@hasna/todos 0.11.88 → 0.11.89

package/dist/cli/index.js

@@ -8876,9 +8876,8 @@ function cloudProjectPathBasename(value) {
 function uniqueProjectMatches(projects, predicate) {
   return [...new Map(projects.filter(predicate).map((project) => [project.id, project])).values()];
 }
-async function cloudResolveProjectRef(client, ref) {
+function resolveCloudProjectRef(projects, ref) {
   const input = ref.trim();
-  const projects = await cloudListProjects(client);
   const normalizedRef = input.toLowerCase();
   const pathLike = input.startsWith(".") || input.includes("/") || input.includes("\\");
   const normalizedPath = pathLike ? resolvePath(input) : undefined;
@@ -8898,6 +8897,9 @@ async function cloudResolveProjectRef(client, ref) {
   }
   throw new Error(`Project not found: "${input}"`);
 }
+async function cloudResolveProjectRef(client, ref) {
+  return resolveCloudProjectRef(await cloudListProjects(client), ref);
+}
 async function cloudListPlans(client, projectId) {
   const query = projectId ? { project_id: projectId } : {};
   const res = await client.list("plans", { query });
@@ -9232,6 +9234,13 @@ async function cloudCreateTaskList(client, input) {
   }
   return raw;
 }
+async function cloudRenameProject(client, ref, newSlug, name) {
+  const id = await cloudResolveProjectRef(client, ref);
+  const normalizedSlug = cloudProjectSlug(newSlug);
+  if (!normalizedSlug)
+    throw new Error("Invalid slug \u2014 must be non-empty kebab-case");
+  return client.transport.post(`/projects/${encodeURIComponent(id)}/rename`, { new_slug: normalizedSlug, ...name !== undefined ? { name } : {} });
+}
 async function cloudDeleteTaskList(client, id) {
   await client.delete("task-lists", id);
   return true;
@@ -11076,6 +11085,95 @@ function ensureSchema(db) {
     )`);
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_project_machine_paths_project ON project_machine_paths(project_id)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_project_machine_paths_machine ON project_machine_paths(machine_id)");
+  ensureTable("canonical_slug_claims", `
+    CREATE TABLE canonical_slug_claims (
+      kind TEXT NOT NULL CHECK(kind IN ('project', 'task_list')),
+      scope_key TEXT NOT NULL,
+      slug TEXT NOT NULL,
+      object_id TEXT NOT NULL,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      PRIMARY KEY (kind, scope_key, slug)
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_canonical_slug_claims_object ON canonical_slug_claims(kind, object_id)");
+  ensureColumn("projects", "task_list_id", "TEXT");
+  db.exec(`CREATE TRIGGER IF NOT EXISTS claim_project_canonical_slug_insert
+    BEFORE INSERT ON projects
+    WHEN NEW.task_list_id IS NOT NULL AND NEW.task_list_id <> ''
+    BEGIN
+      SELECT CASE WHEN EXISTS (
+        SELECT 1 FROM projects WHERE id <> NEW.id AND task_list_id = NEW.task_list_id
+      ) THEN RAISE(ABORT, 'PROJECT_SLUG_CONFLICT') END;
+      INSERT OR IGNORE INTO canonical_slug_claims(kind, scope_key, slug, object_id)
+        VALUES ('project', 'global', NEW.task_list_id, NEW.id);
+      SELECT CASE WHEN (
+        SELECT object_id FROM canonical_slug_claims
+        WHERE kind = 'project' AND scope_key = 'global' AND slug = NEW.task_list_id
+      ) <> NEW.id THEN RAISE(ABORT, 'PROJECT_SLUG_CONFLICT') END;
+    END`);
+  db.exec(`CREATE TRIGGER IF NOT EXISTS claim_project_canonical_slug_update
+    BEFORE UPDATE OF task_list_id ON projects
+    WHEN NEW.task_list_id IS NOT OLD.task_list_id
+    BEGIN
+      DELETE FROM canonical_slug_claims WHERE kind = 'project' AND object_id = NEW.id;
+      SELECT CASE WHEN EXISTS (
+        SELECT 1 FROM projects WHERE id <> NEW.id AND task_list_id = NEW.task_list_id
+      ) AND NEW.task_list_id IS NOT NULL AND NEW.task_list_id <> ''
+        THEN RAISE(ABORT, 'PROJECT_SLUG_CONFLICT') END;
+      INSERT OR IGNORE INTO canonical_slug_claims(kind, scope_key, slug, object_id)
+        SELECT 'project', 'global', NEW.task_list_id, NEW.id
+        WHERE NEW.task_list_id IS NOT NULL AND NEW.task_list_id <> '';
+      SELECT CASE WHEN NEW.task_list_id IS NOT NULL AND NEW.task_list_id <> '' AND (
+        SELECT object_id FROM canonical_slug_claims
+        WHERE kind = 'project' AND scope_key = 'global' AND slug = NEW.task_list_id
+      ) <> NEW.id THEN RAISE(ABORT, 'PROJECT_SLUG_CONFLICT') END;
+    END`);
+  db.exec(`CREATE TRIGGER IF NOT EXISTS release_project_canonical_slug_delete
+    AFTER DELETE ON projects
+    BEGIN
+      DELETE FROM canonical_slug_claims WHERE kind = 'project' AND object_id = OLD.id;
+    END`);
+  db.exec(`CREATE TRIGGER IF NOT EXISTS claim_task_list_canonical_slug_insert
+    BEFORE INSERT ON task_lists
+    WHEN NEW.slug IS NOT NULL AND NEW.slug <> ''
+    BEGIN
+      SELECT CASE WHEN EXISTS (
+        SELECT 1 FROM task_lists
+        WHERE id <> NEW.id AND project_id IS NEW.project_id AND slug = NEW.slug
+      ) THEN RAISE(ABORT, 'TASK_LIST_SLUG_CONFLICT') END;
+      INSERT OR IGNORE INTO canonical_slug_claims(kind, scope_key, slug, object_id)
+        VALUES ('task_list', CASE WHEN NEW.project_id IS NULL THEN 'standalone:' ELSE 'project:' || NEW.project_id END, NEW.slug, NEW.id);
+      SELECT CASE WHEN (
+        SELECT object_id FROM canonical_slug_claims
+        WHERE kind = 'task_list'
+          AND scope_key = CASE WHEN NEW.project_id IS NULL THEN 'standalone:' ELSE 'project:' || NEW.project_id END
+          AND slug = NEW.slug
+      ) <> NEW.id THEN RAISE(ABORT, 'TASK_LIST_SLUG_CONFLICT') END;
+    END`);
+  db.exec(`CREATE TRIGGER IF NOT EXISTS claim_task_list_canonical_slug_update
+    BEFORE UPDATE OF slug, project_id ON task_lists
+    WHEN NEW.slug IS NOT OLD.slug OR NEW.project_id IS NOT OLD.project_id
+    BEGIN
+      DELETE FROM canonical_slug_claims WHERE kind = 'task_list' AND object_id = NEW.id;
+      SELECT CASE WHEN EXISTS (
+        SELECT 1 FROM task_lists
+        WHERE id <> NEW.id AND project_id IS NEW.project_id AND slug = NEW.slug
+      ) AND NEW.slug IS NOT NULL AND NEW.slug <> ''
+        THEN RAISE(ABORT, 'TASK_LIST_SLUG_CONFLICT') END;
+      INSERT OR IGNORE INTO canonical_slug_claims(kind, scope_key, slug, object_id)
+        SELECT 'task_list', CASE WHEN NEW.project_id IS NULL THEN 'standalone:' ELSE 'project:' || NEW.project_id END, NEW.slug, NEW.id
+        WHERE NEW.slug IS NOT NULL AND NEW.slug <> '';
+      SELECT CASE WHEN NEW.slug IS NOT NULL AND NEW.slug <> '' AND (
+        SELECT object_id FROM canonical_slug_claims
+        WHERE kind = 'task_list'
+          AND scope_key = CASE WHEN NEW.project_id IS NULL THEN 'standalone:' ELSE 'project:' || NEW.project_id END
+          AND slug = NEW.slug
+      ) <> NEW.id THEN RAISE(ABORT, 'TASK_LIST_SLUG_CONFLICT') END;
+    END`);
+  db.exec(`CREATE TRIGGER IF NOT EXISTS release_task_list_canonical_slug_delete
+    AFTER DELETE ON task_lists
+    BEGIN
+      DELETE FROM canonical_slug_claims WHERE kind = 'task_list' AND object_id = OLD.id;
+    END`);
   ensureTable("storage_tombstones", `
     CREATE TABLE storage_tombstones (
       id TEXT PRIMARY KEY,
@@ -12489,7 +12587,7 @@ var init_database = __esm(() => {
 });
 
 // src/types/index.ts
-var TASK_STATUSES, TASK_PRIORITIES, VersionConflictError, TaskNotFoundError, ProjectNotFoundError, PlanNotFoundError, LockError, AgentNotFoundError, TaskListNotFoundError, DependencyCycleError, CompletionGuardError, DispatchNotFoundError;
+var TASK_STATUSES, TASK_PRIORITIES, VersionConflictError, TaskNotFoundError, ProjectNotFoundError, ResourceConflictError, PlanNotFoundError, LockError, AgentNotFoundError, TaskListNotFoundError, DependencyCycleError, CompletionGuardError, DispatchNotFoundError;
 var init_types = __esm(() => {
   TASK_STATUSES = [
     "pending",
@@ -12538,6 +12636,14 @@ var init_types = __esm(() => {
       this.name = "ProjectNotFoundError";
     }
   };
+  ResourceConflictError = class ResourceConflictError extends Error {
+    code;
+    constructor(code, message) {
+      super(message);
+      this.code = code;
+      this.name = "ResourceConflictError";
+    }
+  };
   PlanNotFoundError = class PlanNotFoundError extends Error {
     planId;
     static code = "PLAN_NOT_FOUND";
@@ -12690,6 +12796,91 @@ var init_storage_tombstones = __esm(() => {
   init_machines();
 });
 
+// src/lib/slugs.ts
+function normalizeSlug(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function isCanonicalSlug(value) {
+  return typeof value === "string" && value.length > 0 && normalizeSlug(value) === value;
+}
+function isValidTaskListProjectScope(value) {
+  return value === undefined || value === null || typeof value === "string" && value.trim().length > 0;
+}
+function validateSnapshotRoutingRecords(projects, taskLists) {
+  const errors = [];
+  const projectSlugs = new Map;
+  const taskListSlugs = new Map;
+  for (const project of projects) {
+    if (!isCanonicalSlug(project.task_list_id)) {
+      errors.push(`project ${project.id}: task_list_id must be non-empty canonical kebab-case`);
+      continue;
+    }
+    const existing = projectSlugs.get(project.task_list_id);
+    if (projectSlugs.has(project.task_list_id)) {
+      errors.push(`project ${project.id}: task_list_id duplicates project ${existing}: ${project.task_list_id}`);
+    } else {
+      projectSlugs.set(project.task_list_id, project.id);
+    }
+  }
+  for (const taskList of taskLists) {
+    if (!isCanonicalSlug(taskList.slug)) {
+      errors.push(`task list ${taskList.id}: slug must be non-empty canonical kebab-case`);
+      continue;
+    }
+    if (!isValidTaskListProjectScope(taskList.project_id)) {
+      errors.push(`task list ${taskList.id}: project_id must be null, missing, or a non-empty string`);
+      continue;
+    }
+    const scope = taskList.project_id ?? null;
+    const scopedSlugs = taskListSlugs.get(scope) ?? new Map;
+    const existing = scopedSlugs.get(taskList.slug);
+    if (scopedSlugs.has(taskList.slug)) {
+      errors.push(`task list ${taskList.id}: slug duplicates task list ${existing} in the same scope: ${taskList.slug}`);
+    } else {
+      scopedSlugs.set(taskList.slug, taskList.id);
+      taskListSlugs.set(scope, scopedSlugs);
+    }
+  }
+  return errors;
+}
+function validateSnapshotRoutingDestinationConflicts(projects, taskLists, existingProjects, existingTaskLists) {
+  const errors = [];
+  for (const project of projects) {
+    const current = existingProjects.find((candidate) => candidate.id === project.id);
+    if (current?.task_list_id === project.task_list_id)
+      continue;
+    const conflict = existingProjects.find((candidate) => candidate.id !== project.id && candidate.task_list_id === project.task_list_id);
+    if (conflict) {
+      errors.push(`project ${project.id}: task_list_id conflicts with existing project ${conflict.id}: ${String(project.task_list_id)}`);
+    }
+  }
+  for (const taskList of taskLists) {
+    const projectId = taskList.project_id ?? null;
+    const current = existingTaskLists.find((candidate) => candidate.id === taskList.id);
+    if ((current?.project_id ?? null) === projectId && current?.slug === taskList.slug)
+      continue;
+    const conflict = existingTaskLists.find((candidate) => candidate.id !== taskList.id && (candidate.project_id ?? null) === projectId && candidate.slug === taskList.slug);
+    if (conflict) {
+      errors.push(`task list ${taskList.id}: slug conflicts with existing task list ${conflict.id} in the same scope: ${String(taskList.slug)}`);
+    }
+  }
+  return errors;
+}
+
+// src/db/slug-claims.ts
+function taskListSlugScopeKey(projectId) {
+  return projectId ? `project:${projectId}` : "standalone:";
+}
+function claimCanonicalSlug(kind, scopeKey, slug, objectId, db) {
+  db.run(`INSERT OR IGNORE INTO canonical_slug_claims (kind, scope_key, slug, object_id)
+     VALUES (?, ?, ?, ?)`, [kind, scopeKey, slug, objectId]);
+  const claim = db.query("SELECT object_id FROM canonical_slug_claims WHERE kind = ? AND scope_key = ? AND slug = ?").get(kind, scopeKey, slug);
+  return claim?.object_id === objectId;
+}
+function releaseCanonicalSlugClaims(kind, objectId, db) {
+  db.run("DELETE FROM canonical_slug_claims WHERE kind = ? AND object_id = ?", [kind, objectId]);
+}
+
 // src/db/projects.ts
 var exports_projects = {};
 __export(exports_projects, {
@@ -12713,7 +12904,7 @@ __export(exports_projects, {
   addProjectSource: () => addProjectSource
 });
 function slugify(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+  return normalizeSlug(name);
 }
 function generatePrefix(name, db) {
   const words = name.replace(/[^a-zA-Z0-9\s]/g, "").trim().split(/\s+/);
@@ -12737,14 +12928,23 @@ function generatePrefix(name, db) {
 }
 function createProject(input, db) {
   const d = db || getDatabase();
-  const id = uuid();
-  const timestamp = now();
-  const taskListId = input.task_list_id ?? `todos-${slugify(input.name)}`;
-  const taskPrefix = input.task_prefix || generatePrefix(input.name, d);
-  const machineId = currentStorageMachineId(d);
-  d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, created_at, updated_at, machine_id)
-     VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, timestamp, timestamp, machineId]);
-  return getProject(id, d);
+  return d.transaction(() => {
+    const id = uuid();
+    const timestamp = now();
+    const derivedSlug = slugify(input.name);
+    const taskListId = input.task_list_id === undefined ? `todos-${derivedSlug}` : slugify(input.task_list_id);
+    if (!derivedSlug || !taskListId)
+      throw new Error("Project name and task-list slug must be non-empty");
+    const slugConflict = d.query("SELECT id FROM projects WHERE task_list_id = ? LIMIT 1").get(taskListId);
+    if (slugConflict || !claimCanonicalSlug("project", "global", taskListId, id, d)) {
+      throw new ResourceConflictError("PROJECT_SLUG_CONFLICT", `Project slug "${taskListId}" already exists`);
+    }
+    const taskPrefix = input.task_prefix || generatePrefix(input.name, d);
+    const machineId = currentStorageMachineId(d);
+    d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, created_at, updated_at, machine_id)
+       VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, timestamp, timestamp, machineId]);
+    return getProject(id, d);
+  })();
 }
 function getProject(id, db) {
   const d = db || getDatabase();
@@ -12772,6 +12972,9 @@ function updateProject(id, input, db) {
   const project = getProject(id, d);
   if (!project)
     throw new ProjectNotFoundError(id);
+  if ("task_list_id" in input) {
+    throw new Error("task_list_id cannot be changed by updateProject; use renameProject for an atomic canonical rename");
+  }
   const sets = ["updated_at = ?"];
   const params = [now()];
   if (input.name !== undefined) {
@@ -12782,10 +12985,6 @@ function updateProject(id, input, db) {
     sets.push("description = ?");
     params.push(input.description);
   }
-  if (input.task_list_id !== undefined) {
-    sets.push("task_list_id = ?");
-    params.push(input.task_list_id);
-  }
   if (input.path !== undefined) {
     sets.push("path = ?");
     params.push(input.path);
@@ -12796,29 +12995,41 @@ function updateProject(id, input, db) {
 }
 function renameProject(id, input, db) {
   const d = db || getDatabase();
-  const project = getProject(id, d);
-  if (!project)
-    throw new ProjectNotFoundError(id);
-  let taskListsUpdated = 0;
-  const ts = now();
-  if (input.new_slug !== undefined) {
-    const normalised = input.new_slug.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-|-$/g, "");
-    if (!normalised)
-      throw new Error("Invalid slug \u2014 must be non-empty kebab-case");
-    const conflict = d.query("SELECT id FROM projects WHERE task_list_id = ? AND id != ?").get(normalised, id);
-    if (conflict)
-      throw new Error(`Slug "${normalised}" is already used by another project`);
-    const oldSlug = project.task_list_id;
-    d.run("UPDATE projects SET task_list_id = ?, updated_at = ? WHERE id = ?", [normalised, ts, id]);
-    if (oldSlug) {
-      const result = d.run("UPDATE task_lists SET slug = ?, name = COALESCE(?, name), updated_at = ? WHERE project_id = ? AND slug = ?", [normalised, input.name ?? null, ts, id, oldSlug]);
-      taskListsUpdated = result.changes;
+  return d.transaction(() => {
+    const project = getProject(id, d);
+    if (!project)
+      throw new ProjectNotFoundError(id);
+    let taskListsUpdated = 0;
+    const ts = now();
+    if (input.new_slug !== undefined) {
+      const normalised = normalizeSlug(input.new_slug);
+      if (!normalised)
+        throw new Error("Invalid slug \u2014 must be non-empty kebab-case");
+      const oldSlug = project.task_list_id;
+      if (normalised !== oldSlug) {
+        const conflict = d.query("SELECT id FROM projects WHERE task_list_id = ? AND id != ?").get(normalised, id);
+        if (conflict) {
+          throw new ResourceConflictError("PROJECT_SLUG_CONFLICT", `Slug "${normalised}" is already used by another project`);
+        }
+        const taskListConflict = d.query("SELECT id FROM task_lists WHERE project_id = ? AND slug = ? AND slug != COALESCE(?, '') LIMIT 1").get(id, normalised, oldSlug);
+        if (taskListConflict) {
+          throw new ResourceConflictError("TASK_LIST_SLUG_CONFLICT", `Task-list slug "${normalised}" is already used in project "${project.name}"`);
+        }
+        releaseCanonicalSlugClaims("project", id, d);
+        if (!claimCanonicalSlug("project", "global", normalised, id, d)) {
+          throw new ResourceConflictError("PROJECT_SLUG_CONFLICT", `Slug "${normalised}" is already used by another project`);
+        }
+        d.run("UPDATE projects SET task_list_id = ?, updated_at = ? WHERE id = ?", [normalised, ts, id]);
+      }
+      if (oldSlug && (normalised !== oldSlug || input.name !== undefined && input.name !== project.name)) {
+        taskListsUpdated = d.query("UPDATE task_lists SET slug = ?, name = COALESCE(?, name), updated_at = ? WHERE project_id = ? AND slug = ? RETURNING id").all(normalised, input.name ?? null, ts, id, oldSlug).length;
+      }
     }
-  }
-  if (input.name !== undefined) {
-    d.run("UPDATE projects SET name = ?, updated_at = ? WHERE id = ?", [input.name, ts, id]);
-  }
-  return { project: getProject(id, d), task_lists_updated: taskListsUpdated };
+    if (input.name !== undefined && input.name !== project.name) {
+      d.run("UPDATE projects SET name = ?, updated_at = ? WHERE id = ?", [input.name, ts, id]);
+    }
+    return { project: getProject(id, d), task_lists_updated: taskListsUpdated };
+  })();
 }
 function deleteProject(id, db) {
   const d = db || getDatabase();
@@ -12830,8 +13041,10 @@ function deleteProject(id, db) {
     object_id: id,
     payload: project
   }, d);
-  const result = d.run("DELETE FROM projects WHERE id = ?", [id]);
-  return result.changes > 0;
+  return d.transaction(() => {
+    releaseCanonicalSlugClaims("project", id, d);
+    return d.run("DELETE FROM projects WHERE id = ?", [id]).changes > 0;
+  })();
 }
 function rowToSource(row) {
   return {
@@ -14519,19 +14732,22 @@ function rowToTaskList(row) {
 }
 function createTaskList(input, db) {
   const d = db || getDatabase();
-  const id = uuid();
-  const timestamp = now();
-  const slug = input.slug || slugify(input.name);
-  const machineId = currentStorageMachineId(d);
-  if (!input.project_id) {
-    const existing = d.query("SELECT id FROM task_lists WHERE project_id IS NULL AND slug = ?").get(slug);
-    if (existing) {
-      throw new Error(`Standalone task list with slug "${slug}" already exists`);
-    }
-  }
-  d.run(`INSERT INTO task_lists (id, project_id, slug, name, description, metadata, created_at, updated_at, machine_id)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [id, input.project_id || null, slug, input.name, input.description || null, JSON.stringify(input.metadata || {}), timestamp, timestamp, machineId]);
-  return getTaskList(id, d);
+  return d.transaction(() => {
+    const id = uuid();
+    const timestamp = now();
+    const slug = normalizeSlug(input.slug === undefined ? input.name : input.slug);
+    if (!slug)
+      throw new Error("Invalid task-list slug \u2014 must be non-empty kebab-case");
+    const machineId = currentStorageMachineId(d);
+    const scopeKey = taskListSlugScopeKey(input.project_id);
+    const existing = input.project_id ? d.query("SELECT id FROM task_lists WHERE project_id = ? AND slug = ?").get(input.project_id, slug) : d.query("SELECT id FROM task_lists WHERE project_id IS NULL AND slug = ?").get(slug);
+    if (existing || !claimCanonicalSlug("task_list", scopeKey, slug, id, d)) {
+      throw new ResourceConflictError("TASK_LIST_SLUG_CONFLICT", `Task list with slug "${slug}" already exists in this scope`);
+    }
+    d.run(`INSERT INTO task_lists (id, project_id, slug, name, description, metadata, created_at, updated_at, machine_id)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [id, input.project_id || null, slug, input.name, input.description || null, JSON.stringify(input.metadata || {}), timestamp, timestamp, machineId]);
+    return getTaskList(id, d);
+  })();
 }
 function getTaskList(id, db) {
   const d = db || getDatabase();
@@ -14557,26 +14773,45 @@ function listTaskLists(projectId, db) {
 }
 function updateTaskList(id, input, db) {
   const d = db || getDatabase();
-  const existing = getTaskList(id, d);
-  if (!existing)
-    throw new TaskListNotFoundError(id);
-  const sets = ["updated_at = ?"];
-  const params = [now()];
-  if (input.name !== undefined) {
-    sets.push("name = ?");
-    params.push(input.name);
-  }
-  if (input.description !== undefined) {
-    sets.push("description = ?");
-    params.push(input.description);
-  }
-  if (input.metadata !== undefined) {
-    sets.push("metadata = ?");
-    params.push(JSON.stringify(input.metadata));
-  }
-  params.push(id);
-  d.run(`UPDATE task_lists SET ${sets.join(", ")} WHERE id = ?`, params);
-  return getTaskList(id, d);
+  return d.transaction(() => {
+    const existing = getTaskList(id, d);
+    if (!existing)
+      throw new TaskListNotFoundError(id);
+    const sets = ["updated_at = ?"];
+    const params = [now()];
+    if (input.slug !== undefined) {
+      const slug = slugify(input.slug);
+      if (!slug)
+        throw new Error("Invalid task-list slug \u2014 must be non-empty kebab-case");
+      const duplicate = existing.project_id ? d.query("SELECT id FROM task_lists WHERE project_id = ? AND slug = ? AND id != ?").get(existing.project_id, slug, id) : d.query("SELECT id FROM task_lists WHERE project_id IS NULL AND slug = ? AND id != ?").get(slug, id);
+      if (duplicate) {
+        throw new ResourceConflictError("TASK_LIST_SLUG_CONFLICT", `Task list with slug "${slug}" already exists in this scope`);
+      }
+      if (slug !== existing.slug) {
+        releaseCanonicalSlugClaims("task_list", id, d);
+        if (!claimCanonicalSlug("task_list", taskListSlugScopeKey(existing.project_id), slug, id, d)) {
+          throw new ResourceConflictError("TASK_LIST_SLUG_CONFLICT", `Task list with slug "${slug}" already exists in this scope`);
+        }
+      }
+      sets.push("slug = ?");
+      params.push(slug);
+    }
+    if (input.name !== undefined) {
+      sets.push("name = ?");
+      params.push(input.name);
+    }
+    if (input.description !== undefined) {
+      sets.push("description = ?");
+      params.push(input.description);
+    }
+    if (input.metadata !== undefined) {
+      sets.push("metadata = ?");
+      params.push(JSON.stringify(input.metadata));
+    }
+    params.push(id);
+    d.run(`UPDATE task_lists SET ${sets.join(", ")} WHERE id = ?`, params);
+    return getTaskList(id, d);
+  })();
 }
 function deleteTaskList(id, db) {
   const d = db || getDatabase();
@@ -14588,7 +14823,10 @@ function deleteTaskList(id, db) {
     object_id: id,
     payload: list
   }, d);
-  return d.run("DELETE FROM task_lists WHERE id = ?", [id]).changes > 0;
+  return d.transaction(() => {
+    releaseCanonicalSlugClaims("task_list", id, d);
+    return d.run("DELETE FROM task_lists WHERE id = ?", [id]).changes > 0;
+  })();
 }
 function ensureTaskList(name, slug, projectId, db) {
   const d = db || getDatabase();
@@ -20580,7 +20818,8 @@ function registerTaskCommands(program2) {
     if (cloud) {
       let task3;
       try {
-        const cloudProjectId = opts.project || globalOpts.project;
+        const cloudProjectRef = opts.project || globalOpts.project;
+        const cloudProjectId = cloudProjectRef ? await cloudResolveProjectRef(cloud, cloudProjectRef) : undefined;
         const cloudTaskListId = opts.list ? await cloudResolveTaskListRef(cloud, opts.list, cloudProjectId) : undefined;
         if (opts.list && !cloudTaskListId) {
           throw new Error(`Could not resolve task list ID or slug: ${opts.list}`);
@@ -24052,10 +24291,10 @@ function bootstrapProject(options = {}, db) {
   let project = ensureProject(options.name || discovery.projectName, discovery.projectPath, d);
   const createdProject = !beforeProject;
   if (project.task_list_id !== taskListSlug || options.name && project.name !== options.name) {
-    project = updateProject(project.id, {
+    project = renameProject(project.id, {
       name: options.name ?? project.name,
-      task_list_id: taskListSlug
-    }, d);
+      new_slug: taskListSlug
+    }, d).project;
   }
   setMachineLocalPath(project.id, discovery.projectPath, d);
   const beforeTaskList = d.query("SELECT id FROM task_lists WHERE project_id = ? AND slug = ?").get(project.id, taskListSlug);
@@ -32397,7 +32636,7 @@ function registerProjectCommands(program2) {
       if (existing) {
         project = existing;
         if (opts.taskListId) {
-          project = updateProject(existing.id, { task_list_id: opts.taskListId });
+          project = renameProject(existing.id, { new_slug: opts.taskListId }).project;
         }
       } else {
         project = createProject({ name, path: projectPath, task_list_id: opts.taskListId });
@@ -32462,18 +32701,23 @@ function registerProjectCommands(program2) {
     const globalOpts = program2.opts();
     const useJson = opts.json || globalOpts.json;
     try {
-      const { renameProject: renameProject2 } = await Promise.resolve().then(() => (init_projects(), exports_projects));
-      const db = getDatabase();
-      let resolvedId = resolvePartialId(db, "projects", idOrSlug);
-      if (!resolvedId) {
-        const bySlug = db.query("SELECT id FROM projects WHERE task_list_id = ?").get(idOrSlug);
-        resolvedId = bySlug?.id ?? null;
-      }
-      if (!resolvedId) {
-        console.error(chalk4.red(`Project not found: ${idOrSlug}`));
-        process.exit(1);
+      const cloud = getTodosCloudClient();
+      let result;
+      if (cloud) {
+        result = await cloudRenameProject(cloud, idOrSlug, newSlug, opts.name);
+      } else {
+        const db = getDatabase();
+        let resolvedId = resolvePartialId(db, "projects", idOrSlug);
+        if (!resolvedId) {
+          const bySlug = db.query("SELECT id FROM projects WHERE task_list_id = ?").get(idOrSlug);
+          resolvedId = bySlug?.id ?? null;
+        }
+        if (!resolvedId) {
+          console.error(chalk4.red(`Project not found: ${idOrSlug}`));
+          process.exit(1);
+        }
+        result = renameProject(resolvedId, { name: opts.name, new_slug: newSlug });
       }
-      const result = renameProject2(resolvedId, { name: opts.name, new_slug: newSlug });
       if (useJson) {
         output({ project: result.project, task_lists_updated: result.task_lists_updated }, true);
       } else {
@@ -33828,7 +34072,7 @@ ${isOnline ? chalk5.green("\u25CF") : chalk5.dim("\u25CB")} ${chalk5.bold(agent.
     try {
       const globalOpts = program2.opts();
       const cloud = getTodosCloudClient();
-      const projectId = cloud ? globalOpts.project : autoProject(globalOpts);
+      const projectId = cloud ? globalOpts.project ? await cloudResolveProjectRef(cloud, globalOpts.project) : undefined : autoProject(globalOpts);
       if (opts.add) {
         const input = { name: opts.add, slug: opts.slug, description: opts.description, project_id: projectId };
         const list = cloud ? await cloudCreateTaskList(cloud, input) : createTaskList(input);
@@ -37762,6 +38006,14 @@ function importSqliteTodosStorageSnapshot(snapshot, db) {
     skipped: 0,
     errors: []
   };
+  result.errors.push(...validateSnapshotRoutingRecords(snapshot.projects, snapshot.taskLists));
+  if (result.errors.length === 0) {
+    const existingProjects = d.query("SELECT id, task_list_id FROM projects").all();
+    const existingTaskLists = d.query("SELECT id, project_id, slug FROM task_lists").all();
+    result.errors.push(...validateSnapshotRoutingDestinationConflicts(snapshot.projects, snapshot.taskLists, existingProjects, existingTaskLists));
+  }
+  if (result.errors.length > 0)
+    return result;
   const applyRows = (objectType3, table, columns, rows, updateClockColumn, afterUpsert) => {
     for (const row of rows) {
       try {
@@ -38134,6 +38386,7 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       getByPath: (path) => getProjectByPath(path, database()),
       list: () => listProjects(database()),
       update: (id, input) => updateProject(id, input, database()),
+      rename: (id, input) => renameProject(id, input, database()),
       delete: (id) => deleteProject(id, database())
     },
     plans: {
@@ -38241,6 +38494,91 @@ function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABL
     )`
   ];
 }
+function postgresTodosScopedSlugPreflightSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABLE) {
+  assertSafeIdentifier(tableName);
+  return `/* todos:scoped-slug-duplicate-audit */ WITH candidates AS (
+    SELECT service, object_type, COALESCE(payload->>'project_id', '') AS scope,
+      jsonb_typeof(payload->'project_id') AS scope_type,
+      payload->>'slug' AS slug, jsonb_typeof(payload->'slug') AS slug_type, object_id
+    FROM ${tableName}
+    WHERE object_type = 'task_lists' AND deleted_at IS NULL
+    UNION ALL
+    SELECT service, object_type, '' AS scope, NULL::text AS scope_type, payload->>'task_list_id' AS slug,
+      jsonb_typeof(payload->'task_list_id') AS slug_type, object_id
+    FROM ${tableName}
+    WHERE object_type = 'projects' AND deleted_at IS NULL
+  ), annotated AS (
+    SELECT *, trim(both '-' from regexp_replace(lower(COALESCE(slug, '')), '[^a-z0-9]+', '-', 'g')) AS normalized_slug
+    FROM candidates
+  ), invalid AS (
+    SELECT service, object_type, scope, COALESCE(slug, '<null>') AS slug,
+      ARRAY[object_id] AS object_ids, 1::integer AS duplicate_count, 'invalid'::text AS issue
+    FROM annotated
+    WHERE slug_type IS DISTINCT FROM 'string'
+      OR slug IS NULL OR slug = '' OR normalized_slug = '' OR slug IS DISTINCT FROM normalized_slug
+      OR (object_type = 'task_lists' AND (
+        (scope_type IS NOT NULL AND scope_type NOT IN ('string', 'null'))
+        OR (scope_type = 'string' AND btrim(scope) = '')
+      ))
+  ), duplicates AS (
+    SELECT service, object_type, scope, slug,
+      array_agg(object_id ORDER BY object_id) AS object_ids,
+      count(*)::integer AS duplicate_count, 'duplicate'::text AS issue
+    FROM annotated
+    WHERE slug = normalized_slug AND slug <> ''
+    GROUP BY service, object_type, scope, slug
+    HAVING count(*) > 1
+  ) SELECT * FROM invalid
+    UNION ALL SELECT * FROM duplicates
+    ORDER BY service, object_type, scope, slug`;
+}
+function postgresTodosScopedSlugUniqueIndexSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABLE) {
+  assertSafeIdentifier(tableName);
+  return [
+    `CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS ${tableName}_task_list_scope_slug_uidx
+      ON ${tableName} (service, COALESCE(payload->>'project_id', ''), (payload->>'slug'))
+      WHERE object_type = 'task_lists' AND deleted_at IS NULL AND COALESCE(payload->>'slug', '') <> ''`,
+    `CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS ${tableName}_project_task_list_slug_uidx
+      ON ${tableName} (service, (payload->>'task_list_id'))
+      WHERE object_type = 'projects' AND deleted_at IS NULL AND COALESCE(payload->>'task_list_id', '') <> ''`
+  ];
+}
+function postgresTodosScopedSlugIndexStatusSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABLE) {
+  assertSafeIdentifier(tableName);
+  return `/* todos:scoped-slug-index-status */ SELECT index_class.relname AS index_name,
+      index_meta.indisvalid AS is_valid, index_meta.indisready AS is_ready
+    FROM pg_index index_meta
+    JOIN pg_class index_class ON index_class.oid = index_meta.indexrelid
+    WHERE index_meta.indrelid = to_regclass('${tableName}')
+      AND index_class.relname IN (
+        '${tableName}_task_list_scope_slug_uidx',
+        '${tableName}_project_task_list_slug_uidx'
+      )`;
+}
+async function ensurePostgresScopedSlugUniqueIndexes(client, tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABLE) {
+  const audit = await client.query(postgresTodosScopedSlugPreflightSql(tableName));
+  if (audit.rows.length > 0)
+    throw new PostgresScopedSlugMigrationConflictError(audit.rows);
+  for (const sql of postgresTodosScopedSlugUniqueIndexSql(tableName)) {
+    try {
+      await client.query(sql);
+    } catch (error) {
+      const indexName = sql.match(/INDEX CONCURRENTLY IF NOT EXISTS ([a-zA-Z0-9_]+)/)?.[1] ?? "unknown_index";
+      throw new PostgresScopedSlugIndexBuildError(indexName, error);
+    }
+  }
+  const expected = new Set([
+    `${tableName}_task_list_scope_slug_uidx`,
+    `${tableName}_project_task_list_slug_uidx`
+  ]);
+  const status = await client.query(postgresTodosScopedSlugIndexStatusSql(tableName));
+  for (const indexName of expected) {
+    const row = status.rows.find((candidate) => candidate.index_name === indexName);
+    if (!row?.is_valid || !row.is_ready) {
+      throw new PostgresScopedSlugIndexBuildError(indexName, new Error("index is missing, invalid, or not ready"));
+    }
+  }
+}
 function postgresTodosCommentCursorIndexSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABLE) {
   assertSafeIdentifier(tableName);
   return `CREATE INDEX CONCURRENTLY IF NOT EXISTS ${tableName}_comment_task_created_idx
@@ -38269,9 +38607,31 @@ class PostgresTodosSyncStore {
     }
   }
   async pushSnapshot(snapshot, context = {}) {
+    const routingErrors = validateSnapshotRoutingRecords(snapshot.projects, snapshot.taskLists);
+    if (routingErrors.length > 0) {
+      throw new Error(`Invalid snapshot routing metadata: ${routingErrors.join("; ")}`);
+    }
+    const existing = await this.client.query(`SELECT object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version
+       FROM ${this.tableName}
+       WHERE service = $1 AND object_type IN ($2, $3) AND deleted_at IS NULL`, [this.service, "projects", "task_lists"]);
+    const existingProjects = [];
+    const existingTaskLists = [];
+    for (const row of existing.rows) {
+      const payload = payloadRecord(row.payload);
+      if (row.object_type === "projects")
+        existingProjects.push(payload);
+      if (row.object_type === "task_lists")
+        existingTaskLists.push(payload);
+    }
+    const destinationErrors = validateSnapshotRoutingDestinationConflicts(snapshot.projects, snapshot.taskLists, existingProjects, existingTaskLists);
+    if (destinationErrors.length > 0) {
+      throw new Error(`Snapshot routing conflicts with destination: ${destinationErrors.join("; ")}`);
+    }
     const result = { records: 0, objectTypes: {} };
     const sourceMachineId = context.requestId ?? this.sourceMachineId ?? null;
     for (const entry of snapshotEntries(snapshot)) {
+      if (entry.deletedAt === null)
+        assertCanonicalScopedSlugEntry(entry);
       await this.client.query(`INSERT INTO ${this.tableName} (
           service, object_type, object_id, payload, updated_at,
           deleted_at, source_machine_id, version
@@ -38350,6 +38710,22 @@ function snapshotEntries(snapshot) {
     }))
   ];
 }
+function assertCanonicalScopedSlugEntry(entry) {
+  if (!entry.payload || typeof entry.payload !== "object" || Array.isArray(entry.payload))
+    return;
+  const payload = entry.payload;
+  if (entry.type === "projects" && !isCanonicalSlug(payload["task_list_id"])) {
+    throw new Error("Invalid project task-list slug \u2014 sync requires non-empty canonical kebab-case");
+  }
+  if (entry.type === "task_lists") {
+    if (!isCanonicalSlug(payload["slug"])) {
+      throw new Error("Invalid task-list slug \u2014 sync requires non-empty canonical kebab-case");
+    }
+    if (!isValidTaskListProjectScope(payload["project_id"])) {
+      throw new Error("Invalid task-list project scope \u2014 project_id must be null, missing, or a non-empty string");
+    }
+  }
+}
 function entry(type, payload, fallbackUpdatedAt) {
   const id = payload["id"];
   if (typeof id !== "string" || !id)
@@ -38432,7 +38808,26 @@ function assertSafeIdentifier(value) {
   if (!/^[a-z_][a-z0-9_]*$/i.test(value))
     throw new Error(`Unsafe Postgres identifier: ${value}`);
 }
-var DEFAULT_TODOS_POSTGRES_SYNC_TABLE = "todos_sync_records", DEFAULT_TODOS_POSTGRES_CURSOR_TABLE = "todos_sync_cursors";
+var DEFAULT_TODOS_POSTGRES_SYNC_TABLE = "todos_sync_records", DEFAULT_TODOS_POSTGRES_CURSOR_TABLE = "todos_sync_cursors", PostgresScopedSlugMigrationConflictError, PostgresScopedSlugIndexBuildError;
+var init_postgres_sync = __esm(() => {
+  PostgresScopedSlugMigrationConflictError = class PostgresScopedSlugMigrationConflictError extends Error {
+    conflicts;
+    constructor(conflicts) {
+      const preview = conflicts.slice(0, 5).map((conflict) => `${conflict.object_type}:${conflict.scope || "global"}:${conflict.slug} [${conflict.object_ids.join(", ")}]`).join("; ");
+      super(`Scoped slug unique-index preflight found ${conflicts.length} invalid or duplicate slug conflict(s): ${preview}. ` + "Resolve these records explicitly without deleting history, then rerun todos-serve migrate.");
+      this.conflicts = conflicts;
+      this.name = "PostgresScopedSlugMigrationConflictError";
+    }
+  };
+  PostgresScopedSlugIndexBuildError = class PostgresScopedSlugIndexBuildError extends Error {
+    index_name;
+    constructor(index_name, cause) {
+      super(`Concurrent scoped-slug index build failed for ${index_name} after a clean duplicate audit. ` + "No records were rewritten; inspect pg_index for an invalid index, resolve any concurrent duplicate, and rerun todos-serve migrate.", { cause });
+      this.index_name = index_name;
+      this.name = "PostgresScopedSlugIndexBuildError";
+    }
+  };
+});
 
 // src/storage/shadow-outbox.ts
 class TodosShadowOutbox {
@@ -38684,6 +39079,7 @@ function createTodosShadowOutbox(options) {
 var MAX_BACKOFF_MS;
 var init_shadow_outbox = __esm(() => {
   init_local_sqlite();
+  init_postgres_sync();
   init_shadow_outbox_schema();
   init_shadow_outbox_schema();
   MAX_BACKOFF_MS = 5 * 60000;
@@ -39188,6 +39584,7 @@ function createPostgresTodosStorageAdapter(options) {
       getByPath: async (path) => (await store.list("projects")).find((project) => project.path === path) ?? null,
       list: async () => (await store.list("projects")).sort((a, b) => a.name.localeCompare(b.name)),
       update: (id, input) => updateProject2(id, input, store),
+      rename: (id, input, context) => store.renameProject(id, input.new_slug, input.name, context),
       delete: (id, context) => store.delete("projects", id, context)
     },
     plans: {
@@ -39425,9 +39822,22 @@ class PostgresJsonRecordStore {
     });
   }
   async upsert(type, value, context = {}) {
+    if (type === "projects" && !isCanonicalSlug(value.task_list_id)) {
+      throw new Error("Invalid project task-list slug \u2014 imports require non-empty canonical kebab-case");
+    }
+    if (type === "task_lists") {
+      if (!isCanonicalSlug(value.slug)) {
+        throw new Error("Invalid task-list slug \u2014 imports require non-empty canonical kebab-case");
+      }
+      if (!isValidTaskListProjectScope(value.project_id)) {
+        throw new Error("Invalid task-list project scope \u2014 project_id must be null, missing, or a non-empty string");
+      }
+    }
     await this.ensureSchema();
     const updatedAt = stringValue2(value.updated_at) ?? stringValue2(value.created_at) ?? new Date().toISOString();
-    const result = await this.options.client.query(`INSERT INTO ${this.tableName} (
+    let result;
+    try {
+      result = await this.options.client.query(`INSERT INTO ${this.tableName} (
         service, object_type, object_id, payload, updated_at,
         deleted_at, source_machine_id, version
       ) VALUES ($1, $2, $3, $4::jsonb, $5::timestamptz, NULL, $6, $7)
@@ -39442,14 +39852,23 @@ class PostgresJsonRecordStore {
          OR (${this.tableName}.updated_at = EXCLUDED.updated_at
              AND COALESCE(${this.tableName}.version, 0) <= COALESCE(EXCLUDED.version, 0))
       RETURNING object_id`, [
-      this.service,
-      type,
-      value.id,
-      jsonbParam(value),
-      updatedAt,
-      context.requestId ?? this.sourceMachineId ?? null,
-      numberValue2(value.version)
-    ]);
+        this.service,
+        type,
+        value.id,
+        jsonbParam(value),
+        updatedAt,
+        context.requestId ?? this.sourceMachineId ?? null,
+        numberValue2(value.version)
+      ]);
+    } catch (error) {
+      if (type === "task_lists" && isPostgresUniqueViolation(error)) {
+        throw new ResourceConflictError("TASK_LIST_SLUG_CONFLICT", `Task list with slug "${String(value.slug ?? "")}" already exists in this scope`);
+      }
+      if (type === "projects" && isPostgresUniqueViolation(error)) {
+        throw new ResourceConflictError("PROJECT_SLUG_CONFLICT", `Project slug "${String(value.task_list_id ?? "")}" already exists`);
+      }
+      throw error;
+    }
     if (result.rows.length === 0) {
       const current = await this.get(type, value.id);
       if (current)
@@ -39457,6 +39876,93 @@ class PostgresJsonRecordStore {
     }
     return value;
   }
+  async renameProject(id, newSlug, name, context = {}) {
+    await this.ensureSchema();
+    const normalizedSlug = slugifyRaw(newSlug);
+    if (!normalizedSlug)
+      throw new Error("Invalid slug \u2014 must be non-empty kebab-case");
+    const timestamp = new Date().toISOString();
+    try {
+      const result = await this.options.client.query(`/* todos:rename-project-atomic */ WITH target AS (
+          SELECT payload, payload->>'task_list_id' AS old_slug
+          FROM ${this.tableName}
+          WHERE service = $1 AND object_type = 'projects' AND object_id = $2 AND deleted_at IS NULL
+          FOR UPDATE
+        ), project_conflict AS (
+          SELECT 1 FROM ${this.tableName}
+          WHERE service = $1 AND object_type = 'projects' AND object_id <> $2
+            AND deleted_at IS NULL AND payload->>'task_list_id' = $3 LIMIT 1
+        ), task_list_conflict AS (
+          SELECT 1 FROM ${this.tableName} r, target
+          WHERE r.service = $1 AND r.object_type = 'task_lists' AND r.deleted_at IS NULL
+            AND r.payload->>'project_id' = $2 AND r.payload->>'slug' = $3
+            AND r.payload->>'slug' IS DISTINCT FROM target.old_slug LIMIT 1
+        ), updated_lists AS (
+          UPDATE ${this.tableName} r SET
+            payload = r.payload || jsonb_build_object('slug', $3::text, 'updated_at', $5::text)
+              || CASE WHEN $4::text IS NULL THEN '{}'::jsonb ELSE jsonb_build_object('name', $4::text) END,
+            updated_at = $5::timestamptz, version = COALESCE(r.version, 0) + 1,
+            source_machine_id = COALESCE($6, r.source_machine_id)
+          FROM target
+          WHERE r.service = $1 AND r.object_type = 'task_lists' AND r.deleted_at IS NULL
+            AND r.payload->>'project_id' = $2 AND r.payload->>'slug' = target.old_slug
+            AND NOT EXISTS (SELECT 1 FROM project_conflict)
+            AND NOT EXISTS (SELECT 1 FROM task_list_conflict)
+            AND (target.old_slug IS DISTINCT FROM $3
+              OR ($4::text IS NOT NULL AND r.payload->>'name' IS DISTINCT FROM $4))
+          RETURNING 1
+        ), updated_project AS (
+          UPDATE ${this.tableName} r SET
+            payload = r.payload || jsonb_build_object('task_list_id', $3::text, 'updated_at', $5::text)
+              || CASE WHEN $4::text IS NULL THEN '{}'::jsonb ELSE jsonb_build_object('name', $4::text) END,
+            updated_at = $5::timestamptz, version = COALESCE(r.version, 0) + 1,
+            source_machine_id = COALESCE($6, r.source_machine_id)
+          FROM target
+          WHERE r.service = $1 AND r.object_type = 'projects' AND r.object_id = $2 AND r.deleted_at IS NULL
+            AND NOT EXISTS (SELECT 1 FROM project_conflict)
+            AND NOT EXISTS (SELECT 1 FROM task_list_conflict)
+            AND (target.old_slug IS DISTINCT FROM $3
+              OR ($4::text IS NOT NULL AND target.payload->>'name' IS DISTINCT FROM $4))
+          RETURNING r.payload
+        ) SELECT
+          EXISTS (SELECT 1 FROM target) AS found,
+          EXISTS (SELECT 1 FROM project_conflict) AS project_conflict,
+          EXISTS (SELECT 1 FROM task_list_conflict) AS task_list_conflict,
+          COALESCE((SELECT payload FROM updated_project), (SELECT payload FROM target)) AS project,
+          (SELECT count(*) FROM updated_lists) AS task_lists_updated`, [this.service, id, normalizedSlug, name ?? null, timestamp, this.machineId(context)]);
+      const row = result.rows[0];
+      if (!row?.found)
+        throw new ProjectNotFoundError(id);
+      if (row.project_conflict) {
+        throw new ResourceConflictError("PROJECT_SLUG_CONFLICT", `Slug "${normalizedSlug}" is already used by another project`);
+      }
+      if (row.task_list_conflict) {
+        throw new ResourceConflictError("TASK_LIST_SLUG_CONFLICT", `Task-list slug "${normalizedSlug}" is already used in this project`);
+      }
+      return {
+        project: payloadRecord2(row.project),
+        task_lists_updated: Number(row.task_lists_updated)
+      };
+    } catch (error) {
+      if (isPostgresUniqueViolation(error)) {
+        const constraintName = postgresConstraintName(error);
+        let projectConflict = constraintName.includes("project_task_list_slug_uidx");
+        if (!constraintName) {
+          const conflict = await this.options.client.query(`/* todos:classify-project-rename-conflict */ SELECT EXISTS (
+              SELECT 1 FROM ${this.tableName}
+              WHERE service = $1 AND object_type = 'projects' AND object_id <> $2
+                AND deleted_at IS NULL AND payload->>'task_list_id' = $3
+            ) AS project_conflict`, [this.service, id, normalizedSlug]);
+          projectConflict = Boolean(conflict.rows[0]?.project_conflict);
+        }
+        if (projectConflict) {
+          throw new ResourceConflictError("PROJECT_SLUG_CONFLICT", `Slug "${normalizedSlug}" is already used by another project`);
+        }
+        throw new ResourceConflictError("TASK_LIST_SLUG_CONFLICT", `Task-list slug "${normalizedSlug}" is already used in this project`);
+      }
+      throw error;
+    }
+  }
   async incrementProjectTaskCounter(projectId, _context = {}) {
     await this.ensureSchema();
     const result = await this.options.client.query(`UPDATE ${this.tableName}
@@ -39876,12 +40382,16 @@ async function getChangedSince(since, filters, store) {
 }
 async function createProject2(input, store, context) {
   const timestamp = new Date().toISOString();
+  const derivedSlug = slugifyRaw(input.name);
+  const taskListId = input.task_list_id === undefined ? `todos-${derivedSlug}` : slugifyRaw(input.task_list_id);
+  if (!derivedSlug || !taskListId)
+    throw new Error("Project name and task-list slug must be non-empty");
   const project = {
     id: randomUUID3(),
     name: input.name,
     path: input.path,
     description: input.description ?? null,
-    task_list_id: input.task_list_id ?? `todos-${slugify2(input.name)}`,
+    task_list_id: taskListId,
     task_prefix: input.task_prefix ?? await generateProjectPrefix(input.name, store),
     task_counter: 0,
     created_at: timestamp,
@@ -39892,6 +40402,9 @@ async function createProject2(input, store, context) {
   return store.upsert("projects", project, context);
 }
 async function updateProject2(id, input, store) {
+  if ("task_list_id" in input) {
+    throw new Error("task_list_id cannot be changed by updateProject; use renameProject for an atomic canonical rename");
+  }
   const project = await requireRecord("projects", id, store);
   const updated = { ...project, ...definedPatch(input), updated_at: new Date().toISOString() };
   return store.upsert("projects", updated);
@@ -40000,10 +40513,13 @@ async function releaseAgent2(idOrName, sessionId, store, context) {
 }
 async function createTaskList2(input, store, context) {
   const timestamp = new Date().toISOString();
+  const slug = slugifyRaw(input.slug === undefined ? input.name : input.slug);
+  if (!slug)
+    throw new Error("Invalid task-list slug \u2014 must be non-empty kebab-case");
   return store.upsert("task_lists", {
     id: randomUUID3(),
     project_id: input.project_id ?? context?.projectId ?? null,
-    slug: input.slug ?? slugify2(input.name),
+    slug,
     name: input.name,
     description: input.description ?? null,
     metadata: input.metadata ?? {},
@@ -40015,9 +40531,20 @@ async function createTaskList2(input, store, context) {
 }
 async function updateTaskList2(id, input, store) {
   const list = await requireRecord("task_lists", id, store);
+  const patch = definedPatch(input);
+  if (input.slug !== undefined) {
+    const slug = slugifyRaw(input.slug);
+    if (!slug)
+      throw new Error("Invalid task-list slug \u2014 must be non-empty kebab-case");
+    const duplicate = (await store.list("task_lists")).find((candidate) => candidate.id !== id && candidate.project_id === list.project_id && candidate.slug === slug);
+    if (duplicate) {
+      throw new ResourceConflictError("TASK_LIST_SLUG_CONFLICT", `Task list with slug "${slug}" already exists in this scope`);
+    }
+    patch.slug = slug;
+  }
   return store.upsert("task_lists", {
     ...list,
-    ...definedPatch(input),
+    ...patch,
     metadata: input.metadata ?? list.metadata,
     updated_at: new Date().toISOString()
   });
@@ -40101,6 +40628,16 @@ async function exportSnapshot(store) {
 }
 async function importSnapshot(snapshot, store, context) {
   const result = { inserted: 0, updated: 0, deleted: 0, skipped: 0, errors: [] };
+  result.errors.push(...validateSnapshotRoutingRecords(snapshot.projects, snapshot.taskLists));
+  if (result.errors.length > 0)
+    return result;
+  const [existingProjects, existingTaskLists] = await Promise.all([
+    store.list("projects"),
+    store.list("task_lists")
+  ]);
+  result.errors.push(...validateSnapshotRoutingDestinationConflicts(snapshot.projects, snapshot.taskLists, existingProjects, existingTaskLists));
+  if (result.errors.length > 0)
+    return result;
   const entries = [
     ...snapshot.tasks.map((row) => ["tasks", row]),
     ...snapshot.projects.map((row) => ["projects", row]),
@@ -40171,10 +40708,7 @@ async function generateProjectPrefix(name, store) {
   return candidate;
 }
 function slugifyRaw(value) {
-  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-}
-function slugify2(value) {
-  return slugifyRaw(value) || "todos";
+  return normalizeSlug(value);
 }
 function normalizePlanSlug2(value) {
   const slug = slugifyRaw(value);
@@ -40228,9 +40762,20 @@ function compareClock(left, right) {
 function numberValue2(value) {
   return typeof value === "number" && Number.isSafeInteger(value) ? value : null;
 }
+function isPostgresUniqueViolation(error) {
+  return typeof error === "object" && error !== null && error.code === "23505";
+}
+function postgresConstraintName(error) {
+  if (typeof error !== "object" || error === null)
+    return "";
+  const candidate = error;
+  const constraint = candidate.constraint ?? candidate.constraint_name;
+  return typeof constraint === "string" ? constraint : "";
+}
 var CLOUD_LOCK_EXPIRY_MINUTES = 30, TASK_ORDER_BY = "ORDER BY CASE payload->>'priority' WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 ELSE 4 END ASC, payload->>'created_at' ASC, payload->>'id' ASC";
 var init_postgres_adapter = __esm(() => {
   init_types();
+  init_postgres_sync();
   init_redaction();
 });
 
@@ -40331,6 +40876,7 @@ function isCommentRedactionBackfillComplete(result) {
 var COMMENT_REDACTION_BACKFILL_CONFIRMATION = "REDACT_STORED_TODOS_COMMENTS";
 var init_comment_redaction_backfill = __esm(() => {
   init_redaction();
+  init_postgres_sync();
 });
 
 // src/server/cloud.ts
@@ -40344,6 +40890,7 @@ __export(exports_cloud, {
   getCloudVerifier: () => getCloudVerifier,
   getCloudStorageAdapter: () => getCloudStorageAdapter,
   getApiKeyStore: () => getApiKeyStore,
+  ensureCloudScopedSlugUniqueIndexes: () => ensureCloudScopedSlugUniqueIndexes,
   ensureCloudSchema: () => ensureCloudSchema,
   ensureCloudCommentCursorIndex: () => ensureCloudCommentCursorIndex,
   closeCloud: () => closeCloud,
@@ -40428,6 +40975,9 @@ async function ensureCloudSchema() {
 async function ensureCloudCommentCursorIndex() {
   await getClient().query(postgresTodosCommentCursorIndexSql());
 }
+async function ensureCloudScopedSlugUniqueIndexes() {
+  await ensurePostgresScopedSlugUniqueIndexes(getClient());
+}
 async function normalizeCloudPayloads() {
   const client = getClient();
   const res = await client.query(`UPDATE todos_sync_records
@@ -40459,6 +41009,7 @@ var init_cloud = __esm(() => {
   init_auth();
   init_cloud_client();
   init_postgres_adapter();
+  init_postgres_sync();
   init_comment_redaction_backfill();
 });
 
@@ -40483,6 +41034,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
       schemas: {
         Task: taskSchema,
         Project: projectSchema,
+        TaskList: taskListSchema,
         TaskComment: taskCommentSchema,
         CreateTaskInput: {
           type: "object",
@@ -40511,12 +41063,65 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
         },
         CreateProjectInput: {
           type: "object",
+          additionalProperties: false,
           required: ["name", "path"],
           properties: {
+            name: { type: "string", minLength: 1, pattern: ".*[A-Za-z0-9].*" },
+            path: { type: "string", minLength: 1 },
+            description: { type: "string" },
+            task_list_id: { type: "string", minLength: 1, pattern: "^[a-z0-9]+(?:-[a-z0-9]+)*$" },
+            task_prefix: { type: "string", minLength: 1 }
+          }
+        },
+        UpdateProjectInput: {
+          type: "object",
+          additionalProperties: false,
+          minProperties: 1,
+          properties: {
+            name: { type: "string", minLength: 1 },
+            path: { type: "string", minLength: 1 },
+            description: { type: "string", nullable: true }
+          }
+        },
+        RenameProjectInput: {
+          type: "object",
+          additionalProperties: false,
+          required: ["new_slug"],
+          properties: {
+            new_slug: { type: "string", minLength: 1, pattern: ".*[A-Za-z0-9].*" },
+            name: { type: "string", minLength: 1 }
+          }
+        },
+        ErrorResponse: {
+          type: "object",
+          required: ["error"],
+          properties: {
+            error: { type: "string" },
+            code: { type: "string" },
+            conflict: { type: "boolean" }
+          }
+        },
+        CreateTaskListInput: {
+          type: "object",
+          additionalProperties: false,
+          required: ["name"],
+          properties: {
+            name: { type: "string", minLength: 1, pattern: ".*[A-Za-z0-9].*" },
+            slug: { type: "string", minLength: 1, pattern: ".*[A-Za-z0-9].*" },
+            project_id: { type: "string" },
+            description: { type: "string" },
+            metadata: { type: "object", additionalProperties: true }
+          }
+        },
+        UpdateTaskListInput: {
+          type: "object",
+          additionalProperties: false,
+          minProperties: 1,
+          properties: {
+            slug: { type: "string", minLength: 1, pattern: ".*[A-Za-z0-9].*" },
             name: { type: "string" },
-            path: { type: "string" },
             description: { type: "string" },
-            task_prefix: { type: "string" }
+            metadata: { type: "object", additionalProperties: true }
           }
         },
         CreateTaskCommentInput: {
@@ -40725,7 +41330,10 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             required: true,
             content: { "application/json": { schema: { $ref: "#/components/schemas/CreateProjectInput" } } }
           },
-          responses: { "201": { content: { "application/json": { schema: { type: "object", properties: { project: { $ref: "#/components/schemas/Project" } } } } } } }
+          responses: {
+            "201": { content: { "application/json": { schema: { type: "object", properties: { project: { $ref: "#/components/schemas/Project" } } } } } },
+            "409": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
         }
       },
       "/v1/projects/{id}": {
@@ -40734,6 +41342,86 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           summary: "Get a project by id",
           parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
           responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { project: { $ref: "#/components/schemas/Project" } } } } } } }
+        },
+        patch: {
+          operationId: "updateProject",
+          summary: "Update a project",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/UpdateProjectInput" } } }
+          },
+          responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { project: { $ref: "#/components/schemas/Project" } } } } } } }
+        },
+        delete: {
+          operationId: "deleteProject",
+          summary: "Delete a project",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { deleted: { type: "boolean" }, id: { type: "string" } } } } } } }
+        }
+      },
+      "/v1/projects/{id}/rename": {
+        post: {
+          operationId: "renameProject",
+          summary: "Atomically rename a project and its canonical task list",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/RenameProjectInput" } } }
+          },
+          responses: {
+            "200": { content: { "application/json": { schema: { type: "object", properties: { project: { $ref: "#/components/schemas/Project" }, task_lists_updated: { type: "number" } } } } } },
+            "409": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
+        }
+      },
+      "/v1/task-lists": {
+        get: {
+          operationId: "listTaskLists",
+          summary: "List task lists",
+          parameters: [{ name: "project_id", in: "query", schema: { type: "string" } }],
+          responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { task_lists: { type: "array", items: { $ref: "#/components/schemas/TaskList" } }, count: { type: "number" } } } } } } }
+        },
+        post: {
+          operationId: "createTaskList",
+          summary: "Create a task list",
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/CreateTaskListInput" } } }
+          },
+          responses: {
+            "201": { content: { "application/json": { schema: { type: "object", properties: { task_list: { $ref: "#/components/schemas/TaskList" } } } } } },
+            "409": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
+        }
+      },
+      "/v1/task-lists/{id}": {
+        get: {
+          operationId: "getTaskList",
+          summary: "Get a task list by id",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          responses: {
+            "200": { content: { "application/json": { schema: { type: "object", properties: { task_list: { $ref: "#/components/schemas/TaskList" } } } } } }
+          }
+        },
+        patch: {
+          operationId: "updateTaskList",
+          summary: "Update a task list",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/UpdateTaskListInput" } } }
+          },
+          responses: {
+            "200": { content: { "application/json": { schema: { type: "object", properties: { task_list: { $ref: "#/components/schemas/TaskList" } } } } } },
+            "409": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
+        },
+        delete: {
+          operationId: "deleteTaskList",
+          summary: "Delete a task list",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { deleted: { type: "boolean" }, id: { type: "string" } } } } } } }
         }
       },
       "/v1/stats": {
@@ -40800,7 +41488,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
     }
   };
 }
-var taskSchema, projectSchema, taskCommentSchema;
+var taskSchema, projectSchema, taskListSchema, taskCommentSchema;
 var init_openapi = __esm(() => {
   init_package_version();
   taskSchema = {
@@ -40827,6 +41515,22 @@ var init_openapi = __esm(() => {
       name: { type: "string" },
       path: { type: "string" },
       description: { type: "string", nullable: true },
+      task_list_id: { type: "string", nullable: true },
+      task_prefix: { type: "string", nullable: true },
+      task_counter: { type: "number" },
+      created_at: { type: "string" },
+      updated_at: { type: "string" }
+    }
+  };
+  taskListSchema = {
+    type: "object",
+    properties: {
+      id: { type: "string" },
+      project_id: { type: "string", nullable: true },
+      slug: { type: "string" },
+      name: { type: "string" },
+      description: { type: "string", nullable: true },
+      metadata: { type: "object", additionalProperties: true },
       created_at: { type: "string" },
       updated_at: { type: "string" }
     }
@@ -40860,6 +41564,48 @@ function json2(body, status = 200) {
 function error(status, message, extra) {
   return json2({ error: message, ...extra ?? {} }, status);
 }
+function validateProjectPatch(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return { ok: false, message: "project patch must be an object" };
+  const body = value;
+  const allowed = new Set(["name", "path", "description"]);
+  const unknown = Object.keys(body).find((key) => !allowed.has(key));
+  if (unknown)
+    return { ok: false, message: `unknown project field: ${unknown}` };
+  if (Object.keys(body).length === 0)
+    return { ok: false, message: "project patch must not be empty" };
+  if (body["name"] !== undefined && (typeof body["name"] !== "string" || !body["name"].trim()))
+    return { ok: false, message: "name must be a non-empty string" };
+  if (body["path"] !== undefined && (typeof body["path"] !== "string" || !body["path"].trim()))
+    return { ok: false, message: "path must be a non-empty string" };
+  if (body["description"] !== undefined && body["description"] !== null && typeof body["description"] !== "string")
+    return { ok: false, message: "description must be a string or null" };
+  return { ok: true, patch: body };
+}
+function validateProjectCreate(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return { ok: false, message: "project body must be an object" };
+  const body = value;
+  const allowed = new Set(["name", "path", "description", "task_list_id", "task_prefix"]);
+  const unknown = Object.keys(body).find((key) => !allowed.has(key));
+  if (unknown)
+    return { ok: false, message: `unknown project field: ${unknown}` };
+  if (typeof body["name"] !== "string" || !body["name"].trim())
+    return { ok: false, message: "name must be a non-empty string" };
+  if (!normalizeSlug(body["name"]))
+    return { ok: false, message: "name must produce a non-empty canonical slug" };
+  if (typeof body["path"] !== "string" || !body["path"].trim())
+    return { ok: false, message: "path must be a non-empty string" };
+  if (body["description"] !== undefined && typeof body["description"] !== "string")
+    return { ok: false, message: "description must be a string" };
+  if (body["task_list_id"] !== undefined && !isCanonicalSlug(body["task_list_id"])) {
+    return { ok: false, message: "task_list_id must be non-empty canonical kebab-case" };
+  }
+  if (body["task_prefix"] !== undefined && (typeof body["task_prefix"] !== "string" || !body["task_prefix"].trim())) {
+    return { ok: false, message: "task_prefix must be a non-empty string" };
+  }
+  return { ok: true, input: body };
+}
 async function readJson(req) {
   try {
     const text = await req.text();
@@ -41340,14 +42086,31 @@ async function handleV1Request(req, url, dependencies = {}) {
         }
         if (method === "POST") {
           const body = await readJson(req);
-          if (!body || typeof body.name !== "string" || typeof body.path !== "string") {
-            return error(400, "name and path are required");
-          }
-          const project = await store.projects.create(body, contextFromPrincipal(principal));
+          if (!body)
+            return error(400, "invalid JSON body");
+          const validated = validateProjectCreate(body);
+          if (!validated.ok)
+            return error(400, validated.message);
+          const project = await store.projects.create(validated.input, contextFromPrincipal(principal));
           return json2({ project }, 201);
         }
         return error(405, `method ${method} not allowed on /v1/projects`);
       }
+      if (action === "rename") {
+        if (method !== "POST")
+          return error(405, `method ${method} not allowed on /v1/projects/:id/rename`);
+        const body = await readJson(req);
+        if (!body || typeof body.new_slug !== "string" || !body.new_slug.trim() || !normalizeSlug(body.new_slug)) {
+          return error(400, "new_slug must be a non-empty string");
+        }
+        if (body.name !== undefined && (typeof body.name !== "string" || !body.name.trim())) {
+          return error(400, "name must be a non-empty string");
+        }
+        const unknownField = Object.keys(body).find((key) => !["new_slug", "name"].includes(key));
+        if (unknownField)
+          return error(400, `unknown project rename field: ${unknownField}`);
+        return json2(await store.projects.rename(id, body, contextFromPrincipal(principal)));
+      }
       if (method === "GET") {
         const project = await store.projects.get(id);
         return project ? json2({ project }) : error(404, "project not found");
@@ -41356,8 +42119,13 @@ async function handleV1Request(req, url, dependencies = {}) {
         const body = await readJson(req);
         if (!body)
           return error(400, "invalid JSON body");
-        const project = await store.projects.update(id, body);
-        return project ? json2({ project }) : error(404, "project not found");
+        const validated = validateProjectPatch(body);
+        if (!validated.ok)
+          return error(400, validated.message);
+        if (!await store.projects.get(id))
+          return error(404, "project not found");
+        const project = await store.projects.update(id, validated.patch);
+        return json2({ project });
       }
       if (method === "DELETE") {
         await store.projects.delete(id, contextFromPrincipal(principal));
@@ -41444,6 +42212,21 @@ async function handleV1Request(req, url, dependencies = {}) {
         const body = await readJson(req);
         if (!body || typeof body.name !== "string" || !body.name.trim())
           return error(400, "name is required");
+        const unknownField = Object.keys(body).find((key) => !["name", "slug", "project_id", "description", "metadata"].includes(key));
+        if (unknownField)
+          return error(400, `unsupported task-list create field: ${unknownField}`);
+        if (body.slug !== undefined && typeof body.slug !== "string")
+          return error(400, "slug must be a string");
+        if (body.project_id !== undefined && (typeof body.project_id !== "string" || !body.project_id.trim()))
+          return error(400, "project_id must be a non-empty string");
+        if (body.description !== undefined && typeof body.description !== "string")
+          return error(400, "description must be a string");
+        if (body.metadata !== undefined && (!body.metadata || typeof body.metadata !== "object" || Array.isArray(body.metadata))) {
+          return error(400, "metadata must be an object");
+        }
+        if (!normalizeSlug(body.slug === undefined ? body.name : body.slug)) {
+          return error(400, "task-list slug must be non-empty kebab-case");
+        }
         const taskList = await store.taskLists.create(body, contextFromPrincipal(principal));
         return json2({ task_list: taskList }, 201);
       }
@@ -41451,6 +42234,29 @@ async function handleV1Request(req, url, dependencies = {}) {
         const taskList = await store.taskLists.get(id);
         return taskList ? json2({ task_list: taskList }) : error(404, "task list not found");
       }
+      if (id && (method === "PATCH" || method === "PUT")) {
+        const body = await readJson(req);
+        if (!body)
+          return error(400, "invalid JSON body");
+        const unknownField = Object.keys(body).find((key) => !["slug", "name", "description", "metadata"].includes(key));
+        if (unknownField)
+          return error(400, `unsupported task-list update field: ${unknownField}`);
+        if (Object.keys(body).length === 0)
+          return error(400, "task-list update must not be empty");
+        if (body.slug !== undefined && (typeof body.slug !== "string" || !normalizeSlug(body.slug)))
+          return error(400, "slug must be a non-empty string");
+        if (body.name !== undefined && (typeof body.name !== "string" || !body.name.trim()))
+          return error(400, "name must be a non-empty string");
+        if (body.description !== undefined && typeof body.description !== "string")
+          return error(400, "description must be a string");
+        if (body.metadata !== undefined && (!body.metadata || typeof body.metadata !== "object" || Array.isArray(body.metadata))) {
+          return error(400, "metadata must be an object");
+        }
+        if (!await store.taskLists.get(id))
+          return error(404, "task list not found");
+        const taskList = await store.taskLists.update(id, body);
+        return json2({ task_list: taskList });
+      }
       if (id && method === "DELETE") {
         const deleted = await store.taskLists.delete(id, contextFromPrincipal(principal));
         return deleted ? json2({ deleted: true, id }) : error(404, "task list not found");
@@ -41523,6 +42329,10 @@ async function handleV1Request(req, url, dependencies = {}) {
   } catch (e) {
     if (e instanceof LockError)
       return error(409, e.message, { code: LockError.code });
+    if (e instanceof ResourceConflictError)
+      return error(409, e.message, { code: e.code, conflict: true });
+    if (e instanceof ProjectNotFoundError)
+      return error(404, e.message, { code: ProjectNotFoundError.code });
     return error(500, e.message || "internal error");
   }
 }
@@ -79668,6 +80478,7 @@ function createHybridTodosStorageAdapter(options) {
   };
 }
 var init_hybrid = __esm(() => {
+  init_postgres_sync();
   init_local_sqlite();
 });
 
@@ -79925,6 +80736,19 @@ function createShadowTodosStorageAdapter(options) {
         mirror.enqueueUpsert("projects", project, context);
         return project;
       },
+      async rename(id, input, context) {
+        const projectBefore = await local.projects.get(id, context);
+        const cascadeCandidates = projectBefore?.task_list_id ? (await local.taskLists.list(id, context)).filter((list) => list.slug === projectBefore.task_list_id) : [];
+        const result = await local.projects.rename(id, input, context);
+        mirror.enqueueUpsert("projects", result.project, context);
+        for (const candidate of cascadeCandidates) {
+          const changed = await local.taskLists.get(candidate.id, context);
+          if (changed && (changed.slug !== candidate.slug || changed.name !== candidate.name)) {
+            mirror.enqueueUpsert("taskLists", changed, context);
+          }
+        }
+        return result;
+      },
       async delete(id, context) {
         const deleted = await local.projects.delete(id, context);
         if (deleted)
@@ -80027,6 +80851,7 @@ function isAgent(value) {
 var SNAPSHOT_TO_OBJECT_TYPE;
 var init_shadow = __esm(() => {
   init_local_sqlite();
+  init_postgres_sync();
   SNAPSHOT_TO_OBJECT_TYPE = {
     tasks: "tasks",
     projects: "projects",
@@ -80542,6 +81367,9 @@ __export(exports_storage, {
   signAwsV4Request: () => signAwsV4Request,
   registerShadowExitFlush: () => registerShadowExitFlush,
   postgresTodosSyncSchemaSql: () => postgresTodosSyncSchemaSql,
+  postgresTodosScopedSlugUniqueIndexSql: () => postgresTodosScopedSlugUniqueIndexSql,
+  postgresTodosScopedSlugPreflightSql: () => postgresTodosScopedSlugPreflightSql,
+  postgresTodosScopedSlugIndexStatusSql: () => postgresTodosScopedSlugIndexStatusSql,
   postgresTodosCommentCursorIndexSql: () => postgresTodosCommentCursorIndexSql,
   planRunArtifactsS3Sync: () => planRunArtifactsS3Sync,
   parseStorageMode: () => parseStorageMode,
@@ -80564,6 +81392,7 @@ __export(exports_storage, {
   getRuntimeShadowOutbox: () => getRuntimeShadowOutbox,
   getCanonicalTodosRdsConfig: () => getCanonicalTodosRdsConfig,
   exportSqliteTodosStorageSnapshot: () => exportSqliteTodosStorageSnapshot,
+  ensurePostgresScopedSlugUniqueIndexes: () => ensurePostgresScopedSlugUniqueIndexes,
   downloadRunArtifactsFromS3: () => downloadRunArtifactsFromS3,
   createTodosStorageAdapter: () => createTodosStorageAdapter,
   createTodosShadowOutbox: () => createTodosShadowOutbox,
@@ -80589,6 +81418,8 @@ __export(exports_storage, {
   STORAGE_TABLES: () => STORAGE_TABLES,
   SHADOW_TRIGGER_TABLES: () => SHADOW_TRIGGER_TABLES,
   PostgresTodosSyncStore: () => PostgresTodosSyncStore,
+  PostgresScopedSlugMigrationConflictError: () => PostgresScopedSlugMigrationConflictError,
+  PostgresScopedSlugIndexBuildError: () => PostgresScopedSlugIndexBuildError,
   DEFAULT_TODOS_POSTGRES_SYNC_TABLE: () => DEFAULT_TODOS_POSTGRES_SYNC_TABLE,
   DEFAULT_TODOS_POSTGRES_CURSOR_TABLE: () => DEFAULT_TODOS_POSTGRES_CURSOR_TABLE,
   COMMENT_REDACTION_BACKFILL_CONFIRMATION: () => COMMENT_REDACTION_BACKFILL_CONFIRMATION,
@@ -80606,6 +81437,7 @@ var init_storage2 = __esm(() => {
   init_hybrid();
   init_local_sqlite();
   init_sqlite_snapshot();
+  init_postgres_sync();
   init_comment_redaction_backfill();
   init_postgres_adapter();
   init_s3_artifacts();