@hasna/todos 0.15.33 → 0.15.35

package/dist/index.js

@@ -1884,6 +1884,10 @@ var init_migrations = __esm(() => {
   );
   INSERT OR IGNORE INTO _migrations (id) VALUES (70);
   COMMIT;
+  `,
+    `BEGIN;
+  INSERT OR IGNORE INTO _migrations (id) VALUES (71);
+  COMMIT;
   `
   ];
 });
@@ -2557,6 +2561,8 @@ function ensureSchema(db) {
   ensureColumn("projects", "task_list_id", "TEXT");
   ensureColumn("projects", "task_prefix", "TEXT");
   ensureColumn("projects", "task_counter", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn("projects", "parent_id", "TEXT REFERENCES projects(id) ON DELETE SET NULL");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_projects_parent_id ON projects(parent_id)");
   ensureColumn("tasks", "plan_id", "TEXT REFERENCES plans(id) ON DELETE SET NULL");
   ensureColumn("tasks", "task_list_id", "TEXT REFERENCES task_lists(id) ON DELETE SET NULL");
   ensureColumn("tasks", "short_id", "TEXT");
@@ -4177,6 +4183,7 @@ __export(exports_config, {
   TODOS_STORAGE_FALLBACK_ENV: () => TODOS_STORAGE_FALLBACK_ENV,
   TODOS_STORAGE_ENV: () => TODOS_STORAGE_ENV,
   STORAGE_TABLES: () => STORAGE_TABLES,
+  REMOVED_STORAGE_MODE_ENV_KEYS: () => REMOVED_STORAGE_MODE_ENV_KEYS,
   CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV: () => CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV,
   CANONICAL_TODOS_RDS_DATABASE: () => CANONICAL_TODOS_RDS_DATABASE,
   CANONICAL_TODOS_RDS_CLUSTER_ENV: () => CANONICAL_TODOS_RDS_CLUSTER_ENV
@@ -4238,25 +4245,36 @@ function assertTodosRemoteStorageConfig(config) {
   if (!isTodosPostgresBackend(config))
     return;
   if (!config.database?.url) {
-    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${TODOS_STORAGE_ENV.mode}=${config.mode}`);
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when the postgresql backend is selected`);
   }
 }
 function parseStorageBackend(value) {
   const normalized = clean(value)?.toLowerCase();
   if (!normalized)
     return "sqlite";
-  if (normalized === "sqlite" || normalized === "postgres")
-    return normalized;
-  const legacy = LEGACY_BACKEND_TOKENS[normalized];
-  if (legacy)
-    return legacy;
-  throw new Error(`${TODOS_STORAGE_ENV.mode} must be sqlite or postgres (legacy values local and remote are accepted)`);
+  if (normalized === "sqlite")
+    return "sqlite";
+  if (normalized === "postgres" || normalized === "postgresql")
+    return "postgres";
+  if (["local", "remote", "cloud", "hybrid", "self_hosted"].includes(normalized)) {
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} selects the backend. Deployment modes no longer exist: ` + `delete the storage-mode variable and set ${TODOS_STORAGE_ENV.databaseUrl} to select the ` + `postgresql backend, or leave it unset for sqlite.`);
+  }
+  throw new Error(`Storage backend must be sqlite or postgres`);
 }
 function parseStorageMode(value) {
   return parseStorageBackend(value);
 }
 function getTodosStorageBackend(env = process.env) {
-  return parseStorageBackend(readStorageEnv(env, "mode").value);
+  for (const key of REMOVED_STORAGE_MODE_ENV_KEYS) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined) {
+      throw new Error(`${key} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `Set ${TODOS_STORAGE_ENV.databaseUrl} to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+    }
+  }
+  if (!getTodosStorageDatabaseUrl(env))
+    return "sqlite";
+  if (isTodosShadowEnabled(env))
+    return "sqlite";
+  return "postgres";
 }
 function getTodosStorageMode(env = process.env) {
   return getTodosStorageBackend(env);
@@ -4330,7 +4348,7 @@ function parsePositiveInteger(value, fallback) {
   }
   return parsed;
 }
-var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos", LEGACY_BACKEND_TOKENS;
+var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, REMOVED_STORAGE_MODE_ENV_KEYS, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos";
 var init_config = __esm(() => {
   TODOS_STORAGE_TABLES = [
     "todos_sync_records",
@@ -4338,7 +4356,6 @@ var init_config = __esm(() => {
   ];
   STORAGE_TABLES = TODOS_STORAGE_TABLES;
   TODOS_STORAGE_ENV = {
-    mode: "HASNA_TODOS_STORAGE_MODE",
     shadow: "HASNA_TODOS_SHADOW",
     databaseUrl: "HASNA_TODOS_DATABASE_URL",
     databaseSsl: "HASNA_TODOS_DATABASE_SSL",
@@ -4355,7 +4372,6 @@ var init_config = __esm(() => {
     syncDryRun: "HASNA_TODOS_SYNC_DRY_RUN"
   };
   TODOS_STORAGE_FALLBACK_ENV = {
-    mode: "TODOS_STORAGE_MODE",
     shadow: "TODOS_SHADOW",
     databaseUrl: "TODOS_DATABASE_URL",
     databaseSsl: "TODOS_DATABASE_SSL",
@@ -4371,14 +4387,12 @@ var init_config = __esm(() => {
     syncBatchSize: "TODOS_SYNC_BATCH_SIZE",
     syncDryRun: "TODOS_SYNC_DRY_RUN"
   };
-  LEGACY_BACKEND_TOKENS = {
-    local: "sqlite",
-    remote: "postgres",
-    postgresql: "postgres",
-    hybrid: "postgres",
-    self_hosted: "postgres",
-    cloud: "postgres"
-  };
+  REMOVED_STORAGE_MODE_ENV_KEYS = [
+    "HASNA_TODOS_STORAGE_MODE",
+    "HASNA_TODOS_MODE",
+    "TODOS_STORAGE_MODE",
+    "TODOS_MODE"
+  ];
 });
 
 // src/storage/shadow-outbox-schema.ts
@@ -5037,17 +5051,24 @@ function createProject(input, db) {
     const id = uuid();
     const timestamp2 = now();
     const derivedSlug = slugify(input.name);
-    const taskListId = input.task_list_id === undefined ? `todos-${derivedSlug}` : slugify(input.task_list_id);
+    const taskListId = input.task_list_id === undefined ? derivedSlug : slugify(input.task_list_id);
     if (!derivedSlug || !taskListId)
       throw new Error("Project name and task-list slug must be non-empty");
     const slugConflict = d.query("SELECT id FROM projects WHERE task_list_id = ? LIMIT 1").get(taskListId);
     if (slugConflict || !claimCanonicalSlug("project", "global", taskListId, id, d)) {
       throw new ResourceConflictError("PROJECT_SLUG_CONFLICT", `Project slug "${taskListId}" already exists`);
     }
+    const parentId = input.parent_id ?? null;
+    if (parentId !== null) {
+      const parent = getProject(parentId, d);
+      if (!parent)
+        throw new ProjectNotFoundError(parentId);
+      assertNotProjectAncestor(id, parentId, d);
+    }
     const taskPrefix = input.task_prefix || generatePrefix(input.name, d);
     const machineId = currentStorageMachineId(d);
-    d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, created_at, updated_at, machine_id)
-       VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, timestamp2, timestamp2, machineId]);
+    d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, parent_id, created_at, updated_at, machine_id)
+       VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, parentId, timestamp2, timestamp2, machineId]);
     return getProject(id, d);
   })();
 }
@@ -5072,6 +5093,60 @@ function listProjects(db) {
   const d = db || getDatabase();
   return d.query("SELECT * FROM projects ORDER BY name").all();
 }
+function orderProjectsParentFirst(projects) {
+  const projectId = (project) => {
+    const id = project.id;
+    return typeof id === "string" && id.length > 0 ? id : null;
+  };
+  const parentId = (project) => {
+    const parent = project.parent_id;
+    return parent == null ? null : String(parent);
+  };
+  const byId = new Set;
+  for (const project of projects) {
+    const id = projectId(project);
+    if (id !== null)
+      byId.add(id);
+  }
+  const ordered = [];
+  const emitted = new Set;
+  let remaining = [...projects];
+  let progress = true;
+  while (progress && remaining.length > 0) {
+    progress = false;
+    const deferred = [];
+    for (const project of remaining) {
+      const parent = parentId(project);
+      if (parent === null || emitted.has(parent) || !byId.has(parent)) {
+        ordered.push(project);
+        const id = projectId(project);
+        if (id !== null)
+          emitted.add(id);
+        progress = true;
+      } else {
+        deferred.push(project);
+      }
+    }
+    remaining = deferred;
+  }
+  ordered.push(...remaining);
+  return ordered;
+}
+function assertNotProjectAncestor(projectId, ancestorId, db) {
+  const d = db || getDatabase();
+  let cursor = ancestorId;
+  const seen = new Set;
+  while (cursor !== null) {
+    if (cursor === projectId) {
+      throw new ResourceConflictError("PROJECT_PARENT_CYCLE", `Project "${projectId}" cannot be placed under its own descendant`);
+    }
+    if (seen.has(cursor))
+      break;
+    seen.add(cursor);
+    const row = d.query("SELECT parent_id FROM projects WHERE id = ?").get(cursor);
+    cursor = row?.parent_id ?? null;
+  }
+}
 function updateProject(id, input, db) {
   const d = db || getDatabase();
   const project = getProject(id, d);
@@ -5094,6 +5169,16 @@ function updateProject(id, input, db) {
     sets.push("path = ?");
     params.push(input.path);
   }
+  if (input.parent_id !== undefined) {
+    if (input.parent_id !== null) {
+      const parent = getProject(input.parent_id, d);
+      if (!parent)
+        throw new ProjectNotFoundError(input.parent_id);
+      assertNotProjectAncestor(id, input.parent_id, d);
+    }
+    sets.push("parent_id = ?");
+    params.push(input.parent_id);
+  }
   params.push(id);
   d.run(`UPDATE projects SET ${sets.join(", ")} WHERE id = ?`, params);
   return getProject(id, d);
@@ -7227,8 +7312,8 @@ var init_secret_redaction = __esm(() => {
   SECRET_REDACTION_SCHEMA = ["todos", "secret_redaction", "v1"].join(".");
   DEFAULT_PATTERNS = [
     { name: "openai_sk", pattern: /\bsk-[a-zA-Z0-9]{10,}\b/g },
-    { name: "github_pat", pattern: /\bghp_[a-zA-Z0-9]{20,}\b/g },
-    { name: "github_oauth", pattern: /\bgho_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_pat", pattern: /\bgh[p]_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_oauth", pattern: /\bgh[o]_[a-zA-Z0-9]{20,}\b/g },
     { name: "aws_access_key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
     { name: "bearer_token", pattern: /\bBearer\s+[a-zA-Z0-9\-._~+/]+=*\b/gi },
     { name: "jwt", pattern: /\beyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g },
@@ -7240,7 +7325,7 @@ var init_secret_redaction = __esm(() => {
     /example\.com/i,
     /your-api-key-here/i,
     /sk-test/i,
-    /ghp_xxx/i
+    /gh[p]_xxx/i
   ];
   customRedactors = [];
 });
@@ -12833,7 +12918,7 @@ var init_dispatches = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.33",
+  version: "0.15.35",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",
@@ -12907,9 +12992,10 @@ var package_default = {
     "verify:release": "bun run scripts/verify-public-release.ts --mode=review",
     "verify:release-review": "bun run scripts/verify-npm-release-agent-review.ts",
     "verify:attested-container-candidate": "bun run scripts/attested-container-candidate.ts verify",
-    "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts scripts/attested-container-compatibility-vector.test.ts",
+    "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts",
     "emit:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts emit",
     "verify:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts verify",
+    "test:attested-container-compatibility-vector": "bun test scripts/attested-container-compatibility-vector.test.ts",
     "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
     prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
     postinstall: "mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true"
@@ -13598,6 +13684,7 @@ var TODOS_JSON_CONTRACTS = [
       task_list_id: nullableIdField,
       task_prefix: field(["string", "null"], "Optional task prefix.", true),
       task_counter: field("integer", "Monotonic project task counter."),
+      parent_id: field(["string", "null"], "Optional parent project id; null means top-level.", true),
       created_at: isoDateField,
       updated_at: isoDateField
     },
@@ -16883,6 +16970,7 @@ function createAgentProjectDemoBundle() {
     task_list_id: ids.list,
     task_prefix: "DEMO",
     task_counter: 4,
+    parent_id: null,
     created_at: createdAt,
     updated_at: completedAt
   });
@@ -26523,6 +26611,7 @@ var PROJECT_COLUMNS = [
   "task_list_id",
   "task_prefix",
   "task_counter",
+  "parent_id",
   "created_at",
   "updated_at",
   "machine_id",
@@ -26742,7 +26831,7 @@ function importSqliteTodosStorageSnapshot(snapshot, db) {
       }
     }
   };
-  applyRows("projects", "projects", PROJECT_COLUMNS, snapshot.projects, "updated_at");
+  applyRows("projects", "projects", PROJECT_COLUMNS, orderProjectsParentFirst(snapshot.projects), "updated_at");
   applyRows("project_machine_paths", "project_machine_paths", PROJECT_MACHINE_PATH_COLUMNS, snapshot.projectMachinePaths ?? [], "updated_at");
   applyRows("agents", "agents", AGENT_COLUMNS, snapshot.agents, "last_seen_at");
   applyRows("task_lists", "task_lists", TASK_LIST_COLUMNS, snapshot.taskLists, "updated_at");
@@ -28197,8 +28286,12 @@ class PostgresJsonRecordStore {
              OR ($11::text <> $2
                AND NOT EXISTS (SELECT 1 FROM parent_chain WHERE object_id = $2)
                AND NOT EXISTS (SELECT 1 FROM parent_chain WHERE cycle))) AS parent_acyclic,
-           (SELECT count(*) FROM locked_plans) = jsonb_array_length($7::jsonb) AS all_plans_found,
-           ($8::text IS NULL OR EXISTS (SELECT 1 FROM locked_plans WHERE object_id = $8)) AS target_plan_found,
+           (COALESCE((SELECT payload->>'plan_id' FROM locked_task), '')
+              IS DISTINCT FROM COALESCE($3::jsonb->>'plan_id', '')) AS membership_changed,
+           (NOT (COALESCE((SELECT payload->>'plan_id' FROM locked_task), '')
+                   IS DISTINCT FROM COALESCE($3::jsonb->>'plan_id', ''))
+             OR $8::text IS NULL
+             OR EXISTS (SELECT 1 FROM locked_plans WHERE object_id = $8)) AS target_plan_found,
            (SELECT payload->>'project_id' FROM locked_plans WHERE object_id = $8) AS target_project_id
        ), guarded AS (
          SELECT
@@ -28221,7 +28314,6 @@ class PostgresJsonRecordStore {
            AND guarded.version_matches
            AND guarded.parent_found
            AND guarded.parent_acyclic
-           AND guarded.all_plans_found
            AND guarded.target_plan_found
            AND NOT guarded.project_conflict
          ON CONFLICT (service, object_type, object_id) DO UPDATE SET
@@ -28237,7 +28329,7 @@ class PostgresJsonRecordStore {
          RETURNING payload
        )
        SELECT guarded.task_found, guarded.version_matches, guarded.parent_found, guarded.parent_acyclic,
-              guarded.all_plans_found, guarded.target_plan_found, guarded.project_conflict,
+              guarded.membership_changed, guarded.target_plan_found, guarded.project_conflict,
               (SELECT payload FROM stored) AS payload,
               (SELECT payload FROM locked_task) AS current_payload
        FROM guarded`, [
@@ -28269,7 +28361,7 @@ class PostgresJsonRecordStore {
     if (parentGuard && !row?.parent_acyclic && parentGuard.parentId) {
       throw new ResourceConflictError("TASK_PARENT_CYCLE", `TASK_PARENT_CYCLE: assigning parent ${parentGuard.parentId} to task ${value.id} would create or retain a parent cycle`);
     }
-    if (!row?.all_plans_found || !row.target_plan_found) {
+    if (!row?.target_plan_found) {
       throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan membership changed through a missing plan: ${targetPlanId ?? planIds.join(", ")}`, { plan_ids: planIds, target_plan_id: targetPlanId });
     }
     if (row.project_conflict) {
@@ -29481,17 +29573,26 @@ async function getChangedSince(since, filters, store) {
 async function createProject2(input, store, context) {
   const timestamp3 = new Date().toISOString();
   const derivedSlug = slugifyRaw(input.name);
-  const taskListId = input.task_list_id === undefined ? `todos-${derivedSlug}` : slugifyRaw(input.task_list_id);
+  const taskListId = input.task_list_id === undefined ? derivedSlug : slugifyRaw(input.task_list_id);
   if (!derivedSlug || !taskListId)
     throw new Error("Project name and task-list slug must be non-empty");
+  const parentId = input.parent_id ?? null;
+  const id = randomUUID3();
+  if (parentId !== null) {
+    const parent = await store.get("projects", parentId);
+    if (!parent)
+      throw new ProjectNotFoundError(parentId);
+    await assertNotProjectAncestorPostgres(id, parentId, store);
+  }
   const project = {
-    id: randomUUID3(),
+    id,
     name: input.name,
     path: input.path,
     description: input.description ?? null,
     task_list_id: taskListId,
     task_prefix: input.task_prefix ?? await generateProjectPrefix(input.name, store),
     task_counter: 0,
+    parent_id: parentId,
     created_at: timestamp3,
     updated_at: timestamp3,
     machine_id: store.machineId(context),
@@ -29499,12 +29600,38 @@ async function createProject2(input, store, context) {
   };
   return store.upsert("projects", project, context);
 }
+async function assertNotProjectAncestorPostgres(projectId, candidateParentId, store) {
+  const all = await store.list("projects");
+  const byId = new Map(all.map((project) => [project.id, project.parent_id ?? null]));
+  let cursor = candidateParentId;
+  const seen = new Set;
+  while (cursor !== null) {
+    if (cursor === projectId) {
+      throw new ResourceConflictError("PROJECT_PARENT_CYCLE", `Project "${projectId}" cannot be placed under its own descendant`);
+    }
+    if (seen.has(cursor))
+      break;
+    seen.add(cursor);
+    cursor = byId.get(cursor) ?? null;
+  }
+}
 async function updateProject2(id, input, store) {
   if ("task_list_id" in input) {
     throw new Error("task_list_id cannot be changed by updateProject; use renameProject for an atomic canonical rename");
   }
   const project = await requireRecord("projects", id, store);
-  const updated = { ...project, ...definedPatch(input), updated_at: new Date().toISOString() };
+  if (input.parent_id !== undefined && input.parent_id !== null) {
+    const parent = await store.get("projects", input.parent_id);
+    if (!parent)
+      throw new ProjectNotFoundError(input.parent_id);
+    await assertNotProjectAncestorPostgres(id, input.parent_id, store);
+  }
+  const updated = {
+    ...project,
+    ...definedPatch(input),
+    ...input.parent_id !== undefined ? { parent_id: input.parent_id } : {},
+    updated_at: new Date().toISOString()
+  };
   return store.upsert("projects", updated);
 }
 async function createPlan2(input, store, context) {
@@ -35334,7 +35461,7 @@ class StagedSqliteTodosProjectRegistrationTransaction {
   }
   async createProject(input) {
     const derivedSlug = normalizeSlug(input.name);
-    const taskListId = input.task_list_id === undefined ? `todos-${derivedSlug}` : normalizeSlug(input.task_list_id);
+    const taskListId = input.task_list_id === undefined ? derivedSlug : normalizeSlug(input.task_list_id);
     if (!derivedSlug || !taskListId) {
       throw new Error("Project name and task-list slug must be non-empty");
     }
@@ -35346,6 +35473,7 @@ class StagedSqliteTodosProjectRegistrationTransaction {
       task_list_id: taskListId,
       task_prefix: input.task_prefix ?? this.availableProjectPrefix(input.name),
       task_counter: 0,
+      parent_id: input.parent_id ?? null,
       created_at: now(),
       updated_at: now(),
       machine_id: currentStorageMachineId(this.db)
@@ -35356,14 +35484,15 @@ class StagedSqliteTodosProjectRegistrationTransaction {
       try {
         const result = this.db.run(`INSERT INTO projects (
              id, name, path, description, task_list_id, task_prefix,
-             task_counter, created_at, updated_at, machine_id
-           ) VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`, [
+             task_counter, parent_id, created_at, updated_at, machine_id
+           ) VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?)`, [
           project.id,
           project.name,
           project.path,
           project.description,
           project.task_list_id,
           project.task_prefix,
+          project.parent_id,
           project.created_at,
           project.updated_at,
           project.machine_id ?? null
@@ -35759,7 +35888,10 @@ function taskListSlug(projectSlug) {
   if (!slug || slug !== projectSlug) {
     throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "project_slug must be canonical kebab-case");
   }
-  return `todos-${slug}`;
+  return slug;
+}
+function legacyTaskListSlug(projectSlug) {
+  return `todos-${normalizeSlug(projectSlug)}`;
 }
 function deterministicTaskPrefix(projectSlug) {
   const letters = projectSlug.replace(/[^a-z0-9]/gi, "").toUpperCase();
@@ -36278,6 +36410,12 @@ class PackageOwnedTodosProjectRegistrationAuthority {
             created_by_operation: false
           };
         }
+        if (request.bind_existing === true && conflict2.path === path && conflict2.task_list_id === legacyTaskListSlug(request.project_slug)) {
+          return {
+            record: boundExistingProjectRecord(conflict2),
+            created_by_operation: false
+          };
+        }
         return this.terminalFor(transaction, request, normalizedCallDigest(request), "target_already_exists", { targetId: conflict2.id });
       }
       await this.fault("before_object_write", request);
@@ -36314,6 +36452,15 @@ class PackageOwnedTodosProjectRegistrationAuthority {
       }
       return this.terminalFor(transaction, request, normalizedCallDigest(request), "target_already_exists", { targetId: conflict.id });
     }
+    if (request.bind_existing === true) {
+      const legacy = await transaction.findTaskListConflict(todosProjectId, legacyTaskListSlug(request.project_slug));
+      if (legacy && legacy.project_id === todosProjectId) {
+        return {
+          record: boundExistingTaskListRecord(legacy),
+          created_by_operation: false
+        };
+      }
+    }
     await this.fault("before_object_write", request);
     const taskList = await transaction.createTaskList({
       name: request.project_name,
@@ -43481,54 +43628,49 @@ function createTodosTaskManifestHttpClient(options) {
 import { createHash as createHash16 } from "crypto";
 // src/cli/cloud-router.ts
 import { resolveStorageClient } from "@hasna/contracts/client/storage";
-import { normalizeStorageMode } from "@hasna/contracts/mode";
 init_types();
 init_redaction();
-var TRANSPORT_TOKENS = {
-  sqlite: "sqlite",
-  http: "http",
-  local: "sqlite",
-  remote: "http",
-  self_hosted: "http",
-  cloud: "http",
-  hybrid: "http"
-};
 var completionCapabilityCache = new Map;
 var retryCapabilityCache = new Map;
 var taskCreatorCapabilityCache = new Map;
 var gitRefCapabilityCache = new Map;
 var remoteCommandCapabilityCache = new Map;
-function cleanMode(value) {
-  const normalized = value?.trim().toLowerCase();
-  return normalized || null;
+var LEGACY_STORAGE_MODE_KEYS = [
+  "HASNA_TODOS_STORAGE_MODE",
+  "HASNA_TODOS_MODE",
+  "TODOS_STORAGE_MODE",
+  "TODOS_MODE"
+];
+function assertNoLegacyStorageMode(env = process.env) {
+  for (const key2 of LEGACY_STORAGE_MODE_KEYS) {
+    if (Object.hasOwn(env, key2) && env[key2] !== undefined) {
+      throw new Error(`REMOTE_STORAGE_MODE_REMOVED: ${key2} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `The client uses the on-box SQLite store, or the HTTP API selected by ` + `HASNA_TODOS_API_URL + HASNA_TODOS_API_KEY. ` + `On the server, set HASNA_TODOS_DATABASE_URL to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+    }
+  }
 }
 function resolveTodosCliStorageMode(env = process.env) {
-  for (const source9 of ["HASNA_TODOS_STORAGE_MODE", "TODOS_STORAGE_MODE"]) {
-    if (env[source9] !== undefined && env[source9].trim() === "") {
-      throw new Error(`REMOTE_STORAGE_MODE_INVALID: ${source9} must not be blank; local SQLite fallback is disabled for invalid routing state`);
-    }
+  assertNoLegacyStorageMode(env);
+  const urlValue = env.HASNA_TODOS_API_URL?.trim();
+  const keyValue = env.HASNA_TODOS_API_KEY?.trim();
+  if (urlValue && keyValue) {
+    return {
+      mode: "http",
+      transport: "http",
+      selected: true,
+      source: "HASNA_TODOS_API_URL+HASNA_TODOS_API_KEY"
+    };
   }
-  const canonical = cleanMode(env.HASNA_TODOS_STORAGE_MODE);
-  const fallback = cleanMode(env.TODOS_STORAGE_MODE);
-  for (const [source9, value] of [
-    ["HASNA_TODOS_STORAGE_MODE", canonical],
-    ["TODOS_STORAGE_MODE", fallback]
-  ]) {
-    if (value && !(value in TRANSPORT_TOKENS)) {
-      throw new Error(`REMOTE_STORAGE_MODE_INVALID: ${source9}=${value} must be sqlite (local file) or http (hosted /v1 authority); ` + "legacy values local and remote are accepted; " + "local SQLite fallback is disabled for invalid routing state");
-    }
+  if (urlValue) {
+    throw new Error("REMOTE_API_KEY_MISSING: remote Todos storage requires HASNA_TODOS_API_KEY; local SQLite fallback is disabled");
   }
-  const canonicalTransport = canonical ? TRANSPORT_TOKENS[canonical] : null;
-  const fallbackTransport = fallback ? TRANSPORT_TOKENS[fallback] : null;
-  if (canonicalTransport && fallbackTransport && canonicalTransport !== fallbackTransport) {
-    throw new Error(`REMOTE_STORAGE_MODE_CONFLICT: HASNA_TODOS_STORAGE_MODE=${canonical} conflicts with ` + `TODOS_STORAGE_MODE=${fallback}; local SQLite fallback is disabled`);
+  if (keyValue) {
+    throw new Error("REMOTE_API_URL_MISSING: remote Todos storage requires HASNA_TODOS_API_URL; local SQLite fallback is disabled");
   }
-  const transport = canonicalTransport ?? fallbackTransport ?? "sqlite";
   return {
-    mode: transport,
-    transport,
-    selected: transport === "http",
-    source: canonical ? "HASNA_TODOS_STORAGE_MODE" : fallback ? "TODOS_STORAGE_MODE" : "default"
+    mode: "sqlite",
+    transport: "sqlite",
+    selected: false,
+    source: "default"
   };
 }
 function requestedTransport(env) {
@@ -43572,7 +43714,7 @@ function getTodosRemoteAuthorityConfigStatus(env = process.env) {
     return {
       selected: true,
       ok: false,
-      mode: cleanMode(env.HASNA_TODOS_STORAGE_MODE) ?? cleanMode(env.TODOS_STORAGE_MODE) ?? "invalid",
+      mode: "invalid",
       api_url_configured: Boolean(env.HASNA_TODOS_API_URL?.trim()),
       api_key_configured: Boolean(env.HASNA_TODOS_API_KEY?.trim()),
       v1_base_url: null,
@@ -43618,29 +43760,12 @@ function getTodosRemoteAuthorityConfigStatus(env = process.env) {
     local_fallback: false
   };
 }
-var SERVER_MODE_CANDIDATES = ["postgres", "cloud", "self_hosted"];
-var cachedServerMode = null;
-function serverStorageMode(normalize2 = normalizeStorageMode) {
-  const useCache = normalize2 === normalizeStorageMode;
-  if (useCache && cachedServerMode !== null)
-    return cachedServerMode;
-  for (const candidate of SERVER_MODE_CANDIDATES) {
-    try {
-      normalize2(candidate);
-      if (useCache)
-        cachedServerMode = candidate;
-      return candidate;
-    } catch {}
-  }
-  throw new Error(`REMOTE_STORAGE_MODE_UNSUPPORTED: no known server storage mode is accepted by the installed ` + `@hasna/contracts (tried ${SERVER_MODE_CANDIDATES.join(", ")}); the storage-mode enum has changed. ` + `Add the new server token to SERVER_MODE_CANDIDATES in src/cli/cloud-router.ts; ` + `local SQLite fallback is disabled.`);
-}
 function requireTodosRemoteAuthorityEnv(env) {
   const status2 = getTodosRemoteAuthorityConfigStatus(env);
   if (!status2.ok)
     throw new Error(status2.issues[0]);
   return {
     ...env,
-    HASNA_TODOS_STORAGE_MODE: serverStorageMode(),
     HASNA_TODOS_API_URL: status2.v1_base_url.replace(/\/v1$/, ""),
     HASNA_TODOS_API_KEY: env.HASNA_TODOS_API_KEY.trim()
   };
@@ -43678,7 +43803,32 @@ function classifyRemoteRequestError(baseUrl, route, error) {
   }
   throw error;
 }
-function protectRemoteClient(client) {
+var REMOTE_REQUEST_TIMEOUT_MS = 1e4;
+function withBoundedRemoteRequest(options, requestTimeoutMs, run) {
+  const controller = new AbortController;
+  const onBaseAbort = () => controller.abort();
+  if (options?.signal) {
+    if (options.signal.aborted)
+      controller.abort();
+    else
+      options.signal.addEventListener("abort", onBaseAbort, { once: true });
+  }
+  let timer;
+  const deadline = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      reject(new DOMException(`Todos remote request exceeded the ${requestTimeoutMs}ms bounded request timeout`, "AbortError"));
+    }, requestTimeoutMs);
+  });
+  const attempt = run({ ...options, signal: controller.signal });
+  attempt.catch(() => {});
+  return Promise.race([attempt, deadline]).finally(() => {
+    if (timer)
+      clearTimeout(timer);
+    options?.signal?.removeEventListener("abort", onBaseAbort);
+  });
+}
+function protectRemoteClient(client, requestTimeoutMs) {
   const baseUrl = remoteAuthorityBase(client);
   const protect = async (route, request) => {
     try {
@@ -43687,25 +43837,26 @@ function protectRemoteClient(client) {
       return classifyRemoteRequestError(baseUrl, route, error);
     }
   };
+  const bounded = (options, run) => withBoundedRemoteRequest(options, requestTimeoutMs, run);
   const transport = client.transport;
   const protectedTransport = {
     baseUrl: transport.baseUrl,
-    request: (method, path, body2, options) => protect(path, () => transport.request(method, path, body2, options)),
-    get: (path, options) => protect(path, () => transport.get(path, options)),
-    post: (path, body2, options) => protect(path, () => transport.post(path, body2, options)),
-    put: (path, body2, options) => protect(path, () => transport.put(path, body2, options)),
-    patch: (path, body2, options) => protect(path, () => transport.patch(path, body2, options)),
-    del: (path, body2, options) => protect(path, () => transport.del(path, body2, options))
+    request: (method, path, body2, options) => protect(path, () => bounded(options, (opts) => transport.request(method, path, body2, opts))),
+    get: (path, options) => protect(path, () => bounded(options, (opts) => transport.get(path, opts))),
+    post: (path, body2, options) => protect(path, () => bounded(options, (opts) => transport.post(path, body2, opts))),
+    put: (path, body2, options) => protect(path, () => bounded(options, (opts) => transport.put(path, body2, opts))),
+    patch: (path, body2, options) => protect(path, () => bounded(options, (opts) => transport.patch(path, body2, opts))),
+    del: (path, body2, options) => protect(path, () => bounded(options, (opts) => transport.del(path, body2, opts)))
   };
   return {
     name: client.name,
     baseUrl: client.baseUrl,
     transport: protectedTransport,
-    list: (resource, options) => protect(`/${resource}`, () => client.list(resource, options)),
-    get: (resource, id, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => client.get(resource, id, options)),
-    create: (resource, body2, options) => protect(`/${resource}`, () => client.create(resource, body2, options)),
-    update: (resource, id, patch, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => client.update(resource, id, patch, options)),
-    delete: (resource, id, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => client.delete(resource, id, options))
+    list: (resource, options) => protect(`/${resource}`, () => bounded(options, (opts) => client.list(resource, opts))),
+    get: (resource, id, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => bounded(options, (opts) => client.get(resource, id, opts))),
+    create: (resource, body2, options) => protect(`/${resource}`, () => bounded(options, (opts) => client.create(resource, body2, opts))),
+    update: (resource, id, patch, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => bounded(options, (opts) => client.update(resource, id, patch, opts))),
+    delete: (resource, id, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => bounded(options, (opts) => client.delete(resource, id, opts)))
   };
 }
 function remoteAuthorityBase(client) {
@@ -43726,13 +43877,19 @@ async function requiredRemoteRoute(client, route, request, recognized404Codes =
     throw error;
   }
 }
-function getTodosCloudClient(env = process.env) {
+function getTodosCloudClient(env = process.env, requestTimeoutMs = REMOTE_REQUEST_TIMEOUT_MS) {
   if (requestedTransport(env) !== "http")
     return null;
   const resolved = resolveStorageClient("todos", requireTodosRemoteAuthorityEnv(env), {
-    fetchImpl: (input, init) => globalThis.fetch(input, { ...init, redirect: "manual" })
+    fetchImpl: (input, init) => globalThis.fetch(input, { ...init, redirect: "manual" }),
+    timeoutMs: requestTimeoutMs
   });
-  return resolved.transport === "cloud-http" ? protectRemoteClient(resolved.client) : null;
+  if (resolved.transport === "cloud-http")
+    return protectRemoteClient(resolved.client, requestTimeoutMs);
+  const transportName = resolved.transport;
+  if (transportName === "http")
+    return protectRemoteClient(resolved.client, requestTimeoutMs);
+  return null;
 }
 function unwrapTask(raw) {
   if (raw && typeof raw === "object" && "task" in raw) {
@@ -45527,7 +45684,7 @@ function getNativeStorageStatus(env = process.env) {
   const remoteEnabled = isTodosPostgresBackend(config);
   const remoteFieldsConfigured = Boolean(config.database || config.objectStorage);
   if (!remoteEnabled && remoteFieldsConfigured) {
-    warnings.push(`the sqlite backend (${TODOS_STORAGE_ENV.mode}) ignores configured remote storage fields`);
+    warnings.push(`the sqlite backend ignores configured remote storage fields`);
   }
   if (remoteEnabled && !config.objectStorage) {
     warnings.push(`${TODOS_STORAGE_ENV.s3Bucket} is not configured, so artifact sync will stay local`);
@@ -45620,7 +45777,7 @@ function storageEnvStatus(env) {
 function fallbackConfig(env) {
   let mode;
   try {
-    mode = parseStorageBackend(clean2(env[TODOS_STORAGE_ENV.mode]));
+    mode = getTodosStorageBackend(env);
   } catch {
     mode = "sqlite";
   }
@@ -47804,7 +47961,7 @@ function addSourceOnce(projectId, type, name, uri, metadata, db) {
 function bootstrapProject(options = {}, db) {
   const d = db || getDatabase();
   const discovery = discoverProjectWorkspace(options.path);
-  const taskListSlug2 = options.taskListSlug || `todos-${slugify(options.name || discovery.projectName)}`;
+  const taskListSlug2 = options.taskListSlug || slugify(options.name || discovery.projectName);
   if (options.dryRun) {
     return {
       dryRun: true,
@@ -55222,21 +55379,22 @@ function upsertProject(raw, d) {
   const existing = getProject(id, d);
   const ts = now();
   if (!existing) {
-    d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, created_at, updated_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+    d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, parent_id, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
       id,
       raw.name,
       raw.path,
       raw.description ?? null,
-      raw.task_list_id ?? `todos-${String(raw.name).toLowerCase().replace(/\s+/g, "-")}`,
+      raw.task_list_id ?? String(raw.name).toLowerCase().replace(/\s+/g, "-"),
       raw.task_prefix ?? "TSK",
       raw.task_counter ?? 0,
+      raw.parent_id ?? null,
       raw.created_at ?? ts,
       raw.updated_at ?? ts
     ].map(sqlValue));
     return "created";
   }
-  d.run(`UPDATE projects SET name = ?, path = ?, description = ?, task_list_id = ?, task_prefix = ?, task_counter = ?, updated_at = ?
+  d.run(`UPDATE projects SET name = ?, path = ?, description = ?, task_list_id = ?, task_prefix = ?, task_counter = ?, parent_id = ?, updated_at = ?
      WHERE id = ?`, [
     raw.name ?? existing.name,
     raw.path ?? existing.path,
@@ -55244,6 +55402,7 @@ function upsertProject(raw, d) {
     raw.task_list_id ?? existing.task_list_id,
     raw.task_prefix ?? existing.task_prefix,
     raw.task_counter ?? existing.task_counter,
+    raw.parent_id ?? existing.parent_id,
     raw.updated_at ?? ts,
     id
   ].map(sqlValue));
@@ -55324,7 +55483,7 @@ function importBundle(bundle, options = {}, db) {
   };
   if (options.dry_run)
     return result;
-  for (const raw of bundle.projects) {
+  for (const raw of orderProjectsParentFirst(bundle.projects)) {
     try {
       const id = raw.id;
       const local = getProject(id, d);