),
+    ...snapshot.plans.map((payload) => entry("plans", payload, snapshot.exportedAt)),
+    ...snapshot.agents.map((payload) => entry("agents", payload, snapshot.exportedAt)),
+    ...snapshot.taskLists.map((payload) => entry("task_lists", payload, snapshot.exportedAt)),
+    ...snapshot.templates.map((payload) => entry("templates", payload, snapshot.exportedAt)),
+    ...snapshot.auditHistory.map((payload) => entry("audit_history", payload, snapshot.exportedAt))
+  ];
+}
+function entry(type, payload, fallbackUpdatedAt) {
+  const id = payload["id"];
+  if (typeof id !== "string" || !id)
+    throw new Error(`${type} record is missing a stable id`);
+  return {
+    type,
+    id,
+    payload,
+    updatedAt: stringValue(payload["updated_at"]) ?? stringValue(payload["created_at"]) ?? fallbackUpdatedAt,
+    deletedAt: stringValue(payload["deleted_at"]),
+    version: numberValue2(payload["version"])
+  };
+}
+function rowsToSnapshot(rows) {
+  const snapshot = {
+    exportedAt: new Date().toISOString(),
+    source: "postgres",
+    tasks: [],
+    projects: [],
+    plans: [],
+    agents: [],
+    taskLists: [],
+    templates: [],
+    auditHistory: []
+  };
+  for (const row of rows) {
+    const payload = payloadRecord(row.payload);
+    if (row.object_type === "tasks")
+      snapshot.tasks.push(payload);
+    else if (row.object_type === "projects")
+      snapshot.projects.push(payload);
+    else if (row.object_type === "plans")
+      snapshot.plans.push(payload);
+    else if (row.object_type === "agents")
+      snapshot.agents.push(payload);
+    else if (row.object_type === "task_lists")
+      snapshot.taskLists.push(payload);
+    else if (row.object_type === "templates")
+      snapshot.templates.push(payload);
+    else if (row.object_type === "audit_history")
+      snapshot.auditHistory.push(payload);
+  }
+  return snapshot;
+}
+function payloadRecord(value) {
+  if (typeof value === "string")
+    return JSON.parse(value);
+  if (value && typeof value === "object" && !Array.isArray(value))
+    return value;
+  throw new Error("Postgres sync payload must be a JSON object");
+}
+function stringValue(value) {
+  return typeof value === "string" && value ? value : null;
+}
+function numberValue2(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) ? value : null;
+}
+function assertSafeIdentifier(value) {
+  if (!/^[a-z_][a-z0-9_]*$/i.test(value))
+    throw new Error(`Unsafe Postgres identifier: ${value}`);
+}
+
+// src/storage/hybrid.ts
+function createHybridTodosStorageAdapter(options) {
+  const local = options.localAdapter ?? createLocalSqliteTodosStorageAdapter(options.local);
+  const syncStore = options.syncStore ?? (options.postgresClient ? createPostgresTodosSyncStore(options.postgresClient, { sourceMachineId: options.sourceMachineId }) : null);
+  if (!syncStore)
+    throw new Error("hybrid storage requires a Postgres sync store or query client");
+  if (!local.sync.exportSnapshot || !local.sync.importSnapshot) {
+    throw new Error("hybrid storage requires local snapshot export/import support");
+  }
+  const exportSnapshot = async (context) => await local.sync.exportSnapshot(context);
+  const importSnapshot = async (snapshot, context) => await local.sync.importSnapshot(snapshot, context);
+  const remote = {
+    ensureSchema: () => syncStore.ensureSchema(),
+    async pushSnapshot(context) {
+      const snapshot = await exportSnapshot(context);
+      return syncStore.pushSnapshot(snapshot, context);
+    },
+    async pullSnapshot(options2, context) {
+      const snapshot = await syncStore.pullSnapshot(options2);
+      return importSnapshot(snapshot, context);
+    },
+    async syncOnce(options2, context) {
+      const pulled = await remote.pullSnapshot(options2, context);
+      const pushed = await remote.pushSnapshot(context);
+      return { pulled, pushed };
+    }
+  };
+  return {
+    ...local,
+    kind: "hybrid",
+    capabilities: {
+      ...local.capabilities,
+      localPersistence: true,
+      remotePersistence: true,
+      sync: true
+    },
+    sync: {
+      ...local.sync,
+      exportSnapshot,
+      importSnapshot
+    },
+    remote
+  };
+}
+
+// src/storage/postgres-adapter.ts
+import { randomUUID as randomUUID2 } from "crypto";
+function createPostgresTodosStorageAdapter(options) {
+  const store = new PostgresJsonRecordStore(options);
+  const adapter = {
+    kind: "postgres",
+    capabilities: {
+      localPersistence: false,
+      remotePersistence: true,
+      transactions: false,
+      auditLog: true,
+      sync: true
+    },
+    tasks: {
+      create: (input, context) => createTask2(input, store, context),
+      get: (id) => store.get("tasks", id),
+      list: (filter = {}) => listTasks2(filter, store),
+      count: async (filter = {}) => (await listTasks2(filter, store)).length,
+      update: (id, input) => updateTask2(id, input, store),
+      delete: (id, context) => store.delete("tasks", id, context),
+      start: (id, agentId) => startTask2(id, agentId, store),
+      complete: (id, agentId, options2) => completeTask2(id, agentId, options2, store),
+      fail: (id, agentId, reason, options2) => failTask2(id, agentId, reason, options2, store),
+      claimNext: (agentId, filters) => claimNextTask2(agentId, filters, store),
+      getNext: (_agentId, filters) => getNextTask2(filters, store),
+      getActiveWork: (filters) => getActiveWork2(filters, store),
+      getChangedSince: (since, filters) => getChangedSince(since, filters, store)
+    },
+    projects: {
+      create: (input, context) => createProject2(input, store, context),
+      get: (id) => store.get("projects", id),
+      getByPath: async (path) => (await store.list("projects")).find((project) => project.path === path) ?? null,
+      list: async () => (await store.list("projects")).sort((a, b) => a.name.localeCompare(b.name)),
+      update: (id, input) => updateProject2(id, input, store),
+      delete: (id, context) => store.delete("projects", id, context)
+    },
+    plans: {
+      create: (input, context) => createPlan2(input, store, context),
+      get: (id) => store.get("plans", id),
+      list: async (projectId) => (await store.list("plans")).filter((plan) => projectId === undefined || plan.project_id === projectId).sort((a, b) => a.name.localeCompare(b.name)),
+      update: (id, input) => updatePlan2(id, input, store),
+      delete: (id, context) => store.delete("plans", id, context)
+    },
+    agents: {
+      register: (input, context) => registerAgent2(input, store, context),
+      get: (id) => store.get("agents", id),
+      getByName: async (name) => (await store.list("agents")).find((agent) => agent.name === name) ?? null,
+      list: async (options2) => (await store.list("agents")).filter((agent) => options2?.include_archived || agent.status !== "archived").sort((a, b) => a.name.localeCompare(b.name)),
+      update: (id, input) => updateAgent2(id, input, store)
+    },
+    taskLists: {
+      create: (input, context) => createTaskList2(input, store, context),
+      get: (id) => store.get("task_lists", id),
+      getBySlug: async (slug, projectId) => (await store.list("task_lists")).find((list) => list.slug === slug && (projectId === undefined || list.project_id === projectId)) ?? null,
+      list: async (projectId) => (await store.list("task_lists")).filter((list) => projectId === undefined || list.project_id === projectId).sort((a, b) => a.name.localeCompare(b.name)),
+      update: (id, input) => updateTaskList2(id, input, store),
+      delete: (id, context) => store.delete("task_lists", id, context)
+    },
+    templates: {
+      create: (input, context) => createTemplate2(input, store, context),
+      get: (id) => store.get("templates", id),
+      list: async () => (await store.list("templates")).sort((a, b) => a.name.localeCompare(b.name)),
+      update: (id, input) => updateTemplate2(id, input, store),
+      delete: (id, context) => store.delete("templates", id, context),
+      getWithTasks: async (id) => {
+        const template = await store.get("templates", id);
+        return template ? { ...template, tasks: [] } : null;
+      }
+    },
+    audit: {
+      logTaskChange: (taskId, action, field2, oldValue, newValue, agentId, context) => logTaskChange2(taskId, action, field2, oldValue, newValue, agentId, store, context),
+      addComment: (input, context) => addComment2(input, store, context),
+      getTaskHistory: async (taskId) => (await store.list("audit_history")).filter((entry2) => entry2.task_id === taskId).sort((a, b) => a.created_at.localeCompare(b.created_at)),
+      getRecentActivity: async (limit = 20) => (await store.list("audit_history")).sort((a, b) => b.created_at.localeCompare(a.created_at)).slice(0, limit)
+    },
+    sync: {
+      getTasksChangedSince: (since, filters) => getChangedSince(since, filters, store),
+      exportSnapshot: () => exportSnapshot(store),
+      importSnapshot: (snapshot, context) => importSnapshot(snapshot, store, context)
+    },
+    transaction: (fn) => fn(adapter)
+  };
+  return adapter;
+}
+
+class PostgresJsonRecordStore {
+  options;
+  service;
+  sourceMachineId;
+  tableName;
+  cursorTableName;
+  schemaReady = null;
+  constructor(options) {
+    this.options = options;
+    this.service = options.service ?? "todos";
+    this.sourceMachineId = options.sourceMachineId;
+    this.tableName = options.tableName ?? DEFAULT_TODOS_POSTGRES_SYNC_TABLE;
+    this.cursorTableName = options.cursorTableName ?? DEFAULT_TODOS_POSTGRES_CURSOR_TABLE;
+  }
+  async ensureSchema() {
+    this.schemaReady ??= (async () => {
+      for (const sql of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
+        await this.options.client.query(sql);
+      }
+    })();
+    await this.schemaReady;
+  }
+  async get(type, id) {
+    await this.ensureSchema();
+    const result = await this.options.client.query(`SELECT object_type, object_id, payload, updated_at
+       FROM ${this.tableName}
+       WHERE service = $1 AND object_type = $2 AND object_id = $3 AND deleted_at IS NULL
+       LIMIT 1`, [this.service, type, id]);
+    return result.rows[0] ? payloadRecord2(result.rows[0].payload) : null;
+  }
+  async list(type) {
+    return (await this.listRecords(type)).map((record) => record.payload);
+  }
+  async listRecords(type) {
+    await this.ensureSchema();
+    const result = await this.options.client.query(`SELECT object_type, object_id, payload, updated_at
+       FROM ${this.tableName}
+       WHERE service = $1 AND object_type = $2 AND deleted_at IS NULL
+       ORDER BY updated_at ASC, object_id ASC`, [this.service, type]);
+    return result.rows.map((row) => ({
+      objectId: row.object_id,
+      payload: payloadRecord2(row.payload),
+      updatedAt: stringValue2(row.updated_at) ?? new Date().toISOString()
+    }));
+  }
+  async upsert(type, value, context = {}) {
+    await this.ensureSchema();
+    const updatedAt = stringValue2(value.updated_at) ?? stringValue2(value.created_at) ?? new Date().toISOString();
+    await this.options.client.query(`INSERT INTO ${this.tableName} (
+        service, object_type, object_id, payload, updated_at,
+        deleted_at, source_machine_id, version
+      ) VALUES ($1, $2, $3, $4::jsonb, $5::timestamptz, NULL, $6, $7)
+      ON CONFLICT (service, object_type, object_id) DO UPDATE SET
+        payload = EXCLUDED.payload,
+        updated_at = EXCLUDED.updated_at,
+        deleted_at = NULL,
+        source_machine_id = EXCLUDED.source_machine_id,
+        version = EXCLUDED.version`, [
+      this.service,
+      type,
+      value.id,
+      JSON.stringify(value),
+      updatedAt,
+      context.requestId ?? this.sourceMachineId ?? null,
+      numberValue3(value.version)
+    ]);
+    return value;
+  }
+  async delete(type, id, context = {}) {
+    await this.ensureSchema();
+    const existing = await this.get(type, id);
+    if (!existing)
+      return false;
+    const timestamp2 = new Date().toISOString();
+    await this.options.client.query(`UPDATE ${this.tableName}
+       SET deleted_at = $4::timestamptz,
+           updated_at = $4::timestamptz,
+           source_machine_id = $5
+       WHERE service = $1 AND object_type = $2 AND object_id = $3`, [this.service, type, id, timestamp2, context.requestId ?? this.sourceMachineId ?? null]);
+    return true;
+  }
+  async getCursor(name) {
+    await this.ensureSchema();
+    const result = await this.options.client.query(`SELECT value FROM ${this.cursorTableName} WHERE service = $1 AND cursor_name = $2`, [this.service, name]);
+    return result.rows[0]?.value ?? null;
+  }
+  async setCursor(name, value) {
+    await this.ensureSchema();
+    await this.options.client.query(`INSERT INTO ${this.cursorTableName} (service, cursor_name, value, updated_at)
+       VALUES ($1, $2, $3, now())
+       ON CONFLICT (service, cursor_name) DO UPDATE SET
+         value = EXCLUDED.value,
+         updated_at = EXCLUDED.updated_at`, [this.service, name, value]);
+  }
+}
+async function createTask2(input, store, context) {
+  const timestamp2 = new Date().toISOString();
+  const shortId = input.project_id ? await nextTaskShortId2(input.project_id, store, context) : null;
+  const task2 = {
+    id: randomUUID2(),
+    short_id: shortId,
+    project_id: input.project_id ?? context?.projectId ?? null,
+    parent_id: input.parent_id ?? null,
+    plan_id: input.plan_id ?? null,
+    task_list_id: input.task_list_id ?? context?.taskListId ?? null,
+    title: input.title,
+    description: input.description ?? null,
+    status: input.status ?? "pending",
+    priority: input.priority ?? "medium",
+    agent_id: input.agent_id ?? null,
+    assigned_to: input.assigned_to ?? null,
+    session_id: input.session_id ?? context?.sessionId ?? null,
+    working_dir: input.working_dir ?? null,
+    tags: input.tags ?? [],
+    metadata: input.metadata ?? {},
+    version: 1,
+    locked_by: null,
+    locked_at: null,
+    created_at: timestamp2,
+    updated_at: timestamp2,
+    started_at: null,
+    completed_at: null,
+    due_at: input.due_at ?? null,
+    estimated_minutes: input.estimated_minutes ?? null,
+    actual_minutes: null,
+    requires_approval: input.requires_approval ?? false,
+    approved_by: null,
+    approved_at: null,
+    recurrence_rule: input.recurrence_rule ?? null,
+    recurrence_parent_id: input.recurrence_parent_id ?? null,
+    spawns_template_id: input.spawns_template_id ?? null,
+    confidence: input.confidence ?? null,
+    reason: input.reason ?? null,
+    spawned_from_session: input.spawned_from_session ?? null,
+    assigned_by: input.assigned_by ?? null,
+    assigned_from_project: input.assigned_from_project ?? null,
+    task_type: input.task_type ?? null,
+    cost_tokens: 0,
+    cost_usd: 0,
+    delegated_from: null,
+    delegation_depth: 0,
+    retry_count: input.retry_count ?? 0,
+    max_retries: input.max_retries ?? 0,
+    retry_after: input.retry_after ?? null,
+    sla_minutes: input.sla_minutes ?? null,
+    runner_id: null,
+    runner_started_at: null,
+    runner_completed_at: null,
+    current_step: null,
+    total_steps: null
+  };
+  await store.upsert("tasks", task2, context);
+  await logTaskChange2(task2.id, "created", "status", null, task2.status, task2.assigned_by ?? task2.agent_id, store, context);
+  return task2;
+}
+async function updateTask2(id, input, store) {
+  const existing = await requireRecord("tasks", id, store);
+  if (existing.version !== input.version) {
+    throw new Error(`Task ${id} version conflict: expected ${existing.version}, got ${input.version}`);
+  }
+  const task2 = {
+    ...existing,
+    ...definedPatch(input),
+    version: existing.version + 1,
+    updated_at: new Date().toISOString(),
+    tags: input.tags ?? existing.tags,
+    metadata: input.metadata ?? existing.metadata,
+    requires_approval: input.requires_approval ?? existing.requires_approval,
+    task_list_id: input.task_list_id ?? existing.task_list_id
+  };
+  await store.upsert("tasks", task2);
+  return task2;
+}
+async function startTask2(id, agentId, store) {
+  const task2 = await requireRecord("tasks", id, store);
+  return patchTask(task2, {
+    status: "in_progress",
+    assigned_to: task2.assigned_to ?? agentId,
+    agent_id: task2.agent_id ?? agentId,
+    locked_by: agentId,
+    locked_at: new Date().toISOString(),
+    started_at: task2.started_at ?? new Date().toISOString()
+  }, store);
+}
+async function completeTask2(id, agentId, options, store) {
+  const task2 = await requireRecord("tasks", id, store);
+  return patchTask(task2, {
+    status: "completed",
+    assigned_to: task2.assigned_to ?? agentId ?? null,
+    completed_at: options?.completed_at ?? new Date().toISOString(),
+    actual_minutes: task2.actual_minutes,
+    confidence: options?.confidence ?? task2.confidence
+  }, store);
+}
+async function failTask2(id, agentId, reason, options, store) {
+  const task2 = await requireRecord("tasks", id, store);
+  const failed = await patchTask(task2, {
+    status: "failed",
+    assigned_to: task2.assigned_to ?? agentId ?? null,
+    reason: reason ?? task2.reason,
+    retry_after: options?.retry_after ?? task2.retry_after
+  }, store);
+  if (!options?.retry)
+    return { task: failed };
+  const retryTask = await createTask2({
+    title: task2.title,
+    description: task2.description ?? undefined,
+    project_id: task2.project_id ?? undefined,
+    parent_id: task2.parent_id ?? undefined,
+    plan_id: task2.plan_id ?? undefined,
+    task_list_id: task2.task_list_id ?? undefined,
+    priority: task2.priority,
+    assigned_to: task2.assigned_to ?? undefined,
+    tags: task2.tags,
+    metadata: task2.metadata,
+    retry_count: task2.retry_count + 1,
+    max_retries: task2.max_retries,
+    reason: reason ?? undefined,
+    task_type: task2.task_type ?? undefined
+  }, store);
+  return { task: failed, retryTask };
+}
+async function patchTask(task2, patch, store) {
+  const updated = {
+    ...task2,
+    ...patch,
+    version: task2.version + 1,
+    updated_at: new Date().toISOString()
+  };
+  await store.upsert("tasks", updated);
+  return updated;
+}
+async function listTasks2(filter, store) {
+  let tasks = await store.list("tasks");
+  tasks = tasks.filter((task2) => taskMatchesFilter(task2, filter));
+  tasks.sort((a, b) => priorityRank(a.priority) - priorityRank(b.priority) || a.created_at.localeCompare(b.created_at));
+  const offset = filter.offset ?? 0;
+  const limit = filter.limit ?? tasks.length;
+  return tasks.slice(offset, offset + limit);
+}
+async function getNextTask2(filters, store) {
+  return (await listTasks2({ ...filters, status: "pending", limit: 1 }, store))[0] ?? null;
+}
+async function claimNextTask2(agentId, filters, store) {
+  const task2 = await getNextTask2(filters, store);
+  return task2 ? startTask2(task2.id, agentId, store) : null;
+}
+async function getActiveWork2(filters, store) {
+  const tasks = await listTasks2({ ...filters, status: "in_progress" }, store);
+  return tasks.map((task2) => ({
+    id: task2.id,
+    short_id: task2.short_id,
+    title: task2.title,
+    priority: task2.priority,
+    assigned_to: task2.assigned_to,
+    locked_by: task2.locked_by,
+    locked_at: task2.locked_at,
+    updated_at: task2.updated_at
+  }));
+}
+async function getChangedSince(since, filters, store) {
+  return (await listTasks2(filters ?? {}, store)).filter((task2) => task2.updated_at > since);
+}
+async function createProject2(input, store, context) {
+  const timestamp2 = new Date().toISOString();
+  const project = {
+    id: randomUUID2(),
+    name: input.name,
+    path: input.path,
+    description: input.description ?? null,
+    task_list_id: input.task_list_id ?? `todos-${slugify2(input.name)}`,
+    task_prefix: input.task_prefix ?? await generateProjectPrefix(input.name, store),
+    task_counter: 0,
+    created_at: timestamp2,
+    updated_at: timestamp2
+  };
+  return store.upsert("projects", project, context);
+}
+async function updateProject2(id, input, store) {
+  const project = await requireRecord("projects", id, store);
+  const updated = { ...project, ...definedPatch(input), updated_at: new Date().toISOString() };
+  return store.upsert("projects", updated);
+}
+async function createPlan2(input, store, context) {
+  const timestamp2 = new Date().toISOString();
+  return store.upsert("plans", {
+    id: randomUUID2(),
+    project_id: input.project_id ?? context?.projectId ?? null,
+    task_list_id: input.task_list_id ?? context?.taskListId ?? null,
+    agent_id: input.agent_id ?? context?.agentId ?? null,
+    name: input.name,
+    description: input.description ?? null,
+    status: input.status ?? "active",
+    created_at: timestamp2,
+    updated_at: timestamp2
+  }, context);
+}
+async function updatePlan2(id, input, store) {
+  const plan = await requireRecord("plans", id, store);
+  return store.upsert("plans", { ...plan, ...definedPatch(input), updated_at: new Date().toISOString() });
+}
+async function registerAgent2(input, store, context) {
+  const existing = (await store.list("agents")).find((agent2) => agent2.name === input.name && agent2.status !== "archived");
+  if (existing && !input.force && existing.session_id && existing.session_id !== input.session_id) {
+    return { conflict: true, message: `Agent name '${input.name}' is already active` };
+  }
+  const timestamp2 = new Date().toISOString();
+  const agent = {
+    id: existing?.id ?? randomUUID2().slice(0, 8),
+    name: input.name,
+    description: input.description ?? existing?.description ?? null,
+    role: input.role ?? existing?.role ?? null,
+    title: input.title ?? existing?.title ?? null,
+    level: input.level ?? existing?.level ?? null,
+    permissions: input.permissions ?? existing?.permissions ?? [],
+    reports_to: input.reports_to ?? existing?.reports_to ?? null,
+    org_id: input.org_id ?? existing?.org_id ?? null,
+    capabilities: input.capabilities ?? existing?.capabilities ?? [],
+    status: "active",
+    metadata: input.metadata ?? existing?.metadata ?? {},
+    created_at: existing?.created_at ?? timestamp2,
+    last_seen_at: timestamp2,
+    session_id: input.session_id ?? context?.sessionId ?? existing?.session_id ?? null,
+    working_dir: input.working_dir ?? existing?.working_dir ?? null,
+    active_project_id: input.project_id ?? context?.projectId ?? existing?.active_project_id ?? null
+  };
+  return store.upsert("agents", agent, context);
+}
+async function updateAgent2(id, input, store) {
+  const agent = await store.get("agents", id);
+  if (!agent)
+    return null;
+  return store.upsert("agents", {
+    ...agent,
+    ...definedPatch(input),
+    permissions: input.permissions ?? agent.permissions,
+    capabilities: input.capabilities ?? agent.capabilities,
+    metadata: input.metadata ?? agent.metadata,
+    last_seen_at: new Date().toISOString()
+  });
+}
+async function createTaskList2(input, store, context) {
+  const timestamp2 = new Date().toISOString();
+  return store.upsert("task_lists", {
+    id: randomUUID2(),
+    project_id: input.project_id ?? context?.projectId ?? null,
+    slug: input.slug ?? slugify2(input.name),
+    name: input.name,
+    description: input.description ?? null,
+    metadata: input.metadata ?? {},
+    created_at: timestamp2,
+    updated_at: timestamp2
+  }, context);
+}
+async function updateTaskList2(id, input, store) {
+  const list = await requireRecord("task_lists", id, store);
+  return store.upsert("task_lists", {
+    ...list,
+    ...definedPatch(input),
+    metadata: input.metadata ?? list.metadata,
+    updated_at: new Date().toISOString()
+  });
+}
+async function createTemplate2(input, store, context) {
+  const timestamp2 = new Date().toISOString();
+  return store.upsert("templates", {
+    id: randomUUID2(),
+    name: input.name,
+    title_pattern: input.title_pattern,
+    description: input.description ?? null,
+    priority: input.priority ?? "medium",
+    tags: input.tags ?? [],
+    variables: input.variables ?? [],
+    version: 1,
+    project_id: input.project_id ?? context?.projectId ?? null,
+    plan_id: input.plan_id ?? null,
+    metadata: input.metadata ?? {},
+    created_at: timestamp2
+  }, context);
+}
+async function updateTemplate2(id, input, store) {
+  const template = await store.get("templates", id);
+  if (!template)
+    return null;
+  return store.upsert("templates", {
+    ...template,
+    ...definedPatch(input),
+    tags: input.tags ?? template.tags,
+    variables: input.variables ?? template.variables,
+    metadata: input.metadata ?? template.metadata,
+    version: template.version + 1
+  });
+}
+async function logTaskChange2(taskId, action, field2, oldValue, newValue, agentId, store, context) {
+  const entry2 = {
+    id: randomUUID2(),
+    task_id: taskId,
+    action,
+    field: field2 ?? null,
+    old_value: oldValue ?? null,
+    new_value: newValue ?? null,
+    agent_id: agentId ?? context?.agentId ?? null,
+    created_at: new Date().toISOString()
+  };
+  return store.upsert("audit_history", entry2, context);
+}
+async function addComment2(input, store, context) {
+  const comment = {
+    id: randomUUID2(),
+    task_id: input.task_id,
+    agent_id: input.agent_id ?? context?.agentId ?? null,
+    session_id: input.session_id ?? context?.sessionId ?? null,
+    content: input.content,
+    type: input.type ?? "comment",
+    progress_pct: input.progress_pct ?? null,
+    created_at: new Date().toISOString()
+  };
+  return store.upsert("comments", comment, context);
+}
+async function exportSnapshot(store) {
+  return {
+    exportedAt: new Date().toISOString(),
+    source: "postgres",
+    tasks: await store.list("tasks"),
+    projects: await store.list("projects"),
+    plans: await store.list("plans"),
+    agents: await store.list("agents"),
+    taskLists: await store.list("task_lists"),
+    templates: await store.list("templates"),
+    auditHistory: await store.list("audit_history")
+  };
+}
+async function importSnapshot(snapshot, store, context) {
+  const result = { inserted: 0, updated: 0, skipped: 0, errors: [] };
+  const entries = [
+    ...snapshot.tasks.map((row) => ["tasks", row]),
+    ...snapshot.projects.map((row) => ["projects", row]),
+    ...snapshot.plans.map((row) => ["plans", row]),
+    ...snapshot.agents.map((row) => ["agents", row]),
+    ...snapshot.taskLists.map((row) => ["task_lists", row]),
+    ...snapshot.templates.map((row) => ["templates", row]),
+    ...snapshot.auditHistory.map((row) => ["audit_history", row])
+  ];
+  for (const [type, row] of entries) {
+    try {
+      const existing = await store.get(type, row.id);
+      await store.upsert(type, row, context);
+      if (existing)
+        result.updated += 1;
+      else
+        result.inserted += 1;
+    } catch (error) {
+      result.errors.push(error instanceof Error ? error.message : String(error));
+    }
+  }
+  return result;
+}
+async function requireRecord(type, id, store) {
+  const record = await store.get(type, id);
+  if (!record)
+    throw new Error(`${type} record not found: ${id}`);
+  return record;
+}
+async function nextTaskShortId2(projectId, store, context) {
+  const project = await store.get("projects", projectId);
+  if (!project?.task_prefix)
+    return null;
+  const counter = project.task_counter + 1;
+  await store.upsert("projects", {
+    ...project,
+    task_counter: counter,
+    updated_at: new Date().toISOString()
+  }, context);
+  return `${project.task_prefix}-${String(counter).padStart(5, "0")}`;
+}
+async function generateProjectPrefix(name, store) {
+  const base = (name.replace(/[^a-zA-Z0-9\s]/g, "").trim().split(/\s+/).filter(Boolean).slice(0, 3).map((word) => word[0]).join("") || name.slice(0, 3) || "TOD").toUpperCase();
+  const existing = new Set((await store.list("projects")).map((project) => project.task_prefix).filter(Boolean));
+  let candidate = base;
+  let suffix = 1;
+  while (existing.has(candidate)) {
+    suffix += 1;
+    candidate = `${base}${suffix}`;
+  }
+  return candidate;
+}
+function taskMatchesFilter(task2, filter) {
+  if (filter.ids && !filter.ids.includes(task2.id))
+    return false;
+  if (filter.project_id !== undefined && task2.project_id !== filter.project_id)
+    return false;
+  if (filter.parent_id !== undefined && task2.parent_id !== filter.parent_id)
+    return false;
+  if (filter.plan_id !== undefined && task2.plan_id !== filter.plan_id)
+    return false;
+  if (filter.task_list_id !== undefined && task2.task_list_id !== filter.task_list_id)
+    return false;
+  if (filter.status !== undefined && !matchesOne(task2.status, filter.status))
+    return false;
+  if (filter.priority !== undefined && !matchesOne(task2.priority, filter.priority))
+    return false;
+  if (filter.assigned_to !== undefined && task2.assigned_to !== filter.assigned_to)
+    return false;
+  if (filter.agent_id !== undefined && task2.agent_id !== filter.agent_id)
+    return false;
+  if (filter.session_id !== undefined && task2.session_id !== filter.session_id)
+    return false;
+  if (filter.tags?.length && !filter.tags.every((tag) => task2.tags.includes(tag)))
+    return false;
+  if (filter.has_recurrence !== undefined && Boolean(task2.recurrence_rule) !== filter.has_recurrence)
+    return false;
+  if (filter.include_subtasks !== true && task2.parent_id)
+    return false;
+  if (filter.task_type !== undefined && !matchesOne(task2.task_type ?? "", filter.task_type))
+    return false;
+  return true;
+}
+function matchesOne(value, expected) {
+  return Array.isArray(expected) ? expected.includes(value) : value === expected;
+}
+function priorityRank(priority) {
+  return { critical: 0, high: 1, medium: 2, low: 3 }[priority];
+}
+function slugify2(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "todos";
+}
+function definedPatch(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, entry2]) => entry2 !== undefined));
+}
+function payloadRecord2(value) {
+  if (typeof value === "string")
+    return JSON.parse(value);
+  if (value && typeof value === "object" && !Array.isArray(value))
+    return value;
+  throw new Error("Postgres storage payload must be a JSON object");
+}
+function stringValue2(value) {
+  return typeof value === "string" && value ? value : null;
+}
+function numberValue3(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) ? value : null;
+}
+
+// src/storage/factory.ts
+function createTodosStorageAdapter(options = {}) {
+  const config = options.config ?? loadTodosStorageConfig(options.env);
+  if (config.mode === "local")
+    return createLocalSqliteTodosStorageAdapter(options.local);
+  assertTodosRemoteStorageConfig(config);
+  const adapter = config.mode === "hybrid" ? options.hybridAdapter ?? createImplicitHybridAdapter(options) ?? options.remoteAdapter : options.remoteAdapter ?? createImplicitPostgresAdapter(options);
+  if (!adapter) {
+    throw new Error(`${config.mode} storage requires a repo-native remote adapter. ` + "Pass remoteAdapter/hybridAdapter after wiring Postgres RDS and S3 support.");
+  }
+  assertRemoteAdapterCapabilities(adapter, config.mode);
+  return adapter;
+}
+function createImplicitPostgresAdapter(options) {
+  if (!options.postgresClient)
+    return null;
+  return createPostgresTodosStorageAdapter({
+    client: options.postgresClient,
+    ...options.hybrid?.sourceMachineId ? { sourceMachineId: options.hybrid.sourceMachineId } : {}
+  });
+}
+function createImplicitHybridAdapter(options) {
+  if (!options.postgresClient && !options.postgresSyncStore)
+    return null;
+  return createHybridTodosStorageAdapter({
+    ...options.hybrid ?? {},
+    local: options.local,
+    postgresClient: options.postgresClient,
+    syncStore: options.postgresSyncStore
+  });
+}
+function assertRemoteAdapterCapabilities(adapter, mode) {
+  if (!adapter.capabilities.remotePersistence) {
+    throw new Error(`${mode} storage adapter must set capabilities.remotePersistence=true`);
+  }
+  if (mode === "hybrid" && !adapter.capabilities.localPersistence) {
+    throw new Error("hybrid storage adapter must also set capabilities.localPersistence=true");
+  }
+}
+// src/storage/s3-artifacts.ts
+import { createHash as createHash8, createHmac } from "crypto";
+function createTodosS3ArtifactStore(options) {
+  const requestFetch = options.fetch ?? fetch;
+  const now3 = options.now ?? (() => new Date);
+  return {
+    objectKey: (relativePath) => buildS3ObjectKey(options.config, relativePath),
+    objectUrl: (relativePath) => buildS3ObjectUrl(options.config, buildS3ObjectKey(options.config, relativePath)),
+    async putObject(input) {
+      const key = buildS3ObjectKey(options.config, input.key);
+      const url = buildS3ObjectUrl(options.config, key);
+      const body = normalizeBody(input.body);
+      const headers = {
+        "content-type": input.contentType ?? "application/octet-stream"
+      };
+      for (const [name, value] of Object.entries(input.metadata ?? {})) {
+        headers[`x-amz-meta-${name.toLowerCase()}`] = value;
+      }
+      const signed = signAwsV4Request({
+        method: "PUT",
+        url,
+        region: options.config.region ?? "us-east-1",
+        service: "s3",
+        headers,
+        body,
+        credentials: options.credentials,
+        now: now3()
+      });
+      const response = await requestFetch(url, { method: "PUT", headers: signed.headers, body });
+      if (!response.ok)
+        throw new Error(`S3 put failed with HTTP ${response.status}`);
+      return {
+        bucket: options.config.bucket,
+        key,
+        url: url.toString(),
+        etag: response.headers.get("etag") ?? undefined
+      };
+    },
+    async getObject(relativePath) {
+      const url = buildS3ObjectUrl(options.config, buildS3ObjectKey(options.config, relativePath));
+      const signed = signAwsV4Request({
+        method: "GET",
+        url,
+        region: options.config.region ?? "us-east-1",
+        service: "s3",
+        headers: {},
+        credentials: options.credentials,
+        now: now3()
+      });
+      const response = await requestFetch(url, { method: "GET", headers: signed.headers });
+      if (!response.ok)
+        throw new Error(`S3 get failed with HTTP ${response.status}`);
+      return response;
+    },
+    async deleteObject(relativePath) {
+      const url = buildS3ObjectUrl(options.config, buildS3ObjectKey(options.config, relativePath));
+      const signed = signAwsV4Request({
+        method: "DELETE",
+        url,
+        region: options.config.region ?? "us-east-1",
+        service: "s3",
+        headers: {},
+        credentials: options.credentials,
+        now: now3()
+      });
+      const response = await requestFetch(url, { method: "DELETE", headers: signed.headers });
+      if (!response.ok && response.status !== 404)
+        throw new Error(`S3 delete failed with HTTP ${response.status}`);
+    }
+  };
+}
+function buildS3ObjectKey(config, relativePath) {
+  const prefix = normalizeS3Prefix(config.prefix);
+  const key = normalizeS3Key(relativePath);
+  return `${prefix}${key}`;
+}
+function buildS3ObjectUrl(config, key) {
+  const encodedKey = encodeS3Path(key);
+  if (config.endpoint || config.forcePathStyle) {
+    const base = new URL(config.endpoint ?? `https://s3.${config.region ?? "us-east-1"}.amazonaws.com`);
+    base.pathname = `${trimTrailingSlash(base.pathname)}/${encodeURIComponent(config.bucket)}/${encodedKey}`;
+    return base;
+  }
+  return new URL(`https://${config.bucket}.s3.${config.region ?? "us-east-1"}.amazonaws.com/${encodedKey}`);
+}
+function signAwsV4Request(input) {
+  const amzDate = toAmzDate(input.now);
+  const dateStamp = amzDate.slice(0, 8);
+  const bodyHash = sha256Hex(input.body ?? new Uint8Array);
+  const headers = normalizeHeaders({
+    ...input.headers ?? {},
+    host: input.url.host,
+    "x-amz-content-sha256": bodyHash,
+    "x-amz-date": amzDate,
+    ...input.credentials.sessionToken ? { "x-amz-security-token": input.credentials.sessionToken } : {}
+  });
+  const signedHeaders = Object.keys(headers).sort().join(";");
+  const canonicalHeaders = Object.keys(headers).sort().map((name) => `${name}:${headers[name]}
+`).join("");
+  const canonicalRequest = [
+    input.method.toUpperCase(),
+    input.url.pathname || "/",
+    canonicalQuery(input.url),
+    canonicalHeaders,
+    signedHeaders,
+    bodyHash
+  ].join(`
+`);
+  const credentialScope = `${dateStamp}/${input.region}/${input.service}/aws4_request`;
+  const stringToSign = [
+    "AWS4-HMAC-SHA256",
+    amzDate,
+    credentialScope,
+    sha256Hex(canonicalRequest)
+  ].join(`
+`);
+  const signingKey = getSigningKey(input.credentials.secretAccessKey, dateStamp, input.region, input.service);
+  const signature = hmacHex(signingKey, stringToSign);
+  return {
+    headers: {
+      ...headers,
+      authorization: [
+        `AWS4-HMAC-SHA256 Credential=${input.credentials.accessKeyId}/${credentialScope}`,
+        `SignedHeaders=${signedHeaders}`,
+        `Signature=${signature}`
+      ].join(", ")
+    },
+    canonicalRequest,
+    stringToSign
+  };
+}
+function normalizeBody(body) {
+  if (typeof body === "string")
+    return Buffer.from(body);
+  if (body instanceof Uint8Array)
+    return body;
+  if (body instanceof ArrayBuffer)
+    return new Uint8Array(body);
+  throw new Error("S3 body must be a string, Uint8Array, Buffer, or ArrayBuffer");
+}
+function normalizeS3Prefix(value) {
+  const normalized = value.replace(/\\/g, "/").replace(/^\/+/, "");
+  if (!normalized || normalized.includes(".."))
+    throw new Error("Invalid S3 object key");
+  return normalized.endsWith("/") ? normalized : `${normalized}/`;
+}
+function normalizeS3Key(value) {
+  const normalized = value.replace(/\\/g, "/").replace(/^\/+/, "");
+  if (!normalized || normalized.includes("..") || normalized.endsWith("/"))
+    throw new Error("Invalid S3 object key");
+  return normalized;
+}
+function encodeS3Path(key) {
+  return key.split("/").filter(Boolean).map((part) => encodeURIComponent(part)).join("/");
+}
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+function canonicalQuery(url) {
+  return [...url.searchParams.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
+}
+function normalizeHeaders(headers) {
+  const entries = Object.entries(headers).map(([name, value]) => [
+    name.toLowerCase(),
+    value.trim().replace(/\s+/g, " ")
+  ]);
+  entries.sort((left, right) => left[0].localeCompare(right[0]));
+  return Object.fromEntries(entries);
+}
+function toAmzDate(date) {
+  return date.toISOString().replace(/[:-]|\.\d{3}/g, "");
+}
+function sha256Hex(value) {
+  return createHash8("sha256").update(value).digest("hex");
+}
+function hmac(key, value) {
+  return createHmac("sha256", key).update(value).digest();
+}
+function hmacHex(key, value) {
+  return createHmac("sha256", key).update(value).digest("hex");
+}
+function getSigningKey(secretAccessKey, dateStamp, region, service) {
+  const dateKey = hmac(`AWS4${secretAccessKey}`, dateStamp);
+  const dateRegionKey = hmac(dateKey, region);
+  const dateRegionServiceKey = hmac(dateRegionKey, service);
+  return hmac(dateRegionServiceKey, "aws4_request");
+}
+// src/storage/s3-artifact-sync.ts
+init_database();
+async function uploadRunArtifactsToS3(options) {
+  const db = options.db ?? getDatabase();
+  const now3 = options.now ?? (() => new Date);
+  const result = emptyResult();
+  for (const artifact of listRunArtifacts(db, options.filter)) {
+    try {
+      const metadata = artifact.metadata;
+      if (!options.filter?.includeAlreadySynced && remoteRef(metadata)) {
+        result.skipped += 1;
+        continue;
+      }
+      const content = exportStoredArtifactContent({
+        id: artifact.id,
+        path: artifact.path,
+        size_bytes: artifact.size_bytes,
+        sha256: artifact.sha256,
+        metadata
+      });
+      if (!content) {
+        result.skipped += 1;
+        continue;
+      }
+      const ref = await options.store.putObject({
+        key: content.relative_path,
+        body: Buffer.from(content.base64, "base64"),
+        contentType: mediaType(metadata) ?? "application/octet-stream",
+        metadata: {
+          artifact_id: artifact.id,
+          run_id: artifact.run_id,
+          task_id: artifact.task_id,
+          sha256: content.sha256
+        }
+      });
+      const remote = {
+        provider: "s3",
+        bucket: ref.bucket,
+        key: ref.key,
+        relative_path: content.relative_path,
+        url: ref.url,
+        sha256: content.sha256,
+        size_bytes: content.size_bytes,
+        uploaded_at: now3().toISOString()
+      };
+      updateArtifactMetadata(db, artifact.id, {
+        ...metadata,
+        remote_artifact_store: remote
+      });
+      result.uploaded += 1;
+      result.artifacts.push({
+        id: artifact.id,
+        run_id: artifact.run_id,
+        task_id: artifact.task_id,
+        key: ref.key,
+        sha256: content.sha256,
+        size_bytes: content.size_bytes
+      });
+    } catch (error) {
+      result.errors.push(`${artifact.id}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  return result;
+}
+function planRunArtifactsS3Sync(options) {
+  const db = options.db ?? getDatabase();
+  const plan = {
+    direction: options.direction,
+    dry_run: true,
+    no_network: true,
+    total: 0,
+    uploadable: 0,
+    downloadable: 0,
+    skipped: 0,
+    errors: [],
+    artifacts: []
+  };
+  for (const artifact of listRunArtifacts(db, options.filter)) {
+    plan.total += 1;
+    try {
+      const metadata = artifact.metadata;
+      const remote = remoteRef(metadata);
+      const integrity = verifyStoredArtifact({
+        id: artifact.id,
+        path: artifact.path,
+        size_bytes: artifact.size_bytes,
+        sha256: artifact.sha256,
+        metadata
+      });
+      if (options.direction === "upload") {
+        if (remote && !options.filter?.includeAlreadySynced) {
+          plan.skipped += 1;
+          plan.artifacts.push(planArtifact(artifact, "already_remote", remote));
+        } else if (integrity.status === "ok") {
+          plan.uploadable += 1;
+          plan.artifacts.push(planArtifact(artifact, "uploadable", remote));
+        } else {
+          plan.skipped += 1;
+          plan.artifacts.push(planArtifact(artifact, integrity.status === "metadata_only" ? "metadata_only" : "missing_local", remote));
+        }
+      } else if (!remote) {
+        plan.skipped += 1;
+        plan.artifacts.push(planArtifact(artifact, "missing_remote_ref", remote));
+      } else if (!options.force && integrity.status === "ok") {
+        plan.skipped += 1;
+        plan.artifacts.push(planArtifact(artifact, "local_ok", remote));
+      } else {
+        plan.downloadable += 1;
+        plan.artifacts.push(planArtifact(artifact, "downloadable", remote));
+      }
+    } catch (error) {
+      plan.errors.push(`${artifact.id}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  return plan;
+}
+async function downloadRunArtifactsFromS3(options) {
+  const db = options.db ?? getDatabase();
+  const now3 = options.now ?? (() => new Date);
+  const result = emptyResult();
+  for (const artifact of listRunArtifacts(db, options.filter)) {
+    try {
+      const metadata = artifact.metadata;
+      const remote = remoteRef(metadata);
+      if (!remote) {
+        result.skipped += 1;
+        continue;
+      }
+      const integrity = verifyStoredArtifact({
+        id: artifact.id,
+        path: artifact.path,
+        size_bytes: artifact.size_bytes,
+        sha256: artifact.sha256,
+        metadata
+      });
+      if (!options.force && integrity.status === "ok") {
+        result.skipped += 1;
+        continue;
+      }
+      const response = await options.store.getObject(remote.relative_path);
+      const bytes = Buffer.from(await response.arrayBuffer());
+      const report = importStoredArtifactContent({
+        artifact_id: artifact.id,
+        relative_path: remote.relative_path,
+        sha256: remote.sha256,
+        size_bytes: remote.size_bytes,
+        base64: bytes.toString("base64")
+      });
+      if (report.status !== "ok")
+        throw new Error(report.message);
+      updateArtifactMetadata(db, artifact.id, {
+        ...metadata,
+        remote_artifact_store: {
+          ...remote,
+          downloaded_at: now3().toISOString()
+        }
+      });
+      result.downloaded += 1;
+      result.artifacts.push({
+        id: artifact.id,
+        run_id: artifact.run_id,
+        task_id: artifact.task_id,
+        key: remote.key,
+        sha256: remote.sha256,
+        size_bytes: remote.size_bytes
+      });
+    } catch (error) {
+      result.errors.push(`${artifact.id}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  return result;
+}
+function emptyResult() {
+  return { uploaded: 0, downloaded: 0, skipped: 0, errors: [], artifacts: [] };
+}
+function planArtifact(artifact, status, remote) {
+  return {
+    id: artifact.id,
+    run_id: artifact.run_id,
+    task_id: artifact.task_id,
+    status,
+    sha256: artifact.sha256,
+    size_bytes: artifact.size_bytes,
+    ...remote ? { remote_key: remote.key } : {}
+  };
+}
+function listRunArtifacts(db, filter = {}) {
+  const conditions = [];
+  const values = [];
+  if (filter.runId) {
+    conditions.push("run_id = ?");
+    values.push(filter.runId);
+  }
+  if (filter.taskId) {
+    conditions.push("task_id = ?");
+    values.push(filter.taskId);
+  }
+  const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+  const limit = filter.limit && filter.limit > 0 ? " LIMIT ?" : "";
+  const rows = db.query(`SELECT * FROM task_run_artifacts ${where} ORDER BY created_at, id${limit}`).all(...limit ? [...values, String(filter.limit)] : values);
+  return rows.map((row) => ({ ...row, metadata: parseMetadata4(row.metadata) }));
+}
+function updateArtifactMetadata(db, id, metadata) {
+  db.run("UPDATE task_run_artifacts SET metadata = ? WHERE id = ?", [JSON.stringify(metadata), id]);
+}
+function parseMetadata4(value) {
+  if (!value)
+    return {};
+  if (typeof value === "object" && !Array.isArray(value))
+    return value;
+  if (typeof value !== "string")
+    return {};
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function remoteRef(metadata) {
+  const value = metadata["remote_artifact_store"];
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const record = value;
+  if (record.provider !== "s3")
+    return null;
+  if (typeof record.bucket !== "string" || typeof record.key !== "string" || typeof record.relative_path !== "string" || typeof record.url !== "string" || typeof record.sha256 !== "string" || typeof record.size_bytes !== "number") {
+    return null;
+  }
+  return record;
+}
+function mediaType(metadata) {
+  const store = metadata["artifact_store"];
+  if (!store || typeof store !== "object" || Array.isArray(store))
+    return null;
+  const value = store["media_type"];
+  return typeof value === "string" ? value : null;
+}
 // src/sdk/types.ts
 class TodosAPIError extends Error {
   status;
@@ -20333,6 +22352,132 @@ class TodosClient {
 function createClient(options) {
   return new TodosClient(options);
 }
+// src/lib/native-storage-status.ts
+function getNativeStorageStatus(env = process.env) {
+  const issues = [];
+  const warnings = [];
+  let config;
+  try {
+    config = loadTodosStorageConfig(env);
+  } catch (error) {
+    issues.push(error instanceof Error ? error.message : String(error));
+    config = fallbackConfig(env);
+  }
+  try {
+    assertTodosRemoteStorageConfig(config);
+  } catch (error) {
+    issues.push(error instanceof Error ? error.message : String(error));
+  }
+  const remoteEnabled = isTodosRemoteStorageEnabled(config);
+  const remoteFieldsConfigured = Boolean(config.database || config.objectStorage);
+  if (!remoteEnabled && remoteFieldsConfigured) {
+    warnings.push(`${TODOS_STORAGE_ENV.mode}=local ignores configured remote storage fields`);
+  }
+  if (remoteEnabled && !config.objectStorage) {
+    warnings.push(`${TODOS_STORAGE_ENV.s3Bucket} is not configured, so artifact sync will stay local`);
+  }
+  return {
+    ok: issues.length === 0,
+    service: "todos",
+    mode: config.mode,
+    local_default: config.mode === "local",
+    remote_enabled: remoteEnabled,
+    database: {
+      configured: Boolean(config.database),
+      provider: config.database?.provider ?? null,
+      redacted_url: redactDatabaseUrl(config.database?.url),
+      ssl: config.database?.ssl ?? null,
+      schema: config.database?.schema ?? null
+    },
+    object_storage: {
+      configured: Boolean(config.objectStorage),
+      provider: config.objectStorage?.provider ?? null,
+      bucket: config.objectStorage?.bucket ?? null,
+      prefix: config.objectStorage?.prefix ?? null,
+      region: config.objectStorage?.region ?? null,
+      endpoint_configured: Boolean(config.objectStorage?.endpoint),
+      force_path_style: config.objectStorage?.forcePathStyle ?? false
+    },
+    sync: {
+      batch_size: config.sync.batchSize,
+      dry_run: config.sync.dryRun
+    },
+    env: storageEnvStatus(env),
+    canonical: getCanonicalTodosRdsConfig(),
+    issues,
+    warnings,
+    no_network: true
+  };
+}
+function getNativeStorageSyncPlan(env = process.env, options = {}) {
+  const status = getNativeStorageStatus(env);
+  const steps = [
+    "Read local SQLite snapshot",
+    status.remote_enabled ? "Prepare Postgres sync table upserts" : "Skip remote database writes in local mode",
+    status.object_storage.configured ? "Plan S3 artifact object writes" : "Keep artifact storage local",
+    "Report planned changes without opening network connections"
+  ];
+  return {
+    ok: status.ok,
+    service: "todos",
+    dry_run: true,
+    no_network: true,
+    status,
+    postgres: {
+      required: status.remote_enabled,
+      configured: status.database.configured,
+      schema_sql: options.includeSchemaSql ? postgresTodosSyncSchemaSql() : []
+    },
+    object_storage: {
+      required: status.remote_enabled,
+      configured: status.object_storage.configured,
+      bucket: status.object_storage.bucket,
+      prefix: status.object_storage.prefix
+    },
+    steps
+  };
+}
+function redactDatabaseUrl(value) {
+  if (!value)
+    return null;
+  try {
+    const url = new URL(value);
+    if (url.username)
+      url.username = "***";
+    if (url.password)
+      url.password = "***";
+    return url.toString();
+  } catch {
+    return "(redacted)";
+  }
+}
+function storageEnvStatus(env) {
+  return Object.fromEntries(Object.entries(TODOS_STORAGE_ENV).map(([key, name]) => [
+    key,
+    {
+      name,
+      active_name: getTodosStorageEnvName(env, key),
+      configured: Boolean(clean2(env[getTodosStorageEnvName(env, key)]))
+    }
+  ]));
+}
+function fallbackConfig(env) {
+  const modeValue = clean2(env[TODOS_STORAGE_ENV.mode]);
+  const mode = modeValue === "remote" || modeValue === "hybrid" ? modeValue : "local";
+  return {
+    service: "todos",
+    mode,
+    sync: {
+      batchSize: 500,
+      dryRun: false
+    }
+  };
+}
+function clean2(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+
 // src/index.ts
 init_database();
 
@@ -21101,7 +23246,7 @@ function scoreHealth(scope, scopeId, db) {
          JOIN tasks dep ON dep.id = td.depends_on
          WHERE td.task_id = ? AND dep.status != 'completed'`).all(task2.id);
     return { id: task2.id, short_id: task2.short_id, title: redactEvidenceText(task2.title), blockers };
-  }).filter((entry) => entry.blockers.length > 0);
+  }).filter((entry2) => entry2.blockers.length > 0);
   const overdue = tasks.filter((task2) => activeTaskIds.has(task2.id) && Boolean(task2.due_at && task2.due_at < generatedAt)).map((task2) => ({ id: task2.id, short_id: task2.short_id, title: redactEvidenceText(task2.title), due_at: task2.due_at }));
   const failedChecks = d.query(`SELECT tv.id, tv.task_id, tv.command, tv.run_at
      FROM task_verifications tv
@@ -21656,7 +23801,7 @@ function getProjectByPathForBootstrap(path, db) {
 }
 // src/db/api-keys.ts
 init_database();
-import { createHash as createHash8, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHash as createHash9, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 function rowToRecord(row) {
   return {
     id: row.id,
@@ -21670,7 +23815,7 @@ function rowToRecord(row) {
   };
 }
 function hashApiKey(key) {
-  return createHash8("sha256").update(key).digest("hex");
+  return createHash9("sha256").update(key).digest("hex");
 }
 function safeEqualHex(a, b) {
   if (a.length !== b.length)
@@ -22023,11 +24168,11 @@ function exportArtifacts(filter = {}, db, dbPath) {
   }));
   return buildArtifactExportManifest(artifacts, dbPath);
 }
-function importArtifactFromManifestEntry(entry, db, dbPath) {
-  const artifact = addArtifact(entry, db, dbPath);
-  if (entry.content_hash && artifact.content_hash !== entry.content_hash) {
+function importArtifactFromManifestEntry(entry2, db, dbPath) {
+  const artifact = addArtifact(entry2, db, dbPath);
+  if (entry2.content_hash && artifact.content_hash !== entry2.content_hash) {
     purgeArtifact(artifact.id, db, dbPath);
-    throw new Error(`Content hash mismatch for ${entry.name}: expected ${entry.content_hash}, got ${artifact.content_hash}`);
+    throw new Error(`Content hash mismatch for ${entry2.name}: expected ${entry2.content_hash}, got ${artifact.content_hash}`);
   }
   return artifact;
 }
@@ -22038,11 +24183,16 @@ var FORBIDDEN_HOSTED_HOSTS = [
   "www.todos.md",
   "preview.todos.md",
   "pay.hasna.tools",
-  "platform-todos"
+  ["platform", "todos"].join("-")
 ];
+var PRIVATE_PLATFORM_ORG = ["hasna", "studio"].join("");
+var HOSTED_TODOS_PACKAGE = ["platform", "todos"].join("-");
 var FORBIDDEN_WEB_PATTERNS = [
   { name: "hosted todos.md API", pattern: /https?:\/\/(?:www\.)?todos\.md/i },
-  { name: "platform-todos package", pattern: /@hasnastudio\/platform-todos|hasnastudio\/platform-todos/i },
+  {
+    name: "hosted platform package",
+    pattern: new RegExp(`@${PRIVATE_PLATFORM_ORG}/${HOSTED_TODOS_PACKAGE}|${PRIVATE_PLATFORM_ORG}/${HOSTED_TODOS_PACKAGE}`, "i")
+  },
   { name: "browser sign-in flow", pattern: /\/sign-?in\b|\/login\b.*(?:oauth|session|auth)/i },
   { name: "Stripe billing UI", pattern: /\bstripe\.(?:com|js)\b|\bcheckout\.sessions?\b/i },
   { name: "hosted OAuth redirect", pattern: /oauth.*redirect.*todos\.md/i }
@@ -22095,7 +24245,7 @@ function getHeadlessBoundaryManifest() {
     notes: [
       "Use todos CLI or todos-mcp for agent workflows.",
       "todos serve exposes a local-only REST API on 127.0.0.1 \u2014 not a hosted SaaS.",
-      "Cloud sync via @hasna/cloud is explicit opt-in from CLI/MCP, never from the dashboard."
+      "Remote sync is explicit opt-in from CLI/MCP, never from the dashboard."
     ]
   };
 }
@@ -22832,10 +24982,10 @@ async function runVerificationProvider(input, db) {
   }
   return result;
 }
-function verificationRowToRecord(row) {
+function taskVerificationRowToRecord(row) {
   return {
     id: String(row["id"]),
-    task_id: String(row["task_id"]),
+    task_id: row["task_id"] ?? null,
     command: String(row["command"] ?? ""),
     status: row["status"] ?? "unknown",
     output_summary: row["output_summary"] ?? null,
@@ -22853,13 +25003,65 @@ function verificationRowToRecord(row) {
     }
   };
 }
+function portableVerificationRowToRecord(row) {
+  let evidence = {};
+  try {
+    evidence = row["evidence"] ? JSON.parse(String(row["evidence"])) : {};
+  } catch {
+    evidence = {};
+  }
+  return {
+    id: String(row["id"]),
+    task_id: row["task_id"] ?? null,
+    command: String(row["provider_name"] ?? "manual"),
+    status: row["status"] ?? "unknown",
+    output_summary: row["summary"] ?? null,
+    artifact_path: row["artifact_id"] ?? null,
+    agent_id: evidence["agent_id"] ?? null,
+    run_at: String(row["completed_at"] ?? row["started_at"] ?? row["created_at"] ?? ""),
+    created_at: String(row["created_at"] ?? ""),
+    evidence: {
+      ...evidence,
+      provider_name: row["provider_name"] ?? evidence["provider_name"] ?? null,
+      provider_type: row["provider_type"] ?? evidence["provider_type"] ?? "local",
+      status: row["status"] ?? evidence["status"] ?? "unknown",
+      summary: row["summary"] ?? evidence["summary"] ?? null,
+      artifact_id: row["artifact_id"] ?? evidence["artifact_id"] ?? null
+    }
+  };
+}
 function getVerificationRecord(id, db) {
   const d = db || getDatabase();
+  try {
+    const portable = d.query("SELECT * FROM verification_records WHERE id = ?").get(id);
+    if (portable)
+      return portableVerificationRowToRecord(portable);
+  } catch {}
   const row = d.query("SELECT * FROM task_verifications WHERE id = ?").get(id);
-  return row ? verificationRowToRecord(row) : null;
+  return row ? taskVerificationRowToRecord(row) : null;
 }
 function listVerificationRecords(filter = {}, db) {
   const d = db || getDatabase();
+  const records = [];
+  try {
+    const conditions2 = [];
+    const params2 = [];
+    if (filter.task_id) {
+      conditions2.push("task_id = ?");
+      params2.push(filter.task_id);
+    }
+    if (filter.status) {
+      conditions2.push("status = ?");
+      params2.push(filter.status);
+    }
+    if (filter.provider) {
+      conditions2.push("provider_name = ?");
+      params2.push(filter.provider);
+    }
+    const where2 = conditions2.length > 0 ? `WHERE ${conditions2.join(" AND ")}` : "";
+    const rows2 = d.query(`SELECT * FROM verification_records ${where2} ORDER BY COALESCE(completed_at, started_at, created_at) DESC, created_at DESC`).all(...params2);
+    records.push(...rows2.map(portableVerificationRowToRecord));
+  } catch {}
   const conditions = [];
   const params = [];
   if (filter.task_id) {
@@ -22875,9 +25077,21 @@ function listVerificationRecords(filter = {}, db) {
     params.push(filter.status);
   }
   const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
-  const limitClause = filter.limit && filter.limit > 0 ? ` LIMIT ${Math.floor(filter.limit)}` : "";
-  const rows = d.query(`SELECT * FROM task_verifications ${where} ORDER BY run_at DESC, created_at DESC${limitClause}`).all(...params);
-  return rows.map(verificationRowToRecord);
+  const rows = d.query(`SELECT * FROM task_verifications ${where} ORDER BY run_at DESC, created_at DESC`).all(...params);
+  records.push(...rows.map(taskVerificationRowToRecord));
+  let filtered = records;
+  if (filter.agent_id) {
+    filtered = filtered.filter((record) => record.agent_id === filter.agent_id || record.evidence.agent_id === filter.agent_id);
+  }
+  if (filter.run_record_id) {
+    filtered = filtered.filter((record) => record.evidence.run_record_id === filter.run_record_id);
+  }
+  filtered.sort((a, b) => {
+    const at = Date.parse(a.run_at || a.created_at || "");
+    const bt = Date.parse(b.run_at || b.created_at || "");
+    return (Number.isFinite(bt) ? bt : 0) - (Number.isFinite(at) ? at : 0);
+  });
+  return filter.limit && filter.limit > 0 ? filtered.slice(0, Math.floor(filter.limit)) : filtered;
 }
 // src/lib/verification-evidence.ts
 init_database();
@@ -22915,24 +25129,24 @@ function toPortableEvidence(record) {
     id: record.id,
     task_id: record.task_id,
     run_record_id: ev.run_record_id ?? null,
-    agent_id: ev.agent_id ?? verifier.agent_id ?? null,
-    provider_name: record.provider_name,
-    provider_type: record.provider_type,
+    agent_id: record.agent_id ?? ev.agent_id ?? verifier.agent_id ?? null,
+    provider_name: ev.provider_name ?? ev.provider ?? record.command,
+    provider_type: ev.provider_type ?? "local",
     status: record.status,
-    summary: record.summary,
+    summary: ev.summary ?? record.output_summary ?? record.command,
     confidence: typeof ev.confidence === "number" ? ev.confidence : null,
     commands: ev.commands ?? [],
     test_results: ev.test_results ?? [],
     links: ev.links ?? [],
     artifact_ids: [
       ...ev.artifact_ids ?? [],
-      ...record.artifact_id ? [record.artifact_id] : []
+      ...record.artifact_path ? [record.artifact_path] : []
     ],
     log_excerpt: ev.log_excerpt ?? ev.stdout?.slice(-2000) ?? null,
     screenshot_paths: ev.screenshot_paths ?? [],
     verifier,
-    started_at: record.started_at,
-    completed_at: record.completed_at,
+    started_at: record.run_at,
+    completed_at: record.run_at,
     created_at: record.created_at,
     metadata: ev.metadata ?? {}
   };
@@ -23316,7 +25530,10 @@ function buildResourceSnapshot(uri, staleMs = DEFAULT_STALE_MS) {
   };
 }
 function isSnapshotStale(snapshot, now3 = new Date) {
-  return now3.toISOString() > snapshot.stale_after;
+  const staleAt = Date.parse(snapshot.stale_after);
+  if (!Number.isFinite(staleAt))
+    return true;
+  return now3.getTime() >= staleAt;
 }
 function subscribeResource(uri, agentId) {
   const key = `${uri}:${agentId || "*"}`;
@@ -23655,7 +25872,7 @@ async function runNextAgentDispatch(input = {}, db) {
   return { run_id: next.run.id, task_id: next.run.task_id, command, dry_run: false, status, exit_code: exitCode, output_summary: outputSummary };
 }
 function listAgentRuns(filter = {}, db) {
-  let runs = listAgentRunQueue(db);
+  let runs = listAgentRunQueue(db).map(toAgentRun);
   if (filter.task_id)
     runs = runs.filter((r) => r.task_id === filter.task_id);
   if (filter.status)
@@ -23667,11 +25884,12 @@ function listAgentRuns(filter = {}, db) {
   return runs;
 }
 function retryAgentRun(runId, db) {
-  return retryAgentRunDispatch(runId, db);
+  return toAgentRun(retryAgentRunDispatch(runId, db));
 }
 var AGENT_RUN_SCHEMA_VERSION = "todos.agent_run.v1";
 function toAgentRun(item) {
   const md = item.run.metadata || {};
+  const maxRetries = typeof md["agent_run_max_retries"] === "number" ? md["agent_run_max_retries"] : 3;
   return {
     id: item.run.id,
     task_id: item.run.task_id,
@@ -23679,7 +25897,10 @@ function toAgentRun(item) {
     adapter: item.dispatcher.adapter ?? null,
     status: item.dispatcher.state,
     command: item.dispatcher.command ?? null,
+    error: item.dispatcher.last_error ?? null,
     evidence: md["agent_run_evidence"] ?? {},
+    retry_count: Math.max(0, item.dispatcher.attempt - 1),
+    max_retries: maxRetries,
     queued_at: item.dispatcher.queued_at,
     started_at: item.dispatcher.started_at ?? null,
     completed_at: item.dispatcher.completed_at ?? null,
@@ -24016,11 +26237,11 @@ function looksLikeFile(value) {
 }
 function parseMention(raw) {
   const input = raw.trim();
-  const clean = input.startsWith("@") ? input.slice(1) : input;
-  if (/^#\d+$/.test(clean)) {
-    return { input, kind: "pull_request", target: clean.slice(1), explicit: true };
+  const clean3 = input.startsWith("@") ? input.slice(1) : input;
+  if (/^#\d+$/.test(clean3)) {
+    return { input, kind: "pull_request", target: clean3.slice(1), explicit: true };
   }
-  const prefixMatch = clean.match(/^([a-z_]+):(.*)$/i);
+  const prefixMatch = clean3.match(/^([a-z_]+):(.*)$/i);
   if (prefixMatch && PREFIXES[prefixMatch[1].toLowerCase()]) {
     const kind = PREFIXES[prefixMatch[1].toLowerCase()];
     const target = prefixMatch[2].trim();
@@ -24030,13 +26251,13 @@ function parseMention(raw) {
     }
     return { input, kind, target, explicit: true };
   }
-  if (looksLikeCommit(clean))
-    return { input, kind: "commit", target: clean, explicit: false };
-  if (looksLikeFile(clean)) {
-    const parsed = parseLineAnchor(clean);
+  if (looksLikeCommit(clean3))
+    return { input, kind: "commit", target: clean3, explicit: false };
+  if (looksLikeFile(clean3)) {
+    const parsed = parseLineAnchor(clean3);
     return { input, kind: "file", target: parsed.path, line: parsed.line, explicit: false };
   }
-  return { input, kind: "unknown", target: clean, explicit: false };
+  return { input, kind: "unknown", target: clean3, explicit: false };
 }
 function runGit2(root, args) {
   try {
@@ -24090,20 +26311,20 @@ function resolveFile(parsed, workspace) {
 function walkSourceFiles(root, current = root, files = []) {
   if (files.length >= 5000)
     return files;
-  for (const entry of readdirSync2(current, { withFileTypes: true })) {
-    if (entry.name.startsWith(".") && ![".github"].includes(entry.name)) {
-      if (SKIP_DIRS.has(entry.name))
+  for (const entry2 of readdirSync2(current, { withFileTypes: true })) {
+    if (entry2.name.startsWith(".") && ![".github"].includes(entry2.name)) {
+      if (SKIP_DIRS.has(entry2.name))
         continue;
     }
-    const absolutePath = join11(current, entry.name);
-    if (entry.isDirectory()) {
-      if (!SKIP_DIRS.has(entry.name))
+    const absolutePath = join11(current, entry2.name);
+    if (entry2.isDirectory()) {
+      if (!SKIP_DIRS.has(entry2.name))
         walkSourceFiles(root, absolutePath, files);
       continue;
     }
-    if (!entry.isFile())
+    if (!entry2.isFile())
       continue;
-    const extension = `.${basename3(entry.name).split(".").pop() || ""}`;
+    const extension = `.${basename3(entry2.name).split(".").pop() || ""}`;
     if (SOURCE_EXTENSIONS.has(extension) && statSync4(absolutePath).size <= 512 * 1024) {
       files.push(absolutePath);
     }
@@ -24420,7 +26641,7 @@ function getTaskLabels(taskId, db) {
 // src/db/custom-fields.ts
 init_database();
 var CUSTOM_FIELD_TYPES = ["text", "number", "boolean", "date", "enum"];
-function slugify2(name) {
+function slugify3(name) {
   return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 }
 function rowToDef(row) {
@@ -24441,7 +26662,7 @@ function createCustomFieldDefinition(input, db) {
   const d = db || getDatabase();
   const id = uuid();
   const ts = now();
-  const slug = slugify2(input.name);
+  const slug = slugify3(input.name);
   d.run(`INSERT INTO custom_field_definitions (
       id, project_id, name, slug, field_type, options, required, default_value, sort_order, created_at, updated_at
     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
@@ -24463,7 +26684,7 @@ function getCustomFieldDefinition(idOrSlug, db) {
   const d = db || getDatabase();
   let row = d.query("SELECT * FROM custom_field_definitions WHERE id = ?").get(idOrSlug);
   if (!row)
-    row = d.query("SELECT * FROM custom_field_definitions WHERE slug = ?").get(slugify2(idOrSlug));
+    row = d.query("SELECT * FROM custom_field_definitions WHERE slug = ?").get(slugify3(idOrSlug));
   return row ? rowToDef(row) : null;
 }
 function listCustomFieldDefinitions(projectId, db) {
@@ -25157,11 +27378,10 @@ function acquireTaskLease(taskId, agentId, ttlMinutes = DEFAULT_LEASE_MINUTES, d
   const d = db || getDatabase();
   const lock = lockTask(taskId, agentId, d);
   if (!lock.success) {
-    const task2 = getTask(taskId, d);
     const existing = d.query("SELECT * FROM task_leases WHERE task_id = ?").get(taskId);
     return {
       success: false,
-      conflict: formatLockConflict(taskId, lock.locked_by, lock.locked_at, existing?.expires_at ?? null)
+      conflict: formatLockConflict(taskId, lock.locked_by ?? "unknown", lock.locked_at ?? null, existing?.expires_at ?? null)
     };
   }
   const ts = now();
@@ -25230,7 +27450,7 @@ function stealTaskLease(taskId, agentId, options = {}, db) {
     if (stolen?.id === taskId)
       acquired = true;
     else
-      return { success: false, conflict: formatLockConflict(taskId, lock.locked_by, lock.locked_at, lease?.expires_at ?? null) };
+      return { success: false, conflict: formatLockConflict(taskId, lock.locked_by ?? "unknown", lock.locked_at ?? null, lease?.expires_at ?? null) };
   }
   if (!acquired) {
     return { success: false, conflict: formatLockConflict(taskId, previous ?? "unknown", task2.locked_at) };
@@ -25375,19 +27595,19 @@ function getParityReport() {
   let cliOnly = 0;
   let mcpOnly = 0;
   let documentedGaps = 0;
-  for (const entry of CLI_MCP_PARITY_MANIFEST) {
-    byDomain[entry.domain] = byDomain[entry.domain] ?? { matched: 0, gaps: 0 };
-    if (entry.cli && entry.mcp) {
+  for (const entry2 of CLI_MCP_PARITY_MANIFEST) {
+    byDomain[entry2.domain] = byDomain[entry2.domain] ?? { matched: 0, gaps: 0 };
+    if (entry2.cli && entry2.mcp) {
       matched++;
-      byDomain[entry.domain].matched++;
-    } else if (entry.cli && !entry.mcp) {
+      byDomain[entry2.domain].matched++;
+    } else if (entry2.cli && !entry2.mcp) {
       cliOnly++;
       documentedGaps++;
-      byDomain[entry.domain].gaps++;
-    } else if (!entry.cli && entry.mcp) {
+      byDomain[entry2.domain].gaps++;
+    } else if (!entry2.cli && entry2.mcp) {
       mcpOnly++;
     }
-    if (entry.gap)
+    if (entry2.gap)
       documentedGaps++;
   }
   return {
@@ -25404,16 +27624,16 @@ function getParityReport() {
 function validateParityManifest() {
   const issues = [];
   const seen = new Set;
-  for (const entry of CLI_MCP_PARITY_MANIFEST) {
-    const key = `${entry.domain}:${entry.operation}`;
+  for (const entry2 of CLI_MCP_PARITY_MANIFEST) {
+    const key = `${entry2.domain}:${entry2.operation}`;
     if (seen.has(key))
       issues.push(`Duplicate parity entry: ${key}`);
     seen.add(key);
-    if (!entry.cli && !entry.mcp && !entry.gap) {
+    if (!entry2.cli && !entry2.mcp && !entry2.gap) {
       issues.push(`Entry ${key} has no cli, mcp, or gap documentation`);
     }
-    if (entry.cli && !entry.mcp && !entry.gap || !entry.cli && entry.mcp && !entry.gap) {
-      if (!entry.notes) {
+    if (entry2.cli && !entry2.mcp && !entry2.gap || !entry2.cli && entry2.mcp && !entry2.gap) {
+      if (!entry2.notes) {
         issues.push(`Entry ${key} is one-sided without gap or notes`);
       }
     }
@@ -25471,7 +27691,7 @@ var PROFILE_META = {
   },
   admin: {
     name: "admin",
-    description: "Full access including migrations and cloud bridge tools",
+    description: "Full access including migrations and storage bridge tools",
     surfaces: ["cli", "mcp", "sdk", "http"],
     allows_mutations: true,
     allows_admin: true
@@ -25694,7 +27914,6 @@ var AGENT_ADAPTER_DOCS = {
     display_name: "OpenAI Codex CLI",
     install: {
       bun: "bun install -g @hasna/todos",
-      npm: "npm install -g @hasna/todos",
       verify: "todos --version && which todos-mcp"
     },
     mcp: {
@@ -25972,7 +28191,7 @@ function getAdapterDocsFingerprint() {
 init_database();
 import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
 import { basename as basename4 } from "path";
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 init_secret_redaction();
 var INBOX_INTAKE_SCHEMA = "todos.inbox_intake.v1";
 var INTAKE_SOURCE_TYPES = [
@@ -25985,7 +28204,7 @@ var INTAKE_SOURCE_TYPES = [
 ];
 var INTAKE_TRIAGE_STATUSES = ["preview", "triaged", "duplicate", "created"];
 function fingerprint2(text) {
-  return createHash9("sha256").update(text).digest("hex").slice(0, 16);
+  return createHash10("sha256").update(text).digest("hex").slice(0, 16);
 }
 function loadRawContent(input) {
   if (input.github_url) {
@@ -26136,7 +28355,7 @@ ${parsed.failures.map((f) => `- ${f}`).join(`
       return {
         title: titleOverride ?? raw.split(/\n/)[0].slice(0, 200),
         description: raw.includes(`
-`) ? raw.slice(0, 8000) : undefined,
+`) ? raw.slice(0, 8000) : "",
         extra: {}
       };
   }
@@ -26153,10 +28372,9 @@ function findIntakeDuplicate(createInput, sourceFingerprint, db) {
       return { task_id: t.id, short_id: t.short_id, title: t.title, score: 1 };
     }
   }
-  const candidates = findDuplicateCandidates({ min_score: 0.75, limit: 5 }, db);
+  const candidates = findDuplicateCandidates({ threshold: 0.75, limit: 5 }, db);
   for (const c of candidates) {
-    const otherId = c.task_a_id;
-    const other = getTask(otherId, db);
+    const other = c.primary_task;
     if (!other)
       continue;
     const normNew = createInput.title.toLowerCase();
@@ -26655,7 +28873,7 @@ var JIRA_PRIORITY = {
   low: "low",
   lowest: "low"
 };
-function asRecord2(value) {
+function asRecord3(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function labelNames2(labels) {
@@ -26664,7 +28882,7 @@ function labelNames2(labels) {
   return labels.map((label) => {
     if (typeof label === "string")
       return label;
-    const rec = asRecord2(label);
+    const rec = asRecord3(label);
     return typeof rec?.name === "string" ? rec.name : null;
   }).filter((name) => !!name);
 }
@@ -26690,7 +28908,7 @@ function priorityFromLinear(value) {
   return "medium";
 }
 function priorityFromJira(value) {
-  const rec = asRecord2(value);
+  const rec = asRecord3(value);
   const name = typeof rec?.name === "string" ? rec.name.toLowerCase() : "";
   return JIRA_PRIORITY[name] ?? "medium";
 }
@@ -26732,10 +28950,10 @@ function normalizeLinearIssue(raw) {
   const title = typeof raw.title === "string" ? raw.title.trim() : "";
   if (!identifier || !title)
     return null;
-  const stateRec = asRecord2(raw.state);
+  const stateRec = asRecord3(raw.state);
   const state = typeof raw.state === "string" ? raw.state : typeof stateRec?.name === "string" ? stateRec.name : undefined;
   const url = typeof raw.url === "string" ? raw.url : undefined;
-  const labelSource = asRecord2(raw.labels);
+  const labelSource = asRecord3(raw.labels);
   const labels = labelNames2(Array.isArray(labelSource?.nodes) ? labelSource.nodes : raw.labels);
   return {
     source: "linear",
@@ -26758,16 +28976,16 @@ function normalizeLinearIssue(raw) {
 }
 function normalizeJiraIssue(raw) {
   const key = typeof raw.key === "string" ? raw.key.trim() : "";
-  const fields = asRecord2(raw.fields);
+  const fields = asRecord3(raw.fields);
   if (!key || !fields)
     return null;
   const summary = typeof fields.summary === "string" ? fields.summary.trim() : "";
   if (!summary)
     return null;
-  const statusRec = asRecord2(fields.status);
+  const statusRec = asRecord3(fields.status);
   const status = typeof statusRec?.name === "string" ? statusRec.name : undefined;
   const labels = labelNames2(fields.labels);
-  const description = typeof fields.description === "string" ? fields.description.slice(0, 8000) : typeof asRecord2(fields.description)?.content === "string" ? String(asRecord2(fields.description)?.content).slice(0, 8000) : undefined;
+  const description = typeof fields.description === "string" ? fields.description.slice(0, 8000) : typeof asRecord3(fields.description)?.content === "string" ? String(asRecord3(fields.description)?.content).slice(0, 8000) : undefined;
   return {
     source: "jira",
     external_ref: `jira:${key}`,
@@ -26781,13 +28999,13 @@ function normalizeJiraIssue(raw) {
     raw_metadata: {
       jira_key: key,
       jira_status: status,
-      jira_priority: asRecord2(fields.priority)?.name,
+      jira_priority: asRecord3(fields.priority)?.name,
       jira_id: raw.id
     }
   };
 }
 function looksLikeJiraIssue(raw) {
-  return typeof raw.key === "string" && !!asRecord2(raw.fields)?.summary;
+  return typeof raw.key === "string" && !!asRecord3(raw.fields)?.summary;
 }
 function looksLikeLinearIssue(raw) {
   if (typeof raw.identifier !== "string")
@@ -26814,17 +29032,17 @@ function detectIssueExportSource(data) {
 }
 function extractIssueRecords(data) {
   if (Array.isArray(data)) {
-    return data.map(asRecord2).filter((item) => !!item);
+    return data.map(asRecord3).filter((item) => !!item);
   }
-  const root = asRecord2(data);
+  const root = asRecord3(data);
   if (!root)
     return [];
-  const dataNode = asRecord2(root.data);
-  const issuesNode = asRecord2(root.issues);
-  const nestedIssues = asRecord2(dataNode?.issues);
+  const dataNode = asRecord3(root.data);
+  const issuesNode = asRecord3(root.issues);
+  const nestedIssues = asRecord3(dataNode?.issues);
   const nodes = nestedIssues?.nodes ?? issuesNode?.nodes ?? root.issues ?? dataNode?.issues;
   if (Array.isArray(nodes)) {
-    return nodes.map(asRecord2).filter((item) => !!item);
+    return nodes.map(asRecord3).filter((item) => !!item);
   }
   if (looksLikeGitHubIssue(root) || looksLikeLinearIssue(root) || looksLikeJiraIssue(root)) {
     return [root];
@@ -26880,9 +29098,9 @@ function findIssueDuplicate(createInput, db) {
       return { task_id: task2.id, short_id: task2.short_id, title: task2.title, score: 1 };
     }
   }
-  const candidates = findDuplicateCandidates({ min_score: 0.85, limit: 5 }, db);
+  const candidates = findDuplicateCandidates({ threshold: 0.85, limit: 5 }, db);
   for (const candidate of candidates) {
-    const other = getTask(candidate.task_a_id, db);
+    const other = candidate.primary_task;
     if (!other)
       continue;
     if (other.title.toLowerCase() === createInput.title.toLowerCase()) {
@@ -27260,7 +29478,10 @@ import { existsSync as existsSync17, readFileSync as readFileSync15, readdirSync
 import { join as join13, relative as relative5 } from "path";
 var RELEASE_CHECK_SCHEMA = "todos.release_check.v1";
 var FORBIDDEN_DIST_PATTERNS = [
-  { id: "platform_todos", pattern: /platform-todos|@hasnastudio\/platform-todos/i },
+  {
+    id: "hosted_platform_todos",
+    pattern: new RegExp(`${["platform", "todos"].join("-")}|@${["hasna", "studio"].join("")}/${["platform", "todos"].join("-")}`, "i")
+  },
   { id: "stripe", pattern: /\bstripe\.(?:com|js)\b|checkout\.sessions/i },
   { id: "hardcoded_aws_key", pattern: /\bAKIA[0-9A-Z]{16}\b/ },
   { id: "openai_key", pattern: /\bsk-[a-zA-Z0-9]{20,}\b/ }
@@ -27275,12 +29496,12 @@ function readPackageJson3(root) {
 function walkFiles(dir, acc = []) {
   if (!existsSync17(dir))
     return acc;
-  for (const entry of readdirSync3(dir)) {
-    const full = join13(dir, entry);
+  for (const entry2 of readdirSync3(dir)) {
+    const full = join13(dir, entry2);
     const st = statSync5(full);
     if (st.isDirectory())
       walkFiles(full, acc);
-    else if (/\.(js|mjs|cjs|json|d\.ts)$/.test(entry))
+    else if (/\.(js|mjs|cjs|json|d\.ts)$/.test(entry2))
       acc.push(full);
   }
   return acc;
@@ -27419,7 +29640,7 @@ todos-mcp --help 2>&1 | head -1 || true
 - publishConfig public access
 - prepublishOnly build hook
 
-Cloud sync via \`@hasna/cloud\` is explicit opt-in \u2014 not required for local-only usage.
+Remote sync is explicit opt-in \u2014 not required for local-only usage.
 `;
 }
 function runReleaseChecks(options = {}) {
@@ -27656,12 +29877,13 @@ function backupDatabase(outputPath, sourcePath) {
     throw new Error(`Database not found: ${source9}`);
   mkdirSync12(dirname11(outputPath), { recursive: true });
   closeDatabase();
-  const src = new Database3(source9, { readonly: true });
+  const src = new Database3(source9);
   try {
-    src.exec("PRAGMA wal_checkpoint(FULL)");
+    src.exec("PRAGMA wal_checkpoint(TRUNCATE)");
   } catch {}
+  const image = src.serialize();
   src.close();
-  copyFileSync(source9, outputPath);
+  writeFileSync10(outputPath, image);
   const method = "file_copy";
   const bytes = statSync6(outputPath).size;
   return {
@@ -27980,8 +30202,8 @@ var SCHEMA_CONTRACT_FIXTURES = {
   project: {
     schema_version: "todos.project.v1",
     id: "proj-001",
-    name: "open-todos",
-    path: "/tmp/open-todos",
+    name: "todos-example",
+    path: "/tmp/todos-example",
     task_counter: 0,
     created_at: "2026-01-01T00:00:00.000Z",
     updated_at: "2026-01-01T00:00:00.000Z"
@@ -28286,7 +30508,7 @@ function listReadyScheduledTasks(filters = {}, db) {
     return !start || start <= ts;
   });
 }
-function getAgentSafeQueue(agentId, filters = {}, db) {
+function getAgentSafeQueue(_agentId, filters = {}, db) {
   const d = db || getDatabase();
   const ts = Date.now();
   const ready = listReadyScheduledTasks({ project_id: filters.project_id }, d);
@@ -28507,7 +30729,7 @@ function searchTasks(options, projectId, taskListId, db) {
 
 // src/lib/saved-views.ts
 var SAVED_VIEWS_SCHEMA = "todos.saved_views.v1";
-function slugify3(name) {
+function slugify4(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 }
 function rowToView(row) {
@@ -28526,7 +30748,7 @@ function createSavedView(input, db) {
   const d = db || getDatabase();
   const id = uuid();
   const ts = now();
-  const slug = input.slug ?? slugify3(input.name);
+  const slug = input.slug ?? slugify4(input.name);
   d.run(`INSERT INTO saved_views (id, name, slug, entity_type, filters, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, ?, ?)`, [id, input.name, slug, input.entity_type ?? "task", JSON.stringify(input.filters ?? {}), ts, ts]);
   return getSavedView(id, d);
@@ -28604,12 +30826,13 @@ function unifiedSearch(input = {}, db) {
   }
   if (types.includes("run") || types.includes("all")) {
     for (const r of listAgentRuns({ limit: 100 }, d)) {
-      if (query && !r.adapter.toLowerCase().includes(query.toLowerCase()) && !r.id.includes(query))
+      const adapter = r.adapter ?? "custom";
+      if (query && !adapter.toLowerCase().includes(query.toLowerCase()) && !r.id.includes(query))
         continue;
       hits.push({
         entity_type: "run",
         id: r.id,
-        title: `Run ${r.adapter}`,
+        title: `Run ${adapter}`,
         snippet: r.status,
         score: 60,
         data: { status: r.status, task_id: r.task_id }
@@ -29106,6 +31329,15 @@ init_secret_redaction();
 var BUNDLE_SCHEMA = "todos.bundle.v1";
 var BUNDLE_TYPES = ["full_export", "tasks", "partial"];
 var MERGE_STRATEGIES = ["skip_existing", "remote_wins", "local_wins", "newest_wins"];
+function sqlValue(value) {
+  if (value === undefined || value === null)
+    return null;
+  if (typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean")
+    return value;
+  if (value instanceof Uint8Array)
+    return value;
+  return JSON.stringify(value);
+}
 function serializeProject(project) {
   return {
     schema_version: "todos.project.v1",
@@ -29202,10 +31434,11 @@ function exportLocalBundle(options = {}, db) {
     verification_records: verificationRecords,
     artifacts
   };
-  const { data: redacted, warnings: profileWarnings } = applyExportProfile(bundleData, {
+  const { data, warnings: profileWarnings } = applyExportProfile(bundleData, {
     profile,
     acknowledge_plaintext: options.acknowledge_plaintext
   });
+  const redacted = data;
   warnings.push(...profileWarnings);
   return {
     schema_version: BUNDLE_SCHEMA,
@@ -29350,7 +31583,7 @@ function upsertProject(raw, d) {
       raw.task_counter ?? 0,
       raw.created_at ?? ts,
       raw.updated_at ?? ts
-    ]);
+    ].map(sqlValue));
     return "created";
   }
   d.run(`UPDATE projects SET name = ?, path = ?, description = ?, task_list_id = ?, task_prefix = ?, task_counter = ?, updated_at = ?
@@ -29363,7 +31596,7 @@ function upsertProject(raw, d) {
     raw.task_counter ?? existing.task_counter,
     raw.updated_at ?? ts,
     id
-  ]);
+  ].map(sqlValue));
   return "updated";
 }
 function upsertTask(raw, d) {
@@ -29399,7 +31632,7 @@ function upsertTask(raw, d) {
     raw.version ?? existing.version,
     raw.updated_at ?? now(),
     id
-  ]);
+  ].map(sqlValue));
   return "updated";
 }
 function upsertComment(raw, d) {
@@ -29417,7 +31650,7 @@ function upsertComment(raw, d) {
     raw.type ?? "comment",
     raw.progress_pct ?? null,
     raw.created_at ?? now()
-  ]);
+  ].map(sqlValue));
   return "created";
 }
 function importBundle(bundle, options = {}, db) {
@@ -29512,7 +31745,7 @@ function readBundleFile(path) {
 function getBridgeDocs() {
   return `# Local Import/Export/Sync Bridge
 
-OSS @hasna/todos produces stable \`${BUNDLE_SCHEMA}\` JSON bundles for platform-todos consumption.
+OSS @hasna/todos produces stable \`${BUNDLE_SCHEMA}\` JSON bundles for hosted wrapper consumption.
 No automatic cloud calls are made from the OSS package.
 
 ## Bundle types
@@ -29989,7 +32222,7 @@ function summarizeTask2(t) {
     title: t.title,
     status: t.status,
     priority: t.priority,
-    assigned_to: t.assigned_to
+    assigned_to: t.assigned_to ?? null
   };
 }
 function buildHandoffPacket(input = {}, db) {
@@ -30891,8 +33124,6 @@ var BUILTIN_TEMPLATES = [
   },
   {
     name: "open-source-project",
-    version: 1,
-    category: "project",
     description: "Full open-source project bootstrap \u2014 scaffold to publish",
     category: "open-source",
     version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
@@ -30918,7 +33149,7 @@ var BUILTIN_TEMPLATES = [
   },
   {
     name: "release",
-    version: 1,
+    version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
     category: "ops",
     description: "Version release workflow \u2014 test, changelog, publish, verify",
     variables: [
@@ -30935,7 +33166,7 @@ var BUILTIN_TEMPLATES = [
   },
   {
     name: "docs-refresh",
-    version: 1,
+    version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
     category: "workflow",
     description: "Documentation refresh \u2014 audit, update, verify links",
     variables: [{ name: "scope", required: true, description: "Docs scope (README, API, AGENTS.md)" }],
@@ -30948,7 +33179,7 @@ var BUILTIN_TEMPLATES = [
   },
   {
     name: "migration",
-    version: 1,
+    version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
     category: "ops",
     description: "Schema/data migration workflow",
     variables: [
@@ -30965,7 +33196,7 @@ var BUILTIN_TEMPLATES = [
   },
   {
     name: "incident-response",
-    version: 1,
+    version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
     category: "ops",
     description: "Incident triage, mitigation, postmortem",
     variables: [{ name: "incident", required: true, description: "Incident summary" }],
@@ -31036,9 +33267,9 @@ function exportBuiltinTemplateFiles() {
 function writeBuiltinTemplateFiles(directory) {
   mkdirSync15(directory, { recursive: true });
   const files = [];
-  for (const entry of exportBuiltinTemplateFiles()) {
-    const path = join15(directory, entry.filename);
-    writeFileSync13(path, `${JSON.stringify(entry.template, null, 2)}
+  for (const entry2 of exportBuiltinTemplateFiles()) {
+    const path = join15(directory, entry2.filename);
+    writeFileSync13(path, `${JSON.stringify(entry2.template, null, 2)}
 `, "utf-8");
     files.push(path);
   }
@@ -31160,8 +33391,14 @@ function getTemplateLibraryDocs() {
 Marketplace-free bundled workflows \u2014 no network required.
 
 ## Categories
-- **workflow** \u2014 bug-fix, feature, docs-refresh
-- **ops** \u2014 release, migration, incident-response, security-audit
+- **bug-fix** \u2014 defect reproduction, diagnosis, test, implementation, release
+- **feature** \u2014 feature-implementation
+- **security** \u2014 security-review
+- **release** \u2014 release verification and publishing
+- **migration** \u2014 schema and data migration
+- **incident** \u2014 incident and incident-response
+- **docs** \u2014 docs-refresh
+- **qa** \u2014 QA matrix, checks, defects, signoff
 - **project** \u2014 open-source-project bootstrap
 
 ## CLI
@@ -31264,8 +33501,8 @@ function buildMachineTopologyReport(db) {
     schema_version: MACHINE_TOPOLOGY_SCHEMA,
     id: m.id,
     name: m.name,
-    hostname: m.hostname,
-    platform: m.platform,
+    hostname: m.hostname ?? m.name,
+    platform: m.platform ?? "unknown",
     last_seen_at: m.last_seen_at,
     is_local: m.id === localId,
     active_agents: agents.filter((a) => !a.stale && a.machine_id === m.id).length,
@@ -31313,9 +33550,9 @@ todos machines topology      # full diagnostic report
 `;
 }
 // src/lib/environment-snapshots.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { existsSync as existsSync19, readFileSync as readFileSync19, statSync as statSync7 } from "fs";
-import { hostname as hostname3, platform as platform2, arch } from "os";
+import { hostname as hostname3, platform, arch } from "os";
 import { dirname as dirname15, join as join16, resolve as resolve14 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 init_database();
@@ -31338,7 +33575,7 @@ var CONFIG_FILES = [
   "dashboard/vite.config.ts"
 ];
 function sha2565(value) {
-  return createHash10("sha256").update(value).digest("hex");
+  return createHash11("sha256").update(value).digest("hex");
 }
 function fileRecord(root, relativePath) {
   const path = join16(root, relativePath);
@@ -31473,7 +33710,7 @@ function captureEnvironmentSnapshot(input = {}) {
     schema_version: 1,
     captured_at: input.now ? new Date(input.now).toISOString() : new Date().toISOString(),
     root,
-    machine: { hostname: hostname3(), platform: platform2(), arch: arch() },
+    machine: { hostname: hostname3(), platform: platform(), arch: arch() },
     target: {
       task_id: input.task_id ?? null,
       run_id: input.run_id ?? null,
@@ -31562,7 +33799,7 @@ function diffFiles(left, right) {
   const leftMap = keyed(left);
   const rightMap = keyed(right);
   const paths = [...new Set([...leftMap.keys(), ...rightMap.keys()])].sort((a, b) => a.localeCompare(b));
-  return paths.map((path) => ({ path, left_sha256: leftMap.get(path)?.sha256 ?? null, right_sha256: rightMap.get(path)?.sha256 ?? null })).filter((entry) => entry.left_sha256 !== entry.right_sha256);
+  return paths.map((path) => ({ path, left_sha256: leftMap.get(path)?.sha256 ?? null, right_sha256: rightMap.get(path)?.sha256 ?? null })).filter((entry2) => entry2.left_sha256 !== entry2.right_sha256);
 }
 function compareEnvironmentSnapshots(left, right) {
   const warnings = [];
@@ -31588,7 +33825,7 @@ function compareEnvironmentSnapshotFiles(leftPath, rightPath) {
 }
 // src/lib/decision-records.ts
 init_database();
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 import { mkdirSync as mkdirSync17, writeFileSync as writeFileSync15 } from "fs";
 import { dirname as dirname16, join as join17 } from "path";
 var DECISION_RECORD_SCHEMA = "todos.decision_record.v1";
@@ -31644,7 +33881,7 @@ function rowToDecisionRecord(row) {
 }
 function stableSnapshotHash(payload) {
   const { captured_at: _capturedAt, ...rest } = payload;
-  return createHash11("sha256").update(JSON.stringify(rest)).digest("hex");
+  return createHash12("sha256").update(JSON.stringify(rest)).digest("hex");
 }
 function createDecisionRecord(input, db) {
   const d = db || getDatabase();
@@ -32024,7 +34261,7 @@ function buildReportExportData(input, db) {
   let taskId = input.task_id ?? null;
   switch (input.kind) {
     case "project": {
-      const project = projectId ? getProject(projectId, d) : listProjects(undefined, d)[0];
+      const project = projectId ? getProject(projectId, d) : listProjects(d)[0];
       if (!project)
         throw new Error("Project not found");
       projectId = project.id;
@@ -32112,7 +34349,7 @@ function buildReportExportData(input, db) {
       break;
     }
     case "roadmap": {
-      const project = projectId ? getProject(projectId, d) : listProjects(undefined, d)[0];
+      const project = projectId ? getProject(projectId, d) : listProjects(d)[0];
       if (!project)
         throw new Error("Project not found");
       projectId = project.id;
@@ -32747,7 +34984,7 @@ function applyFailureTriage(input, db) {
     }
     if (action === "escalate") {
       const meta = { ...task2.metadata, _triage_escalated: { at: now(), reason, classification } };
-      const escalated = updateTask(task2.id, { priority: "urgent", metadata: meta, version: task2.version }, d);
+      const escalated = updateTask(task2.id, { priority: "critical", metadata: meta, version: task2.version }, d);
       return { schema_version: FAILURE_TRIAGE_SCHEMA, action, classification, playbook, task: escalated, escalated: true };
     }
   }
@@ -32971,7 +35208,7 @@ function storePath(cwd) {
 function versionsDir(cwd) {
   return join19(storeDir(cwd), "versions");
 }
-function slugify4(name) {
+function slugify5(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 }
 function emptyStore2() {
@@ -33010,7 +35247,7 @@ function createUserScaffold(input, db, cwd) {
   const store = loadUserScaffoldStore(cwd);
   const id = uuid();
   const ts = now();
-  const slug = slugify4(input.name);
+  const slug = slugify5(input.name);
   if (Object.values(store.scaffolds).some((s) => s.slug === slug)) {
     throw new Error(`Scaffold slug already exists: ${slug}`);
   }
@@ -33047,8 +35284,8 @@ function updateUserScaffold(idOrSlug, updates, db, cwd) {
   if (!existing)
     throw new Error(`Scaffold not found: ${idOrSlug}`);
   snapshotVersion(existing, cwd);
-  if (updates.name && slugify4(updates.name) !== existing.slug) {
-    const newSlug = slugify4(updates.name);
+  if (updates.name && slugify5(updates.name) !== existing.slug) {
+    const newSlug = slugify5(updates.name);
     if (Object.values(store.scaffolds).some((s) => s.id !== existing.id && s.slug === newSlug)) {
       throw new Error(`Scaffold slug conflict: ${newSlug}`);
     }
@@ -33244,7 +35481,7 @@ import { mkdtempSync } from "fs";
 import { join as join20 } from "path";
 import { tmpdir as tmpdir3 } from "os";
 var AGENT_WORKFLOW_DEMO_SCHEMA = "todos.agent_workflow_demo.v1";
-var DEMO_DEFAULT_AGENT = "demo-agent";
+var DEMO_DEFAULT_AGENT = "demoagent";
 var DEMO_DEFAULT_PROJECT = "Agent Workflow Demo";
 var DEMO_PROJECT_PATH = "/tmp/todos-agent-workflow-demo";
 function pushStep(steps, action, detail, status = "ok") {
@@ -33350,7 +35587,7 @@ function runAgentWorkflowDemo(options = {}) {
       agent_id: agent.id,
       evidence: { demo: true, source: "agent_workflow_demo" }
     }, d);
-    pushStep(steps, "enqueue_agent_run", `Queued agent run on task ${third.short_id ?? third.id.slice(0, 8)}`);
+    pushStep(steps, "enqueue_agent_run", `Queued agent run ${queuedRun.id.slice(0, 8)} on task ${third.short_id ?? third.id.slice(0, 8)}`);
     const claimedRun = claimNextAgentRun(agent.id, { adapter: demoAdapter }, d);
     if (!claimedRun)
       throw new Error("Expected queued agent run");
@@ -33399,7 +35636,7 @@ function runAgentWorkflowDemo(options = {}) {
         id: completedRun.id,
         status: completedRun.status,
         task_id: completedRun.task_id,
-        adapter: completedRun.adapter
+        adapter: completedRun.adapter ?? demoAdapter
       },
       run_record: {
         id: finishedRecord.id,
@@ -33877,13 +36114,13 @@ var ALL_MCP_TOOLS = [
   "sync_todos_md",
   "task_context",
   "template_history",
-  "todos_cloud_conflicts",
-  "todos_cloud_feedback",
-  "todos_cloud_pull",
-  "todos_cloud_push",
-  "todos_cloud_status",
   "todos_inbox",
   "todos_retro",
+  "todos_storage_conflicts",
+  "todos_storage_feedback",
+  "todos_storage_pull",
+  "todos_storage_push",
+  "todos_storage_status",
   "trust_workspace",
   "unarchive_agent",
   "unarchive_task",
@@ -34021,10 +36258,10 @@ var MCP_GROUP_DEFS = [
     match: (t) => /sandbox|trust|secret|crypto|verification|policy_pack|redact|scan_/.test(t)
   },
   {
-    id: "cloud",
-    name: "Cloud bridge",
-    description: "Optional cloud sync tools (admin profile).",
-    match: (t) => t.startsWith("todos_cloud_") || t === "sync_all" || t === "migrate_pg"
+    id: "storage",
+    name: "Storage bridge",
+    description: "Optional storage sync tools (admin profile).",
+    match: (t) => t.startsWith("todos_storage_") || t === "sync_all" || t === "migrate_pg"
   },
   {
     id: "workflow",
@@ -34249,7 +36486,7 @@ function normalizeFeatureManifest(manifest, generatedAt = "2026-01-01T00:00:00.0
     mcp: {
       total_tools: manifest.mcp.total_tools,
       tools_for_profile_count: manifest.mcp.tools_for_profile_count,
-      tool_group_counts: Object.fromEntries(manifest.mcp.tool_groups.map((g) => [g.id, g.tools.length]).sort(([a], [b]) => a.localeCompare(b)))
+      tool_group_counts: Object.fromEntries(manifest.mcp.tool_groups.map((g) => [g.id, g.tools.length]).sort(([a], [b]) => String(a).localeCompare(String(b))))
     },
     profiles: manifest.profiles.map((p) => p.name),
     env_vars: manifest.env_vars.map((e) => e.name),
@@ -34321,7 +36558,7 @@ Set \`TODOS_PROFILE\` to control which MCP tools load:
 | agent_safe | Claim/complete workflow without destructive ops |
 | standard | Default minus admin/template/webhook tools |
 | full | All local tools |
-| admin | Includes migrations and cloud bridge |
+| admin | Includes migrations and storage bridge |
 
 Schema: \`${FEATURE_MANIFEST_SCHEMA}\`
 `;
@@ -34843,8 +37080,8 @@ function getLeaderboard(opts, db) {
   }
   entries.sort((a, b) => b.composite_score - a.composite_score);
   const limit = opts?.limit || 20;
-  return entries.slice(0, limit).map((entry, idx) => ({
-    ...entry,
+  return entries.slice(0, limit).map((entry2, idx) => ({
+    ...entry2,
     rank: idx + 1
   }));
 }
@@ -36115,7 +38352,7 @@ function syncWithAgents(agents, taskListIdByAgent, projectId, direction = "both"
 }
 // src/lib/extract.ts
 import { existsSync as existsSync24, readFileSync as readFileSync23, statSync as statSync8 } from "fs";
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import { relative as relative6, resolve as resolve15, join as join23 } from "path";
 var EXTRACT_TAGS = ["TODO", "FIXME", "HACK", "XXX", "BUG", "NOTE"];
 var DEFAULT_EXTENSIONS = new Set([
@@ -36180,7 +38417,7 @@ var SKIP_DIRS2 = new Set([
   ".parcel-cache"
 ]);
 function stableHash(value) {
-  return createHash12("sha256").update(value).digest("hex");
+  return createHash13("sha256").update(value).digest("hex");
 }
 function normalizePathForMatch(value) {
   return value.replace(/\\/g, "/").replace(/^\.\//, "");
@@ -36305,19 +38542,19 @@ function collectFiles(basePath, extensions, excludes, respectGitignore) {
   const files = [];
   const ignorePatterns = respectGitignore ? readGitignorePatterns(basePath) : [];
   const allExcludes = [...ignorePatterns, ...excludes];
-  for (const entry of glob.scanSync({ cwd: basePath, onlyFiles: true, dot: false })) {
-    const parts = entry.split("/");
+  for (const entry2 of glob.scanSync({ cwd: basePath, onlyFiles: true, dot: false })) {
+    const parts = entry2.split("/");
     if (parts.some((p) => SKIP_DIRS2.has(p)))
       continue;
-    if (matchesAnyPattern(entry, allExcludes))
+    if (matchesAnyPattern(entry2, allExcludes))
       continue;
-    const dotIdx = entry.lastIndexOf(".");
+    const dotIdx = entry2.lastIndexOf(".");
     if (dotIdx === -1)
       continue;
-    const ext = entry.slice(dotIdx);
+    const ext = entry2.slice(dotIdx);
     if (!extensions.has(ext))
       continue;
-    files.push(entry);
+    files.push(entry2);
   }
   return files.sort();
 }
@@ -37068,7 +39305,7 @@ function renderWorkflowStatesMarkdown(states = listWorkflowStates()) {
 }
 // src/lib/agent-replay-simulator.ts
 init_redaction();
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 import { readFileSync as readFileSync24 } from "fs";
 function isObject(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
@@ -37090,7 +39327,7 @@ function stable2(value) {
   return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stable2(value[key])]));
 }
 function fingerprint3(value) {
-  return createHash13("sha256").update(JSON.stringify(stable2(value))).digest("hex");
+  return createHash14("sha256").update(JSON.stringify(stable2(value))).digest("hex");
 }
 function unpackFixture(input) {
   if (!isObject(input))
@@ -37329,7 +39566,7 @@ function renderAgentReplaySimulationMarkdown(simulation) {
 }
 // src/lib/local-extensions.ts
 init_config();
-import { createHash as createHash14, createVerify } from "crypto";
+import { createHash as createHash15, createVerify } from "crypto";
 import { existsSync as existsSync25, readdirSync as readdirSync5, readFileSync as readFileSync25, statSync as statSync9 } from "fs";
 import { basename as basename5, join as join24, resolve as resolve16 } from "path";
 init_redaction();
@@ -37416,7 +39653,7 @@ function parseJson(path) {
   return JSON.parse(readFileSync25(path, "utf8"));
 }
 function sha2566(bytes) {
-  return `sha256:${createHash14("sha256").update(bytes).digest("hex")}`;
+  return `sha256:${createHash15("sha256").update(bytes).digest("hex")}`;
 }
 function compareVersions(a, b) {
   const left = a.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -37716,11 +39953,11 @@ function projectExtensionSources(projectPath) {
   ];
   const extensionDir = join24(root, ".todos", "extensions");
   if (existsSync25(extensionDir)) {
-    for (const entry of readdirSync5(extensionDir)) {
-      if (entry.startsWith("."))
+    for (const entry2 of readdirSync5(extensionDir)) {
+      if (entry2.startsWith("."))
         continue;
-      const full = join24(extensionDir, entry);
-      if (statSync9(full).isDirectory() || entry.endsWith(".json"))
+      const full = join24(extensionDir, entry2);
+      if (statSync9(full).isDirectory() || entry2.endsWith(".json"))
         candidates.push(full);
     }
   }
@@ -38297,16 +40534,16 @@ function getExpiredArtifactFileCandidates(input, generatedAt, db, deletedRunIds)
   }
   const candidates = [];
   for (const [relativePath, entries] of byPath) {
-    const retainedEntries = entries.filter((entry) => !deletedRunIds.has(entry.row.run_id) && (!entry.expires_at || entry.expires_at > generatedAt));
+    const retainedEntries = entries.filter((entry2) => !deletedRunIds.has(entry2.row.run_id) && (!entry2.expires_at || entry2.expires_at > generatedAt));
     if (retainedEntries.length > 0)
       continue;
-    const removableEntries = entries.filter((entry) => deletedRunIds.has(entry.row.run_id) || Boolean(entry.expires_at && entry.expires_at <= generatedAt));
+    const removableEntries = entries.filter((entry2) => deletedRunIds.has(entry2.row.run_id) || Boolean(entry2.expires_at && entry2.expires_at <= generatedAt));
     if (removableEntries.length === 0)
       continue;
-    const latestExpiry = removableEntries.map((entry) => entry.expires_at).filter((expiresAt) => typeof expiresAt === "string").sort().at(-1) ?? generatedAt;
+    const latestExpiry = removableEntries.map((entry2) => entry2.expires_at).filter((expiresAt) => typeof expiresAt === "string").sort().at(-1) ?? generatedAt;
     candidates.push({
       relative_path: relativePath,
-      artifact_ids: removableEntries.map((entry) => entry.row.id).sort(),
+      artifact_ids: removableEntries.map((entry2) => entry2.row.id).sort(),
       expires_at: latestExpiry,
       size_bytes: typeof removableEntries[0].store.size_bytes === "number" ? removableEntries[0].store.size_bytes : null
     });
@@ -39114,7 +41351,7 @@ function removeCapacityProfile(idOrAgent, projectId) {
 function getPlanningForecast(input = {}, db) {
   const startDate = input.start_date ? dateOnly(input.start_date) : todayIso();
   const tasks = listTasks({ project_id: input.project_id, plan_id: input.plan_id, limit: 1e4 }, db).filter((task2) => taskMatchesAgent(task2, input.agent_id));
-  const reportByTask = new Map(getTimeReport({ project_id: input.project_id, plan_id: input.plan_id, agent_id: input.agent_id, include_open: true }, db).map((entry) => [entry.task_id, entry]));
+  const reportByTask = new Map(getTimeReport({ project_id: input.project_id, plan_id: input.plan_id, agent_id: input.agent_id, include_open: true }, db).map((entry2) => [entry2.task_id, entry2]));
   const profiles = listCapacityProfiles({ agent_id: input.agent_id, project_id: input.project_id });
   const globalProfiles = input.project_id ? listCapacityProfiles({ agent_id: input.agent_id }).filter((profile) => profile.project_id === null) : [];
   const capacityProfiles = profiles.length > 0 ? profiles : globalProfiles;
@@ -39142,7 +41379,7 @@ function getPlanningForecast(input = {}, db) {
   const estimatedMinutes = forecastTasks.reduce((sum, task2) => sum + (task2.estimated_minutes ?? 0), 0);
   const remainingEstimatedMinutes = forecastTasks.reduce((sum, task2) => sum + task2.remaining_estimated_minutes, 0);
   const actualMinutes = forecastTasks.reduce((sum, task2) => sum + (task2.actual_minutes ?? 0), 0);
-  const loggedMinutes = [...reportByTask.values()].reduce((sum, entry) => sum + entry.logged_minutes, 0);
+  const loggedMinutes = [...reportByTask.values()].reduce((sum, entry2) => sum + entry2.logged_minutes, 0);
   const missingEstimateCount = forecastTasks.filter((task2) => task2.missing_estimate).length;
   const overdueOpenTaskCount = forecastTasks.filter((task2) => task2.overdue).length;
   const forecastWorkDays = capacityMinutesPerDay > 0 ? Math.ceil(remainingEstimatedMinutes / capacityMinutesPerDay) : null;
@@ -39351,7 +41588,7 @@ function fishEscape(value) {
   return value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"");
 }
 function rootCommandNames(entries) {
-  return entries.filter((entry) => entry.path.length === 1).map((entry) => entry.path[0]).filter((value) => Boolean(value));
+  return entries.filter((entry2) => entry2.path.length === 1).map((entry2) => entry2.path[0]).filter((value) => Boolean(value));
 }
 function optionFlags(options) {
   const flags = new Set;
@@ -39363,17 +41600,17 @@ function optionFlags(options) {
   }
   return [...flags].sort();
 }
-function commandOptions(program, entry) {
-  return optionFlags([...program.options.map(optionEntry), ...entry.options]);
+function commandOptions(program, entry2) {
+  return optionFlags([...program.options.map(optionEntry), ...entry2.options]);
 }
 function generateCompletionScript(program, shell) {
   const entries = collectCliCommandEntries(program);
   const roots = rootCommandNames(entries);
   if (shell === "bash") {
-    const rootCases = entries.filter((entry) => entry.path.length === 1).map((entry) => {
-      const children = entries.filter((child) => child.path.length === 2 && child.path[0] === entry.path[0]).map((child) => child.path[1]).filter((value) => Boolean(value));
-      const options = commandOptions(program, entry);
-      return `    ${entry.path[0]})
+    const rootCases = entries.filter((entry2) => entry2.path.length === 1).map((entry2) => {
+      const children = entries.filter((child) => child.path.length === 2 && child.path[0] === entry2.path[0]).map((child) => child.path[1]).filter((value) => Boolean(value));
+      const options = commandOptions(program, entry2);
+      return `    ${entry2.path[0]})
       COMPREPLY=($(compgen -W '${shellWords([...children, ...options])}' -- "$cur"))
       return
       ;;`;
@@ -39400,14 +41637,14 @@ function generateCompletionScript(program, shell) {
 `);
   }
   if (shell === "zsh") {
-    const commandEntries = entries.filter((entry) => entry.path.length === 1).map((entry) => zshEntry(entry.path[0] || "", entry.description));
+    const commandEntries = entries.filter((entry2) => entry2.path.length === 1).map((entry2) => zshEntry(entry2.path[0] || "", entry2.description));
     const optionEntries = optionFlags(program.options.map(optionEntry)).map((flag) => `'${flag}'`);
-    const childCases = entries.filter((entry) => entry.path.length === 1).map((entry) => {
-      const children = entries.filter((child) => child.path.length === 2 && child.path[0] === entry.path[0]);
+    const childCases = entries.filter((entry2) => entry2.path.length === 1).map((entry2) => {
+      const children = entries.filter((child) => child.path.length === 2 && child.path[0] === entry2.path[0]);
       if (children.length === 0)
         return "";
       const childEntries = children.map((child) => zshEntry(child.path[1] || "", child.description)).join(" ");
-      return `    ${entry.path[0]}) local -a subcommands; subcommands=(${childEntries}); _describe 'subcommand' subcommands ;;`;
+      return `    ${entry2.path[0]}) local -a subcommands; subcommands=(${childEntries}); _describe 'subcommand' subcommands ;;`;
     }).filter(Boolean).join(`
 `);
     return [
@@ -39443,11 +41680,11 @@ function generateCompletionScript(program, shell) {
     parts.push(`-d "${fishEscape(option.description)}"`);
     fishLines.push(parts.join(" "));
   }
-  for (const entry of entries) {
-    if (entry.path.length === 1) {
-      fishLines.push(`complete -c todos -n "__fish_use_subcommand" -a "${entry.path[0]}" -d "${fishEscape(entry.description)}"`);
-    } else if (entry.path.length === 2) {
-      fishLines.push(`complete -c todos -n "__fish_seen_subcommand_from ${entry.path[0]}" -a "${entry.path[1]}" -d "${fishEscape(entry.description)}"`);
+  for (const entry2 of entries) {
+    if (entry2.path.length === 1) {
+      fishLines.push(`complete -c todos -n "__fish_use_subcommand" -a "${entry2.path[0]}" -d "${fishEscape(entry2.description)}"`);
+    } else if (entry2.path.length === 2) {
+      fishLines.push(`complete -c todos -n "__fish_seen_subcommand_from ${entry2.path[0]}" -a "${entry2.path[1]}" -d "${fishEscape(entry2.description)}"`);
     }
   }
   fishLines.push("");
@@ -39499,6 +41736,7 @@ export {
   upsertEncryptionProfile,
   upsertCapacityProfile,
   upsertAgentRunAdapter,
+  uploadRunArtifactsToS3,
   updateUserScaffold,
   updateTemplate,
   updateTaskList,
@@ -39554,6 +41792,7 @@ export {
   slugify,
   simulateAgentReplayFile,
   simulateAgentReplay,
+  signAwsV4Request,
   shouldRegisterToolForProfile,
   shouldRegisterToolForProfile2 as shouldRegisterToolForAccessProfile,
   setupEphemeralDemoDb,
@@ -39691,6 +41930,7 @@ export {
   redactHandoffPayload,
   redactExportRecord,
   redactEvidenceText,
+  redactDatabaseUrl,
   redactCommentContent,
   redactActivityRecord,
   recoverStaleLeases,
@@ -39717,11 +41957,15 @@ export {
   previewInstalledTemplate,
   previewInboxIntake,
   previewBuiltinTemplate,
+  postgresTodosSyncSchemaSql,
   pollLocalSnapshots,
+  planRunArtifactsS3Sync,
   pauseFocusSession,
   patrolTasks,
   parseTmuxTarget,
+  parseStorageMode,
   parseRecurrenceRule,
+  parseQuietHours,
   parseNaturalLanguageTask,
   parseIssueExport,
   parseGoalCommand,
@@ -39747,6 +41991,7 @@ export {
   mergeDuplicateTask,
   materializePlanSteps,
   matchCapabilities,
+  looksSensitiveKey,
   logTrace,
   logTime,
   logTaskChange,
@@ -39756,6 +42001,8 @@ export {
   logActivity,
   lockTask,
   loadUserScaffoldStore,
+  loadTodosStorageConfig,
+  loadStorageConfig,
   loadSandboxProfiles,
   loadIssueExportFromFile,
   loadConfig,
@@ -39856,6 +42103,7 @@ export {
   linkRunArtifact,
   issueToTask,
   isValidRecurrenceRule,
+  isTodosRemoteStorageEnabled,
   isSnapshotStale,
   isEncryptedValue,
   isEncryptedBridgeBundle,
@@ -39873,6 +42121,7 @@ export {
   importTemplate,
   importTaskBoardBundle,
   importStoredArtifactContent,
+  importSqliteTodosStorageSnapshot,
   importRoadmapBundle,
   importOnboardingFixture,
   importLocalBridgeBundle,
@@ -39897,6 +42146,10 @@ export {
   getUnlockImpact,
   getTraceStats,
   getTopologyDocs,
+  getTodosStorageMode,
+  getTodosStorageEnvName,
+  getTodosStorageDatabaseUrl,
+  getTodosStorageDatabaseEnv,
   getTimeReport,
   getTimeLogs,
   getTerminalNotificationRule,
@@ -39933,6 +42186,9 @@ export {
   getTaskBoard,
   getTask,
   getStoredHandoffAsPacket,
+  getStorageMode,
+  getStorageDatabaseUrl,
+  getStorageDatabaseEnv,
   getStatus,
   getStaleTasks,
   getStaleTaskReport,
@@ -39979,6 +42235,8 @@ export {
   getOnboardingFixture,
   getNextTask,
   getNextCycle,
+  getNativeStorageSyncPlan,
+  getNativeStorageStatus,
   getMcpToolNames,
   getMachineTopologyDiagnostics,
   getMachineLocalPath,
@@ -40128,6 +42386,7 @@ export {
   exportTaskFields,
   exportTaskBoardBundle,
   exportStoredArtifactContent,
+  exportSqliteTodosStorageSnapshot,
   exportSchemasToDirectory,
   exportRunReplay,
   exportRoadmapBundle,
@@ -40154,6 +42413,7 @@ export {
   evaluateCondition,
   ensureTaskList,
   ensureProject,
+  ensureEncryptionProfile,
   enqueueAgentRun,
   encryptionProfileStatus,
   encryptValue,
@@ -40161,6 +42421,7 @@ export {
   encryptSensitiveFields,
   emitLocalEventHooksQuiet,
   emitLocalEventHooks,
+  downloadRunArtifactsFromS3,
   dispatchWebhook,
   dispatchToMultiple,
   dismissReminder,
@@ -40203,6 +42464,8 @@ export {
   createVerificationEvidence,
   createUserScaffold,
   createTuiDashboardSnapshot,
+  createTodosStorageAdapter,
+  createTodosS3ArtifactStore,
   createTodosRegistry,
   createTemplate,
   createTaskList,
@@ -40222,6 +42485,8 @@ export {
   createReminder,
   createReleaseCompatibilityReport,
   createProject,
+  createPostgresTodosSyncStore,
+  createPostgresTodosStorageAdapter,
   createPlanWithSteps,
   createPlan,
   createOrg,
@@ -40240,6 +42505,7 @@ export {
   createJsonContractsManifest,
   createInboxItem,
   createInboxIntake,
+  createHybridTodosStorageAdapter,
   createHandoffPacket,
   createHandoff,
   createGoalWorkflow,
@@ -40306,6 +42572,8 @@ export {
   bulkCreateTasks,
   bulkAddTaskFiles,
   buildTaskBoardSnapshot,
+  buildS3ObjectUrl,
+  buildS3ObjectKey,
   buildRunReplayBundle,
   buildResourceSnapshot,
   buildReportExportData,
@@ -40325,6 +42593,7 @@ export {
   attachPlanToProject,
   assignLabelToTask,
   assertToolAllowed,
+  assertTodosRemoteStorageConfig,
   assertNoSecrets,
   assertHeadlessOutboundUrl,
   assertExportProfileAllowed,
@@ -40366,6 +42635,9 @@ export {
   TaskNotFoundError,
   TaskListNotFoundError,
   TUI_DASHBOARD_VIEWS,
+  TODOS_STORAGE_TABLES,
+  TODOS_STORAGE_FALLBACK_ENV,
+  TODOS_STORAGE_ENV,
   TODOS_SDK_INTEGRATION_FIXTURE_SCHEMA_VERSION,
   TODOS_SDK_INTEGRATION_FIXTURE_GENERATED_AT,
   TODOS_REGISTRY,
@@ -40396,6 +42668,7 @@ export {
   TASK_STATUSES,
   TASK_SCHEDULING_SCHEMA,
   TASK_PRIORITIES,
+  STORAGE_TABLES,
   SECRET_REDACTION_SCHEMA,
   SCHEMA_SEMVER,
   SCHEMA_ENTITIES,