@hasna/todos 0.15.33 → 0.15.35

package/dist/cli/index.js

@@ -2123,7 +2123,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.33",
+    version: "0.15.35",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -2197,9 +2197,10 @@ var init_package = __esm(() => {
       "verify:release": "bun run scripts/verify-public-release.ts --mode=review",
       "verify:release-review": "bun run scripts/verify-npm-release-agent-review.ts",
       "verify:attested-container-candidate": "bun run scripts/attested-container-candidate.ts verify",
-      "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts scripts/attested-container-compatibility-vector.test.ts",
+      "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts",
       "emit:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts emit",
       "verify:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts verify",
+      "test:attested-container-compatibility-vector": "bun test scripts/attested-container-compatibility-vector.test.ts",
       "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
       prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
       postinstall: "mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true"
@@ -5657,40 +5658,38 @@ var init_page_validation = __esm(() => {
 
 // src/cli/cloud-router.ts
 import { resolveStorageClient } from "@hasna/contracts/client/storage";
-import { normalizeStorageMode } from "@hasna/contracts/mode";
 import { randomUUID } from "crypto";
 import { resolve as resolvePath } from "path";
-function cleanMode(value) {
-  const normalized = value?.trim().toLowerCase();
-  return normalized || null;
+function assertNoLegacyStorageMode(env = process.env) {
+  for (const key of LEGACY_STORAGE_MODE_KEYS) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined) {
+      throw new Error(`REMOTE_STORAGE_MODE_REMOVED: ${key} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `The client uses the on-box SQLite store, or the HTTP API selected by ` + `HASNA_TODOS_API_URL + HASNA_TODOS_API_KEY. ` + `On the server, set HASNA_TODOS_DATABASE_URL to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+    }
+  }
 }
 function resolveTodosCliStorageMode(env = process.env) {
-  for (const source of ["HASNA_TODOS_STORAGE_MODE", "TODOS_STORAGE_MODE"]) {
-    if (env[source] !== undefined && env[source].trim() === "") {
-      throw new Error(`REMOTE_STORAGE_MODE_INVALID: ${source} must not be blank; local SQLite fallback is disabled for invalid routing state`);
-    }
+  assertNoLegacyStorageMode(env);
+  const urlValue = env.HASNA_TODOS_API_URL?.trim();
+  const keyValue = env.HASNA_TODOS_API_KEY?.trim();
+  if (urlValue && keyValue) {
+    return {
+      mode: "http",
+      transport: "http",
+      selected: true,
+      source: "HASNA_TODOS_API_URL+HASNA_TODOS_API_KEY"
+    };
   }
-  const canonical = cleanMode(env.HASNA_TODOS_STORAGE_MODE);
-  const fallback = cleanMode(env.TODOS_STORAGE_MODE);
-  for (const [source, value] of [
-    ["HASNA_TODOS_STORAGE_MODE", canonical],
-    ["TODOS_STORAGE_MODE", fallback]
-  ]) {
-    if (value && !(value in TRANSPORT_TOKENS)) {
-      throw new Error(`REMOTE_STORAGE_MODE_INVALID: ${source}=${value} must be sqlite (local file) or http (hosted /v1 authority); ` + "legacy values local and remote are accepted; " + "local SQLite fallback is disabled for invalid routing state");
-    }
+  if (urlValue) {
+    throw new Error("REMOTE_API_KEY_MISSING: remote Todos storage requires HASNA_TODOS_API_KEY; local SQLite fallback is disabled");
   }
-  const canonicalTransport = canonical ? TRANSPORT_TOKENS[canonical] : null;
-  const fallbackTransport = fallback ? TRANSPORT_TOKENS[fallback] : null;
-  if (canonicalTransport && fallbackTransport && canonicalTransport !== fallbackTransport) {
-    throw new Error(`REMOTE_STORAGE_MODE_CONFLICT: HASNA_TODOS_STORAGE_MODE=${canonical} conflicts with ` + `TODOS_STORAGE_MODE=${fallback}; local SQLite fallback is disabled`);
+  if (keyValue) {
+    throw new Error("REMOTE_API_URL_MISSING: remote Todos storage requires HASNA_TODOS_API_URL; local SQLite fallback is disabled");
   }
-  const transport = canonicalTransport ?? fallbackTransport ?? "sqlite";
   return {
-    mode: transport,
-    transport,
-    selected: transport === "http",
-    source: canonical ? "HASNA_TODOS_STORAGE_MODE" : fallback ? "TODOS_STORAGE_MODE" : "default"
+    mode: "sqlite",
+    transport: "sqlite",
+    selected: false,
+    source: "default"
   };
 }
 function requestedTransport(env) {
@@ -5734,7 +5733,7 @@ function getTodosRemoteAuthorityConfigStatus(env = process.env) {
     return {
       selected: true,
       ok: false,
-      mode: cleanMode(env.HASNA_TODOS_STORAGE_MODE) ?? cleanMode(env.TODOS_STORAGE_MODE) ?? "invalid",
+      mode: "invalid",
       api_url_configured: Boolean(env.HASNA_TODOS_API_URL?.trim()),
       api_key_configured: Boolean(env.HASNA_TODOS_API_KEY?.trim()),
       v1_base_url: null,
@@ -5780,27 +5779,12 @@ function getTodosRemoteAuthorityConfigStatus(env = process.env) {
     local_fallback: false
   };
 }
-function serverStorageMode(normalize = normalizeStorageMode) {
-  const useCache = normalize === normalizeStorageMode;
-  if (useCache && cachedServerMode !== null)
-    return cachedServerMode;
-  for (const candidate of SERVER_MODE_CANDIDATES) {
-    try {
-      normalize(candidate);
-      if (useCache)
-        cachedServerMode = candidate;
-      return candidate;
-    } catch {}
-  }
-  throw new Error(`REMOTE_STORAGE_MODE_UNSUPPORTED: no known server storage mode is accepted by the installed ` + `@hasna/contracts (tried ${SERVER_MODE_CANDIDATES.join(", ")}); the storage-mode enum has changed. ` + `Add the new server token to SERVER_MODE_CANDIDATES in src/cli/cloud-router.ts; ` + `local SQLite fallback is disabled.`);
-}
 function requireTodosRemoteAuthorityEnv(env) {
   const status = getTodosRemoteAuthorityConfigStatus(env);
   if (!status.ok)
     throw new Error(status.issues[0]);
   return {
     ...env,
-    HASNA_TODOS_STORAGE_MODE: serverStorageMode(),
     HASNA_TODOS_API_URL: status.v1_base_url.replace(/\/v1$/, ""),
     HASNA_TODOS_API_KEY: env.HASNA_TODOS_API_KEY.trim()
   };
@@ -5838,7 +5822,31 @@ function classifyRemoteRequestError(baseUrl, route, error) {
   }
   throw error;
 }
-function protectRemoteClient(client) {
+function withBoundedRemoteRequest(options, requestTimeoutMs, run) {
+  const controller = new AbortController;
+  const onBaseAbort = () => controller.abort();
+  if (options?.signal) {
+    if (options.signal.aborted)
+      controller.abort();
+    else
+      options.signal.addEventListener("abort", onBaseAbort, { once: true });
+  }
+  let timer;
+  const deadline = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      reject(new DOMException(`Todos remote request exceeded the ${requestTimeoutMs}ms bounded request timeout`, "AbortError"));
+    }, requestTimeoutMs);
+  });
+  const attempt = run({ ...options, signal: controller.signal });
+  attempt.catch(() => {});
+  return Promise.race([attempt, deadline]).finally(() => {
+    if (timer)
+      clearTimeout(timer);
+    options?.signal?.removeEventListener("abort", onBaseAbort);
+  });
+}
+function protectRemoteClient(client, requestTimeoutMs) {
   const baseUrl = remoteAuthorityBase(client);
   const protect = async (route, request) => {
     try {
@@ -5847,25 +5855,26 @@ function protectRemoteClient(client) {
       return classifyRemoteRequestError(baseUrl, route, error);
     }
   };
+  const bounded = (options, run) => withBoundedRemoteRequest(options, requestTimeoutMs, run);
   const transport = client.transport;
   const protectedTransport = {
     baseUrl: transport.baseUrl,
-    request: (method, path, body, options) => protect(path, () => transport.request(method, path, body, options)),
-    get: (path, options) => protect(path, () => transport.get(path, options)),
-    post: (path, body, options) => protect(path, () => transport.post(path, body, options)),
-    put: (path, body, options) => protect(path, () => transport.put(path, body, options)),
-    patch: (path, body, options) => protect(path, () => transport.patch(path, body, options)),
-    del: (path, body, options) => protect(path, () => transport.del(path, body, options))
+    request: (method, path, body, options) => protect(path, () => bounded(options, (opts) => transport.request(method, path, body, opts))),
+    get: (path, options) => protect(path, () => bounded(options, (opts) => transport.get(path, opts))),
+    post: (path, body, options) => protect(path, () => bounded(options, (opts) => transport.post(path, body, opts))),
+    put: (path, body, options) => protect(path, () => bounded(options, (opts) => transport.put(path, body, opts))),
+    patch: (path, body, options) => protect(path, () => bounded(options, (opts) => transport.patch(path, body, opts))),
+    del: (path, body, options) => protect(path, () => bounded(options, (opts) => transport.del(path, body, opts)))
   };
   return {
     name: client.name,
     baseUrl: client.baseUrl,
     transport: protectedTransport,
-    list: (resource, options) => protect(`/${resource}`, () => client.list(resource, options)),
-    get: (resource, id, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => client.get(resource, id, options)),
-    create: (resource, body, options) => protect(`/${resource}`, () => client.create(resource, body, options)),
-    update: (resource, id, patch, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => client.update(resource, id, patch, options)),
-    delete: (resource, id, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => client.delete(resource, id, options))
+    list: (resource, options) => protect(`/${resource}`, () => bounded(options, (opts) => client.list(resource, opts))),
+    get: (resource, id, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => bounded(options, (opts) => client.get(resource, id, opts))),
+    create: (resource, body, options) => protect(`/${resource}`, () => bounded(options, (opts) => client.create(resource, body, opts))),
+    update: (resource, id, patch, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => bounded(options, (opts) => client.update(resource, id, patch, opts))),
+    delete: (resource, id, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => bounded(options, (opts) => client.delete(resource, id, opts)))
   };
 }
 function remoteAuthorityBase(client) {
@@ -5886,13 +5895,19 @@ async function requiredRemoteRoute(client, route, request, recognized404Codes =
     throw error;
   }
 }
-function getTodosCloudClient(env = process.env) {
+function getTodosCloudClient(env = process.env, requestTimeoutMs = REMOTE_REQUEST_TIMEOUT_MS) {
   if (requestedTransport(env) !== "http")
     return null;
   const resolved = resolveStorageClient("todos", requireTodosRemoteAuthorityEnv(env), {
-    fetchImpl: (input, init) => globalThis.fetch(input, { ...init, redirect: "manual" })
-  });
-  return resolved.transport === "cloud-http" ? protectRemoteClient(resolved.client) : null;
+    fetchImpl: (input, init) => globalThis.fetch(input, { ...init, redirect: "manual" }),
+    timeoutMs: requestTimeoutMs
+  });
+  if (resolved.transport === "cloud-http")
+    return protectRemoteClient(resolved.client, requestTimeoutMs);
+  const transportName = resolved.transport;
+  if (transportName === "http")
+    return protectRemoteClient(resolved.client, requestTimeoutMs);
+  return null;
 }
 function isCloudRouting(env = process.env) {
   return getTodosCloudClient(env) !== null;
@@ -7549,7 +7564,7 @@ async function cloudTimeline(client, options = {}) {
   const limit = options.limit ?? 50;
   return { entries: entries.slice(offset, offset + limit), total, limit, offset };
 }
-var UUID_RE, TRANSPORT_TOKENS, COMPLETION_EVIDENCE_FIELDS, completionCapabilityCache, retryCapabilityCache, taskCreatorCapabilityCache, gitRefCapabilityCache, remoteCommandCapabilityCache, SERVER_MODE_CANDIDATES, cachedServerMode = null, PRIORITY_RANK, listTagsCapabilityCache, PLAN_COMPLETION_PROTECTED_FIELDS, RELATION_HYDRATION_CONCURRENCY = 6;
+var UUID_RE, COMPLETION_EVIDENCE_FIELDS, completionCapabilityCache, retryCapabilityCache, taskCreatorCapabilityCache, gitRefCapabilityCache, remoteCommandCapabilityCache, LEGACY_STORAGE_MODE_KEYS, REMOTE_REQUEST_TIMEOUT_MS = 1e4, PRIORITY_RANK, listTagsCapabilityCache, PLAN_COMPLETION_PROTECTED_FIELDS, RELATION_HYDRATION_CONCURRENCY = 6;
 var init_cloud_router = __esm(() => {
   init_types();
   init_redaction();
@@ -7558,15 +7573,6 @@ var init_cloud_router = __esm(() => {
   init_adoption_validation();
   init_page_validation();
   UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  TRANSPORT_TOKENS = {
-    sqlite: "sqlite",
-    http: "http",
-    local: "sqlite",
-    remote: "http",
-    self_hosted: "http",
-    cloud: "http",
-    hybrid: "http"
-  };
   COMPLETION_EVIDENCE_FIELDS = [
     "attachment_ids",
     "files_changed",
@@ -7580,7 +7586,12 @@ var init_cloud_router = __esm(() => {
   taskCreatorCapabilityCache = new Map;
   gitRefCapabilityCache = new Map;
   remoteCommandCapabilityCache = new Map;
-  SERVER_MODE_CANDIDATES = ["postgres", "cloud", "self_hosted"];
+  LEGACY_STORAGE_MODE_KEYS = [
+    "HASNA_TODOS_STORAGE_MODE",
+    "HASNA_TODOS_MODE",
+    "TODOS_STORAGE_MODE",
+    "TODOS_MODE"
+  ];
   PRIORITY_RANK = { critical: 0, high: 1, medium: 2, low: 3 };
   listTagsCapabilityCache = new Map;
   PLAN_COMPLETION_PROTECTED_FIELDS = [
@@ -7601,8 +7612,10 @@ var init_cloud_router = __esm(() => {
 function applyTodosCliAuthorityEnvironment(authority, env = process.env) {
   if (authority.route !== "local" || authority.selected_by !== "local-only-command")
     return;
-  env.HASNA_TODOS_STORAGE_MODE = "sqlite";
-  env.TODOS_STORAGE_MODE = "sqlite";
+  env.HASNA_TODOS_API_URL = "";
+  env.HASNA_TODOS_API_KEY = "";
+  env.TODOS_API_URL = "";
+  env.TODOS_API_KEY = "";
 }
 function isTodosCliCommandVisibleForRoute(command, route, remoteCapabilities = new Set) {
   if (route === "local")
@@ -7846,7 +7859,7 @@ function assertInvocationRoutable(invocation) {
   if (command && !owner) {
     const suggestions = nearestCommands(command);
     const didYouMean = suggestions.length > 0 ? ` Did you mean: ${suggestions.join(", ")}?` : "";
-    throw new Error(`UNKNOWN_COMMAND: \`${command}\` is not a built-in todos command on the /v1 route.${didYouMean} ` + "Run `todos --help` for the commands available here; verbs contributed by optional packages are local-only. " + "(This is not a connectivity, storage-mode or credential problem.)");
+    throw new Error(`UNKNOWN_COMMAND: \`${command}\` is not a built-in todos command on the /v1 route.${didYouMean} ` + "Run `todos --help` for the commands available here; verbs contributed by optional packages are local-only. " + "(This is not a connectivity or credential problem.)");
   }
   return owner;
 }
@@ -7863,7 +7876,20 @@ function assertRemoteCommandSupported(invocation, owner) {
   }
 }
 function initializeTodosCliAuthority(args = process.argv.slice(2), env = process.env) {
-  const mode = resolveTodosCliStorageMode(env);
+  let mode;
+  try {
+    mode = resolveTodosCliStorageMode(env);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.includes("REMOTE_STORAGE_MODE_REMOVED"))
+      throw error;
+    const invocation2 = parseInvocation(args);
+    if (isMetadataInvocation(args, invocation2)) {
+      const status = getTodosRemoteAuthorityConfigStatus(env);
+      return { route: "remote-diagnostic", v1_base_url: status.v1_base_url };
+    }
+    throw error;
+  }
   if (!mode.selected)
     return { route: "local", v1_base_url: null };
   const invocation = parseInvocation(args);
@@ -7878,7 +7904,7 @@ function initializeTodosCliAuthority(args = process.argv.slice(2), env = process
   assertRemoteCommandSupported(invocation, owner);
   const client = getTodosCloudClient(env);
   if (!client) {
-    throw new Error("REMOTE_API_UNAVAILABLE: remote mode did not resolve an HTTP client; local SQLite fallback is disabled");
+    throw new Error("REMOTE_API_UNAVAILABLE: HTTP routing did not resolve an authenticated /v1 client; local SQLite fallback is disabled");
   }
   return { route: "remote-http", v1_base_url: client.baseUrl };
 }
@@ -10038,6 +10064,10 @@ var init_migrations = __esm(() => {
   );
   INSERT OR IGNORE INTO _migrations (id) VALUES (70);
   COMMIT;
+  `,
+    `BEGIN;
+  INSERT OR IGNORE INTO _migrations (id) VALUES (71);
+  COMMIT;
   `
   ];
 });
@@ -10711,6 +10741,8 @@ function ensureSchema(db) {
   ensureColumn("projects", "task_list_id", "TEXT");
   ensureColumn("projects", "task_prefix", "TEXT");
   ensureColumn("projects", "task_counter", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn("projects", "parent_id", "TEXT REFERENCES projects(id) ON DELETE SET NULL");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_projects_parent_id ON projects(parent_id)");
   ensureColumn("tasks", "plan_id", "TEXT REFERENCES plans(id) ON DELETE SET NULL");
   ensureColumn("tasks", "task_list_id", "TEXT REFERENCES task_lists(id) ON DELETE SET NULL");
   ensureColumn("tasks", "short_id", "TEXT");
@@ -12041,6 +12073,7 @@ __export(exports_config2, {
   TODOS_STORAGE_FALLBACK_ENV: () => TODOS_STORAGE_FALLBACK_ENV,
   TODOS_STORAGE_ENV: () => TODOS_STORAGE_ENV,
   STORAGE_TABLES: () => STORAGE_TABLES,
+  REMOVED_STORAGE_MODE_ENV_KEYS: () => REMOVED_STORAGE_MODE_ENV_KEYS,
   CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV: () => CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV,
   CANONICAL_TODOS_RDS_DATABASE: () => CANONICAL_TODOS_RDS_DATABASE,
   CANONICAL_TODOS_RDS_CLUSTER_ENV: () => CANONICAL_TODOS_RDS_CLUSTER_ENV
@@ -12102,25 +12135,36 @@ function assertTodosRemoteStorageConfig(config) {
   if (!isTodosPostgresBackend(config))
     return;
   if (!config.database?.url) {
-    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${TODOS_STORAGE_ENV.mode}=${config.mode}`);
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when the postgresql backend is selected`);
   }
 }
 function parseStorageBackend(value) {
   const normalized = clean(value)?.toLowerCase();
   if (!normalized)
     return "sqlite";
-  if (normalized === "sqlite" || normalized === "postgres")
-    return normalized;
-  const legacy = LEGACY_BACKEND_TOKENS[normalized];
-  if (legacy)
-    return legacy;
-  throw new Error(`${TODOS_STORAGE_ENV.mode} must be sqlite or postgres (legacy values local and remote are accepted)`);
+  if (normalized === "sqlite")
+    return "sqlite";
+  if (normalized === "postgres" || normalized === "postgresql")
+    return "postgres";
+  if (["local", "remote", "cloud", "hybrid", "self_hosted"].includes(normalized)) {
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} selects the backend. Deployment modes no longer exist: ` + `delete the storage-mode variable and set ${TODOS_STORAGE_ENV.databaseUrl} to select the ` + `postgresql backend, or leave it unset for sqlite.`);
+  }
+  throw new Error(`Storage backend must be sqlite or postgres`);
 }
 function parseStorageMode(value) {
   return parseStorageBackend(value);
 }
 function getTodosStorageBackend(env = process.env) {
-  return parseStorageBackend(readStorageEnv(env, "mode").value);
+  for (const key of REMOVED_STORAGE_MODE_ENV_KEYS) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined) {
+      throw new Error(`${key} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `Set ${TODOS_STORAGE_ENV.databaseUrl} to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+    }
+  }
+  if (!getTodosStorageDatabaseUrl(env))
+    return "sqlite";
+  if (isTodosShadowEnabled(env))
+    return "sqlite";
+  return "postgres";
 }
 function getTodosStorageMode(env = process.env) {
   return getTodosStorageBackend(env);
@@ -12194,7 +12238,7 @@ function parsePositiveInteger(value, fallback) {
   }
   return parsed;
 }
-var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos", LEGACY_BACKEND_TOKENS;
+var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, REMOVED_STORAGE_MODE_ENV_KEYS, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos";
 var init_config2 = __esm(() => {
   TODOS_STORAGE_TABLES = [
     "todos_sync_records",
@@ -12202,7 +12246,6 @@ var init_config2 = __esm(() => {
   ];
   STORAGE_TABLES = TODOS_STORAGE_TABLES;
   TODOS_STORAGE_ENV = {
-    mode: "HASNA_TODOS_STORAGE_MODE",
     shadow: "HASNA_TODOS_SHADOW",
     databaseUrl: "HASNA_TODOS_DATABASE_URL",
     databaseSsl: "HASNA_TODOS_DATABASE_SSL",
@@ -12219,7 +12262,6 @@ var init_config2 = __esm(() => {
     syncDryRun: "HASNA_TODOS_SYNC_DRY_RUN"
   };
   TODOS_STORAGE_FALLBACK_ENV = {
-    mode: "TODOS_STORAGE_MODE",
     shadow: "TODOS_SHADOW",
     databaseUrl: "TODOS_DATABASE_URL",
     databaseSsl: "TODOS_DATABASE_SSL",
@@ -12235,14 +12277,12 @@ var init_config2 = __esm(() => {
     syncBatchSize: "TODOS_SYNC_BATCH_SIZE",
     syncDryRun: "TODOS_SYNC_DRY_RUN"
   };
-  LEGACY_BACKEND_TOKENS = {
-    local: "sqlite",
-    remote: "postgres",
-    postgresql: "postgres",
-    hybrid: "postgres",
-    self_hosted: "postgres",
-    cloud: "postgres"
-  };
+  REMOVED_STORAGE_MODE_ENV_KEYS = [
+    "HASNA_TODOS_STORAGE_MODE",
+    "HASNA_TODOS_MODE",
+    "TODOS_STORAGE_MODE",
+    "TODOS_MODE"
+  ];
 });
 
 // src/storage/shadow-outbox-schema.ts
@@ -12774,10 +12814,12 @@ __export(exports_projects, {
   renameProject: () => renameProject,
   removeProjectSource: () => removeProjectSource,
   removeMachineLocalPath: () => removeMachineLocalPath,
+  orderProjectsParentFirst: () => orderProjectsParentFirst,
   nextTaskShortId: () => nextTaskShortId,
   listProjects: () => listProjects,
   listProjectSources: () => listProjectSources,
   listMachineLocalPaths: () => listMachineLocalPaths,
+  listChildProjects: () => listChildProjects,
   getProjectWithSources: () => getProjectWithSources,
   getProjectByPath: () => getProjectByPath,
   getProject: () => getProject,
@@ -12785,6 +12827,7 @@ __export(exports_projects, {
   ensureProject: () => ensureProject,
   deleteProject: () => deleteProject,
   createProject: () => createProject,
+  assertNotProjectAncestor: () => assertNotProjectAncestor,
   addProjectSource: () => addProjectSource
 });
 function slugify(name) {
@@ -12816,17 +12859,24 @@ function createProject(input, db) {
     const id = uuid();
     const timestamp2 = now();
     const derivedSlug = slugify(input.name);
-    const taskListId = input.task_list_id === undefined ? `todos-${derivedSlug}` : slugify(input.task_list_id);
+    const taskListId = input.task_list_id === undefined ? derivedSlug : slugify(input.task_list_id);
     if (!derivedSlug || !taskListId)
       throw new Error("Project name and task-list slug must be non-empty");
     const slugConflict = d.query("SELECT id FROM projects WHERE task_list_id = ? LIMIT 1").get(taskListId);
     if (slugConflict || !claimCanonicalSlug("project", "global", taskListId, id, d)) {
       throw new ResourceConflictError("PROJECT_SLUG_CONFLICT", `Project slug "${taskListId}" already exists`);
     }
+    const parentId = input.parent_id ?? null;
+    if (parentId !== null) {
+      const parent = getProject(parentId, d);
+      if (!parent)
+        throw new ProjectNotFoundError(parentId);
+      assertNotProjectAncestor(id, parentId, d);
+    }
     const taskPrefix = input.task_prefix || generatePrefix(input.name, d);
     const machineId = currentStorageMachineId(d);
-    d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, created_at, updated_at, machine_id)
-       VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, timestamp2, timestamp2, machineId]);
+    d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, parent_id, created_at, updated_at, machine_id)
+       VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, parentId, timestamp2, timestamp2, machineId]);
     return getProject(id, d);
   })();
 }
@@ -12851,6 +12901,64 @@ function listProjects(db) {
   const d = db || getDatabase();
   return d.query("SELECT * FROM projects ORDER BY name").all();
 }
+function listChildProjects(parentId, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM projects WHERE parent_id = ? ORDER BY name").all(parentId);
+}
+function orderProjectsParentFirst(projects) {
+  const projectId = (project) => {
+    const id = project.id;
+    return typeof id === "string" && id.length > 0 ? id : null;
+  };
+  const parentId = (project) => {
+    const parent = project.parent_id;
+    return parent == null ? null : String(parent);
+  };
+  const byId = new Set;
+  for (const project of projects) {
+    const id = projectId(project);
+    if (id !== null)
+      byId.add(id);
+  }
+  const ordered = [];
+  const emitted = new Set;
+  let remaining = [...projects];
+  let progress = true;
+  while (progress && remaining.length > 0) {
+    progress = false;
+    const deferred = [];
+    for (const project of remaining) {
+      const parent = parentId(project);
+      if (parent === null || emitted.has(parent) || !byId.has(parent)) {
+        ordered.push(project);
+        const id = projectId(project);
+        if (id !== null)
+          emitted.add(id);
+        progress = true;
+      } else {
+        deferred.push(project);
+      }
+    }
+    remaining = deferred;
+  }
+  ordered.push(...remaining);
+  return ordered;
+}
+function assertNotProjectAncestor(projectId, ancestorId, db) {
+  const d = db || getDatabase();
+  let cursor = ancestorId;
+  const seen = new Set;
+  while (cursor !== null) {
+    if (cursor === projectId) {
+      throw new ResourceConflictError("PROJECT_PARENT_CYCLE", `Project "${projectId}" cannot be placed under its own descendant`);
+    }
+    if (seen.has(cursor))
+      break;
+    seen.add(cursor);
+    const row = d.query("SELECT parent_id FROM projects WHERE id = ?").get(cursor);
+    cursor = row?.parent_id ?? null;
+  }
+}
 function updateProject(id, input, db) {
   const d = db || getDatabase();
   const project = getProject(id, d);
@@ -12873,6 +12981,16 @@ function updateProject(id, input, db) {
     sets.push("path = ?");
     params.push(input.path);
   }
+  if (input.parent_id !== undefined) {
+    if (input.parent_id !== null) {
+      const parent = getProject(input.parent_id, d);
+      if (!parent)
+        throw new ProjectNotFoundError(input.parent_id);
+      assertNotProjectAncestor(id, input.parent_id, d);
+    }
+    sets.push("parent_id = ?");
+    params.push(input.parent_id);
+  }
   params.push(id);
   d.run(`UPDATE projects SET ${sets.join(", ")} WHERE id = ?`, params);
   return getProject(id, d);
@@ -15385,8 +15503,8 @@ var init_secret_redaction = __esm(() => {
   SECRET_REDACTION_SCHEMA = ["todos", "secret_redaction", "v1"].join(".");
   DEFAULT_PATTERNS = [
     { name: "openai_sk", pattern: /\bsk-[a-zA-Z0-9]{10,}\b/g },
-    { name: "github_pat", pattern: /\bghp_[a-zA-Z0-9]{20,}\b/g },
-    { name: "github_oauth", pattern: /\bgho_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_pat", pattern: /\bgh[p]_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_oauth", pattern: /\bgh[o]_[a-zA-Z0-9]{20,}\b/g },
     { name: "aws_access_key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
     { name: "bearer_token", pattern: /\bBearer\s+[a-zA-Z0-9\-._~+/]+=*\b/gi },
     { name: "jwt", pattern: /\beyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g },
@@ -15398,7 +15516,7 @@ var init_secret_redaction = __esm(() => {
     /example\.com/i,
     /your-api-key-here/i,
     /sk-test/i,
-    /ghp_xxx/i
+    /gh[p]_xxx/i
   ];
   customRedactors = [];
 });
@@ -23137,11 +23255,14 @@ function registerTaskCommands(program2) {
     const narrowsAfterQuery = Boolean(opts.dueToday) || Boolean(opts.overdue) || creatorFilterActive && cloud || taskListFilterActive;
     const withholdLimit = requestedLimit !== undefined && (reordersAfterQuery || narrowsAfterQuery);
     const scanCeiling = cloud && (withholdLimit || requestedLimit === undefined) ? Math.max(requestedLimit ?? 0, listScanLimit()) : undefined;
+    const probeLimit = !withholdLimit && requestedLimit !== undefined ? requestedLimit + 1 : undefined;
     const serverFilter = (() => {
       const base = withholdLimit ? (() => {
         const { limit: _dropped, ...rest } = filter;
         return rest;
       })() : filter;
+      if (probeLimit !== undefined)
+        return { ...base, limit: probeLimit };
       return scanCeiling === undefined ? base : { ...base, limit: scanCeiling };
     })();
     let tasks = cloud ? await cloudListTasks(cloud, serverFilter) : listTasks(serverFilter);
@@ -23190,8 +23311,21 @@ function registerTaskCommands(program2) {
         return 0;
       });
     }
-    if (withholdLimit && requestedLimit !== undefined)
-      tasks = tasks.slice(0, requestedLimit);
+    let truncatedByLimit = false;
+    if (requestedLimit !== undefined) {
+      if (withholdLimit) {
+        truncatedByLimit = tasks.length > requestedLimit;
+        tasks = tasks.slice(0, requestedLimit);
+      } else if (tasks.length > requestedLimit) {
+        truncatedByLimit = true;
+        tasks = tasks.slice(0, requestedLimit);
+      }
+    }
+    if (truncatedByLimit) {
+      console.error(chalk3.yellow(`Warning: the matching set has more than --limit ${requestedLimit} rows, so only the first
+` + `         ${requestedLimit} are shown. This read is bounded \u2014 raise --limit or narrow the
+` + `         query (--project, --status, --assigned) to see the full population.`));
+    }
     if (rosterPromise && assignedFilter) {
       try {
         const roster = await rosterPromise;
@@ -25291,7 +25425,7 @@ function importSqliteTodosStorageSnapshot(snapshot, db) {
       }
     }
   };
-  applyRows("projects", "projects", PROJECT_COLUMNS, snapshot.projects, "updated_at");
+  applyRows("projects", "projects", PROJECT_COLUMNS, orderProjectsParentFirst(snapshot.projects), "updated_at");
   applyRows("project_machine_paths", "project_machine_paths", PROJECT_MACHINE_PATH_COLUMNS, snapshot.projectMachinePaths ?? [], "updated_at");
   applyRows("agents", "agents", AGENT_COLUMNS, snapshot.agents, "last_seen_at");
   applyRows("task_lists", "task_lists", TASK_LIST_COLUMNS, snapshot.taskLists, "updated_at");
@@ -25522,6 +25656,7 @@ var init_sqlite_snapshot = __esm(() => {
     "task_list_id",
     "task_prefix",
     "task_counter",
+    "parent_id",
     "created_at",
     "updated_at",
     "machine_id",
@@ -28526,7 +28661,7 @@ function addSourceOnce(projectId, type, name, uri, metadata, db) {
 function bootstrapProject(options = {}, db) {
   const d = db || getDatabase();
   const discovery = discoverProjectWorkspace(options.path);
-  const taskListSlug = options.taskListSlug || `todos-${slugify(options.name || discovery.projectName)}`;
+  const taskListSlug = options.taskListSlug || slugify(options.name || discovery.projectName);
   if (options.dryRun) {
     return {
       dryRun: true,
@@ -30896,7 +31031,7 @@ function registerProjectCommands(program2) {
       }
     }
   });
-  program2.command("projects").description("List and manage projects").option("--add <path>", "Register a project by path").option("--show <project>", "Resolve and show a project").option("--update <project>", "Update a project's name, path, or description").option("--deregister <project>", "Deregister a project without deleting its tasks; refuses projects with incomplete tasks").option("--path-prefix <prefix>", "Require deregistered project path to start with this prefix").option("--dry-run", "Show what would change without modifying local state").option("--name <name>", "Project name (with --add)").option("--path <path>", "Project path (with --update)").option("--description <text>", "Project description (with --add or --update)").option("--task-list-id <id>", "Custom task list ID (with --add)").option("--ensure-task-list <project>", "Plan or apply creation of an existing project's declared task list").option("--rollback-task-list <project>", "Conditionally roll back a task list created by --ensure-task-list").option("--apply", "Apply --ensure-task-list or --rollback-task-list; ensure plans by default").option("--idempotency-key <key>", "Stable idempotency key for --ensure-task-list --apply").option("--receipt <id>", "Accepted ensure receipt for --rollback-task-list --apply").action(async (opts) => {
+  program2.command("projects").description("List and manage projects").option("--add <path>", "Register a project by path").option("--show <project>", "Resolve and show a project").option("--update <project>", "Update a project's name, path, or description").option("--deregister <project>", "Deregister a project without deleting its tasks; refuses projects with incomplete tasks").option("--path-prefix <prefix>", "Require deregistered project path to start with this prefix").option("--dry-run", "Show what would change without modifying local state").option("--name <name>", "Project name (with --add)").option("--path <path>", "Project path (with --update)").option("--description <text>", "Project description (with --add or --update)").option("--task-list-id <id>", "Custom task list ID (with --add)").option("--parent <project>", "Parent project (id, path, task-list slug, or name) to create a sub-project under (with --add)").option("--ensure-task-list <project>", "Plan or apply creation of an existing project's declared task list").option("--rollback-task-list <project>", "Conditionally roll back a task list created by --ensure-task-list").option("--apply", "Apply --ensure-task-list or --rollback-task-list; ensure plans by default").option("--idempotency-key <key>", "Stable idempotency key for --ensure-task-list --apply").option("--receipt <id>", "Accepted ensure receipt for --rollback-task-list --apply").action(async (opts) => {
     const globalOpts = program2.opts();
     const cloud = getTodosCloudClient();
     if (opts.ensureTaskList && opts.rollbackTaskList) {
@@ -31013,10 +31148,21 @@ function registerProjectCommands(program2) {
     if (opts.add) {
       const projectPath = resolve13(opts.add);
       const name = opts.name || basename5(projectPath);
+      let parentId;
+      if (opts.parent !== undefined) {
+        const parent = cloud ? await cloudResolveProject(cloud, opts.parent) : resolveExplicitProject(opts.parent);
+        parentId = parent.id;
+      }
       const existing = cloud ? (await cloudListProjects(cloud)).find((project2) => project2.path === projectPath) : getProjectByPath(projectPath);
       let project;
       if (existing) {
         project = existing;
+        if (opts.parent !== undefined && existing.parent_id !== parentId) {
+          if (cloud)
+            project = await cloudUpdateProject(cloud, existing.id, { parent_id: parentId });
+          else
+            project = updateProject(existing.id, { parent_id: parentId });
+        }
         if (opts.taskListId) {
           if (cloud && existing.task_list_id !== opts.taskListId) {
             handleError(new Error("Remote project task-list slug changes require project-rename"));
@@ -31025,7 +31171,7 @@ function registerProjectCommands(program2) {
             project = renameProject(existing.id, { new_slug: opts.taskListId }).project;
         }
       } else {
-        const input = { name, path: projectPath, description: opts.description, task_list_id: opts.taskListId };
+        const input = { name, path: projectPath, description: opts.description, task_list_id: opts.taskListId, parent_id: parentId };
         project = cloud ? await cloudCreateProject(cloud, input) : createProject(input);
       }
       if (!cloud) {
@@ -31042,6 +31188,8 @@ function registerProjectCommands(program2) {
         console.log(chalk5.green(`Project registered: ${project.name} (${project.path})`));
         if (project.task_list_id)
           console.log(chalk5.dim(`  Task list: ${project.task_list_id}`));
+        if (parentId)
+          console.log(chalk5.dim(`  Parent: ${parentId}`));
       }
       return;
     }
@@ -32533,8 +32681,12 @@ class PostgresJsonRecordStore {
              OR ($11::text <> $2
                AND NOT EXISTS (SELECT 1 FROM parent_chain WHERE object_id = $2)
                AND NOT EXISTS (SELECT 1 FROM parent_chain WHERE cycle))) AS parent_acyclic,
-           (SELECT count(*) FROM locked_plans) = jsonb_array_length($7::jsonb) AS all_plans_found,
-           ($8::text IS NULL OR EXISTS (SELECT 1 FROM locked_plans WHERE object_id = $8)) AS target_plan_found,
+           (COALESCE((SELECT payload->>'plan_id' FROM locked_task), '')
+              IS DISTINCT FROM COALESCE($3::jsonb->>'plan_id', '')) AS membership_changed,
+           (NOT (COALESCE((SELECT payload->>'plan_id' FROM locked_task), '')
+                   IS DISTINCT FROM COALESCE($3::jsonb->>'plan_id', ''))
+             OR $8::text IS NULL
+             OR EXISTS (SELECT 1 FROM locked_plans WHERE object_id = $8)) AS target_plan_found,
            (SELECT payload->>'project_id' FROM locked_plans WHERE object_id = $8) AS target_project_id
        ), guarded AS (
          SELECT
@@ -32557,7 +32709,6 @@ class PostgresJsonRecordStore {
            AND guarded.version_matches
            AND guarded.parent_found
            AND guarded.parent_acyclic
-           AND guarded.all_plans_found
            AND guarded.target_plan_found
            AND NOT guarded.project_conflict
          ON CONFLICT (service, object_type, object_id) DO UPDATE SET
@@ -32573,7 +32724,7 @@ class PostgresJsonRecordStore {
          RETURNING payload
        )
        SELECT guarded.task_found, guarded.version_matches, guarded.parent_found, guarded.parent_acyclic,
-              guarded.all_plans_found, guarded.target_plan_found, guarded.project_conflict,
+              guarded.membership_changed, guarded.target_plan_found, guarded.project_conflict,
               (SELECT payload FROM stored) AS payload,
               (SELECT payload FROM locked_task) AS current_payload
        FROM guarded`, [
@@ -32605,7 +32756,7 @@ class PostgresJsonRecordStore {
     if (parentGuard && !row?.parent_acyclic && parentGuard.parentId) {
       throw new ResourceConflictError("TASK_PARENT_CYCLE", `TASK_PARENT_CYCLE: assigning parent ${parentGuard.parentId} to task ${value.id} would create or retain a parent cycle`);
     }
-    if (!row?.all_plans_found || !row.target_plan_found) {
+    if (!row?.target_plan_found) {
       throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan membership changed through a missing plan: ${targetPlanId ?? planIds.join(", ")}`, { plan_ids: planIds, target_plan_id: targetPlanId });
     }
     if (row.project_conflict) {
@@ -33814,17 +33965,26 @@ async function getChangedSince(since, filters, store) {
 async function createProject2(input, store, context) {
   const timestamp2 = new Date().toISOString();
   const derivedSlug = slugifyRaw(input.name);
-  const taskListId = input.task_list_id === undefined ? `todos-${derivedSlug}` : slugifyRaw(input.task_list_id);
+  const taskListId = input.task_list_id === undefined ? derivedSlug : slugifyRaw(input.task_list_id);
   if (!derivedSlug || !taskListId)
     throw new Error("Project name and task-list slug must be non-empty");
+  const parentId = input.parent_id ?? null;
+  const id = randomUUID4();
+  if (parentId !== null) {
+    const parent = await store.get("projects", parentId);
+    if (!parent)
+      throw new ProjectNotFoundError(parentId);
+    await assertNotProjectAncestorPostgres(id, parentId, store);
+  }
   const project = {
-    id: randomUUID4(),
+    id,
     name: input.name,
     path: input.path,
     description: input.description ?? null,
     task_list_id: taskListId,
     task_prefix: input.task_prefix ?? await generateProjectPrefix(input.name, store),
     task_counter: 0,
+    parent_id: parentId,
     created_at: timestamp2,
     updated_at: timestamp2,
     machine_id: store.machineId(context),
@@ -33832,12 +33992,38 @@ async function createProject2(input, store, context) {
   };
   return store.upsert("projects", project, context);
 }
+async function assertNotProjectAncestorPostgres(projectId, candidateParentId, store) {
+  const all = await store.list("projects");
+  const byId = new Map(all.map((project) => [project.id, project.parent_id ?? null]));
+  let cursor = candidateParentId;
+  const seen = new Set;
+  while (cursor !== null) {
+    if (cursor === projectId) {
+      throw new ResourceConflictError("PROJECT_PARENT_CYCLE", `Project "${projectId}" cannot be placed under its own descendant`);
+    }
+    if (seen.has(cursor))
+      break;
+    seen.add(cursor);
+    cursor = byId.get(cursor) ?? null;
+  }
+}
 async function updateProject2(id, input, store) {
   if ("task_list_id" in input) {
     throw new Error("task_list_id cannot be changed by updateProject; use renameProject for an atomic canonical rename");
   }
   const project = await requireRecord("projects", id, store);
-  const updated = { ...project, ...definedPatch(input), updated_at: new Date().toISOString() };
+  if (input.parent_id !== undefined && input.parent_id !== null) {
+    const parent = await store.get("projects", input.parent_id);
+    if (!parent)
+      throw new ProjectNotFoundError(input.parent_id);
+    await assertNotProjectAncestorPostgres(id, input.parent_id, store);
+  }
+  const updated = {
+    ...project,
+    ...definedPatch(input),
+    ...input.parent_id !== undefined ? { parent_id: input.parent_id } : {},
+    updated_at: new Date().toISOString()
+  };
   return store.upsert("projects", updated);
 }
 async function createPlan2(input, store, context) {
@@ -35229,7 +35415,7 @@ class StagedSqliteTodosProjectRegistrationTransaction {
   }
   async createProject(input) {
     const derivedSlug = normalizeSlug(input.name);
-    const taskListId = input.task_list_id === undefined ? `todos-${derivedSlug}` : normalizeSlug(input.task_list_id);
+    const taskListId = input.task_list_id === undefined ? derivedSlug : normalizeSlug(input.task_list_id);
     if (!derivedSlug || !taskListId) {
       throw new Error("Project name and task-list slug must be non-empty");
     }
@@ -35241,6 +35427,7 @@ class StagedSqliteTodosProjectRegistrationTransaction {
       task_list_id: taskListId,
       task_prefix: input.task_prefix ?? this.availableProjectPrefix(input.name),
       task_counter: 0,
+      parent_id: input.parent_id ?? null,
       created_at: now(),
       updated_at: now(),
       machine_id: currentStorageMachineId(this.db)
@@ -35251,14 +35438,15 @@ class StagedSqliteTodosProjectRegistrationTransaction {
       try {
         const result = this.db.run(`INSERT INTO projects (
              id, name, path, description, task_list_id, task_prefix,
-             task_counter, created_at, updated_at, machine_id
-           ) VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`, [
+             task_counter, parent_id, created_at, updated_at, machine_id
+           ) VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?)`, [
           project.id,
           project.name,
           project.path,
           project.description,
           project.task_list_id,
           project.task_prefix,
+          project.parent_id,
           project.created_at,
           project.updated_at,
           project.machine_id ?? null
@@ -35655,7 +35843,10 @@ function taskListSlug(projectSlug) {
   if (!slug || slug !== projectSlug) {
     throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "project_slug must be canonical kebab-case");
   }
-  return `todos-${slug}`;
+  return slug;
+}
+function legacyTaskListSlug(projectSlug) {
+  return `todos-${normalizeSlug(projectSlug)}`;
 }
 function deterministicTaskPrefix(projectSlug) {
   const letters = projectSlug.replace(/[^a-z0-9]/gi, "").toUpperCase();
@@ -36174,6 +36365,12 @@ class PackageOwnedTodosProjectRegistrationAuthority {
             created_by_operation: false
           };
         }
+        if (request.bind_existing === true && conflict2.path === path && conflict2.task_list_id === legacyTaskListSlug(request.project_slug)) {
+          return {
+            record: boundExistingProjectRecord(conflict2),
+            created_by_operation: false
+          };
+        }
         return this.terminalFor(transaction, request, normalizedCallDigest(request), "target_already_exists", { targetId: conflict2.id });
       }
       await this.fault("before_object_write", request);
@@ -36210,6 +36407,15 @@ class PackageOwnedTodosProjectRegistrationAuthority {
       }
       return this.terminalFor(transaction, request, normalizedCallDigest(request), "target_already_exists", { targetId: conflict.id });
     }
+    if (request.bind_existing === true) {
+      const legacy = await transaction.findTaskListConflict(todosProjectId, legacyTaskListSlug(request.project_slug));
+      if (legacy && legacy.project_id === todosProjectId) {
+        return {
+          record: boundExistingTaskListRecord(legacy),
+          created_by_operation: false
+        };
+      }
+    }
     await this.fault("before_object_write", request);
     const taskList = await transaction.createTaskList({
       name: request.project_name,
@@ -51899,7 +52105,8 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             path: { type: "string", minLength: 1 },
             description: { type: "string" },
             task_list_id: { type: "string", minLength: 1, pattern: "^[a-z0-9]+(?:-[a-z0-9]+)*$" },
-            task_prefix: { type: "string", minLength: 1 }
+            task_prefix: { type: "string", minLength: 1 },
+            parent_id: { type: "string", minLength: 1 }
           }
         },
         UpdateProjectInput: {
@@ -51909,7 +52116,8 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           properties: {
             name: { type: "string", minLength: 1 },
             path: { type: "string", minLength: 1 },
-            description: { type: "string", nullable: true }
+            description: { type: "string", nullable: true },
+            parent_id: { type: "string", minLength: 1, nullable: true }
           }
         },
         RenameProjectInput: {
@@ -54208,6 +54416,7 @@ var init_openapi = __esm(() => {
       task_list_id: { type: "string", nullable: true },
       task_prefix: { type: "string", nullable: true },
       task_counter: { type: "number" },
+      parent_id: { type: "string", nullable: true },
       created_at: { type: "string" },
       updated_at: { type: "string" }
     }
@@ -55278,7 +55487,7 @@ function validateProjectPatch(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return { ok: false, message: "project patch must be an object" };
   const body2 = value;
-  const allowed = new Set(["name", "path", "description"]);
+  const allowed = new Set(["name", "path", "description", "parent_id"]);
   const unknown = Object.keys(body2).find((key2) => !allowed.has(key2));
   if (unknown)
     return { ok: false, message: `unknown project field: ${unknown}` };
@@ -55290,13 +55499,15 @@ function validateProjectPatch(value) {
     return { ok: false, message: "path must be a non-empty string" };
   if (body2["description"] !== undefined && body2["description"] !== null && typeof body2["description"] !== "string")
     return { ok: false, message: "description must be a string or null" };
+  if (body2["parent_id"] !== undefined && body2["parent_id"] !== null && (typeof body2["parent_id"] !== "string" || !body2["parent_id"].trim()))
+    return { ok: false, message: "parent_id must be a string or null" };
   return { ok: true, patch: body2 };
 }
 function validateProjectCreate(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return { ok: false, message: "project body must be an object" };
   const body2 = value;
-  const allowed = new Set(["name", "path", "description", "task_list_id", "task_prefix"]);
+  const allowed = new Set(["name", "path", "description", "task_list_id", "task_prefix", "parent_id"]);
   const unknown = Object.keys(body2).find((key2) => !allowed.has(key2));
   if (unknown)
     return { ok: false, message: `unknown project field: ${unknown}` };
@@ -55314,6 +55525,9 @@ function validateProjectCreate(value) {
   if (body2["task_prefix"] !== undefined && (typeof body2["task_prefix"] !== "string" || !body2["task_prefix"].trim())) {
     return { ok: false, message: "task_prefix must be a non-empty string" };
   }
+  if (body2["parent_id"] !== undefined && (typeof body2["parent_id"] !== "string" || !body2["parent_id"].trim())) {
+    return { ok: false, message: "parent_id must be a non-empty string" };
+  }
   return { ok: true, input: body2 };
 }
 function validatePlanCreate(value) {
@@ -62029,6 +62243,7 @@ function registerTaskProjectTools(server, ctx) {
       name: exports_external.string().describe("Project name"),
       path: exports_external.string().describe("Unique filesystem path for the project"),
       description: exports_external.string().optional(),
+      parent_id: exports_external.string().optional().describe("Optional parent project id to create this as a sub-project"),
       status: exports_external.enum(["active", "completed", "on_hold", "archived"]).optional(),
       short_id: exports_external.string().nullable().optional().describe("Short ID (auto-generated if omitted)"),
       metadata: exports_external.record(exports_external.unknown()).optional()
@@ -69579,6 +69794,7 @@ function createAgentProjectDemoBundle() {
     task_list_id: ids.list,
     task_prefix: "DEMO",
     task_counter: 4,
+    parent_id: null,
     created_at: createdAt,
     updated_at: completedAt
   });
@@ -82446,7 +82662,7 @@ No task claimed (nothing available).`));
         verdict_exit_code: verdict2.verdict,
         fail_on_findings: verdict2.fail_on_findings,
         dry_run: true,
-        mode: "remote-http",
+        mode: "http",
         authority: { v1_base_url: cloud.baseUrl, local_fallback: false },
         routes: {
           stats: true,
@@ -82668,7 +82884,7 @@ Findings`));
       checks.push({ name: "Version", ok: true, message: `v${getPackageVersion3()} \xB7 remote HTTP client` });
       const ok = checks.every((check) => check.ok);
       if (opts.json || globalOpts.json) {
-        console.log(JSON.stringify({ ok, mode: "remote-http", checks }));
+        console.log(JSON.stringify({ ok, mode: "http", checks }));
       } else {
         console.log(chalk9.bold(`todos health
 `));
@@ -89328,6 +89544,7 @@ var init_json_contracts = __esm(() => {
         task_list_id: nullableIdField,
         task_prefix: field(["string", "null"], "Optional task prefix.", true),
         task_counter: field("integer", "Monotonic project task counter."),
+        parent_id: field(["string", "null"], "Optional parent project id; null means top-level.", true),
         created_at: isoDateField,
         updated_at: isoDateField
       },
@@ -93394,7 +93611,7 @@ function getNativeStorageStatus(env = process.env) {
   const remoteEnabled = isTodosPostgresBackend(config);
   const remoteFieldsConfigured = Boolean(config.database || config.objectStorage);
   if (!remoteEnabled && remoteFieldsConfigured) {
-    warnings.push(`the sqlite backend (${TODOS_STORAGE_ENV.mode}) ignores configured remote storage fields`);
+    warnings.push(`the sqlite backend ignores configured remote storage fields`);
   }
   if (remoteEnabled && !config.objectStorage) {
     warnings.push(`${TODOS_STORAGE_ENV.s3Bucket} is not configured, so artifact sync will stay local`);
@@ -93487,7 +93704,7 @@ function storageEnvStatus(env) {
 function fallbackConfig(env) {
   let mode;
   try {
-    mode = parseStorageBackend(clean2(env[TODOS_STORAGE_ENV.mode]));
+    mode = getTodosStorageBackend(env);
   } catch {
     mode = "sqlite";
   }