@hasna/todos 0.15.14 → 0.15.15

package/dist/task-manifest.js

@@ -4922,6 +4922,14 @@ var compensationSchema = exports_external.object({
   idempotency_key: identifier,
   if_binding_version: exports_external.number().int().min(1).max(Number.MAX_SAFE_INTEGER)
 }).strict();
+var bindingLookupSchema = exports_external.object({
+  authority: exports_external.string().min(1).max(64),
+  route: exports_external.string().min(1).max(128),
+  schema_version: exports_external.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+  tenant_id: identifier,
+  plan_id: uuid,
+  max_items: exports_external.number().int().min(1).max(Number.MAX_SAFE_INTEGER)
+}).strict();
 function parseTodosTaskManifest(input) {
   const parsed = schema.safeParse(input);
   if (!parsed.success) {
@@ -4987,6 +4995,36 @@ function parseTodosTaskManifestCompensation(input) {
   }
   return parsed.data;
 }
+function parseTodosTaskManifestBindingLookup(input) {
+  const parsed = bindingLookupSchema.safeParse(input);
+  if (!parsed.success) {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", `Invalid task-manifest binding lookup: ${parsed.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`, { issues: parsed.error.issues });
+  }
+  return parsed.data;
+}
+
+// src/task-manifest/backend.ts
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function validateTaskManifestBindingLookupRows(rows, tenantId, planId) {
+  if (rows.length === 0) {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_BINDING_NOT_FOUND", `Managed task-manifest binding not found for plan: ${planId}`, { plan_id: planId });
+  }
+  if (rows.length !== 1) {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_LOOKUP_CONFLICT", "Task-manifest plan lookup matched more than one binding", { plan_id: planId, matched_items: rows.length, max_items: 1 });
+  }
+  const row = rows[0];
+  const bindingVersion = Number(row.binding_version);
+  const state = row.state;
+  if (row.binding_tenant_id !== tenantId || row.receipt_tenant_id !== tenantId || row.binding_plan_id !== planId || row.receipt_plan_id !== planId || row.receipt_authority !== "todos" || row.receipt_route !== "todos.task-manifest.v1" || Number(row.receipt_schema_version) !== 1 || row.receipt_kind !== "apply" || row.binding_operation_id !== row.receipt_operation_id || typeof row.apply_receipt_id !== "string" || !UUID_PATTERN.test(row.apply_receipt_id) || !Number.isSafeInteger(bindingVersion) || bindingVersion < 1 || state !== "applied" && state !== "compensated") {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_LOOKUP_CONFLICT", "Task-manifest binding and immutable apply receipt disagree", { plan_id: planId });
+  }
+  return {
+    plan_id: planId,
+    apply_receipt_id: row.apply_receipt_id,
+    binding_version: bindingVersion,
+    state
+  };
+}
 
 // src/task-manifest/reference-guard.ts
 function quoteSqliteIdentifier(value) {
@@ -5076,10 +5114,14 @@ function postgresTaskManifestForeignReferenceSql(tableName) {
 }
 
 // src/task-manifest/schema-sql.ts
+function sqlString(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
 function sqliteTodosTaskManifestSchemaSql() {
   return `
     CREATE TABLE IF NOT EXISTS todos_task_manifest_receipts (
       receipt_id TEXT PRIMARY KEY,
+      tenant_id TEXT NOT NULL,
       authority TEXT NOT NULL CHECK(authority = 'todos'),
       route TEXT NOT NULL,
       schema_version INTEGER NOT NULL CHECK(schema_version = 1),
@@ -5097,6 +5139,7 @@ function sqliteTodosTaskManifestSchemaSql() {
     );
     CREATE TABLE IF NOT EXISTS todos_task_manifest_bindings (
       operation_id TEXT PRIMARY KEY,
+      tenant_id TEXT NOT NULL,
       idempotency_key TEXT NOT NULL UNIQUE,
       request_digest TEXT NOT NULL,
       result_digest TEXT NOT NULL,
@@ -5132,10 +5175,37 @@ function sqliteTodosTaskManifestSchemaSql() {
       END;
   `;
 }
-function postgresTodosTaskManifestSchemaSql() {
+function sqliteTableHasColumn(db, tableName, columnName) {
+  const columns = db.query(`PRAGMA table_info("${tableName}")`).all();
+  return columns.some((column) => column.name === columnName);
+}
+function ensureSqliteTodosTaskManifestSchema(db, tenantId) {
+  db.exec(sqliteTodosTaskManifestSchemaSql());
+  const tenantDefault = sqlString(tenantId);
+  for (const tableName of [
+    "todos_task_manifest_receipts",
+    "todos_task_manifest_bindings"
+  ]) {
+    if (!sqliteTableHasColumn(db, tableName, "tenant_id")) {
+      db.exec(`ALTER TABLE "${tableName}" ADD COLUMN tenant_id TEXT NOT NULL DEFAULT ${tenantDefault}`);
+    }
+  }
+  db.exec(`
+    CREATE INDEX IF NOT EXISTS idx_todos_task_manifest_receipts_tenant
+      ON todos_task_manifest_receipts(tenant_id, receipt_id, kind);
+    CREATE INDEX IF NOT EXISTS idx_todos_task_manifest_bindings_tenant_plan
+      ON todos_task_manifest_bindings(
+        tenant_id,
+        json_extract(result_json, '$.graph.plan_id')
+      );
+  `);
+}
+function postgresTodosTaskManifestSchemaSql(tenantId = "default") {
+  const tenantDefault = sqlString(tenantId);
   return [
     `CREATE TABLE IF NOT EXISTS todos_task_manifest_receipts (
       receipt_id text PRIMARY KEY,
+      tenant_id text NOT NULL,
       authority text NOT NULL CHECK(authority = 'todos'),
       route text NOT NULL,
       schema_version integer NOT NULL CHECK(schema_version = 1),
@@ -5151,8 +5221,13 @@ function postgresTodosTaskManifestSchemaSql() {
       created_at timestamptz NOT NULL,
       UNIQUE(kind, idempotency_key)
     )`,
+    `ALTER TABLE todos_task_manifest_receipts
+      ADD COLUMN IF NOT EXISTS tenant_id text NOT NULL DEFAULT ${tenantDefault}`,
+    `ALTER TABLE todos_task_manifest_receipts
+      ALTER COLUMN tenant_id DROP DEFAULT`,
     `CREATE TABLE IF NOT EXISTS todos_task_manifest_bindings (
       operation_id text PRIMARY KEY,
+      tenant_id text NOT NULL,
       idempotency_key text NOT NULL UNIQUE,
       request_digest text NOT NULL,
       result_digest text NOT NULL,
@@ -5165,6 +5240,10 @@ function postgresTodosTaskManifestSchemaSql() {
       created_at timestamptz NOT NULL,
       updated_at timestamptz NOT NULL
     )`,
+    `ALTER TABLE todos_task_manifest_bindings
+      ADD COLUMN IF NOT EXISTS tenant_id text NOT NULL DEFAULT ${tenantDefault}`,
+    `ALTER TABLE todos_task_manifest_bindings
+      ALTER COLUMN tenant_id DROP DEFAULT`,
     `CREATE TABLE IF NOT EXISTS todos_task_manifest_outbox (
       id text PRIMARY KEY,
       apply_receipt_id text NOT NULL REFERENCES todos_task_manifest_receipts(receipt_id),
@@ -5178,6 +5257,13 @@ function postgresTodosTaskManifestSchemaSql() {
     )`,
     `CREATE INDEX IF NOT EXISTS todos_task_manifest_outbox_receipt_idx
       ON todos_task_manifest_outbox(apply_receipt_id, status)`,
+    `CREATE INDEX IF NOT EXISTS todos_task_manifest_receipts_tenant_idx
+      ON todos_task_manifest_receipts(tenant_id, receipt_id, kind)`,
+    `CREATE INDEX IF NOT EXISTS todos_task_manifest_bindings_tenant_plan_idx
+      ON todos_task_manifest_bindings(
+        tenant_id,
+        ((result_json #>> '{graph,plan_id}'))
+      )`,
     `CREATE OR REPLACE FUNCTION todos_task_manifest_receipts_immutable()
       RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN
         RAISE EXCEPTION 'todos task manifest receipts are immutable';
@@ -5201,10 +5287,12 @@ function parseApplyResult(value, duplicate) {
 
 class SqliteTodosTaskManifestBackend {
   db;
+  tenantId;
   kind = "sqlite";
-  constructor(db) {
+  constructor(db, tenantId = "default") {
     this.db = db;
-    db.exec(sqliteTodosTaskManifestSchemaSql());
+    this.tenantId = tenantId;
+    ensureSqliteTodosTaskManifestSchema(db, tenantId);
   }
   async serialized(run) {
     const previous = sqliteTails.get(this.db) ?? Promise.resolve();
@@ -5234,7 +5322,7 @@ class SqliteTodosTaskManifestBackend {
   async apply(input, faults) {
     return this.serialized(() => {
       const { manifest } = input;
-      const binding = this.db.query("SELECT * FROM todos_task_manifest_bindings WHERE operation_id = ? LIMIT 1").get(manifest.operation_id);
+      const binding = this.db.query("SELECT * FROM todos_task_manifest_bindings WHERE tenant_id = ? AND operation_id = ? LIMIT 1").get(this.tenantId, manifest.operation_id);
       if (binding) {
         if (binding["idempotency_key"] !== manifest.idempotency_key || binding["request_digest"] !== input.request_digest) {
           throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_IDEMPOTENCY_CONFLICT", "Operation is already bound to a different request");
@@ -5244,7 +5332,7 @@ class SqliteTodosTaskManifestBackend {
         }
         return parseApplyResult(String(binding["result_json"]), true);
       }
-      const idempotency = this.db.query("SELECT operation_id, request_digest FROM todos_task_manifest_bindings WHERE idempotency_key = ? LIMIT 1").get(manifest.idempotency_key);
+      const idempotency = this.db.query("SELECT operation_id, request_digest FROM todos_task_manifest_bindings WHERE tenant_id = ? AND idempotency_key = ? LIMIT 1").get(this.tenantId, manifest.idempotency_key);
       if (idempotency)
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_IDEMPOTENCY_CONFLICT", "Idempotency key is already used by another operation");
       if (manifest.if_binding_version !== undefined && manifest.if_binding_version !== 0) {
@@ -5334,9 +5422,9 @@ class SqliteTodosTaskManifestBackend {
       const resultJson = canonicalJson(result);
       const manifestJson = canonicalJson(manifest);
       this.db.query(`INSERT INTO todos_task_manifest_receipts (
-        receipt_id, authority, route, schema_version, kind, operation_id, idempotency_key,
+        receipt_id, tenant_id, authority, route, schema_version, kind, operation_id, idempotency_key,
         request_digest, result_digest, binding_version, apply_receipt_id, manifest_json, result_json, created_at
-      ) VALUES (?, 'todos', 'todos.task-manifest.v1', 1, 'apply', ?, ?, ?, ?, 1, NULL, ?, ?, ?)`).run(input.receipt_id, manifest.operation_id, manifest.idempotency_key, input.request_digest, input.result_digest, manifestJson, resultJson, input.now);
+      ) VALUES (?, ?, 'todos', 'todos.task-manifest.v1', 1, 'apply', ?, ?, ?, ?, 1, NULL, ?, ?, ?)`).run(input.receipt_id, this.tenantId, manifest.operation_id, manifest.idempotency_key, input.request_digest, input.result_digest, manifestJson, resultJson, input.now);
       for (const entry of input.outbox) {
         this.db.query(`INSERT INTO todos_task_manifest_outbox (
           id, apply_receipt_id, topic, payload, payload_digest, status, created_at
@@ -5344,24 +5432,55 @@ class SqliteTodosTaskManifestBackend {
       }
       fault(faults, "after_outbox_write");
       this.db.query(`INSERT INTO todos_task_manifest_bindings (
-        operation_id, idempotency_key, request_digest, result_digest, apply_receipt_id,
+        operation_id, tenant_id, idempotency_key, request_digest, result_digest, apply_receipt_id,
         manifest_json, result_json, state, version, created_at, updated_at
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, 'applied', 1, ?, ?)`).run(manifest.operation_id, manifest.idempotency_key, input.request_digest, input.result_digest, input.receipt_id, manifestJson, resultJson, input.now, input.now);
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'applied', 1, ?, ?)`).run(manifest.operation_id, this.tenantId, manifest.idempotency_key, input.request_digest, input.result_digest, input.receipt_id, manifestJson, resultJson, input.now, input.now);
       fault(faults, "after_receipt_write");
       return result;
     });
   }
   async readExact(receiptId) {
-    const row = this.db.query("SELECT result_json FROM todos_task_manifest_receipts WHERE receipt_id = ? AND kind = 'apply' LIMIT 1").get(receiptId);
+    const row = this.db.query("SELECT result_json FROM todos_task_manifest_receipts WHERE tenant_id = ? AND receipt_id = ? AND kind = 'apply' LIMIT 1").get(this.tenantId, receiptId);
     if (!row)
       throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_RECEIPT_NOT_FOUND", `Apply receipt not found: ${receiptId}`);
     return parseApplyResult(row.result_json, false);
   }
+  async lookupBindingByPlanId(planId) {
+    const rows = this.db.query(`
+      SELECT
+        b.apply_receipt_id AS apply_receipt_id,
+        b.state AS state,
+        b.version AS binding_version,
+        b.tenant_id AS binding_tenant_id,
+        b.operation_id AS binding_operation_id,
+        json_extract(b.result_json, '$.graph.plan_id') AS binding_plan_id,
+        r.tenant_id AS receipt_tenant_id,
+        r.authority AS receipt_authority,
+        r.route AS receipt_route,
+        r.schema_version AS receipt_schema_version,
+        r.kind AS receipt_kind,
+        r.operation_id AS receipt_operation_id,
+        json_extract(r.result_json, '$.graph.plan_id') AS receipt_plan_id
+      FROM todos_task_manifest_bindings b
+      LEFT JOIN todos_task_manifest_receipts r
+        ON r.receipt_id = b.apply_receipt_id
+        AND r.tenant_id = b.tenant_id
+      WHERE b.tenant_id = ?
+        AND json_extract(b.result_json, '$.graph.plan_id') = ?
+      LIMIT 2
+    `).all(this.tenantId, planId);
+    return validateTaskManifestBindingLookupRows(rows, this.tenantId, planId);
+  }
   async markOutboxDelivered(outboxId, deliveredAt) {
     await this.serialized(() => {
       const result = this.db.query(`UPDATE todos_task_manifest_outbox
         SET status = 'delivered', delivered_at = ?, attempts = attempts + 1
-        WHERE id = ? AND status = 'pending'`).run(deliveredAt, outboxId);
+        WHERE id = ? AND status = 'pending'
+          AND EXISTS (
+            SELECT 1 FROM todos_task_manifest_receipts r
+            WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
+              AND r.tenant_id = ?
+          )`).run(deliveredAt, outboxId, this.tenantId);
       if (result.changes !== 1) {
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", `Pending outbox row not found: ${outboxId}`);
       }
@@ -5370,23 +5489,28 @@ class SqliteTodosTaskManifestBackend {
   async compensate(input, receipt, compensationReceiptId, requestDigest, now) {
     return this.serialized(() => {
       const existing = this.db.query(`SELECT apply_receipt_id, request_digest, result_json
-        FROM todos_task_manifest_receipts WHERE kind = 'compensate' AND idempotency_key = ? LIMIT 1`).get(input.idempotency_key);
+        FROM todos_task_manifest_receipts
+        WHERE tenant_id = ? AND kind = 'compensate' AND idempotency_key = ?
+        LIMIT 1`).get(this.tenantId, input.idempotency_key);
       if (existing) {
         if (existing.apply_receipt_id !== input.receipt_id || existing.request_digest !== requestDigest) {
           throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_IDEMPOTENCY_CONFLICT", "Compensation idempotency key is already used");
         }
         return { ...JSON.parse(existing.result_json), duplicate: true };
       }
-      const row = this.db.query("SELECT * FROM todos_task_manifest_receipts WHERE receipt_id = ? AND kind = 'apply' LIMIT 1").get(input.receipt_id);
+      const row = this.db.query("SELECT * FROM todos_task_manifest_receipts WHERE tenant_id = ? AND receipt_id = ? AND kind = 'apply' LIMIT 1").get(this.tenantId, input.receipt_id);
       if (!row)
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_RECEIPT_NOT_FOUND", "Apply receipt not found");
-      const binding = this.db.query("SELECT * FROM todos_task_manifest_bindings WHERE operation_id = ? LIMIT 1").get(String(row["operation_id"]));
+      const binding = this.db.query("SELECT * FROM todos_task_manifest_bindings WHERE tenant_id = ? AND operation_id = ? LIMIT 1").get(this.tenantId, String(row["operation_id"]));
       if (!binding || Number(binding["version"]) !== input.if_binding_version) {
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_CAS_CONFLICT", "Binding version changed before compensation");
       }
       if (binding["state"] !== "applied")
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Graph is not in applied state");
-      const delivered = this.db.query("SELECT id FROM todos_task_manifest_outbox WHERE apply_receipt_id = ? AND status = 'delivered' LIMIT 1").get(input.receipt_id);
+      const delivered = this.db.query(`SELECT o.id FROM todos_task_manifest_outbox o
+        JOIN todos_task_manifest_receipts r ON r.receipt_id = o.apply_receipt_id
+        WHERE r.tenant_id = ? AND o.apply_receipt_id = ? AND o.status = 'delivered'
+        LIMIT 1`).get(this.tenantId, input.receipt_id);
       if (delivered)
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: delivered outbox row exists");
       const applyResult = parseApplyResult(String(row["result_json"]), false);
@@ -5399,7 +5523,14 @@ class SqliteTodosTaskManifestBackend {
         ...(manifest.effects ?? []).map((effect2) => ({ topic: effect2.topic, payload: effect2.payload }))
       ];
       const storedOutbox = this.db.query(`SELECT id, topic, payload, payload_digest, status, attempts, delivered_at
-        FROM todos_task_manifest_outbox WHERE apply_receipt_id = ? ORDER BY id`).all(input.receipt_id);
+        FROM todos_task_manifest_outbox
+        WHERE apply_receipt_id = ?
+          AND EXISTS (
+            SELECT 1 FROM todos_task_manifest_receipts r
+            WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
+              AND r.tenant_id = ?
+          )
+        ORDER BY id`).all(input.receipt_id, this.tenantId);
       if (storedOutbox.length !== expectedEffects.length) {
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: outbox changed since apply");
       }
@@ -5487,7 +5618,14 @@ class SqliteTodosTaskManifestBackend {
           }
           expectedVerificationIndex += 1;
         }
-      this.db.query("UPDATE todos_task_manifest_outbox SET status = 'cancelled' WHERE apply_receipt_id = ? AND status = 'pending'").run(input.receipt_id);
+      this.db.query(`UPDATE todos_task_manifest_outbox
+        SET status = 'cancelled'
+        WHERE apply_receipt_id = ? AND status = 'pending'
+          AND EXISTS (
+            SELECT 1 FROM todos_task_manifest_receipts r
+            WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
+              AND r.tenant_id = ?
+          )`).run(input.receipt_id, this.tenantId);
       for (const table of ["task_tags", "task_dependencies", "task_comments", "task_verifications"]) {
         const column = table === "task_dependencies" ? "task_id" : "task_id";
         this.db.query(`DELETE FROM ${table} WHERE ${column} IN (${placeholders2})`).run(...taskIds);
@@ -5498,11 +5636,11 @@ class SqliteTodosTaskManifestBackend {
       const result = { duplicate: false, receipt, absent: true, readback };
       const resultJson = canonicalJson(result);
       this.db.query(`INSERT INTO todos_task_manifest_receipts (
-        receipt_id, authority, route, schema_version, kind, operation_id, idempotency_key,
+        receipt_id, tenant_id, authority, route, schema_version, kind, operation_id, idempotency_key,
         request_digest, result_digest, binding_version, apply_receipt_id, manifest_json, result_json, created_at
-      ) VALUES (?, 'todos', 'todos.task-manifest.v1', 1, 'compensate', ?, ?, ?, ?, ?, ?, NULL, ?, ?)`).run(compensationReceiptId, receipt.operation_id, input.idempotency_key, requestDigest, receipt.result_digest, receipt.binding_version, input.receipt_id, resultJson, now);
+      ) VALUES (?, ?, 'todos', 'todos.task-manifest.v1', 1, 'compensate', ?, ?, ?, ?, ?, ?, NULL, ?, ?)`).run(compensationReceiptId, this.tenantId, receipt.operation_id, input.idempotency_key, requestDigest, receipt.result_digest, receipt.binding_version, input.receipt_id, resultJson, now);
       const updated = this.db.query(`UPDATE todos_task_manifest_bindings SET state = 'compensated', version = ?, compensation_receipt_id = ?, updated_at = ?
-        WHERE operation_id = ? AND state = 'applied' AND version = ?`).run(receipt.binding_version, compensationReceiptId, now, receipt.operation_id, input.if_binding_version);
+        WHERE tenant_id = ? AND operation_id = ? AND state = 'applied' AND version = ?`).run(receipt.binding_version, compensationReceiptId, now, this.tenantId, receipt.operation_id, input.if_binding_version);
       if (updated.changes !== 1) {
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_CAS_CONFLICT", "Binding changed during compensation");
       }
@@ -6045,17 +6183,19 @@ class PostgresTodosTaskManifestBackend {
   kind = "postgresql";
   service;
   tableName;
+  tenantId;
   schemaReady = null;
   constructor(client, options = {}) {
     this.client = client;
     this.service = options.service ?? "todos";
     this.tableName = safeIdentifier(options.tableName ?? DEFAULT_TODOS_POSTGRES_SYNC_TABLE, "tableName");
+    this.tenantId = options.tenantId ?? "default";
   }
   async ensureSchema() {
     this.schemaReady ??= (async () => {
       for (const sql of postgresTodosSyncSchemaSql(this.tableName))
         await this.client.query(sql);
-      for (const sql of postgresTodosTaskManifestSchemaSql())
+      for (const sql of postgresTodosTaskManifestSchemaSql(this.tenantId))
         await this.client.query(sql);
     })();
     await this.schemaReady;
@@ -6077,7 +6217,7 @@ class PostgresTodosTaskManifestBackend {
       const { manifest } = input;
       await tx.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${this.service}\x1F${manifest.operation_id}`]);
       await tx.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${this.service}\x1Fidempotency\x1F${manifest.idempotency_key}`]);
-      const existing = await tx.query("SELECT * FROM todos_task_manifest_bindings WHERE operation_id = $1 LIMIT 1 FOR UPDATE", [manifest.operation_id]);
+      const existing = await tx.query("SELECT * FROM todos_task_manifest_bindings WHERE tenant_id = $1 AND operation_id = $2 LIMIT 1 FOR UPDATE", [this.tenantId, manifest.operation_id]);
       if (existing.rows[0]) {
         const binding = existing.rows[0];
         if (binding["idempotency_key"] !== manifest.idempotency_key || binding["request_digest"] !== input.request_digest) {
@@ -6088,7 +6228,7 @@ class PostgresTodosTaskManifestBackend {
         }
         return { ...parseJson(binding["result_json"]), duplicate: true };
       }
-      const reused = await tx.query("SELECT operation_id FROM todos_task_manifest_bindings WHERE idempotency_key = $1 LIMIT 1", [manifest.idempotency_key]);
+      const reused = await tx.query("SELECT operation_id FROM todos_task_manifest_bindings WHERE tenant_id = $1 AND idempotency_key = $2 LIMIT 1", [this.tenantId, manifest.idempotency_key]);
       if (reused.rows[0])
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_IDEMPOTENCY_CONFLICT", "Idempotency key is already used");
       if (manifest.if_binding_version !== undefined && manifest.if_binding_version !== 0) {
@@ -6198,10 +6338,11 @@ class PostgresTodosTaskManifestBackend {
       const manifestJson = canonicalJson(manifest);
       const resultJson = canonicalJson(result);
       await tx.query(`INSERT INTO todos_task_manifest_receipts (
-        receipt_id, authority, route, schema_version, kind, operation_id, idempotency_key,
+        receipt_id, tenant_id, authority, route, schema_version, kind, operation_id, idempotency_key,
         request_digest, result_digest, binding_version, apply_receipt_id, manifest_json, result_json, created_at
-      ) VALUES ($1, 'todos', 'todos.task-manifest.v1', 1, 'apply', $2, $3, $4, $5, 1, NULL, $6::jsonb, $7::jsonb, $8)`, [
+      ) VALUES ($1, $2, 'todos', 'todos.task-manifest.v1', 1, 'apply', $3, $4, $5, $6, 1, NULL, $7::jsonb, $8::jsonb, $9)`, [
         input.receipt_id,
+        this.tenantId,
         manifest.operation_id,
         manifest.idempotency_key,
         input.request_digest,
@@ -6224,10 +6365,11 @@ class PostgresTodosTaskManifestBackend {
       }
       fault2(faults, "after_outbox_write");
       await tx.query(`INSERT INTO todos_task_manifest_bindings (
-        operation_id, idempotency_key, request_digest, result_digest, apply_receipt_id,
+        operation_id, tenant_id, idempotency_key, request_digest, result_digest, apply_receipt_id,
         manifest_json, result_json, state, version, created_at, updated_at
-      ) VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7::jsonb, 'applied', 1, $8, $8)`, [
+      ) VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8::jsonb, 'applied', 1, $9, $9)`, [
         manifest.operation_id,
+        this.tenantId,
         manifest.idempotency_key,
         input.request_digest,
         input.result_digest,
@@ -6242,17 +6384,50 @@ class PostgresTodosTaskManifestBackend {
   }
   async readExact(receiptId) {
     await this.ensureSchema();
-    const result = await this.client.query("SELECT result_json FROM todos_task_manifest_receipts WHERE receipt_id = $1 AND kind = 'apply' LIMIT 1", [receiptId]);
+    const result = await this.client.query("SELECT result_json FROM todos_task_manifest_receipts WHERE tenant_id = $1 AND receipt_id = $2 AND kind = 'apply' LIMIT 1", [this.tenantId, receiptId]);
     if (!result.rows[0])
       throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_RECEIPT_NOT_FOUND", `Apply receipt not found: ${receiptId}`);
     return { ...parseJson(result.rows[0]["result_json"]), duplicate: false };
   }
+  async lookupBindingByPlanId(planId) {
+    await this.ensureSchema();
+    const result = await this.client.query(`
+      SELECT
+        b.apply_receipt_id AS apply_receipt_id,
+        b.state AS state,
+        b.version AS binding_version,
+        b.tenant_id AS binding_tenant_id,
+        b.operation_id AS binding_operation_id,
+        b.result_json #>> '{graph,plan_id}' AS binding_plan_id,
+        r.tenant_id AS receipt_tenant_id,
+        r.authority AS receipt_authority,
+        r.route AS receipt_route,
+        r.schema_version AS receipt_schema_version,
+        r.kind AS receipt_kind,
+        r.operation_id AS receipt_operation_id,
+        r.result_json #>> '{graph,plan_id}' AS receipt_plan_id
+      FROM todos_task_manifest_bindings b
+      LEFT JOIN todos_task_manifest_receipts r
+        ON r.receipt_id = b.apply_receipt_id
+        AND r.tenant_id = b.tenant_id
+      WHERE b.tenant_id = $1
+        AND b.result_json #>> '{graph,plan_id}' = $2
+      LIMIT 2
+    `, [this.tenantId, planId]);
+    return validateTaskManifestBindingLookupRows(result.rows, this.tenantId, planId);
+  }
   async markOutboxDelivered(outboxId, deliveredAt) {
     await this.ensureSchema();
     await this.client.transaction(async (tx) => {
       const result = await tx.query(`UPDATE todos_task_manifest_outbox
         SET status = 'delivered', delivered_at = $1, attempts = attempts + 1
-        WHERE id = $2 AND status = 'pending' RETURNING id`, [deliveredAt, outboxId]);
+        WHERE id = $2 AND status = 'pending'
+          AND EXISTS (
+            SELECT 1 FROM todos_task_manifest_receipts r
+            WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
+              AND r.tenant_id = $3
+          )
+        RETURNING id`, [deliveredAt, outboxId, this.tenantId]);
       if (!result.rows[0])
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", `Pending outbox row not found: ${outboxId}`);
     });
@@ -6262,7 +6437,10 @@ class PostgresTodosTaskManifestBackend {
     return this.client.transaction(async (tx) => {
       await tx.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${this.service}\x1F${receipt.operation_id}`]);
       await tx.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${this.service}\x1Fcompensation-idempotency\x1F${input.idempotency_key}`]);
-      const previous = await tx.query("SELECT apply_receipt_id, request_digest, result_json FROM todos_task_manifest_receipts WHERE kind = 'compensate' AND idempotency_key = $1 LIMIT 1", [input.idempotency_key]);
+      const previous = await tx.query(`SELECT apply_receipt_id, request_digest, result_json
+         FROM todos_task_manifest_receipts
+         WHERE tenant_id = $1 AND kind = 'compensate' AND idempotency_key = $2
+         LIMIT 1`, [this.tenantId, input.idempotency_key]);
       if (previous.rows[0]) {
         const row = previous.rows[0];
         if (row["apply_receipt_id"] !== input.receipt_id || row["request_digest"] !== requestDigest) {
@@ -6270,18 +6448,21 @@ class PostgresTodosTaskManifestBackend {
         }
         return { ...parseJson(row["result_json"]), duplicate: true };
       }
-      const applyRows = await tx.query("SELECT * FROM todos_task_manifest_receipts WHERE receipt_id = $1 AND kind = 'apply' LIMIT 1", [input.receipt_id]);
+      const applyRows = await tx.query("SELECT * FROM todos_task_manifest_receipts WHERE tenant_id = $1 AND receipt_id = $2 AND kind = 'apply' LIMIT 1", [this.tenantId, input.receipt_id]);
       const applyRow = applyRows.rows[0];
       if (!applyRow)
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_RECEIPT_NOT_FOUND", "Apply receipt not found");
-      const bindingRows = await tx.query("SELECT * FROM todos_task_manifest_bindings WHERE operation_id = $1 LIMIT 1 FOR UPDATE", [receipt.operation_id]);
+      const bindingRows = await tx.query("SELECT * FROM todos_task_manifest_bindings WHERE tenant_id = $1 AND operation_id = $2 LIMIT 1 FOR UPDATE", [this.tenantId, receipt.operation_id]);
       const binding = bindingRows.rows[0];
       if (!binding || Number(binding["version"]) !== input.if_binding_version) {
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_CAS_CONFLICT", "Binding version changed before compensation");
       }
       if (binding["state"] !== "applied")
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Graph is not applied");
-      const delivered = await tx.query("SELECT id FROM todos_task_manifest_outbox WHERE apply_receipt_id = $1 AND status = 'delivered' LIMIT 1", [input.receipt_id]);
+      const delivered = await tx.query(`SELECT o.id FROM todos_task_manifest_outbox o
+         JOIN todos_task_manifest_receipts r ON r.receipt_id = o.apply_receipt_id
+         WHERE r.tenant_id = $1 AND o.apply_receipt_id = $2 AND o.status = 'delivered'
+         LIMIT 1`, [this.tenantId, input.receipt_id]);
       if (delivered.rows[0])
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: delivered outbox row exists");
       const applyResult = parseJson(applyRow["result_json"]);
@@ -6294,7 +6475,14 @@ class PostgresTodosTaskManifestBackend {
         ...(manifest.effects ?? []).map((effect2) => ({ topic: effect2.topic, payload: effect2.payload }))
       ];
       const outboxRows = await tx.query(`SELECT id, topic, payload, payload_digest, status, attempts, delivered_at
-        FROM todos_task_manifest_outbox WHERE apply_receipt_id = $1 ORDER BY id`, [input.receipt_id]);
+        FROM todos_task_manifest_outbox
+        WHERE apply_receipt_id = $1
+          AND EXISTS (
+            SELECT 1 FROM todos_task_manifest_receipts r
+            WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
+              AND r.tenant_id = $2
+          )
+        ORDER BY id`, [input.receipt_id, this.tenantId]);
       if (outboxRows.rows.length !== expectedEffects.length) {
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: outbox changed since apply");
       }
@@ -6394,7 +6582,14 @@ class PostgresTodosTaskManifestBackend {
       }
       if (stored.rows.length !== managedIds.length)
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: managed graph is incomplete");
-      await tx.query("UPDATE todos_task_manifest_outbox SET status = 'cancelled' WHERE apply_receipt_id = $1 AND status = 'pending'", [input.receipt_id]);
+      await tx.query(`UPDATE todos_task_manifest_outbox
+        SET status = 'cancelled'
+        WHERE apply_receipt_id = $1 AND status = 'pending'
+          AND EXISTS (
+            SELECT 1 FROM todos_task_manifest_receipts r
+            WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
+              AND r.tenant_id = $2
+          )`, [input.receipt_id, this.tenantId]);
       const typedIds = [
         ["dependencies", applyResult.graph.dependency_ids],
         ["comments", applyResult.graph.comment_ids],
@@ -6411,10 +6606,11 @@ class PostgresTodosTaskManifestBackend {
       const readback = await this.readback(tx, applyResult.graph);
       const result = { duplicate: false, receipt, absent: true, readback };
       await tx.query(`INSERT INTO todos_task_manifest_receipts (
-        receipt_id, authority, route, schema_version, kind, operation_id, idempotency_key,
+        receipt_id, tenant_id, authority, route, schema_version, kind, operation_id, idempotency_key,
         request_digest, result_digest, binding_version, apply_receipt_id, manifest_json, result_json, created_at
-      ) VALUES ($1, 'todos', 'todos.task-manifest.v1', 1, 'compensate', $2, $3, $4, $5, $6, $7, NULL, $8::jsonb, $9)`, [
+      ) VALUES ($1, $2, 'todos', 'todos.task-manifest.v1', 1, 'compensate', $3, $4, $5, $6, $7, $8, NULL, $9::jsonb, $10)`, [
         compensationReceiptId,
+        this.tenantId,
         receipt.operation_id,
         input.idempotency_key,
         requestDigest,
@@ -6426,10 +6622,11 @@ class PostgresTodosTaskManifestBackend {
       ]);
       const updated = await tx.query(`UPDATE todos_task_manifest_bindings
         SET state = 'compensated', version = $1, compensation_receipt_id = $2, updated_at = $3
-        WHERE operation_id = $4 AND state = 'applied' AND version = $5 RETURNING operation_id`, [
+        WHERE tenant_id = $4 AND operation_id = $5 AND state = 'applied' AND version = $6 RETURNING operation_id`, [
         receipt.binding_version,
         compensationReceiptId,
         now,
+        this.tenantId,
         receipt.operation_id,
         input.if_binding_version
       ]);
@@ -6469,6 +6666,13 @@ var FAULT_POINTS = [
   "after_outbox_write",
   "after_receipt_write"
 ];
+function resolveTenantId(value) {
+  const tenantId = value ?? "default";
+  if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/.test(tenantId)) {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", "tenantId must be a bounded exact authority identifier");
+  }
+  return tenantId;
+}
 function normalize(input, now) {
   const parsed = parseTodosTaskManifest(input);
   const requestBytes = Buffer.byteLength(canonicalJson(parsed), "utf8");
@@ -6556,15 +6760,18 @@ function sanitizeManifest(manifest) {
 class PackageOwnedTodosTaskManifestAuthority {
   backend;
   options;
+  tenantId;
   constructor(backend, options = {}) {
     this.backend = backend;
     this.options = options;
+    this.tenantId = resolveTenantId(options.tenantId);
   }
   async capability() {
     return {
       authority: "todos",
       route: TODOS_TASK_MANIFEST_ROUTE,
       schema_version: TODOS_TASK_MANIFEST_SCHEMA_VERSION,
+      tenant_id: this.tenantId,
       backend: this.backend.kind,
       deterministic_ids: true,
       immutable_receipts: true,
@@ -6603,6 +6810,22 @@ class PackageOwnedTodosTaskManifestAuthority {
     }
     return this.backend.readExact(receiptId).then((result) => this.bounded(result));
   }
+  async lookupBinding(input) {
+    const request = parseTodosTaskManifestBindingLookup(input);
+    if (request.max_items !== 1) {
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_BOUNDS_EXCEEDED", "max_items must be exactly 1 for task-manifest binding lookup", { max_items: request.max_items, max_items_limit: 1 });
+    }
+    if (request.authority !== "todos" || request.route !== TODOS_TASK_MANIFEST_ROUTE || request.schema_version !== TODOS_TASK_MANIFEST_SCHEMA_VERSION || request.tenant_id !== this.tenantId) {
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_CAPABILITY_MISMATCH", "Task-manifest binding lookup does not match this authority identity");
+    }
+    return this.bounded({
+      authority: "todos",
+      route: TODOS_TASK_MANIFEST_ROUTE,
+      schema_version: TODOS_TASK_MANIFEST_SCHEMA_VERSION,
+      tenant_id: this.tenantId,
+      ...await this.backend.lookupBindingByPlanId(request.plan_id)
+    });
+  }
   markOutboxDelivered(outboxId) {
     if (!outboxId || outboxId.length > 200) {
       throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", "outboxId must be a bounded exact identifier");
@@ -6642,13 +6865,15 @@ function createSqliteTodosTaskManifestAuthority(options) {
   if (!options?.database) {
     throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_ATOMICITY_UNAVAILABLE", "An explicit SQLite Database is required");
   }
-  return new PackageOwnedTodosTaskManifestAuthority(new SqliteTodosTaskManifestBackend(options.database), options);
+  const tenantId = resolveTenantId(options.tenantId);
+  return new PackageOwnedTodosTaskManifestAuthority(new SqliteTodosTaskManifestBackend(options.database, tenantId), { ...options, tenantId });
 }
 function createPostgresTodosTaskManifestAuthority(client, options = {}) {
   if (!client || typeof client.transaction !== "function") {
     throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_ATOMICITY_UNAVAILABLE", "An authoritative PostgreSQL transaction(callback) client is required");
   }
-  return new PackageOwnedTodosTaskManifestAuthority(new PostgresTodosTaskManifestBackend(client, options), options);
+  const tenantId = resolveTenantId(options.tenantId);
+  return new PackageOwnedTodosTaskManifestAuthority(new PostgresTodosTaskManifestBackend(client, { ...options, tenantId }), { ...options, tenantId });
 }
 // src/task-manifest/http.ts
 var JSON_HEADERS = { "Content-Type": "application/json" };
@@ -6662,6 +6887,7 @@ function status(error) {
     case "TODOS_TASK_MANIFEST_FOREIGN_REFERENCE":
       return 400;
     case "TODOS_TASK_MANIFEST_RECEIPT_NOT_FOUND":
+    case "TODOS_TASK_MANIFEST_BINDING_NOT_FOUND":
       return 404;
     case "TODOS_TASK_MANIFEST_ATOMICITY_UNAVAILABLE":
       return 503;
@@ -6724,6 +6950,11 @@ async function handleTodosTaskManifestHttpRequest(request, url, authority, baseP
       }
       return json({ result: await authority.readExact(input.receipt_id) });
     }
+    if (action === "bindings/lookup") {
+      return json({
+        result: await authority.lookupBinding(await body(request))
+      });
+    }
     if (action === "compensate") {
       return json({ result: await authority.compensate(await body(request)) }, 201);
     }
@@ -6783,6 +7014,9 @@ class TodosTaskManifestHttpClient {
   async readExact(receiptId) {
     return (await this.request("/read-exact", { method: "POST", body: JSON.stringify({ receipt_id: receiptId }) })).result;
   }
+  async lookupBinding(input) {
+    return (await this.request("/bindings/lookup", { method: "POST", body: JSON.stringify(input) })).result;
+  }
   async markOutboxDelivered(outboxId) {
     await this.request("/outbox/delivered", { method: "POST", body: JSON.stringify({ outbox_id: outboxId }) });
   }
@@ -6797,6 +7031,7 @@ export {
   sqliteTodosTaskManifestSchemaSql,
   postgresTodosTaskManifestSchemaSql,
   parseTodosTaskManifestCompensation,
+  parseTodosTaskManifestBindingLookup,
   parseTodosTaskManifest,
   handleTodosTaskManifestHttpRequest,
   canonicalDigest as digestTodosTaskManifest,