@hasna/todos 0.15.46 → 0.15.49

package/dist/cli/index.js

@@ -2123,7 +2123,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.46",
+    version: "0.15.49",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -2187,6 +2187,7 @@ var init_package = __esm(() => {
     ],
     scripts: {
       build: "rm -rf dist dashboard/dist && cd dashboard && bun install --frozen-lockfile && bun run build && cd .. && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts src/task-manifest.ts src/task-subtree-transfer.ts --outdir dist --root src --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && tsc --emitDeclarationOnly --outDir dist",
+      "build:js": "rm -rf dist && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts src/task-manifest.ts src/task-subtree-transfer.ts --outdir dist --root src --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && tsc --emitDeclarationOnly --outDir dist",
       "build:server": "rm -rf dist && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts src/task-manifest.ts src/task-subtree-transfer.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*'",
       migrate: "bun run src/server/index.ts migrate",
       "backfill:comment-redaction": "bun run src/server/index.ts redact-comments",
@@ -2241,18 +2242,19 @@ var init_package = __esm(() => {
     author: "Andrei Hasna <andrei@hasna.com>",
     license: "Apache-2.0",
     dependencies: {
-      "@hasna/contracts": "0.13.4",
+      "@hasna/contracts": "0.14.0",
       "@hasna/events": "^0.1.11",
       "@modelcontextprotocol/sdk": "^1.12.1",
       chalk: "^5.4.1",
       commander: "^13.1.0",
       ink: "^5.2.0",
       react: "^18.3.1",
-      zod: "^3.24.2"
+      zod: "3.25.76"
     },
     overrides: {
       ajv: "8.20.0",
-      "fast-uri": "3.1.2"
+      "fast-uri": "3.1.2",
+      zod: "3.25.76"
     },
     devDependencies: {
       "@types/bun": "^1.2.4",
@@ -2850,13 +2852,15 @@ function upsertSecretSafetyConfig(input) {
   saveConfig({ ...config, secret_safety: next });
   return next;
 }
-var DEFAULT_SECRET_PATTERNS, DEFAULT_SECRET_KEY_PATTERN, NON_SECRET_USAGE_KEYS, REDACTION_PLACEHOLDER;
+var XAI_PREFIX, DEFAULT_SECRET_PATTERNS, DEFAULT_SECRET_KEY_PATTERN, NON_SECRET_USAGE_KEYS, REDACTION_PLACEHOLDER;
 var init_redaction = __esm(() => {
   init_config();
+  XAI_PREFIX = ["x", "ai", "-"].join("");
   DEFAULT_SECRET_PATTERNS = [
     { name: "aws-access-key", regex: /\b(AKIA|ASIA)[0-9A-Z]{16}\b/g, replacement: "[REDACTED_AWS_KEY]" },
     { name: "private-key", regex: /-----BEGIN (?:RSA |EC |OPENSSH |)PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |)PRIVATE KEY-----/g, replacement: "[REDACTED_PRIVATE_KEY]" },
     { name: "openai-token", regex: /\bsk-[A-Za-z0-9_-]{12,}\b/g, replacement: "[REDACTED_TOKEN]" },
+    { name: `${XAI_PREFIX}token`, regex: /\bxai[-][A-Za-z0-9]{20,80}\b/g, replacement: "[REDACTED_TOKEN]" },
     { name: "npm-token", regex: /\bnpm_[A-Za-z0-9]{20,}\b/g, replacement: "[REDACTED_NPM_TOKEN]" },
     { name: "github-fine-grained-token", regex: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, replacement: "[REDACTED_GITHUB_TOKEN]" },
     { name: "github-token", regex: /\bgh[opsu]_[A-Za-z0-9]{20,}\b/g, replacement: "[REDACTED_GITHUB_TOKEN]" },
@@ -14578,8 +14582,9 @@ var init_event_hooks = __esm(() => {
   VALID_TARGETS = new Set(["stdout", "file", "socket", "script"]);
 });
 
-// node_modules/.bun/@hasna+events@0.1.11/node_modules/@hasna/events/dist/index.js
+// node_modules/.bun/@hasna+events@0.1.16/node_modules/@hasna/events/dist/index.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { Buffer as Buffer2 } from "buffer";
 import { existsSync as existsSync6 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join5 } from "path";
@@ -14688,11 +14693,13 @@ function getEventsDataDir(override) {
 
 class JsonEventsStore {
   dataDir;
+  runtime;
   channelsPath;
   eventsPath;
   deliveriesPath;
   constructor(dataDir = getEventsDataDir()) {
     this.dataDir = dataDir;
+    this.runtime = localJsonRuntime(dataDir);
     this.channelsPath = join5(dataDir, "channels.json");
     this.eventsPath = join5(dataDir, "events.json");
     this.deliveriesPath = join5(dataDir, "deliveries.json");
@@ -14740,13 +14747,58 @@ class JsonEventsStore {
     await this.writeJson(this.eventsPath, events);
     return event;
   }
-  async listEvents() {
+  async appendEventOnce(event, options = {}) {
     await this.init();
-    return this.readJson(this.eventsPath, []);
+    const events = await this.readJson(this.eventsPath, []);
+    const dedupe2 = options.dedupe !== false;
+    if (dedupe2) {
+      const existing = findEventByIdentity(events, { id: event.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return {
+          event: existing,
+          stored: false,
+          deduped: true,
+          identity: { id: existing.id, dedupeKey: existing.dedupeKey }
+        };
+      }
+    }
+    events.push(event);
+    await this.writeJson(this.eventsPath, events);
+    return {
+      event,
+      stored: true,
+      deduped: false,
+      identity: { id: event.id, dedupeKey: event.dedupeKey }
+    };
+  }
+  async listEvents(options = {}) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    return queryEvents(events, options);
+  }
+  async listEventsPage(options = {}) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    const queried = queryEvents(events, {
+      eventId: options.eventId,
+      source: options.source,
+      type: options.type
+    });
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    const limit = normalizeEventPageLimit(options.limit);
+    const pageEvents = queried.slice(offset, offset + limit);
+    const nextOffset = offset + pageEvents.length;
+    const hasMore = nextOffset < queried.length;
+    return {
+      events: pageEvents,
+      cursor: options.cursor,
+      nextCursor: hasMore ? encodeLocalJsonEventCursor(nextOffset, options) : undefined,
+      hasMore
+    };
   }
   async findEventByIdentity(identity) {
     const events = await this.listEvents();
-    return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
+    return findEventByIdentity(events, identity);
   }
   async appendDelivery(result) {
     await this.init();
@@ -14797,6 +14849,83 @@ class JsonEventsStore {
     });
   }
 }
+function localJsonRuntime(dataDir = getEventsDataDir()) {
+  return {
+    mode: "local-files",
+    name: "json-events-store",
+    remote: false,
+    localFiles: true,
+    localSqlite: false,
+    postgres: false,
+    s3: false,
+    aws: false,
+    durable: true,
+    idempotency: "best-effort-local",
+    replayCursors: true,
+    description: `Local JSON files in ${dataDir}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
+  };
+}
+function encodeLocalJsonEventCursor(offset, options = {}) {
+  if (!Number.isInteger(offset) || offset < 0)
+    throw new Error(`Invalid event cursor offset: ${offset}`);
+  const payload = {
+    offset,
+    eventId: options.eventId,
+    source: options.source,
+    type: options.type
+  };
+  return `${LOCAL_JSON_EVENT_CURSOR_PREFIX}${Buffer2.from(JSON.stringify(payload), "utf-8").toString("base64url")}`;
+}
+function decodeLocalJsonEventCursor(cursor, options = {}) {
+  if (!cursor)
+    return 0;
+  if (!cursor.startsWith(LOCAL_JSON_EVENT_CURSOR_PREFIX))
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  const rawPayload = cursor.slice(LOCAL_JSON_EVENT_CURSOR_PREFIX.length);
+  let payload;
+  try {
+    payload = JSON.parse(Buffer2.from(rawPayload, "base64url").toString("utf-8"));
+  } catch {
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  }
+  const offset = payload.offset;
+  if (!Number.isInteger(offset) || offset < 0)
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  assertCursorFilter("eventId", payload.eventId, options.eventId);
+  assertCursorFilter("source", payload.source, options.source);
+  assertCursorFilter("type", payload.type, options.type);
+  return offset;
+}
+function normalizeEventPageLimit(limit) {
+  if (limit === undefined)
+    return DEFAULT_EVENT_PAGE_LIMIT;
+  if (!Number.isInteger(limit) || limit < 1)
+    throw new Error(`Event page limit must be a positive integer, got ${limit}`);
+  return Math.min(limit, MAX_EVENT_PAGE_LIMIT);
+}
+function queryEvents(events, options) {
+  let rows = events;
+  if (options.eventId)
+    rows = rows.filter((event) => event.id === options.eventId);
+  if (options.source)
+    rows = rows.filter((event) => event.source === options.source);
+  if (options.type)
+    rows = rows.filter((event) => event.type === options.type);
+  if (options.cursor) {
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    rows = rows.slice(offset);
+  }
+  if (options.limit !== undefined)
+    rows = rows.slice(0, normalizeEventPageLimit(options.limit));
+  return rows;
+}
+function assertCursorFilter(name, cursorValue, optionValue) {
+  if (cursorValue !== optionValue)
+    throw new Error(`Local JSON event cursor ${name} filter mismatch`);
+}
+function findEventByIdentity(events, identity) {
+  return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
+}
 function buildSignatureBase(timestamp2, body) {
   return `${timestamp2}.${body}`;
 }
@@ -14810,21 +14939,27 @@ function now2() {
 function truncate(value, max = 4096) {
   return value.length > max ? `${value.slice(0, max)}...` : value;
 }
-function buildWebhookRequest(event, channel) {
+function buildWebhookRequest(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
+  for (const name of Object.keys(channel.webhook.headers ?? {})) {
+    if (/^x-hasna-/i.test(name)) {
+      throw new Error(`Webhook header ${name} is reserved for signed delivery metadata`);
+    }
+  }
   const body = JSON.stringify(event);
-  const timestamp2 = event.time;
+  const timestamp2 = options.timestamp ?? new Date().toISOString();
   const headers = {
     "Content-Type": "application/json",
     "User-Agent": "@hasna/events",
     "X-Hasna-Event-Id": event.id,
     "X-Hasna-Event-Type": event.type,
-    "X-Hasna-Timestamp": timestamp2,
-    ...channel.webhook.headers
+    ...channel.webhook.headers,
+    "X-Hasna-Timestamp": timestamp2
   };
-  if (channel.webhook.secret) {
-    headers["X-Hasna-Signature"] = signPayload(channel.webhook.secret, timestamp2, body);
+  const secret = options.secret ?? channel.webhook.secret;
+  if (secret) {
+    headers["X-Hasna-Signature"] = signPayload(secret, timestamp2, body);
   }
   return { body, headers };
 }
@@ -14832,7 +14967,21 @@ async function dispatchWebhook(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
   const startedAt = now2();
-  const { body, headers } = buildWebhookRequest(event, channel);
+  let secret = channel.webhook.secret;
+  if (channel.webhook.secretRef) {
+    if (!options.secretResolver) {
+      return failedAttempt(startedAt, "Webhook secret reference has no runtime resolver");
+    }
+    try {
+      secret = await options.secretResolver(channel.webhook.secretRef);
+    } catch {
+      return failedAttempt(startedAt, "Webhook secret reference could not be resolved");
+    }
+    if (!secret)
+      return failedAttempt(startedAt, "Webhook secret reference could not be resolved");
+  }
+  const timestamp2 = (options.now?.() ?? new Date).toISOString();
+  const { body, headers } = buildWebhookRequest(event, channel, { secret, timestamp: timestamp2 });
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
   try {
@@ -14864,6 +15013,15 @@ async function dispatchWebhook(event, channel, options = {}) {
     clearTimeout(timeout);
   }
 }
+function failedAttempt(startedAt, error) {
+  return {
+    attempt: 1,
+    status: "failed",
+    startedAt,
+    completedAt: now2(),
+    error
+  };
+}
 async function dispatchCommand(event, channel) {
   if (!channel.command)
     throw new Error(`Channel ${channel.id} has no command config`);
@@ -14952,6 +15110,76 @@ function createDeliveryResult(event, channel, attempts) {
     completedAt: attempts.at(-1)?.completedAt ?? now2()
   };
 }
+
+class EventTypeCatalog {
+  definitions = new Map;
+  register(definition) {
+    this.definitions.set(definition.type, definition);
+    return this;
+  }
+  unregister(type) {
+    return this.definitions.delete(type);
+  }
+  has(type) {
+    return this.definitions.has(type);
+  }
+  get(type) {
+    return this.definitions.get(type);
+  }
+  list() {
+    return [...this.definitions.values()];
+  }
+  validateEvent(event) {
+    const definition = this.definitions.get(event.type);
+    if (!definition)
+      return { ok: true };
+    return definition.validate(event.data, event);
+  }
+  assertEventValid(event) {
+    const result = this.validateEvent(event);
+    if (!result.ok) {
+      throw new EventValidationError(event.type, result.issues);
+    }
+  }
+}
+function redactPaths(event, paths, replacement = "[REDACTED]") {
+  if (paths.length === 0)
+    return event;
+  const copy = structuredClone(event);
+  for (const path of paths) {
+    setPath(copy, path, replacement);
+  }
+  return copy;
+}
+function redactSensitiveKeys(event, replacement = "[REDACTED]") {
+  return redactValue2(event, replacement);
+}
+function shouldRedactKey(key) {
+  return /secret|token|password|api[_-]?key|authorization/i.test(key);
+}
+function redactValue2(value, replacement) {
+  if (Array.isArray(value))
+    return value.map((item) => redactValue2(item, replacement));
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    shouldRedactKey(key) ? replacement : redactValue2(item, replacement)
+  ]));
+}
+function setPath(input, path, replacement) {
+  const parts = path.split(".");
+  let cursor = input;
+  for (const part of parts.slice(0, -1)) {
+    const next = cursor[part];
+    if (!next || typeof next !== "object")
+      return;
+    cursor = next;
+  }
+  const last = parts.at(-1);
+  if (last && last in cursor)
+    cursor[last] = replacement;
+}
 function createEvent(input) {
   return {
     id: input.id ?? randomUUID22(),
@@ -14972,10 +15200,18 @@ class EventsClient {
   store;
   redactors;
   transportOptions;
+  catalog;
+  validateCatalogTypes;
   constructor(options = {}) {
     this.store = options.store ?? new JsonEventsStore(options.dataDir);
     this.redactors = options.redactors ?? [];
-    this.transportOptions = { fetchImpl: options.fetchImpl };
+    this.transportOptions = {
+      fetchImpl: options.fetchImpl,
+      secretResolver: options.secretResolver,
+      now: options.now
+    };
+    this.catalog = options.catalog ?? defaultEventTypeCatalog;
+    this.validateCatalogTypes = options.validateCatalogTypes ?? false;
   }
   async addChannel(input) {
     const timestamp2 = new Date().toISOString();
@@ -14993,18 +15229,40 @@ class EventsClient {
   }
   async emit(input, options = {}) {
     const event = options.redactSensitiveData === false ? createEvent(input) : redactSensitiveKeys(createEvent(input));
-    if (options.dedupe !== false) {
-      const existing = await this.store.findEventByIdentity({ id: input.id, dedupeKey: event.dedupeKey });
-      if (existing) {
-        return { event: existing, deliveries: [], deduped: true };
-      }
-    }
-    await this.store.appendEvent(event);
-    const deliveries = options.deliver === false ? [] : await this.deliver(event);
-    return { event, deliveries, deduped: false };
-  }
-  async listEvents() {
-    return this.store.listEvents();
+    if (options.validate ?? this.validateCatalogTypes) {
+      this.catalog.assertEventValid(event);
+    }
+    const append = await this.appendEvent(event, { dedupe: options.dedupe !== false });
+    if (append.deduped) {
+      return { event: append.event, deliveries: [], deduped: true };
+    }
+    const deliveries = options.deliver === false ? [] : await this.deliver(append.event);
+    return { event: append.event, deliveries, deduped: false };
+  }
+  async listEvents(options = {}) {
+    if (Object.keys(options).length === 0)
+      return this.store.listEvents();
+    return queryClientEvents(await this.store.listEvents(), options);
+  }
+  async listEventsPage(options = {}) {
+    if (this.store.listEventsPage)
+      return this.store.listEventsPage(options);
+    const events = queryClientEvents(await this.store.listEvents(), {
+      eventId: options.eventId,
+      source: options.source,
+      type: options.type
+    });
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    const limit = normalizeEventPageLimit(options.limit);
+    const pageEvents = events.slice(offset, offset + limit);
+    const nextOffset = offset + pageEvents.length;
+    const hasMore = nextOffset < events.length;
+    return {
+      events: pageEvents,
+      cursor: options.cursor,
+      nextCursor: hasMore ? encodeLocalJsonEventCursor(nextOffset, options) : undefined,
+      hasMore
+    };
   }
   async listDeliveries() {
     return this.store.listDeliveries();
@@ -15072,22 +15330,37 @@ class EventsClient {
     return result;
   }
   async replay(options = {}) {
-    const events = (await this.store.listEvents()).filter((event) => {
-      if (options.eventId && event.id !== options.eventId)
-        return false;
-      if (options.source && event.source !== options.source)
-        return false;
-      if (options.type && event.type !== options.type)
-        return false;
-      return true;
-    });
+    const page = options.cursor || options.limit !== undefined ? await this.listEventsPage(options) : { events: await this.listEvents(options), hasMore: false };
     if (options.dryRun)
-      return { events, deliveries: [] };
+      return { events: page.events, deliveries: [], cursor: page.cursor, nextCursor: page.nextCursor, hasMore: page.hasMore };
     const deliveries = [];
-    for (const event of events) {
+    for (const event of page.events) {
       deliveries.push(...await this.deliver(event));
     }
-    return { events, deliveries };
+    return { events: page.events, deliveries, cursor: page.cursor, nextCursor: page.nextCursor, hasMore: page.hasMore };
+  }
+  async appendEvent(event, options) {
+    if (this.store.appendEventOnce) {
+      return this.store.appendEventOnce(event, { dedupe: options.dedupe });
+    }
+    if (options.dedupe) {
+      const existing = await this.store.findEventByIdentity({ id: event.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return {
+          event: existing,
+          stored: false,
+          deduped: true,
+          identity: { id: existing.id, dedupeKey: existing.dedupeKey }
+        };
+      }
+    }
+    const stored = await this.store.appendEvent(event);
+    return {
+      event: stored,
+      stored: true,
+      deduped: false,
+      identity: { id: stored.id, dedupeKey: stored.dedupeKey }
+    };
   }
   async applyRedaction(event, channel) {
     let next = redactPaths(event, channel.redact?.paths ?? [], channel.redact?.replacement ?? "[REDACTED]");
@@ -15114,43 +15387,19 @@ class EventsClient {
     return createDeliveryResult(event, channel, attempts);
   }
 }
-function redactPaths(event, paths, replacement = "[REDACTED]") {
-  if (paths.length === 0)
-    return event;
-  const copy = structuredClone(event);
-  for (const path of paths) {
-    setPath(copy, path, replacement);
-  }
-  return copy;
-}
-function redactSensitiveKeys(event, replacement = "[REDACTED]") {
-  return redactValue2(event, replacement);
-}
-function shouldRedactKey(key) {
-  return /secret|token|password|api[_-]?key|authorization/i.test(key);
-}
-function redactValue2(value, replacement) {
-  if (Array.isArray(value))
-    return value.map((item) => redactValue2(item, replacement));
-  if (!value || typeof value !== "object")
-    return value;
-  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
-    key,
-    shouldRedactKey(key) ? replacement : redactValue2(item, replacement)
-  ]));
-}
-function setPath(input, path, replacement) {
-  const parts = path.split(".");
-  let cursor = input;
-  for (const part of parts.slice(0, -1)) {
-    const next = cursor[part];
-    if (!next || typeof next !== "object")
-      return;
-    cursor = next;
-  }
-  const last = parts.at(-1);
-  if (last && last in cursor)
-    cursor[last] = replacement;
+function queryClientEvents(events, options) {
+  let rows = events;
+  if (options.eventId)
+    rows = rows.filter((event) => event.id === options.eventId);
+  if (options.source)
+    rows = rows.filter((event) => event.source === options.source);
+  if (options.type)
+    rows = rows.filter((event) => event.type === options.type);
+  if (options.cursor)
+    rows = rows.slice(decodeLocalJsonEventCursor(options.cursor, options));
+  if (options.limit !== undefined)
+    rows = rows.slice(0, normalizeEventPageLimit(options.limit));
+  return rows;
 }
 function normalizeTime(value) {
   if (!value)
@@ -15164,9 +15413,22 @@ function normalizeRetryPolicy(policy) {
     multiplier: Math.max(1, policy?.multiplier ?? 2)
   };
 }
-var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", DEFAULT_SIGNATURE_TOLERANCE_MS;
+var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:", DEFAULT_EVENT_PAGE_LIMIT = 100, MAX_EVENT_PAGE_LIMIT = 1000, DEFAULT_SIGNATURE_TOLERANCE_MS, EventValidationError, defaultEventTypeCatalog, APP_EVENT_V1_MAX_DATA_BYTES;
 var init_dist = __esm(() => {
   DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
+  EventValidationError = class EventValidationError extends Error {
+    eventType;
+    issues;
+    constructor(eventType, issues) {
+      const detail = issues.map((issue) => `${issue.path || "<root>"}: ${issue.message}`).join("; ");
+      super(`Event validation failed for type "${eventType}": ${detail}`);
+      this.name = "EventValidationError";
+      this.eventType = eventType;
+      this.issues = issues;
+    }
+  };
+  defaultEventTypeCatalog = new EventTypeCatalog;
+  APP_EVENT_V1_MAX_DATA_BYTES = 32 * 1024;
 });
 
 // src/db/task-lists.ts
@@ -16221,8 +16483,12 @@ async function deliverWebhook(wh, event, body, attempt, db) {
       const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(body));
       headers["X-Webhook-Signature"] = Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
     }
-    const resp = await fetch(wh.url, { method: "POST", headers, body });
+    const resp = await fetch(wh.url, { method: "POST", headers, body, redirect: "manual" });
     const respText = await resp.text().catch(() => "");
+    if (resp.status >= 300 && resp.status < 400) {
+      logDelivery(db, wh.id, event, body, resp.status, "Blocked: webhook URL returned a 3xx redirect; redirects are never followed (SSRF prevention)", attempt);
+      return;
+    }
     logDelivery(db, wh.id, event, body, resp.status, respText.slice(0, 1000), attempt);
     if (resp.status >= 400 && attempt < MAX_RETRY_ATTEMPTS) {
       const delay = RETRY_BASE_DELAY_MS * Math.pow(2, attempt - 1);
@@ -18051,6 +18317,12 @@ function listTasks(filter = {}, db) {
   const d = db || getDatabase();
   const { clearExpiredLocks: clearExpiredLocks2 } = (init_database(), __toCommonJS(exports_database));
   clearExpiredLocks2(d);
+  if (filter.limit !== undefined) {
+    const limit = filter.limit;
+    if (!Number.isSafeInteger(limit) || limit <= 0 || limit > MAX_TASK_LIST_LIMIT) {
+      throw new TypeError(`listTasks limit must be a positive integer between 1 and ${MAX_TASK_LIST_LIMIT}; got ${String(limit)}`);
+    }
+  }
   const conditions = [];
   const params = [];
   if (filter.project_id) {
@@ -18584,6 +18856,7 @@ function deleteTask(id, db) {
   }
   return result.changes > 0;
 }
+var MAX_TASK_LIST_LIMIT = 1e5;
 var init_task_crud = __esm(() => {
   init_types();
   init_database();
@@ -21535,7 +21808,8 @@ __export(exports_tasks, {
   buildTaskBoardSnapshot: () => buildTaskBoardSnapshot,
   archiveTasks: () => archiveTasks,
   archiveCompletedTasks: () => archiveCompletedTasks,
-  addDependency: () => addDependency
+  addDependency: () => addDependency,
+  MAX_TASK_LIST_LIMIT: () => MAX_TASK_LIST_LIMIT
 });
 var init_tasks = __esm(() => {
   init_task_crud();
@@ -31975,6 +32249,27 @@ var init_project_commands = __esm(() => {
   };
 });
 
+// src/storage/postgres-errors.ts
+function isPostgresUniqueViolation(error) {
+  if (typeof error !== "object" || error === null)
+    return false;
+  const candidate = error;
+  const states = [candidate.code, candidate.errno, candidate.sqlState, candidate.sqlstate];
+  if (typeof candidate.cause === "object" && candidate.cause !== null) {
+    const cause = candidate.cause;
+    states.push(cause.code, cause.errno, cause.sqlState, cause.sqlstate);
+  }
+  return states.some((state) => String(state) === "23505");
+}
+function postgresConstraintName(error) {
+  if (typeof error !== "object" || error === null)
+    return "";
+  const candidate = error;
+  const cause = typeof candidate.cause === "object" && candidate.cause !== null ? candidate.cause : undefined;
+  const constraint = candidate.constraint ?? candidate.constraint_name ?? cause?.constraint ?? cause?.constraint_name;
+  return typeof constraint === "string" ? constraint : "";
+}
+
 // src/storage/postgres-sync.ts
 function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABLE, cursorTableName = DEFAULT_TODOS_POSTGRES_CURSOR_TABLE) {
   assertSafeIdentifier(tableName);
@@ -32169,53 +32464,98 @@ class PostgresTodosSyncStore {
     if (routingErrors.length > 0) {
       throw new Error(`Invalid snapshot routing metadata: ${routingErrors.join("; ")}`);
     }
-    const existing = await this.client.query(`SELECT object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version
-       FROM ${this.tableName}
-       WHERE service = $1 AND object_type IN ($2, $3) AND deleted_at IS NULL`, [this.service, "projects", "task_lists"]);
-    const existingProjects = [];
-    const existingTaskLists = [];
-    for (const row of existing.rows) {
-      const payload = payloadRecord(row.payload);
-      if (row.object_type === "projects")
-        existingProjects.push(payload);
-      if (row.object_type === "task_lists")
-        existingTaskLists.push(payload);
-    }
-    const destinationErrors = validateSnapshotRoutingDestinationConflicts(snapshot.projects, snapshot.taskLists, existingProjects, existingTaskLists);
-    if (destinationErrors.length > 0) {
-      throw new Error(`Snapshot routing conflicts with destination: ${destinationErrors.join("; ")}`);
-    }
-    const result = { records: 0, objectTypes: {} };
-    const sourceMachineId = context.requestId ?? this.sourceMachineId ?? null;
-    for (const entry of snapshotEntries(snapshot)) {
-      if (entry.deletedAt === null)
-        assertCanonicalScopedSlugEntry(entry);
-      await this.client.query(`INSERT INTO ${this.tableName} (
-          service, object_type, object_id, payload, updated_at,
-          deleted_at, source_machine_id, version
-        ) VALUES ($1, $2, $3, $4::jsonb, $5::timestamptz, $6::timestamptz, $7, $8)
-        ON CONFLICT (service, object_type, object_id) DO UPDATE SET
-          payload = EXCLUDED.payload,
-          updated_at = EXCLUDED.updated_at,
-          deleted_at = EXCLUDED.deleted_at,
-          source_machine_id = EXCLUDED.source_machine_id,
-          version = EXCLUDED.version
-        WHERE ${this.tableName}.updated_at < EXCLUDED.updated_at
-           OR (${this.tableName}.updated_at = EXCLUDED.updated_at
-               AND COALESCE(${this.tableName}.version, 0) <= COALESCE(EXCLUDED.version, 0))`, [
-        this.service,
-        entry.type,
-        entry.id,
-        entry.payload,
-        entry.updatedAt,
-        entry.deletedAt,
-        sourceMachineId,
-        entry.version
-      ]);
-      result.records += 1;
-      result.objectTypes[entry.type] = (result.objectTypes[entry.type] ?? 0) + 1;
+    const push = async (client) => {
+      const existing = await client.query(`SELECT object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version
+         FROM ${this.tableName}
+         WHERE service = $1 AND object_type IN ($2, $3) AND deleted_at IS NULL`, [this.service, "projects", "task_lists"]);
+      const existingProjects = [];
+      const existingTaskLists = [];
+      for (const row of existing.rows) {
+        const payload = payloadRecord(row.payload);
+        if (row.object_type === "projects")
+          existingProjects.push(payload);
+        if (row.object_type === "task_lists")
+          existingTaskLists.push(payload);
+      }
+      const destinationErrors = validateSnapshotRoutingDestinationConflicts(snapshot.projects, snapshot.taskLists, existingProjects, existingTaskLists);
+      if (destinationErrors.length > 0) {
+        throw new ResourceConflictError("SNAPSHOT_DESTINATION_CONFLICT", `Snapshot routing conflicts with destination: ${destinationErrors.join("; ")}`);
+      }
+      const result = { records: 0, objectTypes: {} };
+      const sourceMachineId = context.requestId ?? this.sourceMachineId ?? null;
+      for (const entry of snapshotEntries(snapshot)) {
+        if (entry.deletedAt === null)
+          assertCanonicalScopedSlugEntry(entry);
+        try {
+          await client.query(`INSERT INTO ${this.tableName} (
+              service, object_type, object_id, payload, updated_at,
+              deleted_at, source_machine_id, version
+            ) VALUES ($1, $2, $3, $4::jsonb, $5::timestamptz, $6::timestamptz, $7, $8)
+            ON CONFLICT (service, object_type, object_id) DO UPDATE SET
+              payload = EXCLUDED.payload,
+              updated_at = EXCLUDED.updated_at,
+              deleted_at = EXCLUDED.deleted_at,
+              source_machine_id = EXCLUDED.source_machine_id,
+              version = EXCLUDED.version
+            WHERE ${this.tableName}.updated_at < EXCLUDED.updated_at
+               OR (${this.tableName}.updated_at = EXCLUDED.updated_at
+                   AND COALESCE(${this.tableName}.version, 0) <= COALESCE(EXCLUDED.version, 0))`, [
+            this.service,
+            entry.type,
+            entry.id,
+            entry.payload,
+            entry.updatedAt,
+            entry.deletedAt,
+            sourceMachineId,
+            entry.version
+          ]);
+        } catch (error) {
+          await this.classifySyncInsertConflict(error, entry);
+        }
+        result.records += 1;
+        result.objectTypes[entry.type] = (result.objectTypes[entry.type] ?? 0) + 1;
+      }
+      return result;
+    };
+    if (typeof this.client.transaction === "function") {
+      return this.client.transaction((client) => push(client));
     }
-    return result;
+    return push(this.client);
+  }
+  async classifySyncInsertConflict(error, entry) {
+    if (!isPostgresUniqueViolation(error))
+      throw error;
+    const payload = entry.payload;
+    const taskListSlug = String(payload["slug"] ?? "");
+    const projectSlug = String(payload["task_list_id"] ?? "");
+    const constraintName = postgresConstraintName(error);
+    if (entry.type === "projects" && constraintName.includes("project_task_list_slug_uidx")) {
+      throw new ResourceConflictError("PROJECT_SLUG_CONFLICT", `Project slug "${projectSlug}" already exists`);
+    }
+    if (entry.type === "task_lists" && constraintName.includes("task_list_scope_slug_uidx")) {
+      throw new ResourceConflictError("TASK_LIST_SLUG_CONFLICT", `Task list with slug "${taskListSlug}" already exists in this scope`);
+    }
+    if (entry.type === "task_lists") {
+      const scope = typeof payload["project_id"] === "string" ? payload["project_id"] : "";
+      const conflict = await this.client.query(`/* todos:classify-sync-task-list-conflict */ SELECT EXISTS (
+          SELECT 1 FROM ${this.tableName}
+          WHERE service = $1 AND object_type = 'task_lists' AND object_id <> $2
+            AND deleted_at IS NULL AND COALESCE(payload->>'project_id','') = $3 AND payload->>'slug' = $4
+        ) AS conflict`, [this.service, entry.id, scope, taskListSlug]);
+      if (conflict.rows[0]?.conflict) {
+        throw new ResourceConflictError("TASK_LIST_SLUG_CONFLICT", `Task list with slug "${taskListSlug}" already exists in this scope`);
+      }
+    } else if (entry.type === "projects") {
+      const conflict = await this.client.query(`/* todos:classify-sync-project-conflict */ SELECT EXISTS (
+          SELECT 1 FROM ${this.tableName}
+          WHERE service = $1 AND object_type = 'projects' AND object_id <> $2
+            AND deleted_at IS NULL AND payload->>'task_list_id' = $3
+        ) AS conflict`, [this.service, entry.id, projectSlug]);
+      if (conflict.rows[0]?.conflict) {
+        throw new ResourceConflictError("PROJECT_SLUG_CONFLICT", `Project slug "${projectSlug}" already exists`);
+      }
+    }
+    throw error;
   }
   async pullSnapshot(options = {}) {
     const params = [this.service];
@@ -32372,6 +32712,7 @@ function assertSafeIdentifier(value) {
 }
 var DEFAULT_TODOS_POSTGRES_SYNC_TABLE = "todos_sync_records", DEFAULT_TODOS_POSTGRES_CURSOR_TABLE = "todos_sync_cursors", PostgresScopedSlugMigrationConflictError, PostgresScopedSlugIndexBuildError;
 var init_postgres_sync = __esm(() => {
+  init_types();
   PostgresScopedSlugMigrationConflictError = class PostgresScopedSlugMigrationConflictError extends Error {
     conflicts;
     constructor(conflicts) {
@@ -32599,9 +32940,11 @@ class PostgresJsonRecordStore {
   async ensureSchema() {
     if (!this.schemaReady) {
       this.schemaReady = (async () => {
-        for (const sql of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
-          await this.options.client.query(sql);
-        }
+        await retryOnTransientPostgresError(async () => {
+          for (const sql of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
+            await this.options.client.query(sql);
+          }
+        });
       })().catch((error) => {
         this.schemaReady = null;
         throw error;
@@ -33015,13 +33358,14 @@ class PostgresJsonRecordStore {
     throw new Error(divergentAuditHistoryReplayError(value.id));
   }
   async withTaskParentIntegrityTransaction(fn) {
-    if (typeof this.options.client.transaction !== "function") {
+    const transaction = this.options.client.transaction;
+    if (typeof transaction !== "function") {
       throw new Error("TASK_PARENT_ATOMICITY_UNAVAILABLE: PostgreSQL parent writes and task deletion require transaction(callback)");
     }
-    return this.options.client.transaction(async (client) => {
+    return retryOnTransientPostgresError(() => transaction(async (client) => {
       await client.query("/* todos:task-parent-integrity-lock */ SELECT pg_advisory_xact_lock(hashtextextended($1 || ':task-parent-integrity', 0))", [this.service]);
       return fn(client);
-    });
+    }));
   }
   async upsertTaskWithPlanMembershipGuard(value, guardedPlanIds, explicitProject, context = {}, parentGuard, queryClient) {
     const planIds = [...new Set(guardedPlanIds.filter(Boolean))].sort();
@@ -34904,7 +35248,7 @@ function compareClock(left, right) {
 function numberValue2(value) {
   return typeof value === "number" && Number.isSafeInteger(value) ? value : null;
 }
-function isPostgresUniqueViolation(error) {
+function isTransientPostgresError(error) {
   if (typeof error !== "object" || error === null)
     return false;
   const candidate = error;
@@ -34913,17 +35257,27 @@ function isPostgresUniqueViolation(error) {
     const cause = candidate.cause;
     states.push(cause.code, cause.errno, cause.sqlState, cause.sqlstate);
   }
-  return states.some((state) => String(state) === "23505");
+  if (states.some((state) => typeof state === "string" && TRANSIENT_POSTGRES_SQLSTATES.has(state))) {
+    return true;
+  }
+  const message = typeof candidate.message === "string" ? candidate.message : candidate.cause?.message;
+  return typeof message === "string" && TRANSIENT_POSTGRES_MESSAGE_MARKERS.some((marker) => message.includes(marker));
 }
-function postgresConstraintName(error) {
-  if (typeof error !== "object" || error === null)
-    return "";
-  const candidate = error;
-  const cause = typeof candidate.cause === "object" && candidate.cause !== null ? candidate.cause : undefined;
-  const constraint = candidate.constraint ?? candidate.constraint_name ?? cause?.constraint ?? cause?.constraint_name;
-  return typeof constraint === "string" ? constraint : "";
+async function retryOnTransientPostgresError(fn, attempts = 2, delayMs = 150) {
+  let lastError;
+  for (let attempt = 1;attempt <= attempts; attempt += 1) {
+    try {
+      return await fn();
+    } catch (error) {
+      lastError = error;
+      if (!isTransientPostgresError(error) || attempt === attempts)
+        throw error;
+      await new Promise((resolve14) => setTimeout(resolve14, delayMs * attempt));
+    }
+  }
+  throw lastError;
 }
-var CLOUD_LOCK_EXPIRY_MINUTES = 30, TASK_ORDER_TIEBREAK = "CASE payload->>'priority' WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 ELSE 4 END ASC, payload->>'created_at' ASC, payload->>'id' ASC", TASK_ORDER_BY;
+var CLOUD_LOCK_EXPIRY_MINUTES = 30, TASK_ORDER_TIEBREAK = "CASE payload->>'priority' WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 ELSE 4 END ASC, payload->>'created_at' ASC, payload->>'id' ASC", TASK_ORDER_BY, TRANSIENT_POSTGRES_SQLSTATES, TRANSIENT_POSTGRES_MESSAGE_MARKERS;
 var init_postgres_adapter = __esm(() => {
   init_types();
   init_creator_identity();
@@ -34937,6 +35291,12 @@ var init_postgres_adapter = __esm(() => {
   init_audit_history_import();
   init_canonical();
   TASK_ORDER_BY = `ORDER BY ${TASK_ORDER_TIEBREAK}`;
+  TRANSIENT_POSTGRES_SQLSTATES = new Set(["55P03", "40P01", "40001"]);
+  TRANSIENT_POSTGRES_MESSAGE_MARKERS = [
+    "canceling statement due to lock timeout",
+    "deadlock detected",
+    "could not serialize access"
+  ];
 });
 
 // src/project-registration/postgres.ts
@@ -51893,6 +52253,13 @@ function resolveSigningSecret(env = process.env) {
 function isPostgresBackendConfigured(env = process.env) {
   return Boolean(resolveCloudDatabaseUrl(env));
 }
+function schemaRetryMinIntervalMs(env = process.env) {
+  const raw = env.HASNA_TODOS_SCHEMA_RETRY_MIN_MS;
+  if (!raw)
+    return DEFAULT_SCHEMA_RETRY_MIN_MS;
+  const parsed = Number(raw);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_SCHEMA_RETRY_MIN_MS;
+}
 function getCloudTenantId() {
   return process.env.HASNA_TODOS_TENANT_ID ?? "default";
 }
@@ -51988,6 +52355,10 @@ function getCloudVerifier() {
 async function ensureCloudSchema() {
   if (schemaEnsured)
     return schemaEnsured;
+  if (lastSchemaFailure !== null && Date.now() - lastSchemaAttemptAtMs < schemaRetryMinIntervalMs()) {
+    throw lastSchemaFailure;
+  }
+  lastSchemaAttemptAtMs = Date.now();
   schemaEnsured = (async () => {
     const client = getClient();
     for (const sql of postgresTodosSyncSchemaSql()) {
@@ -52008,6 +52379,7 @@ async function ensureCloudSchema() {
     await getApiKeyStore().ensureSchema();
   })().catch((error) => {
     schemaEnsured = null;
+    lastSchemaFailure = error;
     throw error;
   });
   return schemaEnsured;
@@ -52055,8 +52427,10 @@ async function closeCloud() {
   cachedTaskManifestAuthority = null;
   cachedTaskSubtreeTransferAuthority = null;
   schemaEnsured = null;
+  lastSchemaAttemptAtMs = 0;
+  lastSchemaFailure = null;
 }
-var TODOS_APP_SLUG = "todos", cachedClient = null, cachedAdapter = null, cachedStore = null, cachedVerifier = null, cachedPrGroupLedger = null, cachedProjectRegistrationAuthority = null, cachedTaskManifestAuthority = null, cachedTaskSubtreeTransferAuthority = null, schemaEnsured = null;
+var TODOS_APP_SLUG = "todos", cachedClient = null, cachedAdapter = null, cachedStore = null, cachedVerifier = null, cachedPrGroupLedger = null, cachedProjectRegistrationAuthority = null, cachedTaskManifestAuthority = null, cachedTaskSubtreeTransferAuthority = null, schemaEnsured = null, lastSchemaAttemptAtMs = 0, lastSchemaFailure = null, DEFAULT_SCHEMA_RETRY_MIN_MS = 1e4;
 var init_cloud = __esm(() => {
   init_cloud_client();
   init_postgres_adapter();
@@ -52922,6 +53296,19 @@ function taskStatusQueryParam(url) {
     return { ok: false, message: result.message };
   return { ok: true, value: collapseEnumValues(result.values) };
 }
+function parsePaginationQueryParam(url, name) {
+  const raw = url.searchParams.get(name);
+  if (raw === null)
+    return { ok: true, value: undefined };
+  const min = name === "limit" ? 1 : 0;
+  const message = name === "limit" ? "limit must be a positive integer" : "offset must be a non-negative integer";
+  if (!/^\d+$/.test(raw))
+    return { ok: false, message };
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < min)
+    return { ok: false, message };
+  return { ok: true, value };
+}
 async function handleListTasks(_req, url, _ctx, json5, taskToSummary2) {
   const statusParam = taskStatusQueryParam(url);
   if (!statusParam.ok)
@@ -52929,16 +53316,20 @@ async function handleListTasks(_req, url, _ctx, json5, taskToSummary2) {
   const projectId = url.searchParams.get("project_id") || undefined;
   const sessionId = url.searchParams.get("session_id") || undefined;
   const agentId = url.searchParams.get("agent_id") || undefined;
-  const limitParam = url.searchParams.get("limit");
-  const offsetParam = url.searchParams.get("offset");
+  const limitParam = parsePaginationQueryParam(url, "limit");
+  if (!limitParam.ok)
+    return json5({ error: limitParam.message }, 400);
+  const offsetParam = parsePaginationQueryParam(url, "offset");
+  if (!offsetParam.ok)
+    return json5({ error: offsetParam.message }, 400);
   const fields = parseFieldsParam(url);
   const tasks = listTasks({
     status: statusParam.value,
     project_id: projectId,
     session_id: sessionId,
     agent_id: agentId,
-    limit: limitParam ? parseInt(limitParam, 10) : undefined,
-    offset: offsetParam ? parseInt(offsetParam, 10) : undefined
+    limit: limitParam.value,
+    offset: offsetParam.value
   });
   return json5(tasks.map((t) => taskToSummary2(t, fields)));
 }
@@ -53730,6 +54121,12 @@ class TodosShadowOutbox {
       this.onEvent?.({ type: "mirrored", objectType: row.object_type, id: row.object_id, lagMs });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
+      if (error instanceof ResourceConflictError) {
+        this.metrics.lastError = message;
+        this.db.run(`UPDATE shadow_outbox SET attempts=?, last_error=?, status='failed' WHERE seq=? AND revision=?`, [row.attempts + 1, message, row.seq, row.revision]);
+        this.onEvent?.({ type: "parked", objectType: row.object_type, id: row.object_id, error: message });
+        return;
+      }
       this.metrics.retries += 1;
       this.metrics.lastError = message;
       const attempts = row.attempts + 1;
@@ -53857,6 +54254,7 @@ function createTodosShadowOutbox(options) {
 }
 var MAX_BACKOFF_MS;
 var init_shadow_outbox = __esm(() => {
+  init_types();
   init_local_sqlite();
   init_postgres_sync();
   init_shadow_outbox_schema();
@@ -57831,6 +58229,26 @@ function parseSinceCursor(raw) {
   }
   return { ok: true, value: new Date(parsed).toISOString() };
 }
+function paginationQueryParam(url, name) {
+  const raw = url.searchParams.get(name);
+  if (raw === null)
+    return { ok: true, value: undefined };
+  const min = name === "limit" ? 1 : 0;
+  if (!/^\d+$/.test(raw)) {
+    return {
+      ok: false,
+      response: error(400, name === "limit" ? "limit must be a positive integer" : "offset must be a non-negative integer")
+    };
+  }
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < min) {
+    return {
+      ok: false,
+      response: error(400, name === "limit" ? "limit must be a positive integer" : "offset must be a non-negative integer")
+    };
+  }
+  return { ok: true, value };
+}
 function validateTaskCompletion(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return { ok: false, message: "completion body must be an object" };
@@ -58359,6 +58777,12 @@ async function handleV1Request(req, url, dependencies = {}) {
           if (updatedAfter !== null && !updatedAfter.ok) {
             return error(400, updatedAfter.message);
           }
+          const limitParam = paginationQueryParam(url, "limit");
+          if (!limitParam.ok)
+            return limitParam.response;
+          const offsetParam = paginationQueryParam(url, "offset");
+          if (!offsetParam.ok)
+            return offsetParam.response;
           const filter = {
             ...updatedAfter !== null && updatedAfter.ok ? { updated_after: updatedAfter.value } : {},
             ...url.searchParams.get("q") ? { query: url.searchParams.get("q") } : {},
@@ -58375,8 +58799,8 @@ async function handleV1Request(req, url, dependencies = {}) {
             ...url.searchParams.get("tags") ? {
               tags: url.searchParams.get("tags").split(",").map((tag) => tag.trim()).filter(Boolean)
             } : {},
-            ...url.searchParams.get("limit") ? { limit: Number(url.searchParams.get("limit")) } : {},
-            ...url.searchParams.get("offset") ? { offset: Number(url.searchParams.get("offset")) } : {}
+            ...limitParam.value !== undefined ? { limit: limitParam.value } : {},
+            ...offsetParam.value !== undefined ? { offset: offsetParam.value } : {}
           };
           const tasks = await store.tasks.list(filter);
           const { limit: _l, offset: _o, ...countFilter } = filter;
@@ -60136,8 +60560,8 @@ function registerTaskCrudTools(server, ctx) {
       tags: exports_external.array(exports_external.string()).optional().describe("Filter by tags (AND logic)"),
       created_after: exports_external.string().optional().describe("ISO date \u2014 tasks created after this date"),
       created_before: exports_external.string().optional().describe("ISO date \u2014 tasks created before this date"),
-      limit: exports_external.number().optional().describe("Max results (default: 50, max 500)"),
-      offset: exports_external.number().optional().describe("Pagination offset"),
+      limit: exports_external.number().int().min(1).optional().describe("Max results (default: 50, max 500)"),
+      offset: exports_external.number().int().min(0).optional().describe("Pagination offset"),
       metadata: exports_external.record(exports_external.unknown()).optional().describe("Exact top-level metadata filters")
     }, async (params) => {
       try {
@@ -62099,6 +62523,48 @@ var init_task_relationships = __esm(() => {
   ];
 });
 
+// src/lib/dedupe-projection.ts
+function projectTasksForDedupe(tasks) {
+  return tasks.map((task2) => {
+    const metadata = {};
+    for (const key2 of DEDUPE_SOURCE_KEY_ALLOWLIST) {
+      if (key2 in task2.metadata) {
+        metadata[key2] = redactValue(task2.metadata[key2]);
+      }
+    }
+    return {
+      id: task2.id,
+      short_id: task2.short_id,
+      title: redactEvidenceText(task2.title),
+      description: task2.description === null || task2.description === undefined ? null : redactEvidenceText(task2.description),
+      status: task2.status,
+      created_at: task2.created_at,
+      updated_at: task2.updated_at,
+      project_id: task2.project_id,
+      task_list_id: task2.task_list_id,
+      assigned_to: task2.assigned_to,
+      priority: task2.priority,
+      metadata
+    };
+  });
+}
+var DEDUPE_SOURCE_KEY_ALLOWLIST;
+var init_dedupe_projection = __esm(() => {
+  init_redaction();
+  DEDUPE_SOURCE_KEY_ALLOWLIST = [
+    "github_url",
+    "github_issue_url",
+    "github_pr_url",
+    "source_url",
+    "url",
+    "external_url",
+    "issue_url",
+    "github_owner",
+    "github_repo",
+    "github_number"
+  ];
+});
+
 // src/lib/task-dedupe.ts
 function asObject(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
@@ -62263,10 +62729,10 @@ function olderFirst(left, right) {
 function findDuplicateTasks(options = {}, db) {
   const d = db || getDatabase();
   const threshold = options.threshold ?? DEFAULT_THRESHOLD;
-  const fingerprints = listTasks({
+  const fingerprints = projectTasksForDedupe(listTasks({
     include_archived: Boolean(options.include_archived),
     limit: options.limit ?? 1000
-  }, d).map(fingerprint);
+  }, d)).map(fingerprint);
   const candidates = [];
   for (let i = 0;i < fingerprints.length; i++) {
     for (let j = i + 1;j < fingerprints.length; j++) {
@@ -62501,6 +62967,7 @@ var init_task_dedupe = __esm(() => {
   init_database();
   init_task_relationships();
   init_tasks();
+  init_dedupe_projection();
   STOP_WORDS = new Set([
     "a",
     "an",
@@ -86972,13 +87439,25 @@ Findings`));
       handleError(e);
     }
   });
+  function parseDedupeLimit(raw) {
+    const value = Number(raw);
+    if (!Number.isSafeInteger(value) || value <= 0 || value > MAX_TASK_LIST_LIMIT) {
+      return null;
+    }
+    return value;
+  }
   const dedupe2 = program2.command("dedupe").description("Find and merge likely duplicate local tasks");
   dedupe2.command("scan").description("Scan local tasks for likely duplicates").option("--threshold <n>", "Minimum duplicate score from 0 to 1", "0.74").option("--limit <n>", "Maximum tasks to compare", "1000").option("--include-archived", "Include archived tasks").option("-j, --json", "Output as JSON").action((opts) => {
     const globalOpts = program2.opts();
     try {
+      const limit = parseDedupeLimit(opts.limit);
+      if (limit === null) {
+        handleError(new Error(`--limit must be a positive integer between 1 and ${MAX_TASK_LIST_LIMIT} (got: ${opts.limit})`));
+        return;
+      }
       const candidates = findDuplicateTasks({
         threshold: Number(opts.threshold),
-        limit: Number(opts.limit),
+        limit,
         include_archived: Boolean(opts.includeArchived)
       });
       if (opts.json || globalOpts.json) {
@@ -86998,6 +87477,35 @@ Findings`));
       handleError(e);
     }
   });
+  dedupe2.command("project <ref>").description("Project a project's tasks into the bounded dedup projection (safe to emit: no free-form metadata, tags, comments, or run fields)").option("--limit <n>", "Maximum tasks to project", "1000").option("--include-archived", "Include archived tasks").option("-j, --json", "Output as JSON").action((ref, opts) => {
+    const globalOpts = program2.opts();
+    try {
+      const d = getDatabase();
+      const projectId = resolvePartialId(d, "projects", ref) || d.query("SELECT id FROM projects WHERE path = ? OR name = ? OR task_list_id = ?").get(ref, ref, ref)?.id;
+      if (!projectId) {
+        handleError(new Error(`Could not resolve project: ${ref}`));
+        return;
+      }
+      const limit = parseDedupeLimit(opts.limit);
+      if (limit === null) {
+        handleError(new Error(`--limit must be a positive integer between 1 and ${MAX_TASK_LIST_LIMIT} (got: ${opts.limit})`));
+        return;
+      }
+      const tasks = listTasks({
+        project_id: projectId,
+        include_archived: Boolean(opts.includeArchived),
+        limit
+      }, d);
+      const projected = projectTasksForDedupe(tasks);
+      if (opts.json || globalOpts.json) {
+        output({ project_id: projectId, count: projected.length, tasks: projected }, true);
+        return;
+      }
+      console.log(chalk9.dim(`${projected.length} task(s) projected for dedupe (bounded \u2014 no free-form metadata, tags, comments, or run fields).`));
+    } catch (e) {
+      handleError(e);
+    }
+  });
   dedupe2.command("merge <primary-task-id> <duplicate-task-id>").description("Merge a duplicate task into a primary task and archive the duplicate").option("--agent <agent>", "Agent ID recording the merge").option("--reason <reason>", "Human-readable merge reason").option("-j, --json", "Output as JSON").action((primaryTaskId, duplicateTaskId, opts) => {
     const globalOpts = program2.opts();
     try {
@@ -87302,6 +87810,7 @@ var init_query_commands = __esm(() => {
   init_audit();
   init_handoffs();
   init_task_dedupe();
+  init_dedupe_projection();
   init_local_fields();
   init_workflow_states();
   init_local_reports();
@@ -95207,6 +95716,12 @@ class TodosShadowMirror {
       const message = error2 instanceof Error ? error2.message : String(error2);
       const objectType2 = op.kind === "upsert" ? SNAPSHOT_TO_OBJECT_TYPE[op.key] : op.objectType;
       const id = op.kind === "upsert" ? String(op.record["id"]) : op.id;
+      if (error2 instanceof ResourceConflictError) {
+        this.metrics.failed += 1;
+        this.metrics.lastError = message;
+        this.onEvent?.({ type: "dropped", objectType: objectType2, id, error: message });
+        return;
+      }
       this.metrics.retries += 1;
       this.metrics.lastError = message;
       op.attempts += 1;
@@ -95454,6 +95969,7 @@ function isAgent(value) {
 }
 var SNAPSHOT_TO_OBJECT_TYPE;
 var init_shadow = __esm(() => {
+  init_types();
   init_local_sqlite();
   init_postgres_sync();
   SNAPSHOT_TO_OBJECT_TYPE = {