## Source

`TODO`: "clients can provide project id if created locally which is a problem?"

## Current state

`migrateLocalProjects` passes the existing local project's id to `createProjectApi(name, id, source)`. The server accepts an optional id, returns the existing row when the same owner retries, and rejects an id owned by another account with "Project id is already in use".

## Acceptance

- [ ] Write down the threat model and the migration requirement: why a client-chosen id is needed (preserving offline identity) and what an attacker could do with it.
- [x] Decision: the server owns the new id and remaps the local project during migration.
- [ ] Keep a local-id → server-id mapping so old `/editor/<localId>` URLs redirect to the migrated project.
- [ ] Define when that redirect mapping can be cleaned up without breaking bookmarks.
- [ ] If client ids stay, define the exact ownership and collision rules, including what information the error reveals.
- [ ] Preserve idempotent retries and the local → server id mapping.
- [ ] Add tests for: two accounts using the same local id, retrying the same migration, an id that already exists for the owner, and an id owned by someone else.
- [ ] Update the API schema/docs with the chosen contract.


<sub>Generated on _MrBeast_ using _opencode/deepseek-v4.1-flash_ in _ses_e8326e581ffeJviTmSkomwnKES_</sub>