@hasna/todos 0.15.14 → 0.15.16

package/dist/mcp/index.js

@@ -21041,10 +21041,72 @@ async function requireTagsFilterCapability(client) {
     throw new Error(`REMOTE_TAGS_FILTER_UNSUPPORTED: configured Todos authority ${authority} does not advertise the tags ` + "query param on GET /v1/tasks; deploy the current @hasna/todos /v1 server to filter by tag; " + "no unfiltered task read was issued");
   }
 }
-async function requestCloudTaskPage(client, filter) {
+function parseCloudTaskTotal(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw))
+    return;
+  const total = raw.total;
+  return typeof total === "number" && Number.isSafeInteger(total) && total >= 0 ? total : undefined;
+}
+async function requestRawCloudTaskPage(client, filter) {
   const res = await requiredRemoteRoute(client, "/v1/tasks", () => client.list("tasks", { query: toListQuery(filter) }));
   const envelope = res.raw;
-  return Array.isArray(envelope?.tasks) ? envelope.tasks : res.items;
+  return {
+    tasks: Array.isArray(envelope?.tasks) ? envelope.tasks : res.items,
+    total: parseCloudTaskTotal(res.raw)
+  };
+}
+function cloudTaskListFilterError(code, taskListId, detail) {
+  return new Error(`${code}: hosted authority returned rows outside requested task_list_id ${taskListId}; ${detail}; refusing an incomplete exact-list result`);
+}
+async function requestCloudTaskPage(client, filter) {
+  const firstPage = await requestRawCloudTaskPage(client, filter);
+  const tasks = firstPage.tasks;
+  if (filter.task_list_id === undefined)
+    return tasks;
+  const taskListId = filter.task_list_id;
+  if (tasks.every((task) => task.task_list_id === taskListId))
+    return tasks;
+  const scanLimit = filter.limit;
+  const startOffset = filter.offset ?? 0;
+  if (startOffset !== 0 || scanLimit === undefined || !Number.isSafeInteger(scanLimit) || scanLimit <= 0 || firstPage.total === undefined) {
+    throw cloudTaskListFilterError("REMOTE_TASK_LIST_FILTER_UNSUPPORTED", taskListId, "the response does not provide complete bounded total/offset pagination evidence");
+  }
+  const total = firstPage.total;
+  if (total > scanLimit) {
+    throw cloudTaskListFilterError("REMOTE_TASK_LIST_FILTER_INCOMPLETE", taskListId, `reported total ${total} exceeds bounded scan limit ${scanLimit}`);
+  }
+  if (tasks.length > total) {
+    throw cloudTaskListFilterError("REMOTE_TASK_LIST_FILTER_UNSUPPORTED", taskListId, `the first page contains ${tasks.length} rows but reports total ${total}`);
+  }
+  const seenTaskIds = new Set;
+  for (const task of tasks) {
+    if (seenTaskIds.has(task.id)) {
+      throw cloudTaskListFilterError("REMOTE_TASK_LIST_FILTER_UNSUPPORTED", taskListId, `the first page repeats task id ${task.id}`);
+    }
+    seenTaskIds.add(task.id);
+  }
+  while (tasks.length < total) {
+    const remaining = total - tasks.length;
+    const page = await requestRawCloudTaskPage(client, {
+      ...filter,
+      offset: tasks.length,
+      limit: Math.min(scanLimit - tasks.length, remaining)
+    });
+    if (page.total !== total) {
+      throw cloudTaskListFilterError("REMOTE_TASK_LIST_FILTER_UNSUPPORTED", taskListId, `pagination total changed from ${total} to ${String(page.total)}`);
+    }
+    if (page.tasks.length === 0 || tasks.length + page.tasks.length > total) {
+      throw cloudTaskListFilterError("REMOTE_TASK_LIST_FILTER_UNSUPPORTED", taskListId, "pagination did not make bounded progress toward the reported total");
+    }
+    for (const task of page.tasks) {
+      if (seenTaskIds.has(task.id)) {
+        throw cloudTaskListFilterError("REMOTE_TASK_LIST_FILTER_UNSUPPORTED", taskListId, `pagination repeats task id ${task.id}`);
+      }
+      seenTaskIds.add(task.id);
+    }
+    tasks.push(...page.tasks);
+  }
+  return tasks.filter((task) => task.task_list_id === taskListId);
 }
 async function cloudListTasks(client, filter = {}) {
   if (filter.tags?.length)
@@ -21083,12 +21145,10 @@ async function cloudGetTask(client, id) {
 }
 async function cloudCreateTask(client, input) {
   const expectedParentId = typeof input["parent_id"] === "string" ? input["parent_id"] : null;
-  const created = unwrapTask(await requiredRemoteRoute(client, "/v1/tasks", () => expectedParentId === null ? client.create("tasks", input) : client.create("tasks", input, { retry: false }), ["PARENT_TASK_NOT_FOUND"]));
+  const created = unwrapTask(await requiredRemoteRoute(client, "/v1/tasks", () => client.create("tasks", input, { retry: false }), ["PARENT_TASK_NOT_FOUND"]));
   if (!created || typeof created.id !== "string" || !created.id.trim()) {
     throw new Error(`REMOTE_API_INCOMPATIBLE: configured Todos authority ${remoteAuthorityBase(client)} returned a task create ` + "response without a stored task id; no success row or local SQLite fallback is permitted");
   }
-  if (expectedParentId === null)
-    return created;
   const persisted = await cloudGetTask(client, created.id);
   if (!persisted || persisted.id !== created.id || (persisted.parent_id ?? null) !== expectedParentId) {
     throw new Error(`TASK_CREATE_PERSISTENCE_UNVERIFIED: configured Todos authority ${remoteAuthorityBase(client)} accepted ` + `POST /v1/tasks but authoritative GET /v1/tasks/${encodeURIComponent(created.id)} did not return the same ` + "stored task id and parent_id; no success row or local SQLite fallback is permitted");
@@ -35415,7 +35475,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.14",
+    version: "0.15.16",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -50911,6 +50971,1337 @@ var init_project_registration = __esm(() => {
   init_types4();
 });
 
+// src/task-manifest/canonical.ts
+import { createHash as createHash16 } from "crypto";
+function canonicalize3(value) {
+  if (Array.isArray(value))
+    return value.map(canonicalize3);
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).filter(([, entry2]) => entry2 !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry2]) => [key, canonicalize3(entry2)]));
+  }
+  return value;
+}
+function canonicalJson(value) {
+  return JSON.stringify(canonicalize3(value));
+}
+function canonicalDigest(value) {
+  return createHash16("sha256").update(canonicalJson(value)).digest("hex");
+}
+function deterministicUuid(namespace, ...parts) {
+  const bytes = createHash16("sha256").update([namespace, ...parts].join("\x1F")).digest().subarray(0, 16);
+  bytes[6] = bytes[6] & 15 | 80;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = bytes.toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+var init_canonical = () => {};
+
+// src/task-manifest/types.ts
+var TODOS_TASK_MANIFEST_ROUTE = "todos.task-manifest.v1", TODOS_TASK_MANIFEST_SCHEMA_VERSION = 1, TodosTaskManifestError;
+var init_types5 = __esm(() => {
+  TodosTaskManifestError = class TodosTaskManifestError extends Error {
+    code;
+    details;
+    constructor(code, message, details = {}) {
+      super(message);
+      this.code = code;
+      this.details = details;
+      this.name = "TodosTaskManifestError";
+    }
+  };
+});
+
+// src/task-manifest/schema.ts
+function parseTodosTaskManifest(input) {
+  const parsed = schema.safeParse(input);
+  if (!parsed.success) {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", `Invalid task manifest: ${parsed.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`, { issues: parsed.error.issues });
+  }
+  const taskKeys = new Set;
+  let comments = 0;
+  let verifications = 0;
+  for (const entry2 of parsed.data.tasks) {
+    if (taskKeys.has(entry2.key)) {
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", `Duplicate task key: ${entry2.key}`);
+    }
+    taskKeys.add(entry2.key);
+    comments += entry2.comments?.length ?? 0;
+    verifications += entry2.verifications?.length ?? 0;
+  }
+  if (comments > TODOS_TASK_MANIFEST_BOUNDS.comments || verifications > TODOS_TASK_MANIFEST_BOUNDS.verifications) {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_BOUNDS_EXCEEDED", "Task manifest nested resource bounds exceeded", {
+      comments,
+      verifications
+    });
+  }
+  const seenDependencies = new Set;
+  const dependencyGraph = new Map;
+  for (const edge of parsed.data.dependencies ?? []) {
+    if (!taskKeys.has(edge.task) || !taskKeys.has(edge.depends_on)) {
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_FOREIGN_REFERENCE", `Dependency contains foreign task key: ${edge.task} -> ${edge.depends_on}`);
+    }
+    if (edge.task === edge.depends_on) {
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", `Task ${edge.task} cannot depend on itself`);
+    }
+    const identity = `${edge.task}\x1F${edge.depends_on}`;
+    if (seenDependencies.has(identity)) {
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", `Duplicate dependency: ${edge.task} -> ${edge.depends_on}`);
+    }
+    seenDependencies.add(identity);
+    const prerequisites = dependencyGraph.get(edge.task) ?? [];
+    prerequisites.push(edge.depends_on);
+    dependencyGraph.set(edge.task, prerequisites);
+  }
+  const visiting = new Set;
+  const visited = new Set;
+  const visit = (taskKey) => {
+    if (visiting.has(taskKey)) {
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", `Dependency cycle contains task ${taskKey}`);
+    }
+    if (visited.has(taskKey))
+      return;
+    visiting.add(taskKey);
+    for (const prerequisite of dependencyGraph.get(taskKey) ?? [])
+      visit(prerequisite);
+    visiting.delete(taskKey);
+    visited.add(taskKey);
+  };
+  for (const taskKey of taskKeys)
+    visit(taskKey);
+  return parsed.data;
+}
+function parseTodosTaskManifestCompensation(input) {
+  const parsed = compensationSchema.safeParse(input);
+  if (!parsed.success) {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", `Invalid task-manifest compensation: ${parsed.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`, { issues: parsed.error.issues });
+  }
+  return parsed.data;
+}
+function parseTodosTaskManifestBindingLookup(input) {
+  const parsed = bindingLookupSchema.safeParse(input);
+  if (!parsed.success) {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", `Invalid task-manifest binding lookup: ${parsed.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`, { issues: parsed.error.issues });
+  }
+  return parsed.data;
+}
+var TODOS_TASK_MANIFEST_BOUNDS, key, identifier, uuid2, scalar, boundedScalarRecord = (limit, field) => exports_external.record(exports_external.string().max(200), scalar).superRefine((value, context) => {
+  if (Object.keys(value).length > limit) {
+    context.addIssue({ code: exports_external.ZodIssueCode.custom, message: `${field} exceeds ${limit} fields` });
+  }
+}), comment, verification, task2, dependency, effect, schema, compensationSchema, bindingLookupSchema;
+var init_schema2 = __esm(() => {
+  init_zod();
+  init_types();
+  init_types5();
+  TODOS_TASK_MANIFEST_BOUNDS = {
+    tasks: 128,
+    dependencies: 512,
+    comments: 512,
+    verifications: 512,
+    effects: 64,
+    metadata_fields: 128,
+    effect_payload_fields: 128,
+    request_bytes: 16777216,
+    response_bytes: 1048576
+  };
+  key = exports_external.string().min(1).max(96).regex(/^[a-z][a-z0-9_-]*$/);
+  identifier = exports_external.string().min(1).max(200).regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/);
+  uuid2 = exports_external.string().uuid();
+  scalar = exports_external.union([exports_external.string().max(4096), exports_external.number().finite(), exports_external.boolean(), exports_external.null()]);
+  comment = exports_external.object({
+    content: exports_external.string().min(1).max(16384),
+    type: exports_external.enum(["comment", "progress", "status_change", "system"]).optional(),
+    progress_pct: exports_external.number().int().min(0).max(100).optional(),
+    agent_id: identifier.optional(),
+    session_id: identifier.optional()
+  }).strict();
+  verification = exports_external.object({
+    command: exports_external.string().min(1).max(8192),
+    status: exports_external.enum(["passed", "failed", "unknown"]).optional(),
+    output_summary: exports_external.string().max(16384).optional(),
+    artifact_path: exports_external.string().max(4096).optional(),
+    agent_id: identifier.optional()
+  }).strict();
+  task2 = exports_external.object({
+    key,
+    title: exports_external.string().min(1).max(500),
+    description: exports_external.string().max(64000).optional(),
+    status: exports_external.enum(TASK_STATUSES).optional(),
+    priority: exports_external.enum(TASK_PRIORITIES).optional(),
+    assigned_to: identifier.optional(),
+    created_by: identifier.optional(),
+    tags: exports_external.array(exports_external.string().min(1).max(100)).max(64).optional(),
+    metadata: boundedScalarRecord(TODOS_TASK_MANIFEST_BOUNDS.metadata_fields, "metadata").optional(),
+    comments: exports_external.array(comment).max(64).optional(),
+    verifications: exports_external.array(verification).max(64).optional()
+  }).strict();
+  dependency = exports_external.object({ task: key, depends_on: key }).strict();
+  effect = exports_external.object({
+    topic: exports_external.string().min(1).max(200),
+    payload: boundedScalarRecord(TODOS_TASK_MANIFEST_BOUNDS.effect_payload_fields, "effect payload")
+  }).strict();
+  schema = exports_external.object({
+    version: exports_external.literal(1),
+    operation_id: identifier,
+    idempotency_key: identifier,
+    project_id: uuid2,
+    task_list_id: uuid2.optional(),
+    if_binding_version: exports_external.number().int().min(0).optional(),
+    plan: exports_external.object({
+      key,
+      name: exports_external.string().min(1).max(500),
+      description: exports_external.string().max(64000).optional(),
+      status: exports_external.enum(["active", "completed", "archived"]).optional()
+    }).strict(),
+    tasks: exports_external.array(task2).min(1).max(TODOS_TASK_MANIFEST_BOUNDS.tasks),
+    dependencies: exports_external.array(dependency).max(TODOS_TASK_MANIFEST_BOUNDS.dependencies).optional(),
+    effects: exports_external.array(effect).max(TODOS_TASK_MANIFEST_BOUNDS.effects).optional()
+  }).strict();
+  compensationSchema = exports_external.object({
+    receipt_id: uuid2,
+    idempotency_key: identifier,
+    if_binding_version: exports_external.number().int().min(1).max(Number.MAX_SAFE_INTEGER)
+  }).strict();
+  bindingLookupSchema = exports_external.object({
+    authority: exports_external.string().min(1).max(64),
+    route: exports_external.string().min(1).max(128),
+    schema_version: exports_external.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+    tenant_id: identifier,
+    plan_id: uuid2,
+    max_items: exports_external.number().int().min(1).max(Number.MAX_SAFE_INTEGER)
+  }).strict();
+});
+
+// src/task-manifest/backend.ts
+function validateTaskManifestBindingLookupRows(rows, tenantId, planId) {
+  if (rows.length === 0) {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_BINDING_NOT_FOUND", `Managed task-manifest binding not found for plan: ${planId}`, { plan_id: planId });
+  }
+  if (rows.length !== 1) {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_LOOKUP_CONFLICT", "Task-manifest plan lookup matched more than one binding", { plan_id: planId, matched_items: rows.length, max_items: 1 });
+  }
+  const row = rows[0];
+  const bindingVersion = Number(row.binding_version);
+  const state = row.state;
+  if (row.binding_tenant_id !== tenantId || row.receipt_tenant_id !== tenantId || row.binding_plan_id !== planId || row.receipt_plan_id !== planId || row.receipt_authority !== "todos" || row.receipt_route !== "todos.task-manifest.v1" || Number(row.receipt_schema_version) !== 1 || row.receipt_kind !== "apply" || row.binding_operation_id !== row.receipt_operation_id || typeof row.apply_receipt_id !== "string" || !UUID_PATTERN2.test(row.apply_receipt_id) || !Number.isSafeInteger(bindingVersion) || bindingVersion < 1 || state !== "applied" && state !== "compensated") {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_LOOKUP_CONFLICT", "Task-manifest binding and immutable apply receipt disagree", { plan_id: planId });
+  }
+  return {
+    plan_id: planId,
+    apply_receipt_id: row.apply_receipt_id,
+    binding_version: bindingVersion,
+    state
+  };
+}
+var UUID_PATTERN2;
+var init_backend = __esm(() => {
+  init_types5();
+  UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+});
+
+// src/task-manifest/reference-guard.ts
+function postgresTaskManifestForeignReferenceSql(tableName) {
+  return `SELECT object_type, object_id
+    FROM ${tableName}
+    WHERE service = $1 AND deleted_at IS NULL
+      AND NOT (object_type = 'plans' AND object_id = $2)
+      AND NOT (object_type = 'tasks' AND object_id IN (
+        SELECT value FROM jsonb_array_elements_text($3::jsonb)
+      ))
+      AND NOT (object_type = 'dependencies' AND object_id IN (
+        SELECT value FROM jsonb_array_elements_text($4::jsonb)
+      ))
+      AND NOT (object_type = 'comments' AND object_id IN (
+        SELECT value FROM jsonb_array_elements_text($5::jsonb)
+      ))
+      AND NOT (object_type = 'verifications' AND object_id IN (
+        SELECT value FROM jsonb_array_elements_text($6::jsonb)
+      ))
+      AND jsonb_path_exists(
+        payload,
+        '$.** ? (@ == $refs[*])',
+        jsonb_build_object('refs', $7::jsonb)
+      )
+    LIMIT 1`;
+}
+
+// src/task-manifest/schema-sql.ts
+function sqlString(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
+function postgresTodosTaskManifestSchemaSql(tenantId = "default") {
+  const tenantDefault = sqlString(tenantId);
+  return [
+    `CREATE TABLE IF NOT EXISTS todos_task_manifest_receipts (
+      receipt_id text PRIMARY KEY,
+      tenant_id text NOT NULL,
+      authority text NOT NULL CHECK(authority = 'todos'),
+      route text NOT NULL,
+      schema_version integer NOT NULL CHECK(schema_version = 1),
+      kind text NOT NULL CHECK(kind IN ('apply', 'compensate')),
+      operation_id text NOT NULL,
+      idempotency_key text NOT NULL,
+      request_digest text NOT NULL,
+      result_digest text NOT NULL,
+      binding_version integer NOT NULL,
+      apply_receipt_id text,
+      manifest_json jsonb,
+      result_json jsonb NOT NULL,
+      created_at timestamptz NOT NULL,
+      UNIQUE(kind, idempotency_key)
+    )`,
+    `ALTER TABLE todos_task_manifest_receipts
+      ADD COLUMN IF NOT EXISTS tenant_id text NOT NULL DEFAULT ${tenantDefault}`,
+    `ALTER TABLE todos_task_manifest_receipts
+      ALTER COLUMN tenant_id DROP DEFAULT`,
+    `CREATE TABLE IF NOT EXISTS todos_task_manifest_bindings (
+      operation_id text PRIMARY KEY,
+      tenant_id text NOT NULL,
+      idempotency_key text NOT NULL UNIQUE,
+      request_digest text NOT NULL,
+      result_digest text NOT NULL,
+      apply_receipt_id text NOT NULL UNIQUE REFERENCES todos_task_manifest_receipts(receipt_id),
+      manifest_json jsonb NOT NULL,
+      result_json jsonb NOT NULL,
+      state text NOT NULL CHECK(state IN ('applied', 'compensated')),
+      version integer NOT NULL,
+      compensation_receipt_id text,
+      created_at timestamptz NOT NULL,
+      updated_at timestamptz NOT NULL
+    )`,
+    `ALTER TABLE todos_task_manifest_bindings
+      ADD COLUMN IF NOT EXISTS tenant_id text NOT NULL DEFAULT ${tenantDefault}`,
+    `ALTER TABLE todos_task_manifest_bindings
+      ALTER COLUMN tenant_id DROP DEFAULT`,
+    `CREATE TABLE IF NOT EXISTS todos_task_manifest_outbox (
+      id text PRIMARY KEY,
+      apply_receipt_id text NOT NULL REFERENCES todos_task_manifest_receipts(receipt_id),
+      topic text NOT NULL,
+      payload jsonb NOT NULL,
+      payload_digest text NOT NULL,
+      status text NOT NULL CHECK(status IN ('pending', 'delivered', 'cancelled')),
+      attempts integer NOT NULL DEFAULT 0,
+      created_at timestamptz NOT NULL,
+      delivered_at timestamptz
+    )`,
+    `CREATE INDEX IF NOT EXISTS todos_task_manifest_outbox_receipt_idx
+      ON todos_task_manifest_outbox(apply_receipt_id, status)`,
+    `CREATE INDEX IF NOT EXISTS todos_task_manifest_receipts_tenant_idx
+      ON todos_task_manifest_receipts(tenant_id, receipt_id, kind)`,
+    `CREATE INDEX IF NOT EXISTS todos_task_manifest_bindings_tenant_plan_idx
+      ON todos_task_manifest_bindings(
+        tenant_id,
+        ((result_json #>> '{graph,plan_id}'))
+      )`,
+    `CREATE OR REPLACE FUNCTION todos_task_manifest_receipts_immutable()
+      RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN
+        RAISE EXCEPTION 'todos task manifest receipts are immutable';
+      END; $$`,
+    `DROP TRIGGER IF EXISTS todos_task_manifest_receipts_immutable ON todos_task_manifest_receipts`,
+    `CREATE TRIGGER todos_task_manifest_receipts_immutable
+      BEFORE UPDATE OR DELETE ON todos_task_manifest_receipts
+      FOR EACH ROW EXECUTE FUNCTION todos_task_manifest_receipts_immutable()`
+  ];
+}
+
+// src/task-manifest/sqlite.ts
+var sqliteTails;
+var init_sqlite2 = __esm(() => {
+  init_canonical();
+  init_backend();
+  init_types5();
+  sqliteTails = new WeakMap;
+});
+
+// src/task-manifest/postgres.ts
+function safeIdentifier2(value, field) {
+  if (!/^[a-z_][a-z0-9_]*$/.test(value)) {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", `${field} must be a safe PostgreSQL identifier`);
+  }
+  return value;
+}
+function parseJson2(value) {
+  return typeof value === "string" ? JSON.parse(value) : value;
+}
+function timestamp4(value) {
+  return value instanceof Date ? value.toISOString() : new Date(String(value)).toISOString();
+}
+function fault(faults, point) {
+  if (faults.points.has(point))
+    throw new Error(`Injected task-manifest fault at ${point}`);
+}
+function receiptFromRow3(row) {
+  return {
+    receipt_id: String(row["receipt_id"]),
+    authority: "todos",
+    route: "todos.task-manifest.v1",
+    schema_version: 1,
+    kind: row["kind"],
+    operation_id: String(row["operation_id"]),
+    idempotency_key: String(row["idempotency_key"]),
+    request_digest: String(row["request_digest"]),
+    result_digest: String(row["result_digest"]),
+    binding_version: Number(row["binding_version"]),
+    apply_receipt_id: row["apply_receipt_id"] == null ? null : String(row["apply_receipt_id"]),
+    created_at: timestamp4(row["created_at"])
+  };
+}
+function taskPayload2(manifest, task3, taskId, planId, now4) {
+  return {
+    id: taskId,
+    short_id: null,
+    project_id: manifest.project_id,
+    parent_id: null,
+    plan_id: planId,
+    task_list_id: manifest.task_list_id ?? null,
+    title: task3.title,
+    description: task3.description ?? null,
+    status: task3.status ?? "pending",
+    priority: task3.priority ?? "medium",
+    agent_id: null,
+    assigned_to: task3.assigned_to ?? null,
+    session_id: null,
+    working_dir: null,
+    tags: task3.tags ?? [],
+    metadata: task3.metadata ?? {},
+    version: 1,
+    locked_by: null,
+    locked_at: null,
+    created_at: now4,
+    updated_at: now4,
+    started_at: null,
+    completed_at: null,
+    due_at: null,
+    estimated_minutes: null,
+    actual_minutes: null,
+    requires_approval: false,
+    approved_by: null,
+    approved_at: null,
+    recurrence_rule: null,
+    recurrence_parent_id: null,
+    spawns_template_id: null,
+    confidence: null,
+    reason: null,
+    spawned_from_session: null,
+    assigned_by: null,
+    created_by: task3.created_by ?? null,
+    assigned_from_project: null,
+    task_type: null,
+    cost_tokens: 0,
+    cost_usd: 0,
+    delegated_from: null,
+    delegation_depth: 0,
+    retry_count: 0,
+    max_retries: 0,
+    retry_after: null,
+    sla_minutes: null,
+    runner_id: null,
+    runner_started_at: null,
+    runner_completed_at: null,
+    current_step: null,
+    total_steps: null,
+    machine_id: null,
+    synced_at: null,
+    archived_at: null
+  };
+}
+function planPayload(input) {
+  return {
+    id: input.graph.plan_id,
+    slug: null,
+    project_id: input.manifest.project_id,
+    task_list_id: input.manifest.task_list_id ?? null,
+    agent_id: null,
+    name: input.manifest.plan.name,
+    description: input.manifest.plan.description ?? null,
+    status: input.manifest.plan.status ?? "active",
+    created_at: input.now,
+    updated_at: input.now,
+    machine_id: null,
+    synced_at: null
+  };
+}
+function placeholders2(start, count2) {
+  return Array.from({ length: count2 }, (_, index) => `$${start + index}`).join(",");
+}
+
+class PostgresTodosTaskManifestBackend {
+  client;
+  kind = "postgresql";
+  service;
+  tableName;
+  tenantId;
+  schemaReady = null;
+  constructor(client, options = {}) {
+    this.client = client;
+    this.service = options.service ?? "todos";
+    this.tableName = safeIdentifier2(options.tableName ?? DEFAULT_TODOS_POSTGRES_SYNC_TABLE, "tableName");
+    this.tenantId = options.tenantId ?? "default";
+  }
+  async ensureSchema() {
+    this.schemaReady ??= (async () => {
+      for (const sql of postgresTodosSyncSchemaSql(this.tableName))
+        await this.client.query(sql);
+      for (const sql of postgresTodosTaskManifestSchemaSql(this.tenantId))
+        await this.client.query(sql);
+    })();
+    await this.schemaReady;
+  }
+  async insertSync(tx, objectType2, objectId, payload, now4) {
+    await tx.query(`INSERT INTO ${this.tableName} (
+      service, object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version
+    ) VALUES ($1, $2, $3, $4::jsonb, $5, NULL, NULL, 1)`, [
+      this.service,
+      objectType2,
+      objectId,
+      canonicalJson(payload),
+      now4
+    ]);
+  }
+  async apply(input, faults) {
+    await this.ensureSchema();
+    return this.client.transaction(async (tx) => {
+      const { manifest } = input;
+      await tx.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${this.service}\x1F${manifest.operation_id}`]);
+      await tx.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${this.service}\x1Fidempotency\x1F${manifest.idempotency_key}`]);
+      const existing = await tx.query("SELECT * FROM todos_task_manifest_bindings WHERE tenant_id = $1 AND operation_id = $2 LIMIT 1 FOR UPDATE", [this.tenantId, manifest.operation_id]);
+      if (existing.rows[0]) {
+        const binding = existing.rows[0];
+        if (binding["idempotency_key"] !== manifest.idempotency_key || binding["request_digest"] !== input.request_digest) {
+          throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_IDEMPOTENCY_CONFLICT", "Operation is already bound to a different request");
+        }
+        if (binding["state"] !== "applied") {
+          throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", "Operation was already compensated");
+        }
+        return { ...parseJson2(binding["result_json"]), duplicate: true };
+      }
+      const reused = await tx.query("SELECT operation_id FROM todos_task_manifest_bindings WHERE tenant_id = $1 AND idempotency_key = $2 LIMIT 1", [this.tenantId, manifest.idempotency_key]);
+      if (reused.rows[0])
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_IDEMPOTENCY_CONFLICT", "Idempotency key is already used");
+      if (manifest.if_binding_version !== undefined && manifest.if_binding_version !== 0) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_CAS_CONFLICT", "New manifest binding version must be 0");
+      }
+      const project = await tx.query(`SELECT 1 AS found FROM ${this.tableName}
+        WHERE service = $1 AND object_type = 'projects' AND object_id = $2 AND deleted_at IS NULL LIMIT 1`, [this.service, manifest.project_id]);
+      if (!project.rows[0])
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_FOREIGN_REFERENCE", "Project does not exist");
+      if (manifest.task_list_id) {
+        const taskList = await tx.query(`SELECT payload FROM ${this.tableName}
+          WHERE service = $1 AND object_type = 'task_lists' AND object_id = $2 AND deleted_at IS NULL LIMIT 1`, [this.service, manifest.task_list_id]);
+        const payload = taskList.rows[0] ? parseJson2(taskList.rows[0]["payload"]) : null;
+        if (!payload || payload["project_id"] !== manifest.project_id) {
+          throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_FOREIGN_REFERENCE", "Task list does not belong to the project");
+        }
+      }
+      const objectIds = [input.graph.plan_id, ...Object.values(input.graph.task_ids), ...input.graph.comment_ids, ...input.graph.verification_ids, ...input.graph.dependency_ids];
+      const conflict = await tx.query(`SELECT object_id FROM ${this.tableName}
+        WHERE service = $1 AND object_id IN (${placeholders2(2, objectIds.length)}) LIMIT 1`, [this.service, ...objectIds]);
+      if (conflict.rows[0])
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", "A deterministic graph id already exists");
+      await this.insertSync(tx, "plans", input.graph.plan_id, planPayload(input), input.now);
+      fault(faults, "after_plan_write");
+      for (const task3 of manifest.tasks) {
+        await this.insertSync(tx, "tasks", input.graph.task_ids[task3.key], taskPayload2(manifest, task3, input.graph.task_ids[task3.key], input.graph.plan_id, input.now), input.now);
+      }
+      fault(faults, "after_task_write");
+      for (const [index, edge] of (manifest.dependencies ?? []).entries()) {
+        await this.insertSync(tx, "dependencies", input.graph.dependency_ids[index], {
+          id: input.graph.dependency_ids[index],
+          task_id: input.graph.task_ids[edge.task],
+          depends_on: input.graph.task_ids[edge.depends_on],
+          created_at: input.now,
+          updated_at: input.now
+        }, input.now);
+      }
+      fault(faults, "after_dependency_write");
+      let commentIndex = 0;
+      for (const task3 of manifest.tasks)
+        for (const comment2 of task3.comments ?? []) {
+          const id = input.graph.comment_ids[commentIndex++];
+          await this.insertSync(tx, "comments", id, {
+            id,
+            task_id: input.graph.task_ids[task3.key],
+            agent_id: comment2.agent_id ?? null,
+            session_id: comment2.session_id ?? null,
+            content: comment2.content,
+            type: comment2.type ?? "comment",
+            progress_pct: comment2.progress_pct ?? null,
+            created_at: input.now
+          }, input.now);
+        }
+      fault(faults, "after_comment_write");
+      let verificationIndex = 0;
+      for (const task3 of manifest.tasks)
+        for (const verification2 of task3.verifications ?? []) {
+          const id = input.graph.verification_ids[verificationIndex++];
+          await this.insertSync(tx, "verifications", id, {
+            id,
+            task_id: input.graph.task_ids[task3.key],
+            command: verification2.command,
+            status: verification2.status ?? "unknown",
+            output_summary: verification2.output_summary ?? null,
+            artifact_path: verification2.artifact_path ?? null,
+            agent_id: verification2.agent_id ?? null,
+            run_at: input.now,
+            created_at: input.now,
+            updated_at: input.now
+          }, input.now);
+        }
+      fault(faults, "after_verification_write");
+      const readback = await this.readback(tx, input.graph);
+      const expected = {
+        plans: 1,
+        tasks: manifest.tasks.length,
+        dependencies: manifest.dependencies?.length ?? 0,
+        comments: input.graph.comment_ids.length,
+        verifications: input.graph.verification_ids.length,
+        complete: true
+      };
+      if (canonicalJson(readback) !== canonicalJson(expected)) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_READBACK_MISMATCH", "Exact PostgreSQL graph readback did not match", { expected, readback });
+      }
+      const receipt = {
+        receipt_id: input.receipt_id,
+        authority: "todos",
+        route: "todos.task-manifest.v1",
+        schema_version: 1,
+        kind: "apply",
+        operation_id: manifest.operation_id,
+        idempotency_key: manifest.idempotency_key,
+        request_digest: input.request_digest,
+        result_digest: input.result_digest,
+        binding_version: 1,
+        apply_receipt_id: null,
+        created_at: input.now
+      };
+      const result = {
+        duplicate: false,
+        receipt,
+        graph: input.graph,
+        readback,
+        outbox_ids: input.outbox.map((entry2) => entry2.id),
+        result_digest: input.result_digest
+      };
+      const manifestJson = canonicalJson(manifest);
+      const resultJson = canonicalJson(result);
+      await tx.query(`INSERT INTO todos_task_manifest_receipts (
+        receipt_id, tenant_id, authority, route, schema_version, kind, operation_id, idempotency_key,
+        request_digest, result_digest, binding_version, apply_receipt_id, manifest_json, result_json, created_at
+      ) VALUES ($1, $2, 'todos', 'todos.task-manifest.v1', 1, 'apply', $3, $4, $5, $6, 1, NULL, $7::jsonb, $8::jsonb, $9)`, [
+        input.receipt_id,
+        this.tenantId,
+        manifest.operation_id,
+        manifest.idempotency_key,
+        input.request_digest,
+        input.result_digest,
+        manifestJson,
+        resultJson,
+        input.now
+      ]);
+      for (const entry2 of input.outbox) {
+        await tx.query(`INSERT INTO todos_task_manifest_outbox (
+          id, apply_receipt_id, topic, payload, payload_digest, status, created_at
+        ) VALUES ($1, $2, $3, $4::jsonb, $5, 'pending', $6)`, [
+          entry2.id,
+          input.receipt_id,
+          entry2.topic,
+          canonicalJson(entry2.payload),
+          entry2.digest,
+          input.now
+        ]);
+      }
+      fault(faults, "after_outbox_write");
+      await tx.query(`INSERT INTO todos_task_manifest_bindings (
+        operation_id, tenant_id, idempotency_key, request_digest, result_digest, apply_receipt_id,
+        manifest_json, result_json, state, version, created_at, updated_at
+      ) VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8::jsonb, 'applied', 1, $9, $9)`, [
+        manifest.operation_id,
+        this.tenantId,
+        manifest.idempotency_key,
+        input.request_digest,
+        input.result_digest,
+        input.receipt_id,
+        manifestJson,
+        resultJson,
+        input.now
+      ]);
+      fault(faults, "after_receipt_write");
+      return result;
+    });
+  }
+  async readExact(receiptId2) {
+    await this.ensureSchema();
+    const result = await this.client.query("SELECT result_json FROM todos_task_manifest_receipts WHERE tenant_id = $1 AND receipt_id = $2 AND kind = 'apply' LIMIT 1", [this.tenantId, receiptId2]);
+    if (!result.rows[0])
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_RECEIPT_NOT_FOUND", `Apply receipt not found: ${receiptId2}`);
+    return { ...parseJson2(result.rows[0]["result_json"]), duplicate: false };
+  }
+  async lookupBindingByPlanId(planId) {
+    await this.ensureSchema();
+    const result = await this.client.query(`
+      SELECT
+        b.apply_receipt_id AS apply_receipt_id,
+        b.state AS state,
+        b.version AS binding_version,
+        b.tenant_id AS binding_tenant_id,
+        b.operation_id AS binding_operation_id,
+        b.result_json #>> '{graph,plan_id}' AS binding_plan_id,
+        r.tenant_id AS receipt_tenant_id,
+        r.authority AS receipt_authority,
+        r.route AS receipt_route,
+        r.schema_version AS receipt_schema_version,
+        r.kind AS receipt_kind,
+        r.operation_id AS receipt_operation_id,
+        r.result_json #>> '{graph,plan_id}' AS receipt_plan_id
+      FROM todos_task_manifest_bindings b
+      LEFT JOIN todos_task_manifest_receipts r
+        ON r.receipt_id = b.apply_receipt_id
+        AND r.tenant_id = b.tenant_id
+      WHERE b.tenant_id = $1
+        AND b.result_json #>> '{graph,plan_id}' = $2
+      LIMIT 2
+    `, [this.tenantId, planId]);
+    return validateTaskManifestBindingLookupRows(result.rows, this.tenantId, planId);
+  }
+  async markOutboxDelivered(outboxId, deliveredAt) {
+    await this.ensureSchema();
+    await this.client.transaction(async (tx) => {
+      const owned = await tx.query(`SELECT r.operation_id
+         FROM todos_task_manifest_outbox o
+         JOIN todos_task_manifest_receipts r
+           ON r.receipt_id = o.apply_receipt_id
+         WHERE r.tenant_id = $1
+           AND r.authority = 'todos'
+           AND r.route = 'todos.task-manifest.v1'
+           AND r.schema_version = 1
+           AND r.kind = 'apply'
+           AND o.id = $2
+         LIMIT 1`, [this.tenantId, outboxId]);
+      const operationId = owned.rows[0]?.operation_id;
+      if (operationId == null) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", `Pending outbox row not found: ${outboxId}`);
+      }
+      await tx.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${this.service}\x1F${String(operationId)}`]);
+      const result = await tx.query(`UPDATE todos_task_manifest_outbox
+        SET status = 'delivered', delivered_at = $1, attempts = attempts + 1
+        WHERE id = $2 AND status = 'pending'
+          AND EXISTS (
+            SELECT 1 FROM todos_task_manifest_receipts r
+            WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
+              AND r.tenant_id = $3
+              AND r.authority = 'todos'
+              AND r.route = 'todos.task-manifest.v1'
+              AND r.schema_version = 1
+              AND r.kind = 'apply'
+          )
+        RETURNING id`, [deliveredAt, outboxId, this.tenantId]);
+      if (result.rows[0])
+        return;
+      const existing = await tx.query(`SELECT o.status
+         FROM todos_task_manifest_outbox o
+         JOIN todos_task_manifest_receipts r
+           ON r.receipt_id = o.apply_receipt_id
+         WHERE r.tenant_id = $1
+           AND r.authority = 'todos'
+           AND r.route = 'todos.task-manifest.v1'
+           AND r.schema_version = 1
+           AND r.kind = 'apply'
+           AND o.id = $2
+         LIMIT 1`, [this.tenantId, outboxId]);
+      if (existing.rows[0]?.status === "delivered")
+        return;
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", `Pending outbox row not found: ${outboxId}`);
+    });
+  }
+  async compensate(input, receipt, compensationReceiptId, requestDigest, now4) {
+    await this.ensureSchema();
+    return this.client.transaction(async (tx) => {
+      await tx.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${this.service}\x1F${receipt.operation_id}`]);
+      await tx.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${this.service}\x1Fcompensation-idempotency\x1F${input.idempotency_key}`]);
+      const previous = await tx.query(`SELECT apply_receipt_id, request_digest, result_json
+         FROM todos_task_manifest_receipts
+         WHERE tenant_id = $1 AND kind = 'compensate' AND idempotency_key = $2
+         LIMIT 1`, [this.tenantId, input.idempotency_key]);
+      if (previous.rows[0]) {
+        const row = previous.rows[0];
+        if (row["apply_receipt_id"] !== input.receipt_id || row["request_digest"] !== requestDigest) {
+          throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_IDEMPOTENCY_CONFLICT", "Compensation idempotency key is already used");
+        }
+        return { ...parseJson2(row["result_json"]), duplicate: true };
+      }
+      const applyRows = await tx.query("SELECT * FROM todos_task_manifest_receipts WHERE tenant_id = $1 AND receipt_id = $2 AND kind = 'apply' LIMIT 1", [this.tenantId, input.receipt_id]);
+      const applyRow = applyRows.rows[0];
+      if (!applyRow)
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_RECEIPT_NOT_FOUND", "Apply receipt not found");
+      const bindingRows = await tx.query("SELECT * FROM todos_task_manifest_bindings WHERE tenant_id = $1 AND operation_id = $2 LIMIT 1 FOR UPDATE", [this.tenantId, receipt.operation_id]);
+      const binding = bindingRows.rows[0];
+      if (!binding || Number(binding["version"]) !== input.if_binding_version) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_CAS_CONFLICT", "Binding version changed before compensation");
+      }
+      if (binding["state"] !== "applied")
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Graph is not applied");
+      const delivered = await tx.query(`SELECT o.id FROM todos_task_manifest_outbox o
+         JOIN todos_task_manifest_receipts r ON r.receipt_id = o.apply_receipt_id
+         WHERE r.tenant_id = $1
+           AND r.authority = 'todos'
+           AND r.route = 'todos.task-manifest.v1'
+           AND r.schema_version = 1
+           AND r.kind = 'apply'
+           AND o.apply_receipt_id = $2
+           AND o.status = 'delivered'
+         LIMIT 1`, [this.tenantId, input.receipt_id]);
+      if (delivered.rows[0])
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: delivered outbox row exists");
+      const applyResult = parseJson2(applyRow["result_json"]);
+      const manifest = parseJson2(applyRow["manifest_json"]);
+      const expectedEffects = [
+        {
+          topic: "todos.task-manifest.applied",
+          payload: { operation_id: manifest.operation_id, project_id: manifest.project_id }
+        },
+        ...(manifest.effects ?? []).map((effect2) => ({ topic: effect2.topic, payload: effect2.payload }))
+      ];
+      const outboxRows = await tx.query(`SELECT o.id, o.topic, o.payload, o.payload_digest, o.status, o.attempts, o.delivered_at
+        FROM todos_task_manifest_outbox o
+        WHERE o.apply_receipt_id = $1
+          AND EXISTS (
+            SELECT 1 FROM todos_task_manifest_receipts r
+            WHERE r.receipt_id = o.apply_receipt_id
+              AND r.tenant_id = $2
+              AND r.authority = 'todos'
+              AND r.route = 'todos.task-manifest.v1'
+              AND r.schema_version = 1
+              AND r.kind = 'apply'
+          )
+        ORDER BY o.id
+        FOR UPDATE OF o`, [input.receipt_id, this.tenantId]);
+      if (outboxRows.rows.length !== expectedEffects.length) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: outbox changed since apply");
+      }
+      const outboxById = new Map(outboxRows.rows.map((entry2) => [String(entry2["id"]), entry2]));
+      for (const [index, expectedEffect] of expectedEffects.entries()) {
+        const stored2 = outboxById.get(applyResult.outbox_ids[index]);
+        if (!stored2 || stored2["topic"] !== expectedEffect.topic || canonicalJson(parseJson2(stored2["payload"])) !== canonicalJson(expectedEffect.payload) || stored2["payload_digest"] !== canonicalDigest(expectedEffect) || stored2["status"] !== "pending" || Number(stored2["attempts"]) !== 0 || stored2["delivered_at"] != null) {
+          throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: outbox changed since apply");
+        }
+      }
+      const taskIds = Object.values(applyResult.graph.task_ids);
+      const foreignReference = await tx.query(postgresTaskManifestForeignReferenceSql(this.tableName), [
+        this.service,
+        applyResult.graph.plan_id,
+        taskIds,
+        applyResult.graph.dependency_ids,
+        applyResult.graph.comment_ids,
+        applyResult.graph.verification_ids,
+        [applyResult.graph.plan_id, ...taskIds]
+      ]);
+      if (foreignReference.rows[0]) {
+        const row = foreignReference.rows[0];
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", `Compensation refused: foreign reference in ${String(row["object_type"])}:${String(row["object_id"])} would be changed`, row);
+      }
+      const actualReadback = await this.readback(tx, applyResult.graph);
+      if (canonicalJson(actualReadback) !== canonicalJson(applyResult.readback)) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: graph changed since apply");
+      }
+      const appliedAt = receiptFromRow3(applyRow).created_at;
+      const expectedPayloads = new Map;
+      expectedPayloads.set(applyResult.graph.plan_id, {
+        type: "plans",
+        payload: canonicalJson(planPayload({ manifest, graph: applyResult.graph, now: appliedAt }))
+      });
+      for (const task3 of manifest.tasks)
+        expectedPayloads.set(applyResult.graph.task_ids[task3.key], {
+          type: "tasks",
+          payload: canonicalJson(taskPayload2(manifest, task3, applyResult.graph.task_ids[task3.key], applyResult.graph.plan_id, appliedAt))
+        });
+      for (const [index, edge] of (manifest.dependencies ?? []).entries())
+        expectedPayloads.set(applyResult.graph.dependency_ids[index], {
+          type: "dependencies",
+          payload: canonicalJson({
+            id: applyResult.graph.dependency_ids[index],
+            task_id: applyResult.graph.task_ids[edge.task],
+            depends_on: applyResult.graph.task_ids[edge.depends_on],
+            created_at: appliedAt,
+            updated_at: appliedAt
+          })
+        });
+      let expectedCommentIndex = 0;
+      for (const task3 of manifest.tasks)
+        for (const comment2 of task3.comments ?? []) {
+          const id = applyResult.graph.comment_ids[expectedCommentIndex++];
+          expectedPayloads.set(id, {
+            type: "comments",
+            payload: canonicalJson({
+              id,
+              task_id: applyResult.graph.task_ids[task3.key],
+              agent_id: comment2.agent_id ?? null,
+              session_id: comment2.session_id ?? null,
+              content: comment2.content,
+              type: comment2.type ?? "comment",
+              progress_pct: comment2.progress_pct ?? null,
+              created_at: appliedAt
+            })
+          });
+        }
+      let expectedVerificationIndex = 0;
+      for (const task3 of manifest.tasks)
+        for (const verification2 of task3.verifications ?? []) {
+          const id = applyResult.graph.verification_ids[expectedVerificationIndex++];
+          expectedPayloads.set(id, {
+            type: "verifications",
+            payload: canonicalJson({
+              id,
+              task_id: applyResult.graph.task_ids[task3.key],
+              command: verification2.command,
+              status: verification2.status ?? "unknown",
+              output_summary: verification2.output_summary ?? null,
+              artifact_path: verification2.artifact_path ?? null,
+              agent_id: verification2.agent_id ?? null,
+              run_at: appliedAt,
+              created_at: appliedAt,
+              updated_at: appliedAt
+            })
+          });
+        }
+      const managedIds = [...expectedPayloads.keys()];
+      const stored = await tx.query(`SELECT object_type, object_id, payload FROM ${this.tableName}
+        WHERE service = $1 AND object_id IN (${placeholders2(2, managedIds.length)})`, [this.service, ...managedIds]);
+      for (const row of stored.rows) {
+        const expected = expectedPayloads.get(String(row["object_id"]));
+        if (!expected || expected.type !== row["object_type"] || expected.payload !== canonicalJson(parseJson2(row["payload"]))) {
+          throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: managed graph values changed");
+        }
+      }
+      if (stored.rows.length !== managedIds.length)
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: managed graph is incomplete");
+      const cancelled = await tx.query(`UPDATE todos_task_manifest_outbox
+        SET status = 'cancelled'
+        WHERE apply_receipt_id = $1 AND status = 'pending'
+          AND EXISTS (
+            SELECT 1 FROM todos_task_manifest_receipts r
+            WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
+              AND r.tenant_id = $2
+              AND r.authority = 'todos'
+              AND r.route = 'todos.task-manifest.v1'
+              AND r.schema_version = 1
+              AND r.kind = 'apply'
+          )
+        RETURNING id`, [input.receipt_id, this.tenantId]);
+      const cancelledIds = new Set(cancelled.rows.map((row) => String(row.id)));
+      if (cancelledIds.size !== applyResult.outbox_ids.length || applyResult.outbox_ids.some((id) => !cancelledIds.has(id))) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: failed to cancel every expected outbox row");
+      }
+      const typedIds = [
+        ["dependencies", applyResult.graph.dependency_ids],
+        ["comments", applyResult.graph.comment_ids],
+        ["verifications", applyResult.graph.verification_ids],
+        ["tasks", taskIds],
+        ["plans", [applyResult.graph.plan_id]]
+      ];
+      for (const [objectType2, ids2] of typedIds) {
+        if (!ids2.length)
+          continue;
+        await tx.query(`DELETE FROM ${this.tableName} WHERE service = $1 AND object_type = $2
+          AND object_id IN (${placeholders2(3, ids2.length)})`, [this.service, objectType2, ...ids2]);
+      }
+      const readback = await this.readback(tx, applyResult.graph);
+      const result = { duplicate: false, receipt, absent: true, readback };
+      await tx.query(`INSERT INTO todos_task_manifest_receipts (
+        receipt_id, tenant_id, authority, route, schema_version, kind, operation_id, idempotency_key,
+        request_digest, result_digest, binding_version, apply_receipt_id, manifest_json, result_json, created_at
+      ) VALUES ($1, $2, 'todos', 'todos.task-manifest.v1', 1, 'compensate', $3, $4, $5, $6, $7, $8, NULL, $9::jsonb, $10)`, [
+        compensationReceiptId,
+        this.tenantId,
+        receipt.operation_id,
+        input.idempotency_key,
+        requestDigest,
+        receipt.result_digest,
+        receipt.binding_version,
+        input.receipt_id,
+        canonicalJson(result),
+        now4
+      ]);
+      const updated = await tx.query(`UPDATE todos_task_manifest_bindings
+        SET state = 'compensated', version = $1, compensation_receipt_id = $2, updated_at = $3
+        WHERE tenant_id = $4 AND operation_id = $5 AND state = 'applied' AND version = $6 RETURNING operation_id`, [
+        receipt.binding_version,
+        compensationReceiptId,
+        now4,
+        this.tenantId,
+        receipt.operation_id,
+        input.if_binding_version
+      ]);
+      if (!updated.rows[0])
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_CAS_CONFLICT", "Binding changed during compensation");
+      return result;
+    });
+  }
+  async readback(tx, graph) {
+    const count2 = async (objectType2, ids2) => {
+      if (!ids2.length)
+        return 0;
+      const result = await tx.query(`SELECT count(*) AS count FROM ${this.tableName}
+        WHERE service = $1 AND object_type = $2 AND deleted_at IS NULL
+          AND object_id IN (${placeholders2(3, ids2.length)})`, [this.service, objectType2, ...ids2]);
+      return Number(result.rows[0]?.count ?? 0);
+    };
+    return {
+      plans: await count2("plans", [graph.plan_id]),
+      tasks: await count2("tasks", Object.values(graph.task_ids)),
+      dependencies: await count2("dependencies", graph.dependency_ids),
+      comments: await count2("comments", graph.comment_ids),
+      verifications: await count2("verifications", graph.verification_ids),
+      complete: true
+    };
+  }
+}
+var init_postgres3 = __esm(() => {
+  init_canonical();
+  init_backend();
+  init_postgres_sync();
+  init_types5();
+});
+
+// src/task-manifest/authority.ts
+function resolveTenantId(value) {
+  const tenantId = value ?? "default";
+  if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/.test(tenantId)) {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", "tenantId must be a bounded exact authority identifier");
+  }
+  return tenantId;
+}
+function normalize(input, now4) {
+  const parsed = parseTodosTaskManifest(input);
+  const requestBytes = Buffer.byteLength(canonicalJson(parsed), "utf8");
+  if (requestBytes > TODOS_TASK_MANIFEST_BOUNDS.request_bytes) {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_BOUNDS_EXCEEDED", `Task manifest requires ${requestBytes} bytes but the bound is ${TODOS_TASK_MANIFEST_BOUNDS.request_bytes}`, { request_bytes: requestBytes, request_byte_limit: TODOS_TASK_MANIFEST_BOUNDS.request_bytes });
+  }
+  const manifest = sanitizeManifest(parsed);
+  const task_ids = Object.fromEntries(manifest.tasks.map((task3) => [
+    task3.key,
+    deterministicUuid(TODOS_TASK_MANIFEST_ROUTE, manifest.operation_id, "task", task3.key)
+  ]));
+  const graph = {
+    plan_id: deterministicUuid(TODOS_TASK_MANIFEST_ROUTE, manifest.operation_id, "plan", manifest.plan.key),
+    task_ids,
+    comment_ids: manifest.tasks.flatMap((task3) => (task3.comments ?? []).map((_, index) => deterministicUuid(TODOS_TASK_MANIFEST_ROUTE, manifest.operation_id, "comment", task3.key, String(index)))),
+    verification_ids: manifest.tasks.flatMap((task3) => (task3.verifications ?? []).map((_, index) => deterministicUuid(TODOS_TASK_MANIFEST_ROUTE, manifest.operation_id, "verification", task3.key, String(index)))),
+    dependency_ids: (manifest.dependencies ?? []).map((edge) => `${task_ids[edge.task]}::${task_ids[edge.depends_on]}`)
+  };
+  const request_digest = canonicalDigest(parsed);
+  const effectInputs = [
+    {
+      topic: "todos.task-manifest.applied",
+      payload: { operation_id: manifest.operation_id, project_id: manifest.project_id }
+    },
+    ...manifest.effects ?? []
+  ];
+  const outbox = effectInputs.map((effect2, index) => {
+    const payload = { ...effect2.payload };
+    return {
+      id: deterministicUuid(TODOS_TASK_MANIFEST_ROUTE, manifest.operation_id, "outbox", String(index)),
+      topic: effect2.topic,
+      payload,
+      digest: canonicalDigest({ topic: effect2.topic, payload })
+    };
+  });
+  const result_digest = canonicalDigest({ manifest, graph, outbox });
+  return {
+    manifest,
+    request_digest,
+    result_digest,
+    receipt_id: deterministicUuid(TODOS_TASK_MANIFEST_ROUTE, "apply", manifest.operation_id, manifest.idempotency_key, request_digest),
+    graph,
+    outbox,
+    now: now4
+  };
+}
+function sanitizeManifest(manifest) {
+  return {
+    ...manifest,
+    plan: {
+      ...manifest.plan,
+      name: sanitizePreWriteText(manifest.plan.name, "task_manifest.plan.name"),
+      ...manifest.plan.description !== undefined ? { description: sanitizePreWriteText(manifest.plan.description, "task_manifest.plan.description") } : {}
+    },
+    tasks: manifest.tasks.map((task3) => ({
+      ...task3,
+      title: sanitizePreWriteText(task3.title, `task_manifest.tasks.${task3.key}.title`),
+      ...task3.description !== undefined ? { description: sanitizePreWriteText(task3.description, `task_manifest.tasks.${task3.key}.description`) } : {},
+      ...task3.tags !== undefined ? { tags: sanitizePreWriteValue(task3.tags, `task_manifest.tasks.${task3.key}.tags`) } : {},
+      ...task3.metadata !== undefined ? { metadata: sanitizePreWriteValue(task3.metadata, `task_manifest.tasks.${task3.key}.metadata`) } : {},
+      ...task3.comments !== undefined ? {
+        comments: task3.comments.map((comment2, index) => ({
+          ...comment2,
+          content: sanitizePreWriteText(comment2.content, `task_manifest.tasks.${task3.key}.comments.${index}.content`)
+        }))
+      } : {},
+      ...task3.verifications !== undefined ? {
+        verifications: task3.verifications.map((verification2, index) => ({
+          ...verification2,
+          command: sanitizePreWriteText(verification2.command, `task_manifest.tasks.${task3.key}.verifications.${index}.command`),
+          ...verification2.output_summary !== undefined ? { output_summary: sanitizePreWriteText(verification2.output_summary, `task_manifest.tasks.${task3.key}.verifications.${index}.output_summary`) } : {},
+          ...verification2.artifact_path !== undefined ? { artifact_path: sanitizePreWriteText(verification2.artifact_path, `task_manifest.tasks.${task3.key}.verifications.${index}.artifact_path`) } : {}
+        }))
+      } : {}
+    })),
+    ...manifest.effects !== undefined ? {
+      effects: manifest.effects.map((effect2, index) => ({
+        topic: sanitizePreWriteText(effect2.topic, `task_manifest.effects.${index}.topic`),
+        payload: sanitizePreWriteValue(effect2.payload, `task_manifest.effects.${index}.payload`)
+      }))
+    } : {}
+  };
+}
+
+class PackageOwnedTodosTaskManifestAuthority {
+  backend;
+  options;
+  tenantId;
+  constructor(backend, options = {}) {
+    this.backend = backend;
+    this.options = options;
+    this.tenantId = resolveTenantId(options.tenantId);
+  }
+  async capability() {
+    return {
+      authority: "todos",
+      route: TODOS_TASK_MANIFEST_ROUTE,
+      schema_version: TODOS_TASK_MANIFEST_SCHEMA_VERSION,
+      tenant_id: this.tenantId,
+      backend: this.backend.kind,
+      deterministic_ids: true,
+      immutable_receipts: true,
+      transactional_outbox: true,
+      idempotent_outbox_delivery: true,
+      exact_bounded_readback: true,
+      conditional_compensation: true,
+      transcript_safe: false,
+      bounds: { ...TODOS_TASK_MANIFEST_BOUNDS }
+    };
+  }
+  now() {
+    const value = this.options.now?.() ?? new Date().toISOString();
+    if (!Number.isFinite(Date.parse(value))) {
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", "now() returned an invalid timestamp");
+    }
+    return value;
+  }
+  async prepareFaults() {
+    const points = new Set;
+    if (this.options.faultInjector) {
+      for (const point of FAULT_POINTS) {
+        if (await this.options.faultInjector(point) === true)
+          points.add(point);
+      }
+    }
+    return { points };
+  }
+  async apply(input) {
+    const normalized = normalize(input, this.now());
+    const faults = await this.prepareFaults();
+    return this.bounded(await this.backend.apply(normalized, faults));
+  }
+  readExact(receiptId2) {
+    if (!receiptId2 || receiptId2.length > 200) {
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", "receiptId must be a bounded exact identifier");
+    }
+    return this.backend.readExact(receiptId2).then((result) => this.bounded(result));
+  }
+  async lookupBinding(input) {
+    const request = parseTodosTaskManifestBindingLookup(input);
+    if (request.max_items !== 1) {
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_BOUNDS_EXCEEDED", "max_items must be exactly 1 for task-manifest binding lookup", { max_items: request.max_items, max_items_limit: 1 });
+    }
+    if (request.authority !== "todos" || request.route !== TODOS_TASK_MANIFEST_ROUTE || request.schema_version !== TODOS_TASK_MANIFEST_SCHEMA_VERSION || request.tenant_id !== this.tenantId) {
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_CAPABILITY_MISMATCH", "Task-manifest binding lookup does not match this authority identity");
+    }
+    return this.bounded({
+      authority: "todos",
+      route: TODOS_TASK_MANIFEST_ROUTE,
+      schema_version: TODOS_TASK_MANIFEST_SCHEMA_VERSION,
+      tenant_id: this.tenantId,
+      ...await this.backend.lookupBindingByPlanId(request.plan_id)
+    });
+  }
+  markOutboxDelivered(outboxId) {
+    if (!outboxId || outboxId.length > 200) {
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", "outboxId must be a bounded exact identifier");
+    }
+    return this.backend.markOutboxDelivered(outboxId, this.now());
+  }
+  async compensate(input) {
+    const request = parseTodosTaskManifestCompensation(input);
+    const applied = await this.backend.readExact(request.receipt_id);
+    const requestDigest = canonicalDigest(request);
+    const compensationReceiptId = deterministicUuid(TODOS_TASK_MANIFEST_ROUTE, "compensate", applied.receipt.operation_id, request.idempotency_key, requestDigest);
+    const receipt = {
+      receipt_id: compensationReceiptId,
+      authority: "todos",
+      route: TODOS_TASK_MANIFEST_ROUTE,
+      schema_version: 1,
+      kind: "compensate",
+      operation_id: applied.receipt.operation_id,
+      idempotency_key: request.idempotency_key,
+      request_digest: requestDigest,
+      result_digest: canonicalDigest({ absent: true, apply_receipt_id: applied.receipt.receipt_id }),
+      binding_version: request.if_binding_version + 1,
+      apply_receipt_id: applied.receipt.receipt_id,
+      created_at: this.now()
+    };
+    return this.bounded(await this.backend.compensate(request, receipt, compensationReceiptId, requestDigest, receipt.created_at));
+  }
+  bounded(result) {
+    const responseBytes2 = Buffer.byteLength(canonicalJson(result), "utf8");
+    if (responseBytes2 > TODOS_TASK_MANIFEST_BOUNDS.response_bytes) {
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_BOUNDS_EXCEEDED", `Task-manifest response requires ${responseBytes2} bytes but the bound is ${TODOS_TASK_MANIFEST_BOUNDS.response_bytes}`, { response_bytes: responseBytes2, response_byte_limit: TODOS_TASK_MANIFEST_BOUNDS.response_bytes });
+    }
+    return result;
+  }
+}
+function createPostgresTodosTaskManifestAuthority(client, options = {}) {
+  if (!client || typeof client.transaction !== "function") {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_ATOMICITY_UNAVAILABLE", "An authoritative PostgreSQL transaction(callback) client is required");
+  }
+  const tenantId = resolveTenantId(options.tenantId);
+  return new PackageOwnedTodosTaskManifestAuthority(new PostgresTodosTaskManifestBackend(client, { ...options, tenantId }), { ...options, tenantId });
+}
+var FAULT_POINTS;
+var init_authority2 = __esm(() => {
+  init_canonical();
+  init_schema2();
+  init_sqlite2();
+  init_postgres3();
+  init_prewrite_secrets();
+  init_types5();
+  init_schema2();
+  FAULT_POINTS = [
+    "after_plan_write",
+    "after_task_write",
+    "after_dependency_write",
+    "after_comment_write",
+    "after_verification_write",
+    "after_outbox_write",
+    "after_receipt_write"
+  ];
+});
+
+// src/task-manifest/http.ts
+function json2(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS2 });
+}
+function status(error) {
+  switch (error.code) {
+    case "TODOS_TASK_MANIFEST_INVALID_INPUT":
+    case "TODOS_TASK_MANIFEST_BOUNDS_EXCEEDED":
+    case "TODOS_TASK_MANIFEST_FOREIGN_REFERENCE":
+      return 400;
+    case "TODOS_TASK_MANIFEST_RECEIPT_NOT_FOUND":
+    case "TODOS_TASK_MANIFEST_BINDING_NOT_FOUND":
+      return 404;
+    case "TODOS_TASK_MANIFEST_ATOMICITY_UNAVAILABLE":
+      return 503;
+    default:
+      return 409;
+  }
+}
+async function body(request) {
+  const declaredLength = Number(request.headers.get("content-length") ?? 0);
+  if (Number.isFinite(declaredLength) && declaredLength > TODOS_TASK_MANIFEST_BOUNDS.request_bytes) {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_BOUNDS_EXCEEDED", "Task-manifest HTTP body exceeds the request bound");
+  }
+  const text2 = await boundedText(request, TODOS_TASK_MANIFEST_BOUNDS.request_bytes, "request");
+  try {
+    return JSON.parse(text2);
+  } catch {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", "Invalid JSON body");
+  }
+}
+async function boundedText(message, limit, label) {
+  if (!message.body)
+    return "";
+  const reader = message.body.getReader();
+  const decoder = new TextDecoder;
+  let bytes = 0;
+  let text2 = "";
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      bytes += value.byteLength;
+      if (bytes > limit) {
+        await reader.cancel();
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_BOUNDS_EXCEEDED", `Task-manifest HTTP ${label} exceeds the byte bound`);
+      }
+      text2 += decoder.decode(value, { stream: true });
+    }
+    return text2 + decoder.decode();
+  } finally {
+    reader.releaseLock();
+  }
+}
+async function handleTodosTaskManifestHttpRequest(request, url, authority, basePath = "/v1/task-manifest") {
+  if (url.pathname !== basePath && !url.pathname.startsWith(`${basePath}/`))
+    return null;
+  const action = url.pathname.slice(basePath.length).split("/").filter(Boolean).join("/");
+  try {
+    if ((action === "" || action === "capability") && request.method === "GET") {
+      return json2({ capability: await authority.capability() });
+    }
+    if (request.method !== "POST")
+      return json2({ error: "method not allowed" }, 405);
+    if (action === "apply")
+      return json2({ result: await authority.apply(await body(request)) }, 201);
+    if (action === "read-exact") {
+      const input = await body(request);
+      if (!input || typeof input.receipt_id !== "string") {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", "receipt_id is required");
+      }
+      return json2({ result: await authority.readExact(input.receipt_id) });
+    }
+    if (action === "bindings/lookup") {
+      return json2({
+        result: await authority.lookupBinding(await body(request))
+      });
+    }
+    if (action === "compensate") {
+      return json2({ result: await authority.compensate(await body(request)) }, 201);
+    }
+    if (action === "outbox/delivered") {
+      const input = await body(request);
+      if (!input || typeof input.outbox_id !== "string") {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_INVALID_INPUT", "outbox_id is required");
+      }
+      await authority.markOutboxDelivered(input.outbox_id);
+      return json2({ delivered: true });
+    }
+    return json2({ error: "unknown task-manifest route" }, 404);
+  } catch (cause) {
+    if (cause instanceof TodosTaskManifestError) {
+      return json2({ error: cause.message, code: cause.code, details: cause.details, authoritative: true }, status(cause));
+    }
+    return json2({ error: cause instanceof Error ? cause.message : "task-manifest error" }, 500);
+  }
+}
+var JSON_HEADERS2;
+var init_http3 = __esm(() => {
+  init_types5();
+  init_schema2();
+  JSON_HEADERS2 = { "Content-Type": "application/json" };
+});
+
+// src/task-manifest/index.ts
+var init_task_manifest = __esm(() => {
+  init_authority2();
+  init_postgres3();
+  init_sqlite2();
+  init_http3();
+  init_canonical();
+  init_schema2();
+  init_types5();
+});
+
 // src/storage/comment-redaction-backfill.ts
 function assertSafeIdentifier2(value) {
   if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
@@ -50994,12 +52385,12 @@ async function backfillPostgresCommentRedaction(client, options = {}) {
     result.remaining_candidates = result.candidates;
     return result;
   }
-  const verification = await backfillPostgresCommentRedaction(client, {
+  const verification2 = await backfillPostgresCommentRedaction(client, {
     ...options,
     apply: false,
     confirmation: undefined
   });
-  result.remaining_candidates = verification.candidates;
+  result.remaining_candidates = verification2.candidates;
   return result;
 }
 var COMMENT_REDACTION_BACKFILL_CONFIRMATION = "REDACT_STORED_TODOS_COMMENTS";
@@ -51018,6 +52409,7 @@ __export(exports_cloud, {
   isPostgresBackendConfigured: () => isPostgresBackendConfigured,
   isCloudModeEnabled: () => isCloudModeEnabled,
   getCloudVerifier: () => getCloudVerifier,
+  getCloudTaskManifestAuthority: () => getCloudTaskManifestAuthority,
   getCloudStorageAdapter: () => getCloudStorageAdapter,
   getCloudProjectRegistrationAuthority: () => getCloudProjectRegistrationAuthority,
   getCloudPrGroupLedger: () => getCloudPrGroupLedger,
@@ -51045,6 +52437,9 @@ function isPostgresBackendConfigured(env = process.env) {
 function isCloudModeEnabled(env = process.env) {
   return isPostgresBackendConfigured(env);
 }
+function getCloudTenantId() {
+  return process.env.HASNA_TODOS_TENANT_ID ?? "default";
+}
 function getClient() {
   if (cachedClient)
     return cachedClient;
@@ -51074,11 +52469,20 @@ function getCloudProjectRegistrationAuthority() {
   cachedProjectRegistrationAuthority = createPostgresTodosProjectRegistrationAuthority(getClient(), {
     service: TODOS_APP_SLUG,
     authorityId: TODOS_APP_SLUG,
-    tenantId: process.env.HASNA_TODOS_TENANT_ID ?? "default",
+    tenantId: getCloudTenantId(),
     corpusId: process.env.HASNA_TODOS_CORPUS_ID ?? `${TODOS_APP_SLUG}:postgresql`
   });
   return cachedProjectRegistrationAuthority;
 }
+function getCloudTaskManifestAuthority() {
+  if (cachedTaskManifestAuthority)
+    return cachedTaskManifestAuthority;
+  cachedTaskManifestAuthority = createPostgresTodosTaskManifestAuthority(getClient(), {
+    service: TODOS_APP_SLUG,
+    tenantId: getCloudTenantId()
+  });
+  return cachedTaskManifestAuthority;
+}
 function authClient() {
   const client = getClient();
   return {
@@ -51130,6 +52534,9 @@ async function ensureCloudSchema() {
     for (const sql of postgresTodosProjectRegistrationSchemaSql()) {
       await client.query(sql);
     }
+    for (const sql of postgresTodosTaskManifestSchemaSql(getCloudTenantId())) {
+      await client.query(sql);
+    }
     await getApiKeyStore().ensureSchema();
   })();
   return schemaEnsured;
@@ -51171,15 +52578,17 @@ async function closeCloud() {
   cachedVerifier = null;
   cachedPrGroupLedger = null;
   cachedProjectRegistrationAuthority = null;
+  cachedTaskManifestAuthority = null;
   schemaEnsured = null;
 }
-var TODOS_APP_SLUG = "todos", cachedClient = null, cachedAdapter = null, cachedStore = null, cachedVerifier = null, cachedPrGroupLedger = null, cachedProjectRegistrationAuthority = null, schemaEnsured = null;
+var TODOS_APP_SLUG = "todos", cachedClient = null, cachedAdapter = null, cachedStore = null, cachedVerifier = null, cachedPrGroupLedger = null, cachedProjectRegistrationAuthority = null, cachedTaskManifestAuthority = null, schemaEnsured = null;
 var init_cloud = __esm(() => {
   init_cloud_client();
   init_postgres_adapter();
   init_ledger();
   init_postgres();
   init_project_registration();
+  init_task_manifest();
   init_postgres_sync();
   init_comment_redaction_backfill();
 });
@@ -51393,8 +52802,8 @@ function rowToOrg(row) {
 function createOrg(input, db) {
   const d = db || getDatabase();
   const id = uuid();
-  const timestamp4 = now();
-  d.run(`INSERT INTO orgs (id, name, description, metadata, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)`, [id, input.name, input.description || null, JSON.stringify(input.metadata || {}), timestamp4, timestamp4]);
+  const timestamp5 = now();
+  d.run(`INSERT INTO orgs (id, name, description, metadata, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)`, [id, input.name, input.description || null, JSON.stringify(input.metadata || {}), timestamp5, timestamp5]);
   return getOrg(id, d);
 }
 function getOrg(id, db) {
@@ -51538,9 +52947,9 @@ function parseBoundedLimit(value, fallback, max) {
     return fallback;
   return Math.min(parsed, max);
 }
-function mapTaskError(e, json3) {
+function mapTaskError(e, json4) {
   if (e instanceof VersionConflictError) {
-    return json3({
+    return json4({
       error: e.message,
       code: VersionConflictError.code,
       expected_version: e.expectedVersion,
@@ -51548,23 +52957,23 @@ function mapTaskError(e, json3) {
     }, 409);
   }
   if (e instanceof TaskNotFoundError) {
-    return json3({ error: e.message, code: TaskNotFoundError.code }, 404);
+    return json4({ error: e.message, code: TaskNotFoundError.code }, 404);
   }
   if (e instanceof LockError) {
-    return json3({ error: e.message, code: LockError.code }, 409);
+    return json4({ error: e.message, code: LockError.code }, 409);
   }
   if (e instanceof CompletionGuardError) {
-    return json3({
+    return json4({
       error: e.message,
       code: CompletionGuardError.code,
       retry_after: e.retryAfterSeconds ?? null
     }, 409);
   }
   if (e instanceof TaskNotStartableError) {
-    return json3({ error: e.message, code: TaskNotStartableError.code }, 409);
+    return json4({ error: e.message, code: TaskNotStartableError.code }, 409);
   }
   if (e instanceof Error && / is blocked by /.test(e.message)) {
-    return json3({ error: e.message, code: "TASK_NOT_STARTABLE" }, 409);
+    return json4({ error: e.message, code: "TASK_NOT_STARTABLE" }, 409);
   }
   return null;
 }
@@ -51649,11 +53058,11 @@ data: ${JSON.stringify({ type: "connected", agent_id: agentId, timestamp: new Da
     }
   });
 }
-function handleHealth(_ctx, json3) {
+function handleHealth(_ctx, json4) {
   const stats2 = getTaskStats();
   const staleCount = getStaleTasks(30).length;
   const overdueRecurring = getOverdueTasks().filter((t) => t.recurrence_rule && t.status === "pending").length;
-  return json3({
+  return json4({
     status: staleCount === 0 && overdueRecurring === 0 ? "ok" : "warn",
     tasks: stats2.total,
     stale: staleCount,
@@ -51661,18 +53070,18 @@ function handleHealth(_ctx, json3) {
     timestamp: new Date().toISOString()
   });
 }
-function handleHeadlessBoundary(_ctx, json3) {
+function handleHeadlessBoundary(_ctx, json4) {
   const { getHeadlessBoundaryManifest: getHeadlessBoundaryManifest2 } = (init_headless_boundaries(), __toCommonJS(exports_headless_boundaries));
-  return json3(getHeadlessBoundaryManifest2());
+  return json4(getHeadlessBoundaryManifest2());
 }
-function handleStats(_ctx, json3) {
+function handleStats(_ctx, json4) {
   const stats2 = getTaskStats();
   const byStatus = stats2.by_status;
   const projects = listProjects();
   const agents = listAgents();
   const staleCount = getStaleTasks(30).length;
   const overdueRecurring = getOverdueTasks().filter((t) => t.recurrence_rule && t.status === "pending").length;
-  return json3({
+  return json4({
     total_tasks: stats2.total,
     pending: byStatus["pending"] ?? 0,
     in_progress: byStatus["in_progress"] ?? 0,
@@ -51695,10 +53104,10 @@ function taskStatusQueryParam(url) {
     return { ok: false, message: result.message };
   return { ok: true, value: collapseEnumValues(result.values) };
 }
-async function handleListTasks(_req, url, _ctx, json3, taskToSummary2) {
+async function handleListTasks(_req, url, _ctx, json4, taskToSummary2) {
   const statusParam = taskStatusQueryParam(url);
   if (!statusParam.ok)
-    return json3({ error: statusParam.message }, 400);
+    return json4({ error: statusParam.message }, 400);
   const projectId = url.searchParams.get("project_id") || undefined;
   const sessionId = url.searchParams.get("session_id") || undefined;
   const agentId = url.searchParams.get("agent_id") || undefined;
@@ -51713,60 +53122,60 @@ async function handleListTasks(_req, url, _ctx, json3, taskToSummary2) {
     limit: limitParam ? parseInt(limitParam, 10) : undefined,
     offset: offsetParam ? parseInt(offsetParam, 10) : undefined
   });
-  return json3(tasks.map((t) => taskToSummary2(t, fields)));
+  return json4(tasks.map((t) => taskToSummary2(t, fields)));
 }
-async function handleCreateTask(req, ctx, json3, taskToSummary2) {
+async function handleCreateTask(req, ctx, json4, taskToSummary2) {
   try {
-    const body = await req.json();
-    if (!body.title)
-      return json3({ error: "Missing 'title'" }, 400);
-    const createdBy = body.created_by ?? body.agent_id ?? "dashboard";
-    const task2 = createTask({
-      title: body.title,
-      description: body.description,
-      priority: body.priority,
-      project_id: body.project_id,
-      agent_id: body.agent_id ?? createdBy,
+    const body2 = await req.json();
+    if (!body2.title)
+      return json4({ error: "Missing 'title'" }, 400);
+    const createdBy = body2.created_by ?? body2.agent_id ?? "dashboard";
+    const task3 = createTask({
+      title: body2.title,
+      description: body2.description,
+      priority: body2.priority,
+      project_id: body2.project_id,
+      agent_id: body2.agent_id ?? createdBy,
       created_by: createdBy,
-      ...body.assigned_to ? { assigned_to: body.assigned_to } : {}
+      ...body2.assigned_to ? { assigned_to: body2.assigned_to } : {}
     });
-    ctx.broadcastEvent({ type: "task", task_id: task2.id, action: "created", agent_id: task2.agent_id, project_id: task2.project_id });
-    return json3(taskToSummary2(task2), 201);
+    ctx.broadcastEvent({ type: "task", task_id: task3.id, action: "created", agent_id: task3.agent_id, project_id: task3.project_id });
+    return json4(taskToSummary2(task3), 201);
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed to create task" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed to create task" }, 500);
   }
 }
-async function handleUpsertTask(req, ctx, json3, taskToSummary2) {
+async function handleUpsertTask(req, ctx, json4, taskToSummary2) {
   try {
-    const body = await req.json();
-    if (typeof body["fingerprint"] !== "string" || body["fingerprint"].trim() === "") {
-      return json3({ error: "Missing 'fingerprint'" }, 400);
+    const body2 = await req.json();
+    if (typeof body2["fingerprint"] !== "string" || body2["fingerprint"].trim() === "") {
+      return json4({ error: "Missing 'fingerprint'" }, 400);
     }
-    if (typeof body["title"] !== "string" || body["title"].trim() === "") {
-      return json3({ error: "Missing 'title'" }, 400);
+    if (typeof body2["title"] !== "string" || body2["title"].trim() === "") {
+      return json4({ error: "Missing 'title'" }, 400);
     }
-    const metadata = body["metadata"] && typeof body["metadata"] === "object" && !Array.isArray(body["metadata"]) ? { ...body["metadata"] } : {};
-    for (const key of ["expectation_id", "expectation_fingerprint", "evidence_paths", "origin_loop_id", "origin_run_id", "expected", "observed", "acceptance"]) {
-      if (body[key] !== undefined)
-        metadata[key] = body[key];
+    const metadata = body2["metadata"] && typeof body2["metadata"] === "object" && !Array.isArray(body2["metadata"]) ? { ...body2["metadata"] } : {};
+    for (const key2 of ["expectation_id", "expectation_fingerprint", "evidence_paths", "origin_loop_id", "origin_run_id", "expected", "observed", "acceptance"]) {
+      if (body2[key2] !== undefined)
+        metadata[key2] = body2[key2];
     }
     const result = upsertTaskByFingerprint({
-      fingerprint: body["fingerprint"],
-      title: body["title"],
-      description: typeof body["description"] === "string" ? body["description"] : undefined,
-      status: body["status"],
-      priority: body["priority"],
-      project_id: typeof body["project_id"] === "string" ? body["project_id"] : undefined,
-      task_list_id: typeof body["task_list_id"] === "string" ? body["task_list_id"] : undefined,
-      assigned_to: typeof body["assigned_to"] === "string" ? body["assigned_to"] : undefined,
-      working_dir: typeof body["working_dir"] === "string" ? body["working_dir"] : undefined,
-      tags: Array.isArray(body["tags"]) ? body["tags"].filter((tag) => typeof tag === "string") : undefined,
+      fingerprint: body2["fingerprint"],
+      title: body2["title"],
+      description: typeof body2["description"] === "string" ? body2["description"] : undefined,
+      status: body2["status"],
+      priority: body2["priority"],
+      project_id: typeof body2["project_id"] === "string" ? body2["project_id"] : undefined,
+      task_list_id: typeof body2["task_list_id"] === "string" ? body2["task_list_id"] : undefined,
+      assigned_to: typeof body2["assigned_to"] === "string" ? body2["assigned_to"] : undefined,
+      working_dir: typeof body2["working_dir"] === "string" ? body2["working_dir"] : undefined,
+      tags: Array.isArray(body2["tags"]) ? body2["tags"].filter((tag) => typeof tag === "string") : undefined,
       metadata
     });
     ctx.broadcastEvent({ type: "task", task_id: result.task.id, action: result.created ? "created" : "updated", agent_id: result.task.agent_id, project_id: result.task.project_id });
-    return json3({ created: result.created, task: taskToSummary2(result.task) }, result.created ? 201 : 200);
+    return json4({ created: result.created, task: taskToSummary2(result.task) }, result.created ? 201 : 200);
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed to upsert task" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed to upsert task" }, 500);
   }
 }
 function handleTasksExport(_req, url, _ctx, _json, taskToSummary2) {
@@ -51818,21 +53227,21 @@ function handleTasksExport(_req, url, _ctx, _json, taskToSummary2) {
     }
   });
 }
-async function handleTasksBulk(req, _ctx, json3) {
+async function handleTasksBulk(req, _ctx, json4) {
   try {
-    const body = await req.json();
-    if (!body.ids?.length || !body.action)
-      return json3({ error: "Missing ids or action" }, 400);
+    const body2 = await req.json();
+    if (!body2.ids?.length || !body2.action)
+      return json4({ error: "Missing ids or action" }, 400);
     const results = [];
-    for (const id of body.ids) {
+    for (const id of body2.ids) {
       try {
-        if (body.action === "delete") {
+        if (body2.action === "delete") {
           deleteTask(id);
           results.push({ id, success: true });
-        } else if (body.action === "start") {
+        } else if (body2.action === "start") {
           startTask(id, "dashboard");
           results.push({ id, success: true });
-        } else if (body.action === "complete") {
+        } else if (body2.action === "complete") {
           completeTask(id, "dashboard");
           results.push({ id, success: true });
         }
@@ -51840,84 +53249,84 @@ async function handleTasksBulk(req, _ctx, json3) {
         results.push({ id, success: false, error: e instanceof Error ? e.message : "Failed" });
       }
     }
-    return json3({ results, succeeded: results.filter((r) => r.success).length, failed: results.filter((r) => !r.success).length });
+    return json4({ results, succeeded: results.filter((r) => r.success).length, failed: results.filter((r) => !r.success).length });
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleTasksStatus(_req, url, _ctx, json3) {
+function handleTasksStatus(_req, url, _ctx, json4) {
   try {
     const projectId = url.searchParams.get("project_id") || undefined;
     const agentId = url.searchParams.get("agent_id") || undefined;
-    const status = getStatus(projectId ? { project_id: projectId } : undefined, agentId);
-    return json3(status);
+    const status2 = getStatus(projectId ? { project_id: projectId } : undefined, agentId);
+    return json4(status2);
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleTasksNext(_req, url, _ctx, json3, taskToSummary2) {
+function handleTasksNext(_req, url, _ctx, json4, taskToSummary2) {
   try {
     const projectId = url.searchParams.get("project_id") || undefined;
     const agentId = url.searchParams.get("agent_id") || undefined;
     const fields = parseFieldsParam(url);
-    const task2 = getNextTask(agentId, projectId ? { project_id: projectId } : undefined);
-    return json3({ task: task2 ? taskToSummary2(task2, fields) : null });
+    const task3 = getNextTask(agentId, projectId ? { project_id: projectId } : undefined);
+    return json4({ task: task3 ? taskToSummary2(task3, fields) : null });
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleTasksActive(_req, url, _ctx, json3) {
+function handleTasksActive(_req, url, _ctx, json4) {
   try {
     const projectId = url.searchParams.get("project_id") || undefined;
     const work = getActiveWork(projectId ? { project_id: projectId } : undefined);
-    return json3({ active: work, count: work.length });
+    return json4({ active: work, count: work.length });
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleTasksStale(_req, url, _ctx, json3, taskToSummary2) {
+function handleTasksStale(_req, url, _ctx, json4, taskToSummary2) {
   try {
     const projectId = url.searchParams.get("project_id") || undefined;
     const minutes2 = parseInt(url.searchParams.get("minutes") || "30", 10);
     const fields = parseFieldsParam(url);
     const tasks = getStaleTasks(minutes2, projectId ? { project_id: projectId } : undefined);
-    return json3({ tasks: tasks.map((t) => taskToSummary2(t, fields)), count: tasks.length });
+    return json4({ tasks: tasks.map((t) => taskToSummary2(t, fields)), count: tasks.length });
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleTasksChanged(_req, url, _ctx, json3, taskToSummary2) {
+function handleTasksChanged(_req, url, _ctx, json4, taskToSummary2) {
   try {
     const since = url.searchParams.get("since");
     if (!since)
-      return json3({ error: "since parameter required (ISO date string)" }, 400);
+      return json4({ error: "since parameter required (ISO date string)" }, 400);
     const projectId = url.searchParams.get("project_id") || undefined;
     const fields = parseFieldsParam(url);
     const tasks = getTasksChangedSince(since, projectId ? { project_id: projectId } : undefined);
-    return json3({ tasks: tasks.map((t) => taskToSummary2(t, fields)), count: tasks.length, since });
+    return json4({ tasks: tasks.map((t) => taskToSummary2(t, fields)), count: tasks.length, since });
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleTasksContext(_req, url, _ctx, json3, taskToSummary2) {
+function handleTasksContext(_req, url, _ctx, json4, taskToSummary2) {
   const agentId = url.searchParams.get("agent_id") || undefined;
   const projectId = url.searchParams.get("project_id") || undefined;
   const format = url.searchParams.get("format") || "text";
   const fields = parseFieldsParam(url);
   const filters = projectId ? { project_id: projectId } : undefined;
-  const status = getStatus(filters, agentId);
+  const status2 = getStatus(filters, agentId);
   const next = getNextTask(agentId, filters);
   if (format === "json") {
-    return json3({ status, next_task: next ? taskToSummary2(next, fields) : null });
+    return json4({ status: status2, next_task: next ? taskToSummary2(next, fields) : null });
   }
   const lines = [];
-  lines.push(`Tasks: ${status.pending} pending | ${status.in_progress} active | ${status.completed} done`);
-  if (status.stale_count > 0)
-    lines.push(`${status.stale_count} stale tasks stuck in-progress`);
-  if (status.overdue_recurring > 0)
-    lines.push(`${status.overdue_recurring} overdue recurring tasks`);
-  if (status.active_work.length > 0) {
-    lines.push(`Active: ${status.active_work.slice(0, 3).map((w) => `${w.short_id || w.id.slice(0, 8)} (${w.assigned_to || "?"})`).join(", ")}`);
+  lines.push(`Tasks: ${status2.pending} pending | ${status2.in_progress} active | ${status2.completed} done`);
+  if (status2.stale_count > 0)
+    lines.push(`${status2.stale_count} stale tasks stuck in-progress`);
+  if (status2.overdue_recurring > 0)
+    lines.push(`${status2.overdue_recurring} overdue recurring tasks`);
+  if (status2.active_work.length > 0) {
+    lines.push(`Active: ${status2.active_work.slice(0, 3).map((w) => `${w.short_id || w.id.slice(0, 8)} (${w.assigned_to || "?"})`).join(", ")}`);
   }
   if (next)
     lines.push(`Next up: ${next.short_id || next.id.slice(0, 8)} [${next.priority}] ${next.title}`);
@@ -51925,18 +53334,18 @@ function handleTasksContext(_req, url, _ctx, json3, taskToSummary2) {
 `);
   return new Response(text2, { headers: { "Content-Type": "text/plain" } });
 }
-function handleTaskAttachments(id, _ctx, json3) {
-  const task2 = getTask(id);
-  if (!task2)
-    return json3({ error: "Task not found" }, 404);
-  const evidence = task2.metadata?._evidence || {};
+function handleTaskAttachments(id, _ctx, json4) {
+  const task3 = getTask(id);
+  if (!task3)
+    return json4({ error: "Task not found" }, 404);
+  const evidence = task3.metadata?._evidence || {};
   const attachmentIds = evidence.attachments || [];
-  return json3({ task_id: id, short_id: task2.short_id, attachment_ids: attachmentIds, count: attachmentIds.length, files_changed: evidence.files_changed, commit_hash: evidence.commit_hash, notes: evidence.notes });
+  return json4({ task_id: id, short_id: task3.short_id, attachment_ids: attachmentIds, count: attachmentIds.length, files_changed: evidence.files_changed, commit_hash: evidence.commit_hash, notes: evidence.notes });
 }
-async function handleTaskProgress(id, req, method, _ctx, json3, url) {
-  const task2 = getTask(id);
-  if (!task2)
-    return json3({ error: "Task not found" }, 404);
+async function handleTaskProgress(id, req, method, _ctx, json4, url) {
+  const task3 = getTask(id);
+  if (!task3)
+    return json4({ error: "Task not found" }, 404);
   if (method === "GET") {
     const all = listComments(id);
     const progress = all.filter((c) => c.type === "progress");
@@ -51944,7 +53353,7 @@ async function handleTaskProgress(id, req, method, _ctx, json3, url) {
     const format = url?.searchParams.get("format") || "compact";
     const limit = parseBoundedLimit(url?.searchParams.get("limit") || null, 20, 200);
     const progressEntries = format === "full" ? progress : progress.slice(-limit);
-    return json3({
+    return json4({
       task_id: id,
       progress_entries: progressEntries,
       latest,
@@ -51959,119 +53368,119 @@ async function handleTaskProgress(id, req, method, _ctx, json3, url) {
   }
   if (method === "POST") {
     try {
-      const body = await req.json();
-      if (!body.message)
-        return json3({ error: "message required" }, 400);
-      const comment = logProgress(id, body.message, body.pct_complete, body.agent_id);
-      return json3(comment, 201);
+      const body2 = await req.json();
+      if (!body2.message)
+        return json4({ error: "message required" }, 400);
+      const comment2 = logProgress(id, body2.message, body2.pct_complete, body2.agent_id);
+      return json4(comment2, 201);
     } catch (e) {
-      return json3({ error: e instanceof Error ? e.message : "Failed to log progress" }, 500);
+      return json4({ error: e instanceof Error ? e.message : "Failed to log progress" }, 500);
     }
   }
   return null;
 }
-function handleGetTask(id, _ctx, json3, taskToSummary2, url) {
-  const task2 = getTask(id);
-  if (!task2)
-    return json3({ error: "Task not found" }, 404);
-  return json3(taskToSummary2(task2, url ? parseFieldsParam(url) : undefined));
+function handleGetTask(id, _ctx, json4, taskToSummary2, url) {
+  const task3 = getTask(id);
+  if (!task3)
+    return json4({ error: "Task not found" }, 404);
+  return json4(taskToSummary2(task3, url ? parseFieldsParam(url) : undefined));
 }
-async function handlePatchTask(id, req, _ctx, json3, taskToSummary2) {
+async function handlePatchTask(id, req, _ctx, json4, taskToSummary2) {
   try {
-    const body = await req.json();
-    const task2 = getTask(id);
-    if (!task2)
-      return json3({ error: "Task not found" }, 404);
+    const body2 = await req.json();
+    const task3 = getTask(id);
+    if (!task3)
+      return json4({ error: "Task not found" }, 404);
     const ALLOWED = new Set(["title", "description", "status", "priority", "assigned_to", "plan_id", "task_list_id", "tags", "metadata", "due_at", "estimated_minutes", "actual_minutes", "confidence", "retry_count", "max_retries", "retry_after", "task_type"]);
     const safeBody = {};
-    for (const [key, value] of Object.entries(body)) {
-      if (ALLOWED.has(key))
-        safeBody[key] = value;
+    for (const [key2, value] of Object.entries(body2)) {
+      if (ALLOWED.has(key2))
+        safeBody[key2] = value;
     }
-    const clientVersion = typeof body["version"] === "number" ? body["version"] : task2.version;
+    const clientVersion = typeof body2["version"] === "number" ? body2["version"] : task3.version;
     const updated = updateTask(id, {
       ...safeBody,
       version: clientVersion
     });
-    return json3(taskToSummary2(updated));
+    return json4(taskToSummary2(updated));
   } catch (e) {
-    const mapped = mapTaskError(e, json3);
+    const mapped = mapTaskError(e, json4);
     if (mapped)
       return mapped;
-    return json3({ error: e instanceof Error ? e.message : "Failed to update task" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed to update task" }, 500);
   }
 }
-function handleDeleteTask(id, _ctx, json3) {
+function handleDeleteTask(id, _ctx, json4) {
   const deleted = deleteTask(id);
   if (!deleted)
-    return json3({ error: "Task not found" }, 404);
-  return json3({ success: true });
+    return json4({ error: "Task not found" }, 404);
+  return json4({ success: true });
 }
-function handleStartTask(id, ctx, json3, taskToSummary2) {
+function handleStartTask(id, ctx, json4, taskToSummary2) {
   try {
-    const task2 = startTask(id, "dashboard");
-    ctx.broadcastEvent({ type: "task", task_id: task2.id, action: "started", agent_id: "dashboard", project_id: task2.project_id });
-    return json3(taskToSummary2(task2));
+    const task3 = startTask(id, "dashboard");
+    ctx.broadcastEvent({ type: "task", task_id: task3.id, action: "started", agent_id: "dashboard", project_id: task3.project_id });
+    return json4(taskToSummary2(task3));
   } catch (e) {
-    const mapped = mapTaskError(e, json3);
+    const mapped = mapTaskError(e, json4);
     if (mapped)
       return mapped;
-    return json3({ error: e instanceof Error ? e.message : "Failed to start task" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed to start task" }, 500);
   }
 }
-async function handleFailTask(id, req, ctx, json3, taskToSummary2) {
+async function handleFailTask(id, req, ctx, json4, taskToSummary2) {
   try {
-    const body = await req.json().catch(() => ({}));
-    const result = failTask(id, body.agent_id, body.reason, { retry: body.retry, error_code: body.error_code });
-    ctx.broadcastEvent({ type: "task", task_id: id, action: "failed", agent_id: body.agent_id || null, project_id: result.task.project_id });
-    return json3({ task: taskToSummary2(result.task), retry_task: result.retryTask ? taskToSummary2(result.retryTask) : null });
+    const body2 = await req.json().catch(() => ({}));
+    const result = failTask(id, body2.agent_id, body2.reason, { retry: body2.retry, error_code: body2.error_code });
+    ctx.broadcastEvent({ type: "task", task_id: id, action: "failed", agent_id: body2.agent_id || null, project_id: result.task.project_id });
+    return json4({ task: taskToSummary2(result.task), retry_task: result.retryTask ? taskToSummary2(result.retryTask) : null });
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed to fail task" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed to fail task" }, 500);
   }
 }
-function handleCompleteTask(id, ctx, json3, taskToSummary2) {
+function handleCompleteTask(id, ctx, json4, taskToSummary2) {
   try {
-    const task2 = completeTask(id, "dashboard");
-    ctx.broadcastEvent({ type: "task", task_id: task2.id, action: "completed", agent_id: "dashboard", project_id: task2.project_id });
-    return json3(taskToSummary2(task2));
+    const task3 = completeTask(id, "dashboard");
+    ctx.broadcastEvent({ type: "task", task_id: task3.id, action: "completed", agent_id: "dashboard", project_id: task3.project_id });
+    return json4(taskToSummary2(task3));
   } catch (e) {
-    const mapped = mapTaskError(e, json3);
+    const mapped = mapTaskError(e, json4);
     if (mapped)
       return mapped;
-    return json3({ error: e instanceof Error ? e.message : "Failed to complete task" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed to complete task" }, 500);
   }
 }
-function handleListProjects(url, _ctx, json3) {
+function handleListProjects(url, _ctx, json4) {
   const pFieldsParam = url.searchParams.get("fields");
   const pFields = pFieldsParam ? pFieldsParam.split(",").map((f) => f.trim()).filter(Boolean) : undefined;
   const projects = listProjects();
-  return json3(pFields ? projects.map((p) => Object.fromEntries(pFields.map((f) => [f, p[f] ?? null]))) : projects);
+  return json4(pFields ? projects.map((p) => Object.fromEntries(pFields.map((f) => [f, p[f] ?? null]))) : projects);
 }
-async function handleCreateProject(req, _ctx, json3) {
+async function handleCreateProject(req, _ctx, json4) {
   try {
-    const body = await req.json();
-    if (!body.name || !body.path)
-      return json3({ error: "Missing name or path" }, 400);
-    const project = createProject({ name: body.name, path: body.path, description: body.description });
-    return json3(project, 201);
+    const body2 = await req.json();
+    if (!body2.name || !body2.path)
+      return json4({ error: "Missing name or path" }, 400);
+    const project = createProject({ name: body2.name, path: body2.path, description: body2.description });
+    return json4(project, 201);
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed to create project" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed to create project" }, 500);
   }
 }
-function handleDeleteProject(id, _ctx, json3) {
+function handleDeleteProject(id, _ctx, json4) {
   const deleted = deleteProject(id);
   if (!deleted)
-    return json3({ error: "Project not found" }, 404);
-  return json3({ success: true });
+    return json4({ error: "Project not found" }, 404);
+  return json4({ success: true });
 }
-async function handleAgentMe(_req, url, _ctx, json3, taskToSummary2) {
+async function handleAgentMe(_req, url, _ctx, json4, taskToSummary2) {
   try {
     const name = url.searchParams.get("name");
     if (!name)
-      return json3({ error: "Missing name param" }, 400);
+      return json4({ error: "Missing name param" }, 400);
     const agentResult = registerAgent({ name });
     if (isAgentConflict(agentResult))
-      return json3({ error: agentResult.message, conflict: true }, 409);
+      return json4({ error: agentResult.message, conflict: true }, 409);
     const agent = agentResult;
     const tasks = listTasks({ assigned_to: agent.name });
     const agentIdTasks = listTasks({ agent_id: agent.id });
@@ -52079,7 +53488,7 @@ async function handleAgentMe(_req, url, _ctx, json3, taskToSummary2) {
     const pending = allTasks.filter((t) => t.status === "pending");
     const inProgress = allTasks.filter((t) => t.status === "in_progress");
     const completed = allTasks.filter((t) => t.status === "completed");
-    return json3({
+    return json4({
       agent,
       pending_tasks: pending.map((t) => taskToSummary2(t)),
       in_progress_tasks: inProgress.map((t) => taskToSummary2(t)),
@@ -52093,132 +53502,132 @@ async function handleAgentMe(_req, url, _ctx, json3, taskToSummary2) {
     });
   } catch (e) {
     if (e instanceof InvalidAgentNameError)
-      return json3({ error: e.message, suggestions: e.suggestions }, 400);
-    return json3({ error: e instanceof Error ? e.message : "Failed to get agent profile" }, 500);
+      return json4({ error: e.message, suggestions: e.suggestions }, 400);
+    return json4({ error: e instanceof Error ? e.message : "Failed to get agent profile" }, 500);
   }
 }
-function handleAgentQueue(agentId, _ctx, json3, taskToSummary2) {
+function handleAgentQueue(agentId, _ctx, json4, taskToSummary2) {
   const aliasSet = assignedToAliasSet(getDatabase(), agentId);
   const pending = listTasks({ status: "pending" });
   const queue = pending.filter((t) => aliasSet.has((t.assigned_to ?? "").toLowerCase()) || t.agent_id === agentId || !t.assigned_to && !t.locked_by);
   const order = { critical: 0, high: 1, medium: 2, low: 3 };
   queue.sort((a, b) => (order[a.priority] ?? 4) - (order[b.priority] ?? 4) || new Date(a.created_at).getTime() - new Date(b.created_at).getTime());
-  return json3(queue.map((t) => taskToSummary2(t)));
+  return json4(queue.map((t) => taskToSummary2(t)));
 }
-async function handleClaimTask(req, _ctx, json3, taskToSummary2) {
+async function handleClaimTask(req, _ctx, json4, taskToSummary2) {
   try {
-    const body = await req.json();
-    const agentId = body.agent_id || "anonymous";
-    const task2 = claimNextTask(agentId, body.project_id ? { project_id: body.project_id } : undefined);
-    return json3({ task: task2 ? taskToSummary2(task2) : null });
+    const body2 = await req.json();
+    const agentId = body2.agent_id || "anonymous";
+    const task3 = claimNextTask(agentId, body2.project_id ? { project_id: body2.project_id } : undefined);
+    return json4({ task: task3 ? taskToSummary2(task3) : null });
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed to claim" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed to claim" }, 500);
   }
 }
-function handleListOrgs(_ctx, json3) {
-  return json3(listOrgs());
+function handleListOrgs(_ctx, json4) {
+  return json4(listOrgs());
 }
-async function handleCreateOrg(req, _ctx, json3) {
+async function handleCreateOrg(req, _ctx, json4) {
   try {
-    const body = await req.json();
-    if (!body.name)
-      return json3({ error: "Missing name" }, 400);
-    return json3(createOrg(body), 201);
+    const body2 = await req.json();
+    if (!body2.name)
+      return json4({ error: "Missing name" }, 400);
+    return json4(createOrg(body2), 201);
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-async function handleUpdateOrg(id, req, _ctx, json3) {
+async function handleUpdateOrg(id, req, _ctx, json4) {
   try {
-    const body = await req.json();
-    return json3(updateOrg(id, body));
+    const body2 = await req.json();
+    return json4(updateOrg(id, body2));
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleDeleteOrg(id, _ctx, json3) {
+function handleDeleteOrg(id, _ctx, json4) {
   const deleted = deleteOrg(id);
-  return json3(deleted ? { success: true } : { error: "Not found" }, deleted ? 200 : 404);
+  return json4(deleted ? { success: true } : { error: "Not found" }, deleted ? 200 : 404);
 }
-function handleOrgChart(_ctx, json3) {
-  return json3(getOrgChart());
+function handleOrgChart(_ctx, json4) {
+  return json4(getOrgChart());
 }
-function handleAgentTeam(agentId, _ctx, json3) {
-  return json3(getDirectReports(decodeURIComponent(agentId)));
+function handleAgentTeam(agentId, _ctx, json4) {
+  return json4(getDirectReports(decodeURIComponent(agentId)));
 }
-function handleListAgents(url, _ctx, json3) {
+function handleListAgents(url, _ctx, json4) {
   const aFieldsParam = url.searchParams.get("fields");
   const aFields = aFieldsParam ? aFieldsParam.split(",").map((f) => f.trim()).filter(Boolean) : undefined;
   const agents = listAgents();
-  return json3(aFields ? agents.map((a) => Object.fromEntries(aFields.map((f) => [f, a[f] ?? null]))) : agents);
+  return json4(aFields ? agents.map((a) => Object.fromEntries(aFields.map((f) => [f, a[f] ?? null]))) : agents);
 }
-async function handleRegisterAgent(req, _ctx, json3) {
+async function handleRegisterAgent(req, _ctx, json4) {
   try {
-    const body = await req.json();
-    if (!body.name)
-      return json3({ error: "Missing name" }, 400);
-    const result = registerAgent({ name: body.name, description: body.description, session_id: body.session_id, working_dir: body.working_dir });
+    const body2 = await req.json();
+    if (!body2.name)
+      return json4({ error: "Missing name" }, 400);
+    const result = registerAgent({ name: body2.name, description: body2.description, session_id: body2.session_id, working_dir: body2.working_dir });
     if (isAgentConflict(result))
-      return json3({ error: result.message, conflict: true }, 409);
-    return json3(result, 201);
+      return json4({ error: result.message, conflict: true }, 409);
+    return json4(result, 201);
   } catch (e) {
     if (e instanceof InvalidAgentNameError)
-      return json3({ error: e.message, suggestions: e.suggestions }, 400);
-    return json3({ error: e instanceof Error ? e.message : "Failed to register agent" }, 500);
+      return json4({ error: e.message, suggestions: e.suggestions }, 400);
+    return json4({ error: e instanceof Error ? e.message : "Failed to register agent" }, 500);
   }
 }
-async function handleUpdateAgent(id, req, _ctx, json3) {
+async function handleUpdateAgent(id, req, _ctx, json4) {
   try {
-    const body = await req.json();
-    const agent = updateAgent(id, body);
-    return json3(agent);
+    const body2 = await req.json();
+    const agent = updateAgent(id, body2);
+    return json4(agent);
   } catch (e) {
     if (e instanceof InvalidAgentNameError)
-      return json3({ error: e.message, suggestions: e.suggestions }, 400);
-    return json3({ error: e instanceof Error ? e.message : "Failed to update agent" }, 500);
+      return json4({ error: e.message, suggestions: e.suggestions }, 400);
+    return json4({ error: e instanceof Error ? e.message : "Failed to update agent" }, 500);
   }
 }
-function handleDeleteAgent(id, _ctx, json3) {
+function handleDeleteAgent(id, _ctx, json4) {
   const deleted = deleteAgent(id);
   if (!deleted)
-    return json3({ error: "Agent not found" }, 404);
-  return json3({ success: true });
+    return json4({ error: "Agent not found" }, 404);
+  return json4({ success: true });
 }
-async function handleBulkDeleteAgents(req, _ctx, json3) {
+async function handleBulkDeleteAgents(req, _ctx, json4) {
   try {
-    const body = await req.json();
-    if (!body.ids?.length || body.action !== "delete")
-      return json3({ error: "Missing ids or invalid action" }, 400);
+    const body2 = await req.json();
+    if (!body2.ids?.length || body2.action !== "delete")
+      return json4({ error: "Missing ids or invalid action" }, 400);
     let succeeded = 0;
-    for (const id of body.ids) {
+    for (const id of body2.ids) {
       if (deleteAgent(id))
         succeeded++;
     }
-    return json3({ succeeded, failed: body.ids.length - succeeded });
+    return json4({ succeeded, failed: body2.ids.length - succeeded });
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-async function handleBulkDeleteProjects(req, _ctx, json3) {
+async function handleBulkDeleteProjects(req, _ctx, json4) {
   try {
-    const body = await req.json();
-    if (!body.ids?.length || body.action !== "delete")
-      return json3({ error: "Missing ids or invalid action" }, 400);
+    const body2 = await req.json();
+    if (!body2.ids?.length || body2.action !== "delete")
+      return json4({ error: "Missing ids or invalid action" }, 400);
     let succeeded = 0;
-    for (const id of body.ids) {
+    for (const id of body2.ids) {
       if (deleteProject(id))
         succeeded++;
     }
-    return json3({ succeeded, failed: body.ids.length - succeeded });
+    return json4({ succeeded, failed: body2.ids.length - succeeded });
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleDoctor(_ctx, json3) {
+function handleDoctor(_ctx, json4) {
   const { runTodosDoctor: runTodosDoctor2 } = (init_doctor(), __toCommonJS(exports_doctor));
-  return json3(runTodosDoctor2({ apply: false }));
+  return json4(runTodosDoctor2({ apply: false }));
 }
-function handleReport(_req, url, _ctx, json3) {
+function handleReport(_req, url, _ctx, json4) {
   const days = parseInt(url.searchParams.get("days") || "7", 10);
   const projectId = url.searchParams.get("project_id") || undefined;
   const since = new Date(Date.now() - days * 24 * 60 * 60 * 1000).toISOString();
@@ -52234,114 +53643,114 @@ function handleReport(_req, url, _ctx, json3) {
     byDay[day] = (byDay[day] || 0) + 1;
   }
   const completionRate = changed.length > 0 ? Math.round(completed.length / changed.length * 100) : 0;
-  return json3({ days, period_since: since, total: all.length, stats: stats2, changed: changed.length, completed: completed.length, failed: failed.length, completion_rate: completionRate, by_day: byDay });
+  return json4({ days, period_since: since, total: all.length, stats: stats2, changed: changed.length, completed: completed.length, failed: failed.length, completion_rate: completionRate, by_day: byDay });
 }
-function handleActivity(_req, url, _ctx, json3) {
+function handleActivity(_req, url, _ctx, json4) {
   const limit = parseInt(url.searchParams.get("limit") || "50", 10);
-  return json3(getRecentActivity(limit));
+  return json4(getRecentActivity(limit));
 }
-function handleTaskHistory(id, _ctx, json3, url) {
+function handleTaskHistory(id, _ctx, json4, url) {
   const history = getTaskHistory(id);
   const format = url?.searchParams.get("format") || "compact";
   const limit = parseBoundedLimit(url?.searchParams.get("limit") || null, 20, 500);
-  return json3(format === "full" ? history : history.slice(0, limit));
+  return json4(format === "full" ? history : history.slice(0, limit));
 }
-function handleListWebhooks(_ctx, json3) {
-  return json3(listWebhooks());
+function handleListWebhooks(_ctx, json4) {
+  return json4(listWebhooks());
 }
-async function handleCreateWebhook(req, _ctx, json3) {
+async function handleCreateWebhook(req, _ctx, json4) {
   try {
-    const body = await req.json();
-    if (!body.url)
-      return json3({ error: "Missing url" }, 400);
-    return json3(createWebhook(body), 201);
+    const body2 = await req.json();
+    if (!body2.url)
+      return json4({ error: "Missing url" }, 400);
+    return json4(createWebhook(body2), 201);
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleDeleteWebhook(id, _ctx, json3) {
+function handleDeleteWebhook(id, _ctx, json4) {
   const deleted = deleteWebhook(id);
-  return json3(deleted ? { success: true } : { error: "Not found" }, deleted ? 200 : 404);
+  return json4(deleted ? { success: true } : { error: "Not found" }, deleted ? 200 : 404);
 }
-function handleListTemplates(_ctx, json3) {
-  return json3(listTemplates());
+function handleListTemplates(_ctx, json4) {
+  return json4(listTemplates());
 }
-async function handleCreateTemplate(req, _ctx, json3) {
+async function handleCreateTemplate(req, _ctx, json4) {
   try {
-    const body = await req.json();
-    if (!body.name || !body.title_pattern)
-      return json3({ error: "Missing name or title_pattern" }, 400);
-    return json3(createTemplate(body), 201);
+    const body2 = await req.json();
+    if (!body2.name || !body2.title_pattern)
+      return json4({ error: "Missing name or title_pattern" }, 400);
+    return json4(createTemplate(body2), 201);
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleDeleteTemplate(id, _ctx, json3) {
+function handleDeleteTemplate(id, _ctx, json4) {
   const deleted = deleteTemplate(id);
-  return json3(deleted ? { success: true } : { error: "Not found" }, deleted ? 200 : 404);
+  return json4(deleted ? { success: true } : { error: "Not found" }, deleted ? 200 : 404);
 }
-function handleListPlans(url, _ctx, json3) {
+function handleListPlans(url, _ctx, json4) {
   const projectId = url.searchParams.get("project_id") || undefined;
   const plans = listPlans(projectId);
-  return json3(plans);
+  return json4(plans);
 }
-async function handleCreatePlan(req, _ctx, json3) {
+async function handleCreatePlan(req, _ctx, json4) {
   try {
-    const body = await req.json();
-    if (!body.name)
-      return json3({ error: "Missing 'name'" }, 400);
+    const body2 = await req.json();
+    if (!body2.name)
+      return json4({ error: "Missing 'name'" }, 400);
     const plan = createPlan({
-      name: body.name,
-      slug: body.slug,
-      description: body.description,
-      project_id: body.project_id,
-      task_list_id: body.task_list_id,
-      agent_id: body.agent_id,
-      status: body.status
-    });
-    return json3(plan, 201);
+      name: body2.name,
+      slug: body2.slug,
+      description: body2.description,
+      project_id: body2.project_id,
+      task_list_id: body2.task_list_id,
+      agent_id: body2.agent_id,
+      status: body2.status
+    });
+    return json4(plan, 201);
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed to create plan" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed to create plan" }, 500);
   }
 }
-async function handleBulkDeletePlans(req, _ctx, json3) {
+async function handleBulkDeletePlans(req, _ctx, json4) {
   try {
-    const body = await req.json();
-    if (!body.ids?.length || body.action !== "delete")
-      return json3({ error: "Missing ids or invalid action" }, 400);
+    const body2 = await req.json();
+    if (!body2.ids?.length || body2.action !== "delete")
+      return json4({ error: "Missing ids or invalid action" }, 400);
     let succeeded = 0;
-    for (const id of body.ids) {
+    for (const id of body2.ids) {
       if (deletePlan(id))
         succeeded++;
     }
-    return json3({ succeeded, failed: body.ids.length - succeeded });
+    return json4({ succeeded, failed: body2.ids.length - succeeded });
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleGetPlan(id, _ctx, json3, taskToSummary2) {
+function handleGetPlan(id, _ctx, json4, taskToSummary2) {
   const plan = getPlan(id);
   if (!plan)
-    return json3({ error: "Plan not found" }, 404);
+    return json4({ error: "Plan not found" }, 404);
   const tasks = listTasks({ plan_id: id });
-  return json3({ ...plan, tasks: tasks.map((t) => taskToSummary2(t)) });
+  return json4({ ...plan, tasks: tasks.map((t) => taskToSummary2(t)) });
 }
-async function handleUpdatePlan(id, req, _ctx, json3) {
+async function handleUpdatePlan(id, req, _ctx, json4) {
   try {
-    const body = await req.json();
-    const plan = updatePlan(id, body);
-    return json3(plan);
+    const body2 = await req.json();
+    const plan = updatePlan(id, body2);
+    return json4(plan);
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : "Failed to update plan" }, 500);
+    return json4({ error: e instanceof Error ? e.message : "Failed to update plan" }, 500);
   }
 }
-function handleDeletePlan(id, _ctx, json3) {
+function handleDeletePlan(id, _ctx, json4) {
   const deleted = deletePlan(id);
   if (!deleted)
-    return json3({ error: "Plan not found" }, 404);
-  return json3({ success: true });
+    return json4({ error: "Plan not found" }, 404);
+  return json4({ success: true });
 }
-function handleStaticFiles(path, method, ctx, json3, serveStaticFile2) {
+function handleStaticFiles(path, method, ctx, json4, serveStaticFile2) {
   if (!ctx.dashboardExists || method !== "GET" && method !== "HEAD")
     return null;
   if (path !== "/") {
@@ -52349,7 +53758,7 @@ function handleStaticFiles(path, method, ctx, json3, serveStaticFile2) {
     const resolvedFile = resolve16(filePath);
     const resolvedBase = resolve16(ctx.dashboardDir);
     if (!resolvedFile.startsWith(resolvedBase + sep3) && resolvedFile !== resolvedBase) {
-      return json3({ error: "Forbidden" }, 403);
+      return json4({ error: "Forbidden" }, 403);
     }
     const res2 = serveStaticFile2(filePath);
     if (res2)
@@ -52398,6 +53807,9 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
       schemas: {
         Task: taskSchema,
         Project: projectSchema,
+        TaskManifestBindingLookupRequest: taskManifestBindingLookupRequestSchema,
+        TaskManifestBindingLookupResult: taskManifestBindingLookupResultSchema,
+        TaskManifestBindingLookupResponse: taskManifestBindingLookupResponseSchema,
         TaskList: taskListSchema,
         ProjectTaskListEnsureReceipt: projectTaskListEnsureReceiptSchema,
         ProjectTaskListEnsureResult: projectTaskListEnsureResultSchema,
@@ -53373,6 +54785,32 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
     },
     security: [{ apiKey: [] }],
     paths: {
+      "/v1/task-manifest/bindings/lookup": {
+        post: {
+          operationId: "lookupTaskManifestBinding",
+          summary: "Recover one exact task-manifest apply receipt from its managed plan id",
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/TaskManifestBindingLookupRequest" }
+              }
+            }
+          },
+          responses: {
+            "200": {
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/TaskManifestBindingLookupResponse" }
+                }
+              }
+            },
+            "400": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "404": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "409": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
+        }
+      },
       "/v1/tasks": {
         get: {
           operationId: "listTasks",
@@ -54103,7 +55541,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
     }
   };
 }
-var taskSchema, projectSchema, taskListSchema, projectTaskListEnsureReceiptSchema, projectTaskListEnsureResultSchema, projectTaskListRollbackResultSchema, taskCommentSchema, taskGitRefSchema, planSchema, planProjectLinkReceiptSchema, planProjectLinkResultSchema, planProjectLinkRollbackResultSchema, templateTaskSchema, templateSchema, templateVariableSchema, createTemplateTaskInputSchema;
+var taskSchema, projectSchema, taskManifestBindingLookupRequestSchema, taskManifestBindingLookupResultSchema, taskManifestBindingLookupResponseSchema, taskListSchema, projectTaskListEnsureReceiptSchema, projectTaskListEnsureResultSchema, projectTaskListRollbackResultSchema, taskCommentSchema, taskGitRefSchema, planSchema, planProjectLinkReceiptSchema, planProjectLinkResultSchema, planProjectLinkRollbackResultSchema, templateTaskSchema, templateSchema, templateVariableSchema, createTemplateTaskInputSchema;
 var init_openapi = __esm(() => {
   init_package_version();
   init_types();
@@ -54139,6 +55577,51 @@ var init_openapi = __esm(() => {
       updated_at: { type: "string" }
     }
   };
+  taskManifestBindingLookupRequestSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: ["authority", "route", "schema_version", "tenant_id", "plan_id", "max_items"],
+    properties: {
+      authority: { type: "string", enum: ["todos"] },
+      route: { type: "string", enum: ["todos.task-manifest.v1"] },
+      schema_version: { type: "integer", enum: [1] },
+      tenant_id: { type: "string", minLength: 1, maxLength: 200 },
+      plan_id: { type: "string", format: "uuid" },
+      max_items: { type: "integer", enum: [1] }
+    }
+  };
+  taskManifestBindingLookupResultSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "authority",
+      "route",
+      "schema_version",
+      "tenant_id",
+      "plan_id",
+      "apply_receipt_id",
+      "binding_version",
+      "state"
+    ],
+    properties: {
+      authority: { type: "string", enum: ["todos"] },
+      route: { type: "string", enum: ["todos.task-manifest.v1"] },
+      schema_version: { type: "integer", enum: [1] },
+      tenant_id: { type: "string" },
+      plan_id: { type: "string", format: "uuid" },
+      apply_receipt_id: { type: "string", format: "uuid" },
+      binding_version: { type: "integer", minimum: 1 },
+      state: { type: "string", enum: ["applied", "compensated"] }
+    }
+  };
+  taskManifestBindingLookupResponseSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: ["result"],
+    properties: {
+      result: { $ref: "#/components/schemas/TaskManifestBindingLookupResult" }
+    }
+  };
   taskListSchema = {
     type: "object",
     properties: {
@@ -54424,8 +55907,8 @@ var exports_pr_groups = {};
 __export(exports_pr_groups, {
   handlePrGroupHttpRequest: () => handlePrGroupHttpRequest
 });
-function json3(body, status = 200) {
-  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS2 });
+function json4(body2, status2 = 200) {
+  return new Response(JSON.stringify(body2), { status: status2, headers: JSON_HEADERS3 });
 }
 function errorStatus2(error) {
   switch (error.code) {
@@ -54459,26 +55942,26 @@ async function handlePrGroupHttpRequest(req, url, ledger, basePath, principal) {
   const method = req.method.toUpperCase();
   try {
     if (!groupId && method === "POST" && action === undefined) {
-      return json3({ error: "unknown PR-group route", code: "PR_GROUP_NOT_FOUND" }, 404);
+      return json4({ error: "unknown PR-group route", code: "PR_GROUP_NOT_FOUND" }, 404);
     }
     if (groupId === "admit" && !action) {
       if (method !== "POST")
-        return json3({ error: "method not allowed" }, 405);
-      const body = await readJson2(req);
-      if (!body)
-        return json3({ error: "invalid JSON body", code: "PR_GROUP_INVALID_INPUT" }, 400);
-      return json3(await ledger.admit(body), 201);
+        return json4({ error: "method not allowed" }, 405);
+      const body2 = await readJson2(req);
+      if (!body2)
+        return json4({ error: "invalid JSON body", code: "PR_GROUP_INVALID_INPUT" }, 400);
+      return json4(await ledger.admit(body2), 201);
     }
     if (!groupId)
-      return json3({ error: "PR group id is required", code: "PR_GROUP_INVALID_INPUT" }, 400);
+      return json4({ error: "PR group id is required", code: "PR_GROUP_INVALID_INPUT" }, 400);
     if (!action && method === "GET") {
-      return json3({ view: await ledger.get(groupId) });
+      return json4({ view: await ledger.get(groupId) });
     }
     if (action === "events") {
       if (method === "GET") {
         const limit = url.searchParams.has("limit") ? Number(url.searchParams.get("limit")) : undefined;
         const afterSequence = url.searchParams.has("after_sequence") ? Number(url.searchParams.get("after_sequence")) : undefined;
-        return json3({
+        return json4({
           history: await ledger.events(groupId, {
             ...limit !== undefined ? { limit } : {},
             ...afterSequence !== undefined ? { after_sequence: afterSequence } : {}
@@ -54486,54 +55969,54 @@ async function handlePrGroupHttpRequest(req, url, ledger, basePath, principal) {
         });
       }
       if (method === "POST") {
-        const body = await readJson2(req);
-        if (!body)
-          return json3({ error: "invalid JSON body", code: "PR_GROUP_INVALID_INPUT" }, 400);
-        return json3(await ledger.append({
-          ...body,
+        const body2 = await readJson2(req);
+        if (!body2)
+          return json4({ error: "invalid JSON body", code: "PR_GROUP_INVALID_INPUT" }, 400);
+        return json4(await ledger.append({
+          ...body2,
           group_id: groupId,
           authenticated_actor_id: principal?.actor_id ?? undefined,
           authenticated_actor_run_id: principal?.actor_run_id ?? undefined
         }), 201);
       }
-      return json3({ error: "method not allowed" }, 405);
+      return json4({ error: "method not allowed" }, 405);
     }
     if (action === "recover") {
       if (method !== "POST")
-        return json3({ error: "method not allowed" }, 405);
-      const body = await readJson2(req);
-      if (!body)
-        return json3({ error: "invalid JSON body", code: "PR_GROUP_INVALID_INPUT" }, 400);
-      return json3(await ledger.recover({
-        ...body,
+        return json4({ error: "method not allowed" }, 405);
+      const body2 = await readJson2(req);
+      if (!body2)
+        return json4({ error: "invalid JSON body", code: "PR_GROUP_INVALID_INPUT" }, 400);
+      return json4(await ledger.recover({
+        ...body2,
         group_id: groupId
       }), 201);
     }
-    return json3({ error: "unknown PR-group route", code: "PR_GROUP_NOT_FOUND" }, 404);
+    return json4({ error: "unknown PR-group route", code: "PR_GROUP_NOT_FOUND" }, 404);
   } catch (cause) {
     if (cause instanceof PrGroupLedgerError) {
-      return json3({
+      return json4({
         error: cause.message,
         code: cause.code,
         details: cause.details,
         authoritative: true
       }, errorStatus2(cause));
     }
-    return json3({
+    return json4({
       error: cause instanceof Error ? cause.message : "internal PR-group error",
       code: "PR_GROUP_ATOMICITY_UNAVAILABLE"
     }, 500);
   }
 }
-var JSON_HEADERS2;
+var JSON_HEADERS3;
 var init_pr_groups = __esm(() => {
   init_types3();
-  JSON_HEADERS2 = { "Content-Type": "application/json" };
+  JSON_HEADERS3 = { "Content-Type": "application/json" };
 });
 
 // src/lib/comment-cursor.ts
-function encodeCommentCursor(comment) {
-  return Buffer.from(JSON.stringify({ created_at: comment.created_at, id: comment.id }), "utf8").toString("base64url");
+function encodeCommentCursor(comment2) {
+  return Buffer.from(JSON.stringify({ created_at: comment2.created_at, id: comment2.id }), "utf8").toString("base64url");
 }
 function decodeCommentCursor(value) {
   if (value.length > MAX_COMMENT_CURSOR_LENGTH)
@@ -54555,26 +56038,26 @@ function decodeCommentCursor(value) {
 var MAX_COMMENT_CURSOR_LENGTH = 1024;
 
 // src/lib/project-task-list-ensure.ts
-import { createHash as createHash16 } from "crypto";
-function canonicalJson(value) {
+import { createHash as createHash17 } from "crypto";
+function canonicalJson2(value) {
   if (value === null || typeof value !== "object")
     return JSON.stringify(value);
   if (Array.isArray(value))
-    return `[${value.map(canonicalJson).join(",")}]`;
-  return `{${Object.entries(value).filter(([, item]) => item !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`).join(",")}}`;
+    return `[${value.map(canonicalJson2).join(",")}]`;
+  return `{${Object.entries(value).filter(([, item]) => item !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key2, item]) => `${JSON.stringify(key2)}:${canonicalJson2(item)}`).join(",")}}`;
 }
 function digest(value) {
-  return createHash16("sha256").update(canonicalJson(value)).digest("hex");
+  return createHash17("sha256").update(canonicalJson2(value)).digest("hex");
 }
 function deriveIdempotencyKey(projectId, slug) {
   return `ptlk_${digest({ project_id: projectId, slug }).slice(0, 48)}`;
 }
 function normalizeIdempotencyKey(value, projectId, slug) {
-  const key = value?.trim() || deriveIdempotencyKey(projectId, slug);
-  if (key.length < 8 || key.length > 128 || !/^[A-Za-z0-9._:-]+$/.test(key)) {
+  const key2 = value?.trim() || deriveIdempotencyKey(projectId, slug);
+  if (key2.length < 8 || key2.length > 128 || !/^[A-Za-z0-9._:-]+$/.test(key2)) {
     throw new ProjectTaskListEnsureError("PROJECT_TASK_LIST_IDEMPOTENCY_KEY_INVALID", "idempotency_key must be 8-128 ASCII letters, digits, dots, underscores, colons, or hyphens");
   }
-  return key;
+  return key2;
 }
 function receiptId2(projectId, slug, idempotencyKey) {
   return `ptlr_${digest({ project_id: projectId, slug, idempotency_key: idempotencyKey }).slice(0, 48)}`;
@@ -54837,7 +56320,7 @@ async function exactPlanProjectLinkState(store, planId, projectId) {
 }
 async function planPlanProjectLink(store, planId, projectId) {
   const state = await exactPlanProjectLinkState(store, planId, projectId);
-  const alreadyLinked = state.plan.project_id === state.project.id && state.tasks.every((task2) => task2.project_id === state.project.id);
+  const alreadyLinked = state.plan.project_id === state.project.id && state.tasks.every((task3) => task3.project_id === state.project.id);
   return {
     mode: "plan",
     action: alreadyLinked ? "already_linked" : "would_link",
@@ -54849,14 +56332,14 @@ async function applyPlanProjectLink(store, planId, projectId, options) {
   if (!store.planProjectLinks) {
     throw new PlanProjectLinkError("PLAN_PROJECT_LINK_UNSUPPORTED", "This storage backend cannot atomically link an existing plan and its tasks", { storage_kind: store.kind });
   }
-  const key = normalizePlanProjectLinkIdempotencyKey(options.idempotency_key);
+  const key2 = normalizePlanProjectLinkIdempotencyKey(options.idempotency_key);
   return store.planProjectLinks.apply({
     plan_id: planId,
     project_id: projectId,
     expected_plan_revision: options.expected_plan_revision,
     expected_project_revision: options.expected_project_revision,
-    idempotency_key: key,
-    receipt_id: planProjectLinkReceiptId(key),
+    idempotency_key: key2,
+    receipt_id: planProjectLinkReceiptId(key2),
     created_at: new Date().toISOString()
   });
 }
@@ -54885,11 +56368,11 @@ __export(exports_v1, {
   handleV1Request: () => handleV1Request,
   countSnapshotRecords: () => countSnapshotRecords
 });
-function json4(body, status = 200) {
-  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS3 });
+function json5(body2, status2 = 200) {
+  return new Response(JSON.stringify(body2), { status: status2, headers: JSON_HEADERS4 });
 }
-function error(status, message, extra) {
-  return json4({ error: message, ...extra ?? {} }, status);
+function error(status2, message, extra) {
+  return json5({ error: message, ...extra ?? {} }, status2);
 }
 function enumQueryParam(url, name, vocabulary) {
   const raw = url.searchParams.get(name);
@@ -54918,112 +56401,112 @@ function parseSinceCursor(raw) {
 function validateTaskCompletion(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return { ok: false, message: "completion body must be an object" };
-  const body = value;
+  const body2 = value;
   const allowed = new Set(["agent_id", "attachment_ids", "files_changed", "test_results", "commit_hash", "notes", "confidence"]);
-  const unknown = Object.keys(body).find((key) => !allowed.has(key));
+  const unknown = Object.keys(body2).find((key2) => !allowed.has(key2));
   if (unknown)
     return { ok: false, message: `unknown completion field: ${unknown}` };
-  if (body.agent_id !== undefined && (typeof body.agent_id !== "string" || !body.agent_id.trim())) {
+  if (body2.agent_id !== undefined && (typeof body2.agent_id !== "string" || !body2.agent_id.trim())) {
     return { ok: false, message: "agent_id must be a non-empty string" };
   }
   for (const field of ["attachment_ids", "files_changed"]) {
-    const value2 = body[field];
+    const value2 = body2[field];
     if (value2 !== undefined && (!Array.isArray(value2) || value2.some((item) => typeof item !== "string" || !item.trim()))) {
       return { ok: false, message: `${field} must be an array of non-empty strings` };
     }
   }
   for (const field of ["test_results", "commit_hash", "notes"]) {
-    if (body[field] !== undefined && typeof body[field] !== "string") {
+    if (body2[field] !== undefined && typeof body2[field] !== "string") {
       return { ok: false, message: `${field} must be a string` };
     }
   }
-  if (body.confidence !== undefined && (typeof body.confidence !== "number" || !Number.isFinite(body.confidence) || body.confidence < 0 || body.confidence > 1)) {
+  if (body2.confidence !== undefined && (typeof body2.confidence !== "number" || !Number.isFinite(body2.confidence) || body2.confidence < 0 || body2.confidence > 1)) {
     return { ok: false, message: "confidence must be a number between 0 and 1" };
   }
   return {
     ok: true,
-    ...typeof body.agent_id === "string" ? { agentId: body.agent_id } : {},
+    ...typeof body2.agent_id === "string" ? { agentId: body2.agent_id } : {},
     options: {
-      ...Array.isArray(body.attachment_ids) ? { attachment_ids: body.attachment_ids } : {},
-      ...Array.isArray(body.files_changed) ? { files_changed: body.files_changed } : {},
-      ...typeof body.test_results === "string" ? { test_results: body.test_results } : {},
-      ...typeof body.commit_hash === "string" ? { commit_hash: body.commit_hash } : {},
-      ...typeof body.notes === "string" ? { notes: body.notes } : {},
-      ...typeof body.confidence === "number" ? { confidence: body.confidence } : {}
+      ...Array.isArray(body2.attachment_ids) ? { attachment_ids: body2.attachment_ids } : {},
+      ...Array.isArray(body2.files_changed) ? { files_changed: body2.files_changed } : {},
+      ...typeof body2.test_results === "string" ? { test_results: body2.test_results } : {},
+      ...typeof body2.commit_hash === "string" ? { commit_hash: body2.commit_hash } : {},
+      ...typeof body2.notes === "string" ? { notes: body2.notes } : {},
+      ...typeof body2.confidence === "number" ? { confidence: body2.confidence } : {}
     }
   };
 }
 function validateProjectPatch(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return { ok: false, message: "project patch must be an object" };
-  const body = value;
+  const body2 = value;
   const allowed = new Set(["name", "path", "description"]);
-  const unknown = Object.keys(body).find((key) => !allowed.has(key));
+  const unknown = Object.keys(body2).find((key2) => !allowed.has(key2));
   if (unknown)
     return { ok: false, message: `unknown project field: ${unknown}` };
-  if (Object.keys(body).length === 0)
+  if (Object.keys(body2).length === 0)
     return { ok: false, message: "project patch must not be empty" };
-  if (body["name"] !== undefined && (typeof body["name"] !== "string" || !body["name"].trim()))
+  if (body2["name"] !== undefined && (typeof body2["name"] !== "string" || !body2["name"].trim()))
     return { ok: false, message: "name must be a non-empty string" };
-  if (body["path"] !== undefined && (typeof body["path"] !== "string" || !body["path"].trim()))
+  if (body2["path"] !== undefined && (typeof body2["path"] !== "string" || !body2["path"].trim()))
     return { ok: false, message: "path must be a non-empty string" };
-  if (body["description"] !== undefined && body["description"] !== null && typeof body["description"] !== "string")
+  if (body2["description"] !== undefined && body2["description"] !== null && typeof body2["description"] !== "string")
     return { ok: false, message: "description must be a string or null" };
-  return { ok: true, patch: body };
+  return { ok: true, patch: body2 };
 }
 function validateProjectCreate(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return { ok: false, message: "project body must be an object" };
-  const body = value;
+  const body2 = value;
   const allowed = new Set(["name", "path", "description", "task_list_id", "task_prefix"]);
-  const unknown = Object.keys(body).find((key) => !allowed.has(key));
+  const unknown = Object.keys(body2).find((key2) => !allowed.has(key2));
   if (unknown)
     return { ok: false, message: `unknown project field: ${unknown}` };
-  if (typeof body["name"] !== "string" || !body["name"].trim())
+  if (typeof body2["name"] !== "string" || !body2["name"].trim())
     return { ok: false, message: "name must be a non-empty string" };
-  if (!normalizeSlug(body["name"]))
+  if (!normalizeSlug(body2["name"]))
     return { ok: false, message: "name must produce a non-empty canonical slug" };
-  if (typeof body["path"] !== "string" || !body["path"].trim())
+  if (typeof body2["path"] !== "string" || !body2["path"].trim())
     return { ok: false, message: "path must be a non-empty string" };
-  if (body["description"] !== undefined && typeof body["description"] !== "string")
+  if (body2["description"] !== undefined && typeof body2["description"] !== "string")
     return { ok: false, message: "description must be a string" };
-  if (body["task_list_id"] !== undefined && !isCanonicalSlug(body["task_list_id"])) {
+  if (body2["task_list_id"] !== undefined && !isCanonicalSlug(body2["task_list_id"])) {
     return { ok: false, message: "task_list_id must be non-empty canonical kebab-case" };
   }
-  if (body["task_prefix"] !== undefined && (typeof body["task_prefix"] !== "string" || !body["task_prefix"].trim())) {
+  if (body2["task_prefix"] !== undefined && (typeof body2["task_prefix"] !== "string" || !body2["task_prefix"].trim())) {
     return { ok: false, message: "task_prefix must be a non-empty string" };
   }
-  return { ok: true, input: body };
+  return { ok: true, input: body2 };
 }
 function validatePlanCreate(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return { ok: false, message: "plan body must be an object" };
-  const body = value;
+  const body2 = value;
   const allowed = new Set(["title", "name", "slug", "description", "project_id", "task_list_id", "agent_id", "status"]);
-  const unknown = Object.keys(body).find((key) => !allowed.has(key));
+  const unknown = Object.keys(body2).find((key2) => !allowed.has(key2));
   if (unknown)
     return { ok: false, message: `unknown plan field: ${unknown}` };
-  if (body.name !== undefined && (typeof body.name !== "string" || !body.name.trim()))
+  if (body2.name !== undefined && (typeof body2.name !== "string" || !body2.name.trim()))
     return { ok: false, message: "name must be a non-empty string" };
-  if (body.title !== undefined && (typeof body.title !== "string" || !body.title.trim()))
+  if (body2.title !== undefined && (typeof body2.title !== "string" || !body2.title.trim()))
     return { ok: false, message: "title must be a non-empty string" };
-  if (typeof body.name === "string" && typeof body.title === "string" && body.name !== body.title) {
+  if (typeof body2.name === "string" && typeof body2.title === "string" && body2.name !== body2.title) {
     return { ok: false, message: "name and title must match when both are provided" };
   }
-  const name = body.name ?? body.title;
+  const name = body2.name ?? body2.title;
   if (!name)
     return { ok: false, message: "name is required" };
   for (const field of ["slug", "project_id", "task_list_id", "agent_id"]) {
-    if (body[field] !== undefined && (typeof body[field] !== "string" || !body[field].trim())) {
+    if (body2[field] !== undefined && (typeof body2[field] !== "string" || !body2[field].trim())) {
       return { ok: false, message: `${field} must be a non-empty string` };
     }
   }
-  const slug = typeof body.slug === "string" ? normalizeSlug(body.slug) : undefined;
-  if (body.slug !== undefined && !slug)
+  const slug = typeof body2.slug === "string" ? normalizeSlug(body2.slug) : undefined;
+  if (body2.slug !== undefined && !slug)
     return { ok: false, message: "slug must produce a non-empty canonical slug" };
-  if (body.description !== undefined && typeof body.description !== "string")
+  if (body2.description !== undefined && typeof body2.description !== "string")
     return { ok: false, message: "description must be a string" };
-  if (body.status !== undefined && (typeof body.status !== "string" || !["active", "completed", "archived"].includes(body.status))) {
+  if (body2.status !== undefined && (typeof body2.status !== "string" || !["active", "completed", "archived"].includes(body2.status))) {
     return { ok: false, message: "status must be active, completed, or archived" };
   }
   return {
@@ -55031,102 +56514,102 @@ function validatePlanCreate(value) {
     input: {
       name,
       ...slug ? { slug } : {},
-      ...typeof body.description === "string" ? { description: body.description } : {},
-      ...typeof body.project_id === "string" ? { project_id: body.project_id } : {},
-      ...typeof body.task_list_id === "string" ? { task_list_id: body.task_list_id } : {},
-      ...typeof body.agent_id === "string" ? { agent_id: body.agent_id } : {},
-      ...typeof body.status === "string" ? { status: body.status } : {}
+      ...typeof body2.description === "string" ? { description: body2.description } : {},
+      ...typeof body2.project_id === "string" ? { project_id: body2.project_id } : {},
+      ...typeof body2.task_list_id === "string" ? { task_list_id: body2.task_list_id } : {},
+      ...typeof body2.agent_id === "string" ? { agent_id: body2.agent_id } : {},
+      ...typeof body2.status === "string" ? { status: body2.status } : {}
     }
   };
 }
 function validateTemplateTask(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return null;
-  const body = value;
+  const body2 = value;
   const allowed = new Set(["position", "title_pattern", "description", "priority", "tags", "task_type", "condition", "include_template_id", "depends_on", "depends_on_positions", "metadata"]);
-  if (Object.keys(body).some((key) => !allowed.has(key)))
+  if (Object.keys(body2).some((key2) => !allowed.has(key2)))
     return null;
-  if (typeof body.title_pattern !== "string" || !body.title_pattern.trim())
+  if (typeof body2.title_pattern !== "string" || !body2.title_pattern.trim())
     return null;
-  if (body.position !== undefined && (typeof body.position !== "number" || !Number.isSafeInteger(body.position) || body.position < 0))
+  if (body2.position !== undefined && (typeof body2.position !== "number" || !Number.isSafeInteger(body2.position) || body2.position < 0))
     return null;
-  if (body.description !== undefined && body.description !== null && typeof body.description !== "string")
+  if (body2.description !== undefined && body2.description !== null && typeof body2.description !== "string")
     return null;
-  if (body.priority !== undefined && (typeof body.priority !== "string" || !["low", "medium", "high", "critical"].includes(body.priority)))
+  if (body2.priority !== undefined && (typeof body2.priority !== "string" || !["low", "medium", "high", "critical"].includes(body2.priority)))
     return null;
-  if (body.tags !== undefined && (!Array.isArray(body.tags) || body.tags.some((tag) => typeof tag !== "string" || !tag.trim())))
+  if (body2.tags !== undefined && (!Array.isArray(body2.tags) || body2.tags.some((tag) => typeof tag !== "string" || !tag.trim())))
     return null;
   for (const field of ["task_type", "condition", "include_template_id"]) {
-    if (body[field] !== undefined && body[field] !== null && (typeof body[field] !== "string" || !body[field].trim()))
+    if (body2[field] !== undefined && body2[field] !== null && (typeof body2[field] !== "string" || !body2[field].trim()))
       return null;
   }
-  if (body.depends_on !== undefined && body.depends_on_positions !== undefined)
+  if (body2.depends_on !== undefined && body2.depends_on_positions !== undefined)
     return null;
-  const dependencies = body.depends_on ?? body.depends_on_positions;
+  const dependencies = body2.depends_on ?? body2.depends_on_positions;
   if (dependencies !== undefined && (!Array.isArray(dependencies) || dependencies.some((position) => !Number.isSafeInteger(position) || position < 0)))
     return null;
-  if (body.metadata !== undefined && (!body.metadata || typeof body.metadata !== "object" || Array.isArray(body.metadata)))
+  if (body2.metadata !== undefined && (!body2.metadata || typeof body2.metadata !== "object" || Array.isArray(body2.metadata)))
     return null;
   return {
-    title_pattern: body.title_pattern,
-    ...typeof body.description === "string" ? { description: body.description } : {},
-    ...typeof body.priority === "string" ? { priority: body.priority } : {},
-    ...Array.isArray(body.tags) ? { tags: body.tags } : {},
-    ...typeof body.task_type === "string" ? { task_type: body.task_type } : {},
-    ...typeof body.condition === "string" ? { condition: body.condition } : {},
-    ...typeof body.include_template_id === "string" ? { include_template_id: body.include_template_id } : {},
+    title_pattern: body2.title_pattern,
+    ...typeof body2.description === "string" ? { description: body2.description } : {},
+    ...typeof body2.priority === "string" ? { priority: body2.priority } : {},
+    ...Array.isArray(body2.tags) ? { tags: body2.tags } : {},
+    ...typeof body2.task_type === "string" ? { task_type: body2.task_type } : {},
+    ...typeof body2.condition === "string" ? { condition: body2.condition } : {},
+    ...typeof body2.include_template_id === "string" ? { include_template_id: body2.include_template_id } : {},
     ...Array.isArray(dependencies) ? { depends_on: dependencies } : {},
-    ...body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata) ? { metadata: body.metadata } : {}
+    ...body2.metadata && typeof body2.metadata === "object" && !Array.isArray(body2.metadata) ? { metadata: body2.metadata } : {}
   };
 }
 function validateTemplateCreate(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return { ok: false, message: "template body must be an object" };
-  const body = value;
+  const body2 = value;
   const allowed = new Set(["name", "title_pattern", "description", "priority", "tags", "variables", "project_id", "plan_id", "metadata", "tasks"]);
-  const unknown = Object.keys(body).find((key) => !allowed.has(key));
+  const unknown = Object.keys(body2).find((key2) => !allowed.has(key2));
   if (unknown)
     return { ok: false, message: `unknown template field: ${unknown}` };
-  if (typeof body.name !== "string" || !body.name.trim())
+  if (typeof body2.name !== "string" || !body2.name.trim())
     return { ok: false, message: "name must be a non-empty string" };
-  if (typeof body.title_pattern !== "string" || !body.title_pattern.trim())
+  if (typeof body2.title_pattern !== "string" || !body2.title_pattern.trim())
     return { ok: false, message: "title_pattern must be a non-empty string" };
-  if (body.description !== undefined && body.description !== null && typeof body.description !== "string")
+  if (body2.description !== undefined && body2.description !== null && typeof body2.description !== "string")
     return { ok: false, message: "description must be a string or null" };
-  if (body.priority !== undefined && (typeof body.priority !== "string" || !["low", "medium", "high", "critical"].includes(body.priority)))
+  if (body2.priority !== undefined && (typeof body2.priority !== "string" || !["low", "medium", "high", "critical"].includes(body2.priority)))
     return { ok: false, message: "priority must be low, medium, high, or critical" };
-  if (body.tags !== undefined && (!Array.isArray(body.tags) || body.tags.some((tag) => typeof tag !== "string" || !tag.trim())))
+  if (body2.tags !== undefined && (!Array.isArray(body2.tags) || body2.tags.some((tag) => typeof tag !== "string" || !tag.trim())))
     return { ok: false, message: "tags must be an array of non-empty strings" };
-  if (body.variables !== undefined && (!Array.isArray(body.variables) || body.variables.some((variable) => !variable || typeof variable !== "object" || Array.isArray(variable) || typeof variable.name !== "string" || !variable.name || typeof variable.required !== "boolean" || variable.default !== undefined && typeof variable.default !== "string" || variable.description !== undefined && typeof variable.description !== "string"))) {
+  if (body2.variables !== undefined && (!Array.isArray(body2.variables) || body2.variables.some((variable) => !variable || typeof variable !== "object" || Array.isArray(variable) || typeof variable.name !== "string" || !variable.name || typeof variable.required !== "boolean" || variable.default !== undefined && typeof variable.default !== "string" || variable.description !== undefined && typeof variable.description !== "string"))) {
     return { ok: false, message: "variables must be valid template variable objects" };
   }
   for (const field of ["project_id", "plan_id"]) {
-    if (body[field] !== undefined && body[field] !== null && (typeof body[field] !== "string" || !body[field].trim()))
+    if (body2[field] !== undefined && body2[field] !== null && (typeof body2[field] !== "string" || !body2[field].trim()))
       return { ok: false, message: `${field} must be a non-empty string or null` };
   }
-  if (body.metadata !== undefined && (!body.metadata || typeof body.metadata !== "object" || Array.isArray(body.metadata)))
+  if (body2.metadata !== undefined && (!body2.metadata || typeof body2.metadata !== "object" || Array.isArray(body2.metadata)))
     return { ok: false, message: "metadata must be an object" };
-  const tasks = body.tasks === undefined ? [] : Array.isArray(body.tasks) ? body.tasks.map(validateTemplateTask) : null;
-  if (tasks === null || tasks.some((task2) => task2 === null))
+  const tasks = body2.tasks === undefined ? [] : Array.isArray(body2.tasks) ? body2.tasks.map(validateTemplateTask) : null;
+  if (tasks === null || tasks.some((task3) => task3 === null))
     return { ok: false, message: "tasks must be valid template task objects" };
   const taskInputs = tasks;
-  for (const [position, task2] of taskInputs.entries()) {
-    if ((task2.depends_on ?? []).some((dependency) => dependency >= position)) {
+  for (const [position, task3] of taskInputs.entries()) {
+    if ((task3.depends_on ?? []).some((dependency2) => dependency2 >= position)) {
       return { ok: false, message: "template task dependencies must reference earlier task positions" };
     }
   }
   return {
     ok: true,
     input: {
-      name: body.name,
-      title_pattern: body.title_pattern,
-      ...typeof body.description === "string" ? { description: body.description } : {},
-      ...typeof body.priority === "string" ? { priority: body.priority } : {},
-      ...Array.isArray(body.tags) ? { tags: body.tags } : {},
-      ...Array.isArray(body.variables) ? { variables: body.variables } : {},
-      ...typeof body.project_id === "string" ? { project_id: body.project_id } : {},
-      ...typeof body.plan_id === "string" ? { plan_id: body.plan_id } : {},
-      ...body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata) ? { metadata: body.metadata } : {},
+      name: body2.name,
+      title_pattern: body2.title_pattern,
+      ...typeof body2.description === "string" ? { description: body2.description } : {},
+      ...typeof body2.priority === "string" ? { priority: body2.priority } : {},
+      ...Array.isArray(body2.tags) ? { tags: body2.tags } : {},
+      ...Array.isArray(body2.variables) ? { variables: body2.variables } : {},
+      ...typeof body2.project_id === "string" ? { project_id: body2.project_id } : {},
+      ...typeof body2.plan_id === "string" ? { plan_id: body2.plan_id } : {},
+      ...body2.metadata && typeof body2.metadata === "object" && !Array.isArray(body2.metadata) ? { metadata: body2.metadata } : {},
       tasks: taskInputs
     }
   };
@@ -55134,25 +56617,25 @@ function validateTemplateCreate(value) {
 function validateTemplatePatch(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return { ok: false, message: "template patch must be an object" };
-  const body = value;
+  const body2 = value;
   const allowed = new Set(["name", "title_pattern", "description", "priority", "tags", "variables", "project_id", "plan_id", "metadata"]);
-  const unknown = Object.keys(body).find((key) => !allowed.has(key));
+  const unknown = Object.keys(body2).find((key2) => !allowed.has(key2));
   if (unknown)
     return { ok: false, message: `unknown template field: ${unknown}` };
-  if (Object.keys(body).length === 0)
+  if (Object.keys(body2).length === 0)
     return { ok: false, message: "template patch must not be empty" };
-  const templateLike = { name: body.name ?? "template", title_pattern: body.title_pattern ?? "template", ...body };
+  const templateLike = { name: body2.name ?? "template", title_pattern: body2.title_pattern ?? "template", ...body2 };
   const validated = validateTemplateCreate(templateLike);
   if (!validated.ok)
     return validated;
   const { name: _name, title_pattern: _title, tasks: _tasks, ...patch } = validated.input;
   return { ok: true, patch: {
-    ...body.name !== undefined ? { name: validated.input.name } : {},
-    ...body.title_pattern !== undefined ? { title_pattern: validated.input.title_pattern } : {},
+    ...body2.name !== undefined ? { name: validated.input.name } : {},
+    ...body2.title_pattern !== undefined ? { title_pattern: validated.input.title_pattern } : {},
     ...patch,
-    ...body.description === null ? { description: null } : {},
-    ...body.project_id === null ? { project_id: null } : {},
-    ...body.plan_id === null ? { plan_id: null } : {}
+    ...body2.description === null ? { description: null } : {},
+    ...body2.project_id === null ? { project_id: null } : {},
+    ...body2.plan_id === null ? { plan_id: null } : {}
   } };
 }
 async function readJson3(req) {
@@ -55175,29 +56658,29 @@ async function readOptionalJson(req) {
     return { ok: false };
   }
 }
-function contextFromPrincipal(principal, body) {
-  const agentId = body?.agent_id || principal.agent || undefined;
+function contextFromPrincipal(principal, body2) {
+  const agentId = body2?.agent_id || principal.agent || undefined;
   return agentId ? { agentId } : {};
 }
-function redactComment3(comment) {
-  return { ...comment, content: redactEvidenceText(comment.content) };
+function redactComment3(comment2) {
+  return { ...comment2, content: redactEvidenceText(comment2.content) };
 }
 function normalizeImportSnapshot(raw) {
-  const body = raw && typeof raw === "object" ? raw : {};
+  const body2 = raw && typeof raw === "object" ? raw : {};
   const arr = (v) => Array.isArray(v) ? v : [];
   return {
-    exportedAt: typeof body["exportedAt"] === "string" ? body["exportedAt"] : new Date().toISOString(),
-    source: typeof body["source"] === "string" ? body["source"] : "sqlite",
-    tasks: arr(body["tasks"]),
-    projects: arr(body["projects"]),
-    projectMachinePaths: arr(body["projectMachinePaths"]),
-    plans: arr(body["plans"]),
-    agents: arr(body["agents"]),
-    taskLists: arr(body["taskLists"]),
-    templates: arr(body["templates"]),
-    templateTasks: arr(body["templateTasks"]),
-    auditHistory: arr(body["auditHistory"]),
-    tombstones: arr(body["tombstones"])
+    exportedAt: typeof body2["exportedAt"] === "string" ? body2["exportedAt"] : new Date().toISOString(),
+    source: typeof body2["source"] === "string" ? body2["source"] : "sqlite",
+    tasks: arr(body2["tasks"]),
+    projects: arr(body2["projects"]),
+    projectMachinePaths: arr(body2["projectMachinePaths"]),
+    plans: arr(body2["plans"]),
+    agents: arr(body2["agents"]),
+    taskLists: arr(body2["taskLists"]),
+    templates: arr(body2["templates"]),
+    templateTasks: arr(body2["templateTasks"]),
+    auditHistory: arr(body2["auditHistory"]),
+    tombstones: arr(body2["tombstones"])
   };
 }
 function countSnapshotRecords(s) {
@@ -55228,6 +56711,9 @@ async function handleV1Request(req, url, dependencies = {}) {
   if (path === "/v1/project-registration" || path.startsWith("/v1/project-registration/")) {
     return handleTodosProjectRegistrationHttpRequest(req, url, (dependencies.getProjectRegistrationAuthority ?? getCloudProjectRegistrationAuthority)());
   }
+  if (path === "/v1/task-manifest" || path.startsWith("/v1/task-manifest/")) {
+    return handleTodosTaskManifestHttpRequest(req, url, (dependencies.getTaskManifestAuthority ?? getCloudTaskManifestAuthority)());
+  }
   const store = (dependencies.getStorageAdapter ?? getCloudStorageAdapter)();
   const segments = path.split("/").filter(Boolean);
   const resource = segments[1];
@@ -55239,8 +56725,8 @@ async function handleV1Request(req, url, dependencies = {}) {
       if (id === "exists" && !action) {
         if (method !== "POST")
           return error(405, `method ${method} not allowed on /v1/tasks/exists`);
-        const body = await readJson3(req);
-        const ids2 = Array.isArray(body?.ids) ? Array.from(new Set(body.ids.filter((v) => typeof v === "string" && v.length > 0))) : [];
+        const body2 = await readJson3(req);
+        const ids2 = Array.isArray(body2?.ids) ? Array.from(new Set(body2.ids.filter((v) => typeof v === "string" && v.length > 0))) : [];
         if (ids2.length === 0)
           return error(400, "provide a non-empty string array `ids`");
         if (ids2.length > 5000)
@@ -55249,7 +56735,7 @@ async function handleV1Request(req, url, dependencies = {}) {
         const presentSet = new Set(found.map((t) => t.id));
         const present = ids2.filter((i) => presentSet.has(i));
         const missing = ids2.filter((i) => !presentSet.has(i));
-        return json4({
+        return json5({
           requested: ids2.length,
           present_count: present.length,
           missing_count: missing.length,
@@ -55262,20 +56748,20 @@ async function handleV1Request(req, url, dependencies = {}) {
         if (typeof store.tasks.getByFingerprint !== "function") {
           return error(501, "fingerprint upsert is not supported by this storage backend");
         }
-        const body = await readJson3(req) ?? {};
-        const fingerprint3 = typeof body.fingerprint === "string" ? body.fingerprint.trim() : "";
+        const body2 = await readJson3(req) ?? {};
+        const fingerprint3 = typeof body2.fingerprint === "string" ? body2.fingerprint.trim() : "";
         if (!fingerprint3)
           return error(400, "fingerprint is required");
-        if (typeof body.title !== "string" || !body.title.trim())
+        if (typeof body2.title !== "string" || !body2.title.trim())
           return error(400, "title is required");
         const existing = await store.tasks.getByFingerprint(fingerprint3);
         const metadata = {
           ...existing?.metadata ?? {},
-          ...body.metadata ?? {},
+          ...body2.metadata ?? {},
           fingerprint: fingerprint3
         };
         const fields = { metadata };
-        for (const key of [
+        for (const key2 of [
           "title",
           "description",
           "priority",
@@ -55293,17 +56779,17 @@ async function handleV1Request(req, url, dependencies = {}) {
           "recurrence_rule",
           "task_type"
         ]) {
-          const bag = body;
-          if (bag[key] !== undefined)
-            fields[key] = bag[key];
+          const bag = body2;
+          if (bag[key2] !== undefined)
+            fields[key2] = bag[key2];
         }
         if (!existing) {
-          const task2 = await store.tasks.create({ ...fields, title: body.title }, contextFromPrincipal(principal, body));
-          return json4({ task: task2, created: true }, 201);
+          const task3 = await store.tasks.create({ ...fields, title: body2.title }, contextFromPrincipal(principal, body2));
+          return json5({ task: task3, created: true }, 201);
         }
         try {
-          const task2 = await store.tasks.update(existing.id, { ...fields, version: existing.version }, contextFromPrincipal(principal, body));
-          return json4({ task: task2, created: false });
+          const task3 = await store.tasks.update(existing.id, { ...fields, version: existing.version }, contextFromPrincipal(principal, body2));
+          return json5({ task: task3, created: false });
         } catch (e) {
           const msg = e.message || "";
           if (msg.includes("version conflict"))
@@ -55351,32 +56837,32 @@ async function handleV1Request(req, url, dependencies = {}) {
           const tasks = await store.tasks.list(filter);
           const { limit: _l, offset: _o, ...countFilter } = filter;
           const total = await store.tasks.count(countFilter);
-          return json4({ tasks, count: tasks.length, total });
+          return json5({ tasks, count: tasks.length, total });
         }
         if (method === "POST") {
-          const body = await readJson3(req);
-          if (!body || typeof body.title !== "string" || !body.title.trim()) {
+          const body2 = await readJson3(req);
+          if (!body2 || typeof body2.title !== "string" || !body2.title.trim()) {
             return error(400, "title is required");
           }
-          const storageContext = contextFromPrincipal(principal, body);
-          if (body.parent_id !== undefined) {
-            if (typeof body.parent_id !== "string" || !body.parent_id.trim()) {
+          const storageContext = contextFromPrincipal(principal, body2);
+          if (body2.parent_id !== undefined) {
+            if (typeof body2.parent_id !== "string" || !body2.parent_id.trim()) {
               return error(400, "parent_id must be a non-empty task id", {
                 code: "PARENT_TASK_ID_INVALID"
               });
             }
-            if (!await store.tasks.get(body.parent_id, storageContext)) {
-              return error(404, `parent task not found: ${body.parent_id}`, {
+            if (!await store.tasks.get(body2.parent_id, storageContext)) {
+              return error(404, `parent task not found: ${body2.parent_id}`, {
                 code: "PARENT_TASK_NOT_FOUND"
               });
             }
           }
-          const created = await store.tasks.create(body, storageContext);
+          const created = await store.tasks.create(body2, storageContext);
           const persisted = created?.id ? await store.tasks.get(created.id, storageContext) : null;
-          if (!persisted || persisted.id !== created.id || (persisted.parent_id ?? null) !== (body.parent_id ?? null)) {
+          if (!persisted || persisted.id !== created.id || (persisted.parent_id ?? null) !== (body2.parent_id ?? null)) {
             return error(500, "TASK_CREATE_PERSISTENCE_UNVERIFIED: task create was acknowledged but authoritative readback did not return the same stored task id and parent_id", { code: "TASK_CREATE_PERSISTENCE_UNVERIFIED" });
           }
-          return json4({ task: persisted }, 201);
+          return json5({ task: persisted }, 201);
         }
         return error(405, `method ${method} not allowed on /v1/tasks`);
       }
@@ -55393,7 +56879,7 @@ async function handleV1Request(req, url, dependencies = {}) {
               if (legacyPage.length > LEGACY_COMMENT_RESPONSE_LIMIT) {
                 return error(426, "task has too many comments for this client; upgrade @hasna/todos to use cursor pagination");
               }
-              return json4({
+              return json5({
                 comments: legacyPage,
                 count: legacyPage.length,
                 has_more: false,
@@ -55418,7 +56904,7 @@ async function handleV1Request(req, url, dependencies = {}) {
             const page = (await store.audit.getCommentsPage(id, { limit: limit + 1, ...before ? { before } : {} }, contextFromPrincipal(principal))).map(redactComment3);
             const hasMore = page.length > limit;
             const comments = hasMore ? page.slice(1) : page;
-            return json4({
+            return json5({
               comments,
               count: comments.length,
               has_more: hasMore,
@@ -55426,22 +56912,22 @@ async function handleV1Request(req, url, dependencies = {}) {
             });
           }
           if (method === "POST") {
-            const body2 = await readJson3(req) ?? {};
-            if (typeof body2.content !== "string" || !body2.content.trim()) {
+            const body3 = await readJson3(req) ?? {};
+            if (typeof body3.content !== "string" || !body3.content.trim()) {
               return error(400, "content is required");
             }
             const target = await store.tasks.get(id);
             if (!target)
               return error(404, "task not found");
-            const comment = await store.audit.addComment({
+            const comment2 = await store.audit.addComment({
               task_id: id,
-              content: body2.content,
-              agent_id: body2.agent_id ?? principal.agent ?? undefined,
-              session_id: body2.session_id,
-              type: body2.type,
-              progress_pct: body2.progress_pct
-            }, contextFromPrincipal(principal, body2));
-            return json4({ comment: redactComment3(comment) }, 201);
+              content: body3.content,
+              agent_id: body3.agent_id ?? principal.agent ?? undefined,
+              session_id: body3.session_id,
+              type: body3.type,
+              progress_pct: body3.progress_pct
+            }, contextFromPrincipal(principal, body3));
+            return json5({ comment: redactComment3(comment2) }, 201);
           }
           return error(405, `method ${method} not allowed on /v1/tasks/:id/comments`);
         }
@@ -55451,36 +56937,36 @@ async function handleV1Request(req, url, dependencies = {}) {
           if (!await store.tasks.get(id))
             return error(404, "task not found");
           const history = await store.audit.getTaskHistory(id);
-          return json4({ history, count: history.length });
+          return json5({ history, count: history.length });
         }
         if (action === "lock" || action === "unlock") {
           if (method !== "POST")
             return error(405, `method ${method} not allowed on /v1/tasks/:id/${action}`);
-          const body2 = await readJson3(req) ?? {};
+          const body3 = await readJson3(req) ?? {};
           if (!await store.tasks.get(id))
             return error(404, "task not found");
           if (action === "lock") {
             if (typeof store.tasks.lock !== "function")
               return error(501, "task locking is not supported by this storage backend");
-            const agentId3 = body2.agent_id || principal.agent || "todos-serve";
-            return json4({ result: await store.tasks.lock(id, agentId3) });
+            const agentId3 = body3.agent_id || principal.agent || "todos-serve";
+            return json5({ result: await store.tasks.lock(id, agentId3) });
           }
           if (typeof store.tasks.unlock !== "function")
             return error(501, "task unlocking is not supported by this storage backend");
-          if (body2.force === true) {
+          if (body3.force === true) {
             if (!principal.scopes.includes("todos:*"))
               return error(403, "force unlock requires todos:* scope");
             const released2 = await store.tasks.unlock(id);
-            return json4({ success: released2 });
+            return json5({ success: released2 });
           }
-          if (body2.agent_id && body2.agent_id !== principal.agent && !principal.scopes.includes("todos:*")) {
+          if (body3.agent_id && body3.agent_id !== principal.agent && !principal.scopes.includes("todos:*")) {
             return error(403, "unlock agent_id must match the authenticated agent");
           }
-          const agentId2 = body2.agent_id || principal.agent;
+          const agentId2 = body3.agent_id || principal.agent;
           if (!agentId2)
             return error(403, "unlock requires an agent-bound key or force=true");
           const released = await store.tasks.unlock(id, agentId2);
-          return json4({ success: released });
+          return json5({ success: released });
         }
         if (action === "dependencies") {
           if (!store.dependencies)
@@ -55489,16 +56975,16 @@ async function handleV1Request(req, url, dependencies = {}) {
             if (!await store.tasks.get(id))
               return error(404, "task not found");
             const edges = await store.dependencies.list(id);
-            return json4(edges);
+            return json5(edges);
           }
           if (method === "POST") {
-            const body2 = await readJson3(req) ?? {};
-            if (typeof body2.depends_on !== "string" || !body2.depends_on.trim()) {
+            const body3 = await readJson3(req) ?? {};
+            if (typeof body3.depends_on !== "string" || !body3.depends_on.trim()) {
               return error(400, "depends_on is required");
             }
             try {
-              const dependency = await store.dependencies.add(id, body2.depends_on, contextFromPrincipal(principal));
-              return json4({ dependency }, 201);
+              const dependency2 = await store.dependencies.add(id, body3.depends_on, contextFromPrincipal(principal));
+              return json5({ dependency: dependency2 }, 201);
             } catch (e) {
               const msg = e.message || "";
               if (msg.includes("not found"))
@@ -55512,7 +56998,7 @@ async function handleV1Request(req, url, dependencies = {}) {
             if (!subId)
               return error(400, "dependency target id is required (/v1/tasks/:id/dependencies/:dep)");
             const removed = await store.dependencies.remove(id, subId);
-            return json4({ removed });
+            return json5({ removed });
           }
           return error(405, `method ${method} not allowed on /v1/tasks/:id/dependencies`);
         }
@@ -55523,23 +57009,23 @@ async function handleV1Request(req, url, dependencies = {}) {
             if (!await store.tasks.get(id))
               return error(404, "task not found");
             const verifications = await store.verifications.list(id);
-            return json4({ verifications, count: verifications.length });
+            return json5({ verifications, count: verifications.length });
           }
           if (method === "POST") {
-            const body2 = await readJson3(req) ?? {};
-            if (typeof body2.command !== "string" || !body2.command.trim()) {
+            const body3 = await readJson3(req) ?? {};
+            if (typeof body3.command !== "string" || !body3.command.trim()) {
               return error(400, "command is required");
             }
             try {
-              const verification = await store.verifications.add({
+              const verification2 = await store.verifications.add({
                 task_id: id,
-                command: body2.command,
-                status: body2.status,
-                output_summary: body2.output_summary,
-                artifact_path: body2.artifact_path,
-                agent_id: body2.agent_id
-              }, contextFromPrincipal(principal, body2));
-              return json4({ verification }, 201);
+                command: body3.command,
+                status: body3.status,
+                output_summary: body3.output_summary,
+                artifact_path: body3.artifact_path,
+                agent_id: body3.agent_id
+              }, contextFromPrincipal(principal, body3));
+              return json5({ verification: verification2 }, 201);
             } catch (e) {
               const msg = e.message || "";
               if (msg.includes("not found"))
@@ -55556,21 +57042,21 @@ async function handleV1Request(req, url, dependencies = {}) {
             if (!await store.tasks.get(id))
               return error(404, "task not found");
             const commits = await store.commits.list(id);
-            return json4({ commits, count: commits.length });
+            return json5({ commits, count: commits.length });
           }
           if (method === "POST") {
-            const body2 = await readJson3(req) ?? {};
-            if (typeof body2.sha !== "string" || !body2.sha.trim())
+            const body3 = await readJson3(req) ?? {};
+            if (typeof body3.sha !== "string" || !body3.sha.trim())
               return error(400, "sha is required");
             try {
               const commit = await store.commits.add({
                 task_id: id,
-                sha: body2.sha,
-                message: body2.message,
-                author: body2.author,
-                files_changed: Array.isArray(body2.files_changed) ? body2.files_changed : undefined
+                sha: body3.sha,
+                message: body3.message,
+                author: body3.author,
+                files_changed: Array.isArray(body3.files_changed) ? body3.files_changed : undefined
               }, contextFromPrincipal(principal));
-              return json4({ commit }, 201);
+              return json5({ commit }, 201);
             } catch (e) {
               const msg = e.message || "";
               if (msg.includes("not found"))
@@ -55587,23 +57073,23 @@ async function handleV1Request(req, url, dependencies = {}) {
             if (!await store.tasks.get(id))
               return error(404, "task not found");
             const refs = await store.gitRefs.list(id);
-            return json4({ refs, count: refs.length });
+            return json5({ refs, count: refs.length });
           }
           if (method === "POST") {
-            const body2 = await readJson3(req) ?? {};
-            const refType = body2.ref_type === "pull_request" || body2.ref_type === "branch" ? body2.ref_type : "branch";
-            if (typeof body2.name !== "string" || !body2.name.trim())
+            const body3 = await readJson3(req) ?? {};
+            const refType = body3.ref_type === "pull_request" || body3.ref_type === "branch" ? body3.ref_type : "branch";
+            if (typeof body3.name !== "string" || !body3.name.trim())
               return error(400, "name is required");
             try {
               const ref = await store.gitRefs.add({
                 task_id: id,
                 ref_type: refType,
-                name: body2.name,
-                url: body2.url,
-                provider: body2.provider,
-                metadata: body2.metadata
+                name: body3.name,
+                url: body3.url,
+                provider: body3.provider,
+                metadata: body3.metadata
               }, contextFromPrincipal(principal));
-              return json4({ ref }, 201);
+              return json5({ ref }, 201);
             } catch (e) {
               const msg = e.message || "";
               if (msg.includes("not found"))
@@ -55616,32 +57102,32 @@ async function handleV1Request(req, url, dependencies = {}) {
         const actionJson = await readOptionalJson(req);
         if (!actionJson.ok)
           return error(400, "invalid JSON body");
-        const body = actionJson.value && typeof actionJson.value === "object" && !Array.isArray(actionJson.value) ? actionJson.value : {};
-        const agentId = typeof body.agent_id === "string" ? body.agent_id : principal.agent || "todos-serve";
+        const body2 = actionJson.value && typeof actionJson.value === "object" && !Array.isArray(actionJson.value) ? actionJson.value : {};
+        const agentId = typeof body2.agent_id === "string" ? body2.agent_id : principal.agent || "todos-serve";
         if (action === "start" && method === "POST") {
-          return json4({ task: await store.tasks.start(id, agentId) });
+          return json5({ task: await store.tasks.start(id, agentId) });
         }
         if (action === "complete" && method === "POST") {
           const parsed = validateTaskCompletion(actionJson.value);
           if (!parsed.ok)
             return error(400, parsed.message);
-          return json4({
-            task: await store.tasks.complete(id, parsed.agentId || principal.agent || "todos-serve", parsed.options, contextFromPrincipal(principal, body))
+          return json5({
+            task: await store.tasks.complete(id, parsed.agentId || principal.agent || "todos-serve", parsed.options, contextFromPrincipal(principal, body2))
           });
         }
         if (action === "fail" && method === "POST") {
-          return json4({ result: await store.tasks.fail(id, agentId, typeof body.reason === "string" ? body.reason : "failed", {}) });
+          return json5({ result: await store.tasks.fail(id, agentId, typeof body2.reason === "string" ? body2.reason : "failed", {}) });
         }
         if (action === "claim" && method === "POST") {
-          return json4({ task: await store.tasks.claimNext(agentId, {}) });
+          return json5({ task: await store.tasks.claimNext(agentId, {}) });
         }
         return error(404, `unknown task action: ${action}`);
       }
       if (method === "GET") {
-        let task2 = await store.tasks.get(id);
-        if (!task2 && typeof store.tasks.resolveRef === "function") {
+        let task3 = await store.tasks.get(id);
+        if (!task3 && typeof store.tasks.resolveRef === "function") {
           try {
-            task2 = await store.tasks.resolveRef(id);
+            task3 = await store.tasks.resolveRef(id);
           } catch (e) {
             if (e instanceof TaskReferenceAmbiguousError) {
               return error(409, e.message, {
@@ -55656,22 +57142,22 @@ async function handleV1Request(req, url, dependencies = {}) {
             throw e;
           }
         }
-        return task2 ? json4({ task: task2 }) : error(404, "task not found");
+        return task3 ? json5({ task: task3 }) : error(404, "task not found");
       }
       if (method === "PATCH" || method === "PUT") {
-        const body = await readJson3(req);
-        if (!body)
+        const body2 = await readJson3(req);
+        if (!body2)
           return error(400, "invalid JSON body");
         const current = await store.tasks.get(id);
         if (!current)
           return error(404, "task not found");
         const patch = {
-          ...body,
-          version: typeof body.version === "number" ? body.version : current.version
+          ...body2,
+          version: typeof body2.version === "number" ? body2.version : current.version
         };
         try {
-          const task2 = await store.tasks.update(id, patch);
-          return task2 ? json4({ task: task2 }) : error(404, "task not found");
+          const task3 = await store.tasks.update(id, patch);
+          return task3 ? json5({ task: task3 }) : error(404, "task not found");
         } catch (e) {
           const msg = e.message || "";
           if (msg.includes("version conflict"))
@@ -55681,7 +57167,7 @@ async function handleV1Request(req, url, dependencies = {}) {
       }
       if (method === "DELETE") {
         await store.tasks.delete(id, contextFromPrincipal(principal));
-        return json4({ deleted: true, id });
+        return json5({ deleted: true, id });
       }
       return error(405, `method ${method} not allowed on /v1/tasks/:id`);
     }
@@ -55689,111 +57175,111 @@ async function handleV1Request(req, url, dependencies = {}) {
       if (!id) {
         if (method === "GET") {
           const projects = await store.projects.list();
-          return json4({ projects, count: projects.length });
+          return json5({ projects, count: projects.length });
         }
         if (method === "POST") {
-          const body = await readJson3(req);
-          if (!body)
+          const body2 = await readJson3(req);
+          if (!body2)
             return error(400, "invalid JSON body");
-          const validated = validateProjectCreate(body);
+          const validated = validateProjectCreate(body2);
           if (!validated.ok)
             return error(400, validated.message);
           const project = await store.projects.create(validated.input, contextFromPrincipal(principal));
-          return json4({ project }, 201);
+          return json5({ project }, 201);
         }
         return error(405, `method ${method} not allowed on /v1/projects`);
       }
       if (action === "task-list" && subId === "ensure") {
         if (method === "GET") {
-          return json4(await planProjectTaskListEnsure(store, id));
+          return json5(await planProjectTaskListEnsure(store, id));
         }
         if (method !== "POST") {
           return error(405, `method ${method} not allowed on /v1/projects/:id/task-list/ensure`);
         }
-        const body = await readJson3(req);
-        if (!body)
+        const body2 = await readJson3(req);
+        if (!body2)
           return error(400, "invalid JSON body");
-        const unknown = Object.keys(body).find((key) => !["expected_project_revision", "idempotency_key"].includes(key));
+        const unknown = Object.keys(body2).find((key2) => !["expected_project_revision", "idempotency_key"].includes(key2));
         if (unknown)
           return error(400, `unknown task-list ensure field: ${unknown}`);
-        if (typeof body.expected_project_revision !== "string" || !body.expected_project_revision.trim()) {
+        if (typeof body2.expected_project_revision !== "string" || !body2.expected_project_revision.trim()) {
           return error(400, "expected_project_revision must be a non-empty string from a fresh ensure plan");
         }
-        if (body.idempotency_key !== undefined && typeof body.idempotency_key !== "string") {
+        if (body2.idempotency_key !== undefined && typeof body2.idempotency_key !== "string") {
           return error(400, "idempotency_key must be a string");
         }
         const result = await applyProjectTaskListEnsure(store, id, {
-          expected_project_revision: body.expected_project_revision,
-          ...typeof body.idempotency_key === "string" ? { idempotency_key: body.idempotency_key } : {}
+          expected_project_revision: body2.expected_project_revision,
+          ...typeof body2.idempotency_key === "string" ? { idempotency_key: body2.idempotency_key } : {}
         });
-        return json4(result, result.action === "created" ? 201 : 200);
+        return json5(result, result.action === "created" ? 201 : 200);
       }
       if (action === "task-list" && subId === "rollback") {
         if (method !== "POST") {
           return error(405, `method ${method} not allowed on /v1/projects/:id/task-list/rollback`);
         }
-        const body = await readJson3(req);
-        if (!body)
+        const body2 = await readJson3(req);
+        if (!body2)
           return error(400, "invalid JSON body");
-        const unknown = Object.keys(body).find((key) => !["receipt_id", "expected_task_list_revision"].includes(key));
+        const unknown = Object.keys(body2).find((key2) => !["receipt_id", "expected_task_list_revision"].includes(key2));
         if (unknown)
           return error(400, `unknown task-list rollback field: ${unknown}`);
-        if (typeof body.receipt_id !== "string" || !body.receipt_id.trim()) {
+        if (typeof body2.receipt_id !== "string" || !body2.receipt_id.trim()) {
           return error(400, "receipt_id must be a non-empty string");
         }
-        if (typeof body.expected_task_list_revision !== "string" || !body.expected_task_list_revision.trim()) {
+        if (typeof body2.expected_task_list_revision !== "string" || !body2.expected_task_list_revision.trim()) {
           return error(400, "expected_task_list_revision must be a non-empty string from the accepted receipt");
         }
-        return json4(await rollbackProjectTaskListEnsure(store, id, {
-          receipt_id: body.receipt_id,
-          expected_task_list_revision: body.expected_task_list_revision
+        return json5(await rollbackProjectTaskListEnsure(store, id, {
+          receipt_id: body2.receipt_id,
+          expected_task_list_revision: body2.expected_task_list_revision
         }));
       }
       if (action === "rename") {
         if (method !== "POST")
           return error(405, `method ${method} not allowed on /v1/projects/:id/rename`);
-        const body = await readJson3(req);
-        if (!body || typeof body.new_slug !== "string" || !body.new_slug.trim() || !normalizeSlug(body.new_slug)) {
+        const body2 = await readJson3(req);
+        if (!body2 || typeof body2.new_slug !== "string" || !body2.new_slug.trim() || !normalizeSlug(body2.new_slug)) {
           return error(400, "new_slug must be a non-empty string");
         }
-        if (body.name !== undefined && (typeof body.name !== "string" || !body.name.trim())) {
+        if (body2.name !== undefined && (typeof body2.name !== "string" || !body2.name.trim())) {
           return error(400, "name must be a non-empty string");
         }
-        const unknownField = Object.keys(body).find((key) => !["new_slug", "name"].includes(key));
+        const unknownField = Object.keys(body2).find((key2) => !["new_slug", "name"].includes(key2));
         if (unknownField)
           return error(400, `unknown project rename field: ${unknownField}`);
-        return json4(await store.projects.rename(id, body, contextFromPrincipal(principal)));
+        return json5(await store.projects.rename(id, body2, contextFromPrincipal(principal)));
       }
       if (method === "GET") {
         const project = await store.projects.get(id);
-        return project ? json4({ project }) : error(404, "project not found");
+        return project ? json5({ project }) : error(404, "project not found");
       }
       if (method === "PATCH" || method === "PUT") {
-        const body = await readJson3(req);
-        if (!body)
+        const body2 = await readJson3(req);
+        if (!body2)
           return error(400, "invalid JSON body");
-        const validated = validateProjectPatch(body);
+        const validated = validateProjectPatch(body2);
         if (!validated.ok)
           return error(400, validated.message);
         if (!await store.projects.get(id))
           return error(404, "project not found");
         const project = await store.projects.update(id, validated.patch);
-        return json4({ project });
+        return json5({ project });
       }
       if (method === "DELETE") {
         await store.projects.delete(id, contextFromPrincipal(principal));
-        return json4({ deleted: true, id });
+        return json5({ deleted: true, id });
       }
       return error(405, `method ${method} not allowed on /v1/projects/:id`);
     }
     if (resource === "plans") {
       if (!id && method === "GET") {
         const plans = await store.plans.list(url.searchParams.get("project_id") ?? undefined);
-        return json4({ plans, count: plans.length });
+        return json5({ plans, count: plans.length });
       }
       if (!id && method === "POST") {
-        const body = await readJson3(req);
-        const validated = validatePlanCreate(body);
+        const body2 = await readJson3(req);
+        const validated = validatePlanCreate(body2);
         if (!validated.ok)
           return error(400, validated.message);
         if (validated.input.slug) {
@@ -55807,104 +57293,104 @@ async function handleV1Request(req, url, dependencies = {}) {
           }
         }
         const plan = await store.plans.create(validated.input, contextFromPrincipal(principal, validated.input));
-        return json4({ plan }, 201);
+        return json5({ plan }, 201);
       }
       if (id && action === "project-link" && !subId) {
         if (method === "GET") {
           const projectId = url.searchParams.get("project_id");
           if (!projectId?.trim())
             return error(400, "project_id query parameter is required");
-          return json4(await planPlanProjectLink(store, id, projectId));
+          return json5(await planPlanProjectLink(store, id, projectId));
         }
         if (method !== "POST")
           return error(405, `method ${method} not allowed on /v1/plans/:id/project-link`);
-        const body = await readJson3(req);
-        if (!body)
+        const body2 = await readJson3(req);
+        if (!body2)
           return error(400, "invalid JSON body");
         const allowed = new Set(["project_id", "expected_plan_revision", "expected_project_revision", "idempotency_key"]);
-        const unknown = Object.keys(body).find((key) => !allowed.has(key));
+        const unknown = Object.keys(body2).find((key2) => !allowed.has(key2));
         if (unknown)
           return error(400, `unknown plan-project-link field: ${unknown}`);
         for (const field of ["project_id", "expected_plan_revision", "expected_project_revision", "idempotency_key"]) {
-          if (typeof body[field] !== "string" || !body[field].trim()) {
+          if (typeof body2[field] !== "string" || !body2[field].trim()) {
             return error(400, `${field} must be a non-empty string`);
           }
         }
-        const result = await applyPlanProjectLink(store, id, body.project_id, {
-          expected_plan_revision: body.expected_plan_revision,
-          expected_project_revision: body.expected_project_revision,
-          idempotency_key: body.idempotency_key
+        const result = await applyPlanProjectLink(store, id, body2.project_id, {
+          expected_plan_revision: body2.expected_plan_revision,
+          expected_project_revision: body2.expected_project_revision,
+          idempotency_key: body2.idempotency_key
         });
-        return json4(result, result.action === "linked" ? 201 : 200);
+        return json5(result, result.action === "linked" ? 201 : 200);
       }
       if (id && action === "project-link" && subId === "rollback") {
         if (method !== "POST")
           return error(405, `method ${method} not allowed on /v1/plans/:id/project-link/rollback`);
-        const body = await readJson3(req);
-        if (!body)
+        const body2 = await readJson3(req);
+        if (!body2)
           return error(400, "invalid JSON body");
         const allowed = new Set(["project_id", "receipt_id", "expected_plan_revision"]);
-        const unknown = Object.keys(body).find((key) => !allowed.has(key));
+        const unknown = Object.keys(body2).find((key2) => !allowed.has(key2));
         if (unknown)
           return error(400, `unknown plan-project-link rollback field: ${unknown}`);
         for (const field of ["project_id", "receipt_id", "expected_plan_revision"]) {
-          if (typeof body[field] !== "string" || !body[field].trim()) {
+          if (typeof body2[field] !== "string" || !body2[field].trim()) {
             return error(400, `${field} must be a non-empty string`);
           }
         }
-        return json4(await rollbackPlanProjectLink(store, id, body.project_id, {
-          receipt_id: body.receipt_id,
-          expected_plan_revision: body.expected_plan_revision
+        return json5(await rollbackPlanProjectLink(store, id, body2.project_id, {
+          receipt_id: body2.receipt_id,
+          expected_plan_revision: body2.expected_plan_revision
         }));
       }
       if (id && method === "GET") {
         const plan = await store.plans.get(id);
-        return plan ? json4({ plan }) : error(404, "plan not found");
+        return plan ? json5({ plan }) : error(404, "plan not found");
       }
       if (id && (method === "PATCH" || method === "PUT")) {
-        const body = await readJson3(req);
-        if (!body || Object.keys(body).length === 0)
+        const body2 = await readJson3(req);
+        if (!body2 || Object.keys(body2).length === 0)
           return error(400, "plan patch is required");
         const allowed = new Set(["name", "slug", "description", "status", "task_list_id", "agent_id"]);
-        const unknownField = Object.keys(body).find((key) => !allowed.has(key));
+        const unknownField = Object.keys(body2).find((key2) => !allowed.has(key2));
         if (unknownField)
           return error(400, `unknown plan field: ${unknownField}`);
         for (const field of ["name", "slug", "task_list_id", "agent_id"]) {
-          if (body[field] !== undefined && (typeof body[field] !== "string" || !body[field].trim())) {
+          if (body2[field] !== undefined && (typeof body2[field] !== "string" || !body2[field].trim())) {
             return error(400, `${field} must be a non-empty string`);
           }
         }
-        if (typeof body.slug === "string") {
-          const slug = normalizeSlug(body.slug);
+        if (typeof body2.slug === "string") {
+          const slug = normalizeSlug(body2.slug);
           if (!slug)
             return error(400, "slug must produce a non-empty canonical slug");
-          body.slug = slug;
+          body2.slug = slug;
         }
-        if (body.description !== undefined && typeof body.description !== "string") {
+        if (body2.description !== undefined && typeof body2.description !== "string") {
           return error(400, "description must be a string");
         }
-        if (body.status !== undefined && (typeof body.status !== "string" || !["active", "completed", "archived"].includes(body.status))) {
+        if (body2.status !== undefined && (typeof body2.status !== "string" || !["active", "completed", "archived"].includes(body2.status))) {
           return error(400, "status must be active, completed, or archived");
         }
         const existing = await store.plans.get(id);
         if (!existing)
           return error(404, "plan not found");
-        if (typeof body.slug === "string") {
-          const duplicate = (await store.plans.list(existing.project_id ?? undefined)).find((plan2) => plan2.id !== id && plan2.project_id === existing.project_id && plan2.slug === body.slug);
+        if (typeof body2.slug === "string") {
+          const duplicate = (await store.plans.list(existing.project_id ?? undefined)).find((plan2) => plan2.id !== id && plan2.project_id === existing.project_id && plan2.slug === body2.slug);
           if (duplicate) {
-            return error(409, `Plan slug already exists in this scope: ${body.slug}`, {
+            return error(409, `Plan slug already exists in this scope: ${body2.slug}`, {
               code: "PLAN_SLUG_CONFLICT",
               conflict: true
             });
           }
         }
-        const plan = await store.plans.update(id, body);
-        return json4({ plan });
+        const plan = await store.plans.update(id, body2);
+        return json5({ plan });
       }
       if (id && method === "DELETE") {
         if (!await store.plans.delete(id, contextFromPrincipal(principal)))
           return error(404, "plan not found");
-        return json4({ deleted: true, id });
+        return json5({ deleted: true, id });
       }
       if (id)
         return error(405, `method ${method} not allowed on /v1/plans/:id`);
@@ -55913,50 +57399,50 @@ async function handleV1Request(req, url, dependencies = {}) {
       if (!id && method === "GET") {
         const projectId = url.searchParams.get("project_id");
         const templates = (await store.templates.list()).filter((template) => projectId === null || template.project_id === projectId);
-        return json4({ templates, count: templates.length });
+        return json5({ templates, count: templates.length });
       }
       if (!id && method === "POST") {
-        const body = await readJson3(req);
-        const validated = validateTemplateCreate(body);
+        const body2 = await readJson3(req);
+        const validated = validateTemplateCreate(body2);
         if (!validated.ok)
           return error(400, validated.message);
         const template = await store.templates.create(validated.input, contextFromPrincipal(principal));
-        return json4({ template: await store.templates.getWithTasks(template.id) }, 201);
+        return json5({ template: await store.templates.getWithTasks(template.id) }, 201);
       }
       if (!id)
         return error(405, `method ${method} not allowed on /v1/templates`);
       if (method === "GET") {
         const template = await store.templates.getWithTasks(id);
-        return template ? json4({ template }) : error(404, "template not found");
+        return template ? json5({ template }) : error(404, "template not found");
       }
       if (method === "PATCH" || method === "PUT") {
-        const body = await readJson3(req);
-        const validated = validateTemplatePatch(body);
+        const body2 = await readJson3(req);
+        const validated = validateTemplatePatch(body2);
         if (!validated.ok)
           return error(400, validated.message);
         const template = await store.templates.update(id, validated.patch, contextFromPrincipal(principal));
-        return template ? json4({ template: await store.templates.getWithTasks(id) }) : error(404, "template not found");
+        return template ? json5({ template: await store.templates.getWithTasks(id) }) : error(404, "template not found");
       }
       if (method === "DELETE") {
         const deleted = await store.templates.delete(id, contextFromPrincipal(principal));
-        return deleted ? json4({ deleted: true, id }) : error(404, "template not found");
+        return deleted ? json5({ deleted: true, id }) : error(404, "template not found");
       }
       return error(405, `method ${method} not allowed on /v1/templates/:id`);
     }
     if (resource === "agents") {
       if (!id && method === "GET") {
         const agents = await store.agents.list();
-        return json4({ agents, count: agents.length });
+        return json5({ agents, count: agents.length });
       }
       if (!id && method === "POST") {
-        const body = await readJson3(req);
-        if (!body || typeof body.name !== "string" || !body.name.trim())
+        const body2 = await readJson3(req);
+        if (!body2 || typeof body2.name !== "string" || !body2.name.trim())
           return error(400, "name is required");
-        const result = await store.agents.register(body, contextFromPrincipal(principal));
+        const result = await store.agents.register(body2, contextFromPrincipal(principal));
         if (result && typeof result === "object" && "conflict" in result) {
           return error(409, result.message ?? "agent name conflict", { conflict: true });
         }
-        return json4({ agent: result }, 201);
+        return json5({ agent: result }, 201);
       }
       if (id && action === "heartbeat") {
         if (method !== "POST")
@@ -55965,7 +57451,7 @@ async function handleV1Request(req, url, dependencies = {}) {
           return error(501, "agent heartbeat is not supported by this storage backend");
         }
         const agent = await store.agents.heartbeat(id, contextFromPrincipal(principal));
-        return agent ? json4({ agent }) : error(404, "agent not found");
+        return agent ? json5({ agent }) : error(404, "agent not found");
       }
       if (id && action === "release") {
         if (method !== "POST")
@@ -55973,18 +57459,18 @@ async function handleV1Request(req, url, dependencies = {}) {
         if (typeof store.agents.release !== "function") {
           return error(501, "agent release is not supported by this storage backend");
         }
-        const body = await readJson3(req) ?? {};
-        const result = await store.agents.release(id, body.session_id, contextFromPrincipal(principal));
+        const body2 = await readJson3(req) ?? {};
+        const result = await store.agents.release(id, body2.session_id, contextFromPrincipal(principal));
         if (!result)
           return error(404, "agent not found");
         if (!result.released) {
           return error(409, "release denied: session_id does not match agent's current session", { released: false });
         }
-        return json4({ agent: result.agent, released: true });
+        return json5({ agent: result.agent, released: true });
       }
       if (id && method === "GET") {
         const agent = await store.agents.get(id);
-        return agent ? json4({ agent }) : error(404, "agent not found");
+        return agent ? json5({ agent }) : error(404, "agent not found");
       }
     }
     if (resource === "activity" && !id) {
@@ -55993,66 +57479,66 @@ async function handleV1Request(req, url, dependencies = {}) {
       const limitParam = url.searchParams.get("limit");
       const limit = limitParam ? Math.max(1, Math.min(1e4, Number(limitParam) || 50)) : 50;
       const activity = await store.audit.getRecentActivity(limit);
-      return json4({ activity, count: activity.length });
+      return json5({ activity, count: activity.length });
     }
     if (resource === "task-lists") {
       if (!id && method === "GET") {
         const projectId = url.searchParams.get("project_id") ?? undefined;
         const taskLists = await store.taskLists.list(projectId);
-        return json4({ task_lists: taskLists, count: taskLists.length });
+        return json5({ task_lists: taskLists, count: taskLists.length });
       }
       if (!id && method === "POST") {
-        const body = await readJson3(req);
-        if (!body || typeof body.name !== "string" || !body.name.trim())
+        const body2 = await readJson3(req);
+        if (!body2 || typeof body2.name !== "string" || !body2.name.trim())
           return error(400, "name is required");
-        const unknownField = Object.keys(body).find((key) => !["name", "slug", "project_id", "description", "metadata"].includes(key));
+        const unknownField = Object.keys(body2).find((key2) => !["name", "slug", "project_id", "description", "metadata"].includes(key2));
         if (unknownField)
           return error(400, `unsupported task-list create field: ${unknownField}`);
-        if (body.slug !== undefined && typeof body.slug !== "string")
+        if (body2.slug !== undefined && typeof body2.slug !== "string")
           return error(400, "slug must be a string");
-        if (body.project_id !== undefined && (typeof body.project_id !== "string" || !body.project_id.trim()))
+        if (body2.project_id !== undefined && (typeof body2.project_id !== "string" || !body2.project_id.trim()))
           return error(400, "project_id must be a non-empty string");
-        if (body.description !== undefined && typeof body.description !== "string")
+        if (body2.description !== undefined && typeof body2.description !== "string")
           return error(400, "description must be a string");
-        if (body.metadata !== undefined && (!body.metadata || typeof body.metadata !== "object" || Array.isArray(body.metadata))) {
+        if (body2.metadata !== undefined && (!body2.metadata || typeof body2.metadata !== "object" || Array.isArray(body2.metadata))) {
           return error(400, "metadata must be an object");
         }
-        if (!normalizeSlug(body.slug === undefined ? body.name : body.slug)) {
+        if (!normalizeSlug(body2.slug === undefined ? body2.name : body2.slug)) {
           return error(400, "task-list slug must be non-empty kebab-case");
         }
-        const taskList = await store.taskLists.create(body, contextFromPrincipal(principal));
-        return json4({ task_list: taskList }, 201);
+        const taskList = await store.taskLists.create(body2, contextFromPrincipal(principal));
+        return json5({ task_list: taskList }, 201);
       }
       if (id && method === "GET") {
         const taskList = await store.taskLists.get(id);
-        return taskList ? json4({ task_list: taskList }) : error(404, "task list not found");
+        return taskList ? json5({ task_list: taskList }) : error(404, "task list not found");
       }
       if (id && (method === "PATCH" || method === "PUT")) {
-        const body = await readJson3(req);
-        if (!body)
+        const body2 = await readJson3(req);
+        if (!body2)
           return error(400, "invalid JSON body");
-        const unknownField = Object.keys(body).find((key) => !["slug", "name", "description", "metadata"].includes(key));
+        const unknownField = Object.keys(body2).find((key2) => !["slug", "name", "description", "metadata"].includes(key2));
         if (unknownField)
           return error(400, `unsupported task-list update field: ${unknownField}`);
-        if (Object.keys(body).length === 0)
+        if (Object.keys(body2).length === 0)
           return error(400, "task-list update must not be empty");
-        if (body.slug !== undefined && (typeof body.slug !== "string" || !normalizeSlug(body.slug)))
+        if (body2.slug !== undefined && (typeof body2.slug !== "string" || !normalizeSlug(body2.slug)))
           return error(400, "slug must be a non-empty string");
-        if (body.name !== undefined && (typeof body.name !== "string" || !body.name.trim()))
+        if (body2.name !== undefined && (typeof body2.name !== "string" || !body2.name.trim()))
           return error(400, "name must be a non-empty string");
-        if (body.description !== undefined && typeof body.description !== "string")
+        if (body2.description !== undefined && typeof body2.description !== "string")
           return error(400, "description must be a string");
-        if (body.metadata !== undefined && (!body.metadata || typeof body.metadata !== "object" || Array.isArray(body.metadata))) {
+        if (body2.metadata !== undefined && (!body2.metadata || typeof body2.metadata !== "object" || Array.isArray(body2.metadata))) {
           return error(400, "metadata must be an object");
         }
         if (!await store.taskLists.get(id))
           return error(404, "task list not found");
-        const taskList = await store.taskLists.update(id, body);
-        return json4({ task_list: taskList });
+        const taskList = await store.taskLists.update(id, body2);
+        return json5({ task_list: taskList });
       }
       if (id && method === "DELETE") {
         const deleted = await store.taskLists.delete(id, contextFromPrincipal(principal));
-        return deleted ? json4({ deleted: true, id }) : error(404, "task list not found");
+        return deleted ? json5({ deleted: true, id }) : error(404, "task list not found");
       }
       return error(405, `method ${method} not allowed on /v1/task-lists${id ? "/:id" : ""}`);
     }
@@ -56063,7 +57549,7 @@ async function handleV1Request(req, url, dependencies = {}) {
         return error(501, "dependency edge listing is not supported by this storage backend");
       }
       const dependencies2 = await store.dependencies.listAll();
-      return json4({ dependencies: dependencies2, count: dependencies2.length });
+      return json5({ dependencies: dependencies2, count: dependencies2.length });
     }
     if (resource === "commits" && id) {
       if (method !== "GET")
@@ -56071,7 +57557,7 @@ async function handleV1Request(req, url, dependencies = {}) {
       if (!store.commits)
         return error(501, "commit links are not supported by this storage backend");
       const commit = await store.commits.find(id);
-      return json4({ commit: commit ?? null });
+      return json5({ commit: commit ?? null });
     }
     if (resource === "refs" && id) {
       if (method !== "GET")
@@ -56085,7 +57571,7 @@ async function handleV1Request(req, url, dependencies = {}) {
         return error(400, "ref path segment has invalid percent encoding");
       }
       const refs = await store.gitRefs.find(decodedRef);
-      return json4({ refs, count: refs.length });
+      return json5({ refs, count: refs.length });
     }
     if (resource === "next" && !id) {
       if (method !== "GET")
@@ -56096,8 +57582,8 @@ async function handleV1Request(req, url, dependencies = {}) {
         ...url.searchParams.get("task_list_id") ? { task_list_id: url.searchParams.get("task_list_id") } : {},
         ...url.searchParams.get("plan_id") ? { plan_id: url.searchParams.get("plan_id") } : {}
       };
-      const task2 = await store.tasks.getNext(agent, filters);
-      return json4({ task: task2 ?? null });
+      const task3 = await store.tasks.getNext(agent, filters);
+      return json5({ task: task3 ?? null });
     }
     if (resource === "stats" && method === "GET") {
       const [tasks, tasksAll, projects] = await Promise.all([
@@ -56105,7 +57591,7 @@ async function handleV1Request(req, url, dependencies = {}) {
         store.tasks.count({ include_subtasks: true }),
         store.projects.list()
       ]);
-      return json4({ tasks, tasks_all: tasksAll, subtasks: tasksAll - tasks, projects: projects.length });
+      return json5({ tasks, tasks_all: tasksAll, subtasks: tasksAll - tasks, projects: projects.length });
     }
     if (resource === "integrity" && !id) {
       if (method !== "GET")
@@ -56114,7 +57600,7 @@ async function handleV1Request(req, url, dependencies = {}) {
         return error(501, "referential-integrity reporting is not supported by this storage backend");
       }
       const integrity = await store.integrity.report();
-      return json4({ integrity });
+      return json5({ integrity });
     }
     if (resource === "import") {
       if (method !== "POST")
@@ -56131,17 +57617,17 @@ async function handleV1Request(req, url, dependencies = {}) {
         return error(400, "empty snapshot: provide at least one record array (tasks/projects/plans/...)");
       }
       const result = await store.sync.importSnapshot(snapshot, contextFromPrincipal(principal));
-      return json4({ result, received });
+      return json5({ result, received });
     }
     return error(404, `unknown /v1 resource: ${resource ?? "(root)"}`);
   } catch (e) {
     if (e instanceof PlanProjectLinkError) {
-      const status = e.code === "PLAN_PROJECT_LINK_PLAN_NOT_FOUND" || e.code === "PLAN_PROJECT_LINK_PROJECT_NOT_FOUND" || e.code === "PLAN_PROJECT_LINK_RECEIPT_NOT_FOUND" ? 404 : e.code === "PLAN_PROJECT_LINK_IDEMPOTENCY_KEY_INVALID" ? 400 : e.code === "PLAN_PROJECT_LINK_UNSUPPORTED" ? 501 : 409;
-      return error(status, e.message, { code: e.code, conflict: status === 409, ...e.details });
+      const status2 = e.code === "PLAN_PROJECT_LINK_PLAN_NOT_FOUND" || e.code === "PLAN_PROJECT_LINK_PROJECT_NOT_FOUND" || e.code === "PLAN_PROJECT_LINK_RECEIPT_NOT_FOUND" ? 404 : e.code === "PLAN_PROJECT_LINK_IDEMPOTENCY_KEY_INVALID" ? 400 : e.code === "PLAN_PROJECT_LINK_UNSUPPORTED" ? 501 : 409;
+      return error(status2, e.message, { code: e.code, conflict: status2 === 409, ...e.details });
     }
     if (e instanceof ProjectTaskListEnsureError) {
-      const status = e.code === "PROJECT_NOT_FOUND" || e.code === "PROJECT_TASK_LIST_RECEIPT_NOT_FOUND" ? 404 : e.code === "PROJECT_TASK_LIST_IDEMPOTENCY_KEY_INVALID" ? 400 : 409;
-      return error(status, e.message, { code: e.code, conflict: status === 409, ...e.details });
+      const status2 = e.code === "PROJECT_NOT_FOUND" || e.code === "PROJECT_TASK_LIST_RECEIPT_NOT_FOUND" ? 404 : e.code === "PROJECT_TASK_LIST_IDEMPOTENCY_KEY_INVALID" ? 400 : 409;
+      return error(status2, e.message, { code: e.code, conflict: status2 === 409, ...e.details });
     }
     if (e instanceof TaskReferenceAmbiguousError) {
       return error(409, e.message, {
@@ -56165,21 +57651,22 @@ async function handleV1Request(req, url, dependencies = {}) {
     return error(500, e.message || "internal error");
   }
 }
-var JSON_HEADERS3, DEFAULT_COMMENT_PAGE_SIZE = 100, MAX_COMMENT_PAGE_SIZE = 500, LEGACY_COMMENT_RESPONSE_LIMIT = 500, RFC3339_DATE_TIME;
+var JSON_HEADERS4, DEFAULT_COMMENT_PAGE_SIZE = 100, MAX_COMMENT_PAGE_SIZE = 500, LEGACY_COMMENT_RESPONSE_LIMIT = 500, RFC3339_DATE_TIME;
 var init_v1 = __esm(() => {
   init_types();
   init_cloud();
   init_pr_groups();
   init_project_registration();
+  init_task_manifest();
   init_redaction();
   init_project_task_list_ensure();
   init_plan_project_link();
-  JSON_HEADERS3 = { "Content-Type": "application/json" };
+  JSON_HEADERS4 = { "Content-Type": "application/json" };
   RFC3339_DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})[Tt]\d{2}:\d{2}:\d{2}(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;
 });
 
 // src/pr-groups/sqlite.ts
-function parseJson2(value) {
+function parseJson3(value) {
   return JSON.parse(value);
 }
 function groupFromRow2(row) {
@@ -56206,9 +57693,9 @@ function eventFromRow2(row) {
     sequence: Number(row["sequence"]),
     pr_number: row["pr_number"] === null ? null : Number(row["pr_number"]),
     repair_cycle: row["repair_cycle"] === null ? null : Number(row["repair_cycle"]),
-    ci_proof: row["ci_proof"] ? parseJson2(String(row["ci_proof"])) : null,
-    cleanup_proof: row["cleanup_proof"] ? parseJson2(String(row["cleanup_proof"])) : null,
-    metadata: parseJson2(String(row["metadata"] ?? "{}"))
+    ci_proof: row["ci_proof"] ? parseJson3(String(row["ci_proof"])) : null,
+    cleanup_proof: row["cleanup_proof"] ? parseJson3(String(row["cleanup_proof"])) : null,
+    metadata: parseJson3(String(row["metadata"] ?? "{}"))
   };
 }
 
@@ -56272,8 +57759,8 @@ class SqlitePrGroupTransaction {
       WHERE id = ?
     `).run(attempt.status, attempt.started_at, attempt.last_heartbeat_at, attempt.handed_off_at, attempt.fenced_at, attempt.terminal_at, attempt.updated_at, attempt.id);
   }
-  async getEventByIdempotency(groupId, key) {
-    const row = this.db.query("SELECT * FROM pr_group_events WHERE group_id = ? AND idempotency_key = ? LIMIT 1").get(groupId, key);
+  async getEventByIdempotency(groupId, key2) {
+    const row = this.db.query("SELECT * FROM pr_group_events WHERE group_id = ? AND idempotency_key = ? LIMIT 1").get(groupId, key2);
     return row ? eventFromRow2(row) : null;
   }
   async findEventByReceiptKey(receiptKey) {
@@ -56283,14 +57770,14 @@ class SqlitePrGroupTransaction {
   async findEvent(groupId, filters) {
     const clauses = ["group_id = ?", "event_type = ?"];
     const values = [groupId, filters.event_type];
-    for (const key of ["attempt_id", "head_sha", "outcome", "receipt_key"]) {
-      if (!(key in filters))
+    for (const key2 of ["attempt_id", "head_sha", "outcome", "receipt_key"]) {
+      if (!(key2 in filters))
         continue;
-      if (filters[key] === null)
-        clauses.push(`${key} IS NULL`);
+      if (filters[key2] === null)
+        clauses.push(`${key2} IS NULL`);
       else {
-        clauses.push(`${key} = ?`);
-        values.push(String(filters[key]));
+        clauses.push(`${key2} = ?`);
+        values.push(String(filters[key2]));
       }
     }
     const row = this.db.query(`SELECT * FROM pr_group_events WHERE ${clauses.join(" AND ")} ORDER BY sequence DESC LIMIT 1`).get(...values);
@@ -56385,7 +57872,7 @@ class SqlitePrGroupLedgerPersistence {
   }
 }
 var sqliteTransactionTails2;
-var init_sqlite2 = __esm(() => {
+var init_sqlite3 = __esm(() => {
   sqliteTransactionTails2 = new WeakMap;
 });
 
@@ -56416,10 +57903,10 @@ function createLocalPrGroupLedger(db = getDatabase()) {
 var init_pr_groups2 = __esm(() => {
   init_database();
   init_ledger();
-  init_sqlite2();
+  init_sqlite3();
   init_types3();
   init_ledger();
-  init_sqlite2();
+  init_sqlite3();
   init_http_client();
   init_postgres();
 });
@@ -56430,7 +57917,7 @@ __export(exports_serve, {
   taskToSummary: () => taskToSummary,
   startServer: () => startServer,
   serveStaticFile: () => serveStaticFile,
-  json: () => json2,
+  json: () => json3,
   checkAuth: () => checkAuth,
   SECURITY_HEADERS: () => SECURITY_HEADERS,
   MIME_TYPES: () => MIME_TYPES
@@ -56516,9 +58003,9 @@ function checkRateLimit(ip) {
   }
   return { allowed: true };
 }
-function json2(data, status = 200, headers) {
+function json3(data, status2 = 200, headers) {
   return new Response(JSON.stringify(data), {
-    status,
+    status: status2,
     headers: {
       "Content-Type": "application/json",
       ...SECURITY_HEADERS,
@@ -56538,29 +58025,29 @@ function serveStaticFile(filePath) {
     }
   });
 }
-function taskToSummary(task2, fields) {
+function taskToSummary(task3, fields) {
   const full = {
-    id: task2.id,
-    short_id: task2.short_id,
-    title: task2.title,
-    description: task2.description,
-    status: task2.status,
-    priority: task2.priority,
-    project_id: task2.project_id,
-    plan_id: task2.plan_id,
-    task_list_id: task2.task_list_id,
-    agent_id: task2.agent_id,
-    assigned_to: task2.assigned_to,
-    working_dir: task2.working_dir,
-    locked_by: task2.locked_by,
-    tags: task2.tags,
-    metadata: task2.metadata,
-    version: task2.version,
-    created_at: task2.created_at,
-    updated_at: task2.updated_at,
-    completed_at: task2.completed_at,
-    due_at: task2.due_at,
-    recurrence_rule: task2.recurrence_rule
+    id: task3.id,
+    short_id: task3.short_id,
+    title: task3.title,
+    description: task3.description,
+    status: task3.status,
+    priority: task3.priority,
+    project_id: task3.project_id,
+    plan_id: task3.plan_id,
+    task_list_id: task3.task_list_id,
+    agent_id: task3.agent_id,
+    assigned_to: task3.assigned_to,
+    working_dir: task3.working_dir,
+    locked_by: task3.locked_by,
+    tags: task3.tags,
+    metadata: task3.metadata,
+    version: task3.version,
+    created_at: task3.created_at,
+    updated_at: task3.updated_at,
+    completed_at: task3.completed_at,
+    due_at: task3.due_at,
+    recurrence_rule: task3.recurrence_rule
   };
   if (!fields || fields.length === 0)
     return full;
@@ -56661,7 +58148,7 @@ Dashboard not found at: ${dashboardDir}`);
         "Access-Control-Allow-Headers": "Content-Type, X-API-Key, Authorization",
         Vary: "Origin"
       } : undefined;
-      const jsonWithCors = (data, status = 200) => json2(data, status, corsHeaders);
+      const jsonWithCors = (data, status2 = 200) => json3(data, status2, corsHeaders);
       if (method === "OPTIONS") {
         return new Response(null, {
           headers: corsHeaders || {
@@ -56742,13 +58229,13 @@ Dashboard not found at: ${dashboardDir}`);
           return res;
       }
       if (path === "/api/health" && method === "GET") {
-        return handleHealth(ctx, json2);
+        return handleHealth(ctx, json3);
       }
       if (path === "/api/headless" && method === "GET") {
-        return handleHeadlessBoundary(ctx, json2);
+        return handleHeadlessBoundary(ctx, json3);
       }
       if (path === "/api/stats" && method === "GET") {
-        return handleStats(ctx, json2);
+        return handleStats(ctx, json3);
       }
       if (path === "/api/tasks" && method === "GET") {
         return handleListTasks(req, url, ctx, jsonWithCors, taskToSummary);
@@ -56763,16 +58250,16 @@ Dashboard not found at: ${dashboardDir}`);
         return handleTasksExport(req, url, ctx, jsonWithCors, taskToSummary);
       }
       if (path === "/api/tasks/bulk" && method === "POST") {
-        return handleTasksBulk(req, ctx, json2);
+        return handleTasksBulk(req, ctx, json3);
       }
       if (path === "/api/tasks/status" && method === "GET") {
-        return handleTasksStatus(req, url, ctx, json2);
+        return handleTasksStatus(req, url, ctx, json3);
       }
       if (path === "/api/tasks/next" && method === "GET") {
         return handleTasksNext(req, url, ctx, jsonWithCors, taskToSummary);
       }
       if (path === "/api/tasks/active" && method === "GET") {
-        return handleTasksActive(req, url, ctx, json2);
+        return handleTasksActive(req, url, ctx, json3);
       }
       if (path === "/api/tasks/stale" && method === "GET") {
         return handleTasksStale(req, url, ctx, jsonWithCors, taskToSummary);
@@ -56785,11 +58272,11 @@ Dashboard not found at: ${dashboardDir}`);
       }
       const attachmentsMatch = path.match(/^\/api\/tasks\/([^/]+)\/attachments$/);
       if (attachmentsMatch && method === "GET") {
-        return handleTaskAttachments(attachmentsMatch[1], ctx, json2);
+        return handleTaskAttachments(attachmentsMatch[1], ctx, json3);
       }
       const progressMatch = path.match(/^\/api\/tasks\/([^/]+)\/progress$/);
       if (progressMatch) {
-        const res = await handleTaskProgress(progressMatch[1], req, method, ctx, json2, url);
+        const res = await handleTaskProgress(progressMatch[1], req, method, ctx, json3, url);
         if (res !== null)
           return res;
       }
@@ -56803,7 +58290,7 @@ Dashboard not found at: ${dashboardDir}`);
           return handlePatchTask(id, req, ctx, jsonWithCors, taskToSummary);
         }
         if (method === "DELETE") {
-          return handleDeleteTask(id, ctx, json2);
+          return handleDeleteTask(id, ctx, json3);
         }
       }
       const startMatch = path.match(/^\/api\/tasks\/([^/]+)\/start$/);
@@ -56819,7 +58306,7 @@ Dashboard not found at: ${dashboardDir}`);
         return handleCompleteTask(completeMatch[1], ctx, jsonWithCors, taskToSummary);
       }
       if (path === "/api/projects" && method === "GET") {
-        return handleListProjects(url, ctx, json2);
+        return handleListProjects(url, ctx, json3);
       }
       if (path === "/api/agents/me" && method === "GET") {
         return handleAgentMe(req, url, ctx, jsonWithCors, taskToSummary);
@@ -56832,92 +58319,92 @@ Dashboard not found at: ${dashboardDir}`);
         return handleClaimTask(req, ctx, jsonWithCors, taskToSummary);
       }
       if (path === "/api/orgs" && method === "GET") {
-        return handleListOrgs(ctx, json2);
+        return handleListOrgs(ctx, json3);
       }
       if (path === "/api/orgs" && method === "POST") {
-        return handleCreateOrg(req, ctx, json2);
+        return handleCreateOrg(req, ctx, json3);
       }
       const orgMatch = path.match(/^\/api\/orgs\/([^/]+)$/);
       if (orgMatch && method === "PATCH") {
-        return handleUpdateOrg(orgMatch[1], req, ctx, json2);
+        return handleUpdateOrg(orgMatch[1], req, ctx, json3);
       }
       if (orgMatch && method === "DELETE") {
-        return handleDeleteOrg(orgMatch[1], ctx, json2);
+        return handleDeleteOrg(orgMatch[1], ctx, json3);
       }
       if (path === "/api/org" && method === "GET") {
-        return handleOrgChart(ctx, json2);
+        return handleOrgChart(ctx, json3);
       }
       const teamMatch = path.match(/^\/api\/agents\/([^/]+)\/team$/);
       if (teamMatch && method === "GET") {
-        return handleAgentTeam(teamMatch[1], ctx, json2);
+        return handleAgentTeam(teamMatch[1], ctx, json3);
       }
       if (path === "/api/agents" && method === "GET") {
-        return handleListAgents(url, ctx, json2);
+        return handleListAgents(url, ctx, json3);
       }
       if (path === "/api/projects" && method === "POST") {
-        return handleCreateProject(req, ctx, json2);
+        return handleCreateProject(req, ctx, json3);
       }
       const projectDeleteMatch = path.match(/^\/api\/projects\/([^/]+)$/);
       if (projectDeleteMatch && method === "DELETE") {
-        return handleDeleteProject(projectDeleteMatch[1], ctx, json2);
+        return handleDeleteProject(projectDeleteMatch[1], ctx, json3);
       }
       if (path === "/api/agents" && method === "POST") {
-        return handleRegisterAgent(req, ctx, json2);
+        return handleRegisterAgent(req, ctx, json3);
       }
       const agentMatch = path.match(/^\/api\/agents\/([^/]+)$/);
       if (agentMatch && method === "PATCH") {
-        return handleUpdateAgent(agentMatch[1], req, ctx, json2);
+        return handleUpdateAgent(agentMatch[1], req, ctx, json3);
       }
       if (agentMatch && method === "DELETE") {
-        return handleDeleteAgent(agentMatch[1], ctx, json2);
+        return handleDeleteAgent(agentMatch[1], ctx, json3);
       }
       if (path === "/api/agents/bulk" && method === "POST") {
-        return handleBulkDeleteAgents(req, ctx, json2);
+        return handleBulkDeleteAgents(req, ctx, json3);
       }
       if (path === "/api/projects/bulk" && method === "POST") {
-        return handleBulkDeleteProjects(req, ctx, json2);
+        return handleBulkDeleteProjects(req, ctx, json3);
       }
       if (path === "/api/doctor" && method === "GET") {
-        return handleDoctor(ctx, json2);
+        return handleDoctor(ctx, json3);
       }
       if (path === "/api/report" && method === "GET") {
-        return handleReport(req, url, ctx, json2);
+        return handleReport(req, url, ctx, json3);
       }
       if (path === "/api/activity" && method === "GET") {
-        return handleActivity(req, url, ctx, json2);
+        return handleActivity(req, url, ctx, json3);
       }
       const historyMatch = path.match(/^\/api\/tasks\/([^/]+)\/history$/);
       if (historyMatch && method === "GET") {
-        return handleTaskHistory(historyMatch[1], ctx, json2, url);
+        return handleTaskHistory(historyMatch[1], ctx, json3, url);
       }
       if (path === "/api/webhooks" && method === "GET") {
-        return handleListWebhooks(ctx, json2);
+        return handleListWebhooks(ctx, json3);
       }
       if (path === "/api/webhooks" && method === "POST") {
-        return handleCreateWebhook(req, ctx, json2);
+        return handleCreateWebhook(req, ctx, json3);
       }
       const webhookMatch = path.match(/^\/api\/webhooks\/([^/]+)$/);
       if (webhookMatch && method === "DELETE") {
-        return handleDeleteWebhook(webhookMatch[1], ctx, json2);
+        return handleDeleteWebhook(webhookMatch[1], ctx, json3);
       }
       if (path === "/api/templates" && method === "GET") {
-        return handleListTemplates(ctx, json2);
+        return handleListTemplates(ctx, json3);
       }
       if (path === "/api/templates" && method === "POST") {
-        return handleCreateTemplate(req, ctx, json2);
+        return handleCreateTemplate(req, ctx, json3);
       }
       const templateMatch = path.match(/^\/api\/templates\/([^/]+)$/);
       if (templateMatch && method === "DELETE") {
-        return handleDeleteTemplate(templateMatch[1], ctx, json2);
+        return handleDeleteTemplate(templateMatch[1], ctx, json3);
       }
       if (path === "/api/plans" && method === "GET") {
-        return handleListPlans(url, ctx, json2);
+        return handleListPlans(url, ctx, json3);
       }
       if (path === "/api/plans" && method === "POST") {
-        return handleCreatePlan(req, ctx, json2);
+        return handleCreatePlan(req, ctx, json3);
       }
       if (path === "/api/plans/bulk" && method === "POST") {
-        return handleBulkDeletePlans(req, ctx, json2);
+        return handleBulkDeletePlans(req, ctx, json3);
       }
       const planMatch = path.match(/^\/api\/plans\/([^/]+)$/);
       if (planMatch) {
@@ -56926,16 +58413,16 @@ Dashboard not found at: ${dashboardDir}`);
           return handleGetPlan(id, ctx, jsonWithCors, taskToSummary);
         }
         if (method === "PATCH") {
-          return handleUpdatePlan(id, req, ctx, json2);
+          return handleUpdatePlan(id, req, ctx, json3);
         }
         if (method === "DELETE") {
-          return handleDeletePlan(id, ctx, json2);
+          return handleDeletePlan(id, ctx, json3);
         }
       }
       const staticRes = handleStaticFiles(path, method, ctx, jsonWithCors, serveStaticFile);
       if (staticRes)
         return staticRes;
-      return json2({ error: "Not found" }, 404);
+      return json3({ error: "Not found" }, 404);
     }
   });
   const shutdown = () => {
@@ -57135,52 +58622,52 @@ function resolveId(partialId, table = "tasks") {
   }
   return id;
 }
-function formatTask(task2) {
-  const id = task2.short_id || task2.id.slice(0, 8);
-  const assigned = task2.assigned_to ? ` -> ${task2.assigned_to}` : "";
-  const lockState = lockDisplayState(task2.locked_by, task2.locked_at);
+function formatTask(task3) {
+  const id = task3.short_id || task3.id.slice(0, 8);
+  const assigned = task3.assigned_to ? ` -> ${task3.assigned_to}` : "";
+  const lockState = lockDisplayState(task3.locked_by, task3.locked_at);
   const lock = lockState.held ? ` [locked:${lockState.holder}]` : "";
-  const recur = task2.recurrence_rule ? ` [\u21BB]` : "";
-  return `${id} ${task2.status.padEnd(11)} ${task2.priority.padEnd(8)} ${task2.title}${assigned}${lock}${recur}`;
+  const recur = task3.recurrence_rule ? ` [\u21BB]` : "";
+  return `${id} ${task3.status.padEnd(11)} ${task3.priority.padEnd(8)} ${task3.title}${assigned}${lock}${recur}`;
 }
-function formatTaskDetail(task2, maxDescriptionChars) {
+function formatTaskDetail(task3, maxDescriptionChars) {
   const parts = [
-    `ID: ${task2.id}`,
-    `Title: ${task2.title}`,
-    `Status: ${task2.status}`,
-    `Priority: ${task2.priority}`
+    `ID: ${task3.id}`,
+    `Title: ${task3.title}`,
+    `Status: ${task3.status}`,
+    `Priority: ${task3.priority}`
   ];
-  if (task2.description) {
-    const desc = maxDescriptionChars && task2.description.length > maxDescriptionChars ? task2.description.slice(0, maxDescriptionChars) + "\u2026" : task2.description;
+  if (task3.description) {
+    const desc = maxDescriptionChars && task3.description.length > maxDescriptionChars ? task3.description.slice(0, maxDescriptionChars) + "\u2026" : task3.description;
     parts.push(`Description: ${desc}`);
   }
-  if (task2.assigned_to)
-    parts.push(`Assigned to: ${task2.assigned_to}`);
-  if (task2.agent_id)
-    parts.push(`Agent: ${task2.agent_id}`);
-  const detailLock = lockDisplayState(task2.locked_by, task2.locked_at);
+  if (task3.assigned_to)
+    parts.push(`Assigned to: ${task3.assigned_to}`);
+  if (task3.agent_id)
+    parts.push(`Agent: ${task3.agent_id}`);
+  const detailLock = lockDisplayState(task3.locked_by, task3.locked_at);
   if (detailLock.held)
     parts.push(`Locked by: ${detailLock.holder}`);
   else if (detailLock.expired)
     parts.push(`Lock: ${formatExpiredLock(detailLock)}`);
-  if (task2.parent_id)
-    parts.push(`Parent: ${task2.parent_id}`);
-  if (task2.project_id)
-    parts.push(`Project: ${task2.project_id}`);
-  if (task2.plan_id)
-    parts.push(`Plan: ${task2.plan_id}`);
-  if (task2.due_at)
-    parts.push(`Due: ${task2.due_at.slice(0, 10)}`);
-  if (task2.tags.length > 0)
-    parts.push(`Tags: ${task2.tags.join(", ")}`);
-  if (task2.recurrence_rule)
-    parts.push(`Recurrence: ${task2.recurrence_rule}`);
-  if (task2.recurrence_parent_id)
-    parts.push(`Recurrence parent: ${task2.recurrence_parent_id}`);
-  parts.push(`Version: ${task2.version}`);
-  parts.push(`Created: ${task2.created_at}`);
-  if (task2.completed_at)
-    parts.push(`Completed: ${task2.completed_at}`);
+  if (task3.parent_id)
+    parts.push(`Parent: ${task3.parent_id}`);
+  if (task3.project_id)
+    parts.push(`Project: ${task3.project_id}`);
+  if (task3.plan_id)
+    parts.push(`Plan: ${task3.plan_id}`);
+  if (task3.due_at)
+    parts.push(`Due: ${task3.due_at.slice(0, 10)}`);
+  if (task3.tags.length > 0)
+    parts.push(`Tags: ${task3.tags.join(", ")}`);
+  if (task3.recurrence_rule)
+    parts.push(`Recurrence: ${task3.recurrence_rule}`);
+  if (task3.recurrence_parent_id)
+    parts.push(`Recurrence parent: ${task3.recurrence_parent_id}`);
+  parts.push(`Version: ${task3.version}`);
+  parts.push(`Created: ${task3.created_at}`);
+  if (task3.completed_at)
+    parts.push(`Completed: ${task3.completed_at}`);
   return parts.join(`
 `);
 }