diff --git a/server/utils/repo.ts b/server/utils/repo.ts
new file mode 100644
index 0000000..65b0cf3
--- /dev/null
+++ b/server/utils/repo.ts
@@ -0,0 +1,99 @@
+import postgres from "postgres";
+import { randomUUID } from "node:crypto";
+
+type Sql = ReturnType<typeof postgres>;
+
+export interface ListRow {
+  id: string;
+  name: string;
+}
+
+export interface TaskRow {
+  id: string;
+  list_id: string;
+  title: string;
+  description: string | null;
+  source: string;
+  consumed: boolean;
+  created_at: Date;
+  updated_at: Date;
+}
+
+export async function getLists(sql: Sql): Promise<ListRow[]> {
+  return sql<ListRow[]>`select id, name from lists order by name`;
+}
+
+/** Full-replace catalog: upsert all supplied, delete any list not present (cascades tasks). */
+export async function replaceLists(
+  sql: Sql,
+  lists: { id: string; name: string }[],
+): Promise<void> {
+  await sql.begin(async (tx) => {
+    for (const l of lists) {
+      await tx`
+        insert into lists (id, name, updated_at)
+        values (${l.id}, ${l.name}, now())
+        on conflict (id) do update set name = excluded.name, updated_at = now()`;
+    }
+    if (lists.length) {
+      const ids = lists.map((l) => l.id);
+      await tx`delete from lists where id <> all(${ids})`;
+    } else {
+      await tx`delete from lists`;
+    }
+  });
+}
+
+export async function listExists(sql: Sql, id: string): Promise<boolean> {
+  const rows = await sql`select 1 from lists where id = ${id}`;
+  return rows.length > 0;
+}
+
+export async function getTasksForList(sql: Sql, listId: string): Promise<TaskRow[]> {
+  return sql<TaskRow[]>`select * from tasks where list_id = ${listId} order by created_at`;
+}
+
+export async function createWebTask(
+  sql: Sql,
+  t: { listId: string; title: string; description: string | null },
+): Promise<TaskRow> {
+  const id = randomUUID();
+  const [row] = await sql<TaskRow[]>`
+    insert into tasks (id, list_id, title, description, source, consumed)
+    values (${id}, ${t.listId}, ${t.title}, ${t.description}, 'web', false)
+    returning *`;
+  return row;
+}
+
+/** Idempotent upsert of a desktop Idle task by id. Returns whether a row was inserted. */
+export async function upsertDesktopTask(
+  sql: Sql,
+  id: string,
+  t: { listId: string; title: string; description?: string | null },
+): Promise<{ created: boolean }> {
+  const [row] = await sql<{ created: boolean }[]>`
+    insert into tasks (id, list_id, title, description, source)
+    values (${id}, ${t.listId}, ${t.title}, ${t.description ?? null}, 'desktop')
+    on conflict (id) do update set
+      list_id = excluded.list_id,
+      title = excluded.title,
+      description = excluded.description,
+      updated_at = now()
+    returning (xmax = 0) as created`;
+  return { created: row.created };
+}
+
+/** Web-created tasks the desktop has not yet imported. */
+export async function getUnconsumed(sql: Sql): Promise<TaskRow[]> {
+  return sql<TaskRow[]>`
+    select * from tasks where source = 'web' and consumed = false order by created_at`;
+}
+
+export async function consume(sql: Sql, id: string): Promise<boolean> {
+  const res = await sql`update tasks set consumed = true, updated_at = now() where id = ${id}`;
+  return res.count > 0;
+}
+
+export async function deleteTask(sql: Sql, id: string): Promise<void> {
+  await sql`delete from tasks where id = ${id}`;
+}
diff --git a/tests/repo.test.ts b/tests/repo.test.ts
new file mode 100644
index 0000000..6d9dfea
--- /dev/null
+++ b/tests/repo.test.ts
@@ -0,0 +1,95 @@
+import { afterAll, beforeEach, describe, expect, it } from "vitest";
+import postgres from "postgres";
+import * as repo from "../server/utils/repo";
+
+const sql = postgres(process.env.DATABASE_URL!, { max: 1, onnotice: () => {} });
+
+beforeEach(async () => {
+  await sql`truncate lists cascade`;
+});
+
+afterAll(async () => {
+  await sql.end();
+});
+
+describe("lists", () => {
+  it("full-replace upserts supplied and deletes missing", async () => {
+    await repo.replaceLists(sql, [
+      { id: "a", name: "A" },
+      { id: "b", name: "B" },
+    ]);
+    await repo.replaceLists(sql, [{ id: "a", name: "A2" }]); // b removed, a renamed
+    const got = await repo.getLists(sql);
+    expect(got).toEqual([{ id: "a", name: "A2" }]);
+  });
+
+  it("empty payload clears all lists", async () => {
+    await repo.replaceLists(sql, [{ id: "a", name: "A" }]);
+    await repo.replaceLists(sql, []);
+    expect(await repo.getLists(sql)).toEqual([]);
+  });
+
+  it("deleting a list cascades its tasks", async () => {
+    await repo.replaceLists(sql, [{ id: "a", name: "A" }]);
+    await repo.upsertDesktopTask(sql, "t1", { listId: "a", title: "x" });
+    await repo.replaceLists(sql, []); // removes a + cascades t1
+    expect(await repo.getUnconsumed(sql)).toEqual([]);
+  });
+
+  it("listExists validates listId", async () => {
+    await repo.replaceLists(sql, [{ id: "L", name: "List" }]);
+    expect(await repo.listExists(sql, "L")).toBe(true);
+    expect(await repo.listExists(sql, "ghost")).toBe(false);
+  });
+});
+
+describe("tasks", () => {
+  beforeEach(async () => {
+    await repo.replaceLists(sql, [{ id: "L", name: "List" }]);
+  });
+
+  it("web create returns generated GUID, source=web, consumed=false", async () => {
+    const t = await repo.createWebTask(sql, { listId: "L", title: "buy milk", description: null });
+    expect(t.id).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/);
+    expect(t.source).toBe("web");
+    expect(t.consumed).toBe(false);
+    expect(t.title).toBe("buy milk");
+  });
+
+  it("desktop upsert is idempotent by id; source=desktop on insert", async () => {
+    const a = await repo.upsertDesktopTask(sql, "fixed-id", { listId: "L", title: "one" });
+    expect(a.created).toBe(true);
+    const b = await repo.upsertDesktopTask(sql, "fixed-id", { listId: "L", title: "two", description: "d" });
+    expect(b.created).toBe(false);
+    const tasks = await repo.getTasksForList(sql, "L");
+    expect(tasks).toHaveLength(1);
+    expect(tasks[0].title).toBe("two");
+    expect(tasks[0].description).toBe("d");
+    expect(tasks[0].source).toBe("desktop");
+  });
+
+  it("getUnconsumed returns only web tasks with consumed=false", async () => {
+    await repo.createWebTask(sql, { listId: "L", title: "web1", description: null });
+    await repo.upsertDesktopTask(sql, "d1", { listId: "L", title: "desk1" });
+    const u = await repo.getUnconsumed(sql);
+    expect(u).toHaveLength(1);
+    expect(u[0].title).toBe("web1");
+  });
+
+  it("consume sets consumed=true and is reflected in getUnconsumed", async () => {
+    const t = await repo.createWebTask(sql, { listId: "L", title: "c", description: null });
+    expect(await repo.consume(sql, t.id)).toBe(true);
+    expect(await repo.getUnconsumed(sql)).toEqual([]);
+  });
+
+  it("consume on unknown id returns false", async () => {
+    expect(await repo.consume(sql, "nope")).toBe(false);
+  });
+
+  it("deleteTask is idempotent", async () => {
+    const t = await repo.createWebTask(sql, { listId: "L", title: "c", description: null });
+    await repo.deleteTask(sql, t.id);
+    await repo.deleteTask(sql, t.id); // no throw on absent
+    expect(await repo.getTasksForList(sql, "L")).toEqual([]);
+  });
+});