@hasna/todos 0.15.24 → 0.15.26

package/dist/cli/index.js

@@ -2123,7 +2123,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.24",
+    version: "0.15.26",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -2172,7 +2172,8 @@ var init_package = __esm(() => {
       }
     },
     workspaces: [
-      "dashboard"
+      "dashboard",
+      "ai"
     ],
     files: [
       "dist",
@@ -2195,6 +2196,8 @@ var init_package = __esm(() => {
       "dev:serve": "bun run src/server/index.ts",
       "verify:release": "bun run scripts/verify-public-release.ts --mode=review",
       "verify:release-review": "bun run scripts/verify-npm-release-agent-review.ts",
+      "verify:attested-container-candidate": "bun run scripts/attested-container-candidate.ts verify",
+      "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts",
       "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
       prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
       postinstall: "mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true"
@@ -2241,12 +2244,14 @@ var init_package = __esm(() => {
       zod: "^3.24.2"
     },
     overrides: {
+      ajv: "8.20.0",
       "fast-uri": "3.1.2"
     },
     devDependencies: {
       "@types/bun": "^1.2.4",
       "@types/react": "^18.3.18",
       "bun-types": "1.3.9",
+      "hasna-deployment-contracts": "npm:@hasna/contracts@0.10.4",
       typescript: "^5.7.3"
     }
   };
@@ -5785,6 +5790,39 @@ async function cloudPrGroupEvents(client, groupId, options = {}) {
     throw new Error(`REMOTE_API_INCOMPATIBLE: ${route} did not return a complete closed authoritative remote event page; ` + "local SQLite fallback is disabled", { cause: error });
   }
 }
+function unwrapTaskManifestEnvelope(raw, key, route) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw) || !(key in raw)) {
+    throw new Error(`REMOTE_API_INCOMPATIBLE: ${route} returned a non-authoritative task-manifest response envelope; ` + "local SQLite fallback is disabled");
+  }
+  return raw[key];
+}
+async function cloudTaskManifestCapability(client) {
+  const route = "/v1/task-manifest/capability";
+  return unwrapTaskManifestEnvelope(await requiredRemoteRoute(client, route, () => client.transport.get("/task-manifest/capability")), "capability", route);
+}
+async function cloudApplyTaskManifest(client, input) {
+  const route = "/v1/task-manifest/apply";
+  return unwrapTaskManifestEnvelope(await requiredRemoteRoute(client, route, () => client.transport.post("/task-manifest/apply", input)), "result", route);
+}
+async function cloudReadExactTaskManifest(client, receiptId) {
+  const route = "/v1/task-manifest/read-exact";
+  return unwrapTaskManifestEnvelope(await requiredRemoteRoute(client, route, () => client.transport.post("/task-manifest/read-exact", { receipt_id: receiptId })), "result", route);
+}
+async function cloudLookupTaskManifestBinding(client, input) {
+  const route = "/v1/task-manifest/bindings/lookup";
+  return unwrapTaskManifestEnvelope(await requiredRemoteRoute(client, route, () => client.transport.post("/task-manifest/bindings/lookup", input)), "result", route);
+}
+async function cloudCompensateTaskManifest(client, input) {
+  const route = "/v1/task-manifest/compensate";
+  return unwrapTaskManifestEnvelope(await requiredRemoteRoute(client, route, () => client.transport.post("/task-manifest/compensate", input)), "result", route);
+}
+async function cloudMarkTaskManifestOutboxDelivered(client, outboxId) {
+  const route = "/v1/task-manifest/outbox/delivered";
+  const delivered = unwrapTaskManifestEnvelope(await requiredRemoteRoute(client, route, () => client.transport.post("/task-manifest/outbox/delivered", { outbox_id: outboxId })), "delivered", route);
+  if (delivered !== true) {
+    throw new Error(`REMOTE_API_INCOMPATIBLE: ${route} did not confirm task-manifest outbox delivery; ` + "local SQLite fallback is disabled");
+  }
+}
 function unwrapTask(raw) {
   if (raw && typeof raw === "object" && "task" in raw) {
     return raw.task;
@@ -7756,6 +7794,7 @@ var init_stage_a = __esm(() => {
     "sync",
     "tag",
     "task",
+    "task-manifest",
     "template-export",
     "template-history",
     "template-import",
@@ -7881,6 +7920,7 @@ var init_stage_a = __esm(() => {
     "task",
     "task-lists",
     "stale-lock-handoff",
+    "task-manifest",
     "template-export",
     "template-import",
     "template-preview",
@@ -32676,11 +32716,14 @@ function resolveAdapter(options) {
   const client = getTodosCloudClient(options.env);
   return client ? createHttpTodosAiReadAdapter(client) : createLocalTodosAiReadAdapter(options.database);
 }
-function resolvePermission(options) {
+function resolvePermission(options, profile) {
   if (options.workspacePermission)
     return options.workspacePermission;
   const path = options.workspacePath ?? process.cwd();
-  return (permission) => checkWorkspacePermission({ path, tool: permission }).allowed;
+  return (permission, tool) => {
+    const check = checkWorkspacePermission({ path, tool: permission });
+    return check.allowed || profile === "minimal" && tool === "get_task" && permission === "read" && check.status.matched_root === null && check.status.profile.preset === "restricted";
+  };
 }
 function configuredProfileIsKnown(value) {
   if (value === undefined || value.trim() === "")
@@ -32692,7 +32735,7 @@ function createTodosAiToolSource(options = {}) {
   const adapter = resolveAdapter(options);
   const configuredProfile = options.env ? options.env["TODOS_PROFILE"] : process.env["TODOS_PROFILE"];
   const profile = options.accessProfile ?? resolveAccessProfile(configuredProfile ?? "minimal");
-  const permission = resolvePermission(options);
+  const permission = resolvePermission(options, profile);
   const enabled = new Set(TODOS_AI_READ_TOOL_NAMES.filter((name) => shouldRegisterToolForProfile(name, profile) && permission(name === "get_task" ? "read" : "list", name)));
   const hostAllowsUpdate = (options.accessProfile !== undefined || configuredProfileIsKnown(configuredProfile)) && shouldRegisterToolForProfile("update_task", profile) && permission("write", "update_task");
   const approvalVerifier = options.approvalVerifier ?? adapter.verifyApproval;
@@ -46085,6 +46128,13 @@ var init_schema2 = __esm(() => {
   }).strict();
 });
 
+// src/task-manifest/plan-slug.ts
+function taskManifestPlanSlug(manifest, planId) {
+  const base = normalizeSlug(manifest.plan.key) || normalizeSlug(manifest.plan.name) || "plan";
+  return `${base}-${planId}`;
+}
+var init_plan_slug = () => {};
+
 // src/task-manifest/backend.ts
 function validateTaskManifestBindingLookupRows(rows, tenantId, planId) {
   if (rows.length === 0) {
@@ -46113,6 +46163,67 @@ var init_backend = __esm(() => {
 });
 
 // src/task-manifest/reference-guard.ts
+function quoteSqliteIdentifier2(value) {
+  return `"${value.replaceAll('"', '""')}"`;
+}
+function placeholders3(count) {
+  return Array.from({ length: count }, () => "?").join(",");
+}
+function sqliteManagedReferencePredicate(table, field, target, managed) {
+  const taskPlaceholders = placeholders3(managed.task_ids.length);
+  if (table === "tasks" && field === "plan_id" && target === "plans") {
+    return {
+      sql: `id IN (${taskPlaceholders})`,
+      values: managed.task_ids
+    };
+  }
+  if (table === "task_dependencies" && target === "tasks" && (field === "task_id" || field === "depends_on")) {
+    return {
+      sql: `task_id IN (${taskPlaceholders}) AND depends_on IN (${taskPlaceholders})`,
+      values: [...managed.task_ids, ...managed.task_ids]
+    };
+  }
+  if (table === "task_comments" && field === "task_id" && target === "tasks") {
+    return managed.comment_ids.length > 0 ? { sql: `id IN (${placeholders3(managed.comment_ids.length)})`, values: managed.comment_ids } : { sql: "0", values: [] };
+  }
+  if (table === "task_verifications" && field === "task_id" && target === "tasks") {
+    return managed.verification_ids.length > 0 ? { sql: `id IN (${placeholders3(managed.verification_ids.length)})`, values: managed.verification_ids } : { sql: "0", values: [] };
+  }
+  if (table === "task_tags" && field === "task_id" && target === "tasks") {
+    return {
+      sql: `task_id IN (${taskPlaceholders})`,
+      values: managed.task_ids
+    };
+  }
+  return null;
+}
+function findSqliteTaskManifestForeignReference(db, managed) {
+  const tables = db.query(`SELECT name FROM sqlite_master
+    WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name`).all();
+  for (const { name: table } of tables) {
+    const foreignKeys = db.query(`PRAGMA foreign_key_list(${quoteSqliteIdentifier2(table)})`).all();
+    for (const foreignKey of foreignKeys) {
+      if (foreignKey.table !== "tasks" && foreignKey.table !== "plans")
+        continue;
+      const target = foreignKey.table;
+      const targetIds = target === "tasks" ? managed.task_ids : [managed.plan_id];
+      const owned = sqliteManagedReferencePredicate(table, foreignKey.from, target, managed);
+      const sql = `SELECT 1 AS found FROM ${quoteSqliteIdentifier2(table)}
+        WHERE ${quoteSqliteIdentifier2(foreignKey.from)} IN (${placeholders3(targetIds.length)})
+        ${owned ? `AND NOT (${owned.sql})` : ""}
+        LIMIT 1`;
+      if (db.query(sql).get(...targetIds, ...owned?.values ?? [])) {
+        return {
+          surface: table,
+          field: foreignKey.from,
+          target,
+          on_delete: foreignKey.on_delete.toUpperCase()
+        };
+      }
+    }
+  }
+  return null;
+}
 function postgresTaskManifestForeignReferenceSql(tableName) {
   return `SELECT object_type, object_id
     FROM ${tableName}
@@ -46142,6 +46253,89 @@ function postgresTaskManifestForeignReferenceSql(tableName) {
 function sqlString(value) {
   return `'${value.replaceAll("'", "''")}'`;
 }
+function sqliteTodosTaskManifestSchemaSql() {
+  return `
+    CREATE TABLE IF NOT EXISTS todos_task_manifest_receipts (
+      receipt_id TEXT PRIMARY KEY,
+      tenant_id TEXT NOT NULL,
+      authority TEXT NOT NULL CHECK(authority = 'todos'),
+      route TEXT NOT NULL,
+      schema_version INTEGER NOT NULL CHECK(schema_version = 1),
+      kind TEXT NOT NULL CHECK(kind IN ('apply', 'compensate')),
+      operation_id TEXT NOT NULL,
+      idempotency_key TEXT NOT NULL,
+      request_digest TEXT NOT NULL,
+      result_digest TEXT NOT NULL,
+      binding_version INTEGER NOT NULL,
+      apply_receipt_id TEXT,
+      manifest_json TEXT,
+      result_json TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      UNIQUE(kind, idempotency_key)
+    );
+    CREATE TABLE IF NOT EXISTS todos_task_manifest_bindings (
+      operation_id TEXT PRIMARY KEY,
+      tenant_id TEXT NOT NULL,
+      idempotency_key TEXT NOT NULL UNIQUE,
+      request_digest TEXT NOT NULL,
+      result_digest TEXT NOT NULL,
+      apply_receipt_id TEXT NOT NULL UNIQUE REFERENCES todos_task_manifest_receipts(receipt_id),
+      manifest_json TEXT NOT NULL,
+      result_json TEXT NOT NULL,
+      state TEXT NOT NULL CHECK(state IN ('applied', 'compensated')),
+      version INTEGER NOT NULL,
+      compensation_receipt_id TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS todos_task_manifest_outbox (
+      id TEXT PRIMARY KEY,
+      apply_receipt_id TEXT NOT NULL REFERENCES todos_task_manifest_receipts(receipt_id),
+      topic TEXT NOT NULL,
+      payload TEXT NOT NULL,
+      payload_digest TEXT NOT NULL,
+      status TEXT NOT NULL CHECK(status IN ('pending', 'delivered', 'cancelled')),
+      attempts INTEGER NOT NULL DEFAULT 0,
+      created_at TEXT NOT NULL,
+      delivered_at TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_todos_task_manifest_outbox_receipt
+      ON todos_task_manifest_outbox(apply_receipt_id, status);
+    CREATE TRIGGER IF NOT EXISTS todos_task_manifest_receipts_immutable_update
+      BEFORE UPDATE ON todos_task_manifest_receipts BEGIN
+        SELECT RAISE(ABORT, 'todos task manifest receipts are immutable');
+      END;
+    CREATE TRIGGER IF NOT EXISTS todos_task_manifest_receipts_immutable_delete
+      BEFORE DELETE ON todos_task_manifest_receipts BEGIN
+        SELECT RAISE(ABORT, 'todos task manifest receipts are immutable');
+      END;
+  `;
+}
+function sqliteTableHasColumn(db, tableName, columnName) {
+  const columns = db.query(`PRAGMA table_info("${tableName}")`).all();
+  return columns.some((column) => column.name === columnName);
+}
+function ensureSqliteTodosTaskManifestSchema(db, tenantId) {
+  db.exec(sqliteTodosTaskManifestSchemaSql());
+  const tenantDefault = sqlString(tenantId);
+  for (const tableName of [
+    "todos_task_manifest_receipts",
+    "todos_task_manifest_bindings"
+  ]) {
+    if (!sqliteTableHasColumn(db, tableName, "tenant_id")) {
+      db.exec(`ALTER TABLE "${tableName}" ADD COLUMN tenant_id TEXT NOT NULL DEFAULT ${tenantDefault}`);
+    }
+  }
+  db.exec(`
+    CREATE INDEX IF NOT EXISTS idx_todos_task_manifest_receipts_tenant
+      ON todos_task_manifest_receipts(tenant_id, receipt_id, kind);
+    CREATE INDEX IF NOT EXISTS idx_todos_task_manifest_bindings_tenant_plan
+      ON todos_task_manifest_bindings(
+        tenant_id,
+        json_extract(result_json, '$.graph.plan_id')
+      );
+  `);
+}
 function postgresTodosTaskManifestSchemaSql(tenantId = "default") {
   const tenantDefault = sqlString(tenantId);
   return [
@@ -46218,9 +46412,411 @@ function postgresTodosTaskManifestSchemaSql(tenantId = "default") {
 }
 
 // src/task-manifest/sqlite.ts
+function fault(faults, point) {
+  if (faults.points.has(point))
+    throw new Error(`Injected task-manifest fault at ${point}`);
+}
+function parseApplyResult(value, duplicate) {
+  return { ...JSON.parse(value), duplicate };
+}
+
+class SqliteTodosTaskManifestBackend {
+  db;
+  tenantId;
+  kind = "sqlite";
+  constructor(db, tenantId = "default") {
+    this.db = db;
+    this.tenantId = tenantId;
+    ensureSqliteTodosTaskManifestSchema(db, tenantId);
+  }
+  async serialized(run) {
+    const previous = sqliteTails.get(this.db) ?? Promise.resolve();
+    let release;
+    const current = new Promise((resolve17) => {
+      release = resolve17;
+    });
+    const tail = previous.then(() => current);
+    sqliteTails.set(this.db, tail);
+    await previous;
+    try {
+      this.db.exec("BEGIN IMMEDIATE");
+      try {
+        const result = run();
+        this.db.exec("COMMIT");
+        return result;
+      } catch (error) {
+        this.db.exec("ROLLBACK");
+        throw error;
+      }
+    } finally {
+      release();
+      if (sqliteTails.get(this.db) === tail)
+        sqliteTails.delete(this.db);
+    }
+  }
+  async apply(input, faults) {
+    return this.serialized(() => {
+      const { manifest } = input;
+      const binding = this.db.query("SELECT * FROM todos_task_manifest_bindings WHERE tenant_id = ? AND operation_id = ? LIMIT 1").get(this.tenantId, manifest.operation_id);
+      if (binding) {
+        if (binding["idempotency_key"] !== manifest.idempotency_key || binding["request_digest"] !== input.request_digest) {
+          throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_IDEMPOTENCY_CONFLICT", "Operation is already bound to a different request");
+        }
+        if (binding["state"] !== "applied") {
+          throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", "Operation was already compensated");
+        }
+        return parseApplyResult(String(binding["result_json"]), true);
+      }
+      const idempotency = this.db.query("SELECT operation_id, request_digest FROM todos_task_manifest_bindings WHERE tenant_id = ? AND idempotency_key = ? LIMIT 1").get(this.tenantId, manifest.idempotency_key);
+      if (idempotency)
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_IDEMPOTENCY_CONFLICT", "Idempotency key is already used by another operation");
+      if (manifest.if_binding_version !== undefined && manifest.if_binding_version !== 0) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_CAS_CONFLICT", "New manifest binding version must be 0");
+      }
+      if (!this.db.query("SELECT 1 AS found FROM projects WHERE id = ? LIMIT 1").get(manifest.project_id)) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_FOREIGN_REFERENCE", "Project does not exist");
+      }
+      if (manifest.task_list_id && !this.db.query("SELECT 1 AS found FROM task_lists WHERE id = ? AND project_id = ? LIMIT 1").get(manifest.task_list_id, manifest.project_id)) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_FOREIGN_REFERENCE", "Task list does not belong to the project");
+      }
+      const allIds = [input.graph.plan_id, ...Object.values(input.graph.task_ids), ...input.graph.comment_ids, ...input.graph.verification_ids];
+      for (const id of allIds) {
+        for (const table of ["plans", "tasks", "task_comments", "task_verifications"]) {
+          if (this.db.query(`SELECT 1 AS found FROM ${table} WHERE id = ? LIMIT 1`).get(id)) {
+            throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", `Deterministic id already exists: ${id}`);
+          }
+        }
+      }
+      this.db.query(`INSERT INTO plans (id, project_id, name, description, status, task_list_id, slug, created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(input.graph.plan_id, manifest.project_id, manifest.plan.name, manifest.plan.description ?? null, manifest.plan.status ?? "active", manifest.task_list_id ?? null, taskManifestPlanSlug(manifest, input.graph.plan_id), input.now, input.now);
+      fault(faults, "after_plan_write");
+      for (const task2 of manifest.tasks) {
+        const taskId = input.graph.task_ids[task2.key];
+        this.db.query(`INSERT INTO tasks (
+          id, project_id, title, description, status, priority, assigned_to, tags, metadata,
+          version, plan_id, task_list_id, created_at, updated_at, created_by
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, ?, ?)`).run(taskId, manifest.project_id, task2.title, task2.description ?? null, task2.status ?? "pending", task2.priority ?? "medium", task2.assigned_to ?? null, JSON.stringify(task2.tags ?? []), canonicalJson2(task2.metadata ?? {}), input.graph.plan_id, manifest.task_list_id ?? null, input.now, input.now, task2.created_by ?? null);
+        for (const tag of [...new Set(task2.tags ?? [])].sort()) {
+          this.db.query("INSERT INTO task_tags (task_id, tag) VALUES (?, ?)").run(taskId, tag);
+        }
+      }
+      fault(faults, "after_task_write");
+      for (const edge of manifest.dependencies ?? []) {
+        this.db.query("INSERT INTO task_dependencies (task_id, depends_on) VALUES (?, ?)").run(input.graph.task_ids[edge.task], input.graph.task_ids[edge.depends_on]);
+      }
+      fault(faults, "after_dependency_write");
+      let commentIndex = 0;
+      for (const task2 of manifest.tasks)
+        for (const comment2 of task2.comments ?? []) {
+          this.db.query(`INSERT INTO task_comments (id, task_id, agent_id, session_id, content, created_at, type, progress_pct)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(input.graph.comment_ids[commentIndex++], input.graph.task_ids[task2.key], comment2.agent_id ?? null, comment2.session_id ?? null, comment2.content, input.now, comment2.type ?? "comment", comment2.progress_pct ?? null);
+        }
+      fault(faults, "after_comment_write");
+      let verificationIndex = 0;
+      for (const task2 of manifest.tasks)
+        for (const verification2 of task2.verifications ?? []) {
+          this.db.query(`INSERT INTO task_verifications (
+          id, task_id, command, status, output_summary, artifact_path, agent_id, run_at, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(input.graph.verification_ids[verificationIndex++], input.graph.task_ids[task2.key], verification2.command, verification2.status ?? "unknown", verification2.output_summary ?? null, verification2.artifact_path ?? null, verification2.agent_id ?? null, input.now, input.now);
+        }
+      fault(faults, "after_verification_write");
+      const readback = this.readback(input.graph);
+      const expected = {
+        plans: 1,
+        tasks: manifest.tasks.length,
+        dependencies: manifest.dependencies?.length ?? 0,
+        comments: input.graph.comment_ids.length,
+        verifications: input.graph.verification_ids.length,
+        complete: true
+      };
+      if (canonicalJson2(readback) !== canonicalJson2(expected)) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_READBACK_MISMATCH", "Exact graph readback did not match", { expected, readback });
+      }
+      const receipt = {
+        receipt_id: input.receipt_id,
+        authority: "todos",
+        route: "todos.task-manifest.v1",
+        schema_version: 1,
+        kind: "apply",
+        operation_id: manifest.operation_id,
+        idempotency_key: manifest.idempotency_key,
+        request_digest: input.request_digest,
+        result_digest: input.result_digest,
+        binding_version: 1,
+        apply_receipt_id: null,
+        created_at: input.now
+      };
+      const result = {
+        duplicate: false,
+        receipt,
+        graph: input.graph,
+        readback,
+        outbox_ids: input.outbox.map((entry2) => entry2.id),
+        result_digest: input.result_digest
+      };
+      const resultJson2 = canonicalJson2(result);
+      const manifestJson = canonicalJson2(manifest);
+      this.db.query(`INSERT INTO todos_task_manifest_receipts (
+        receipt_id, tenant_id, authority, route, schema_version, kind, operation_id, idempotency_key,
+        request_digest, result_digest, binding_version, apply_receipt_id, manifest_json, result_json, created_at
+      ) VALUES (?, ?, 'todos', 'todos.task-manifest.v1', 1, 'apply', ?, ?, ?, ?, 1, NULL, ?, ?, ?)`).run(input.receipt_id, this.tenantId, manifest.operation_id, manifest.idempotency_key, input.request_digest, input.result_digest, manifestJson, resultJson2, input.now);
+      for (const entry2 of input.outbox) {
+        this.db.query(`INSERT INTO todos_task_manifest_outbox (
+          id, apply_receipt_id, topic, payload, payload_digest, status, created_at
+        ) VALUES (?, ?, ?, ?, ?, 'pending', ?)`).run(entry2.id, input.receipt_id, entry2.topic, canonicalJson2(entry2.payload), entry2.digest, input.now);
+      }
+      fault(faults, "after_outbox_write");
+      this.db.query(`INSERT INTO todos_task_manifest_bindings (
+        operation_id, tenant_id, idempotency_key, request_digest, result_digest, apply_receipt_id,
+        manifest_json, result_json, state, version, created_at, updated_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'applied', 1, ?, ?)`).run(manifest.operation_id, this.tenantId, manifest.idempotency_key, input.request_digest, input.result_digest, input.receipt_id, manifestJson, resultJson2, input.now, input.now);
+      fault(faults, "after_receipt_write");
+      return result;
+    });
+  }
+  async readExact(receiptId3) {
+    const row = this.db.query("SELECT result_json FROM todos_task_manifest_receipts WHERE tenant_id = ? AND receipt_id = ? AND kind = 'apply' LIMIT 1").get(this.tenantId, receiptId3);
+    if (!row)
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_RECEIPT_NOT_FOUND", `Apply receipt not found: ${receiptId3}`);
+    return parseApplyResult(row.result_json, false);
+  }
+  async lookupBindingByPlanId(planId) {
+    const rows = this.db.query(`
+      SELECT
+        b.apply_receipt_id AS apply_receipt_id,
+        b.state AS state,
+        b.version AS binding_version,
+        b.tenant_id AS binding_tenant_id,
+        b.operation_id AS binding_operation_id,
+        json_extract(b.result_json, '$.graph.plan_id') AS binding_plan_id,
+        r.tenant_id AS receipt_tenant_id,
+        r.authority AS receipt_authority,
+        r.route AS receipt_route,
+        r.schema_version AS receipt_schema_version,
+        r.kind AS receipt_kind,
+        r.operation_id AS receipt_operation_id,
+        json_extract(r.result_json, '$.graph.plan_id') AS receipt_plan_id
+      FROM todos_task_manifest_bindings b
+      LEFT JOIN todos_task_manifest_receipts r
+        ON r.receipt_id = b.apply_receipt_id
+        AND r.tenant_id = b.tenant_id
+      WHERE b.tenant_id = ?
+        AND json_extract(b.result_json, '$.graph.plan_id') = ?
+      LIMIT 2
+    `).all(this.tenantId, planId);
+    return validateTaskManifestBindingLookupRows(rows, this.tenantId, planId);
+  }
+  async markOutboxDelivered(outboxId, deliveredAt) {
+    await this.serialized(() => {
+      const result = this.db.query(`UPDATE todos_task_manifest_outbox
+        SET status = 'delivered', delivered_at = ?, attempts = attempts + 1
+        WHERE id = ? AND status = 'pending'
+          AND EXISTS (
+            SELECT 1 FROM todos_task_manifest_receipts r
+            WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
+              AND r.tenant_id = ?
+              AND r.authority = 'todos'
+              AND r.route = 'todos.task-manifest.v1'
+              AND r.schema_version = 1
+              AND r.kind = 'apply'
+          )`).run(deliveredAt, outboxId, this.tenantId);
+      if (result.changes === 1)
+        return;
+      const existing = this.db.query(`SELECT o.status
+        FROM todos_task_manifest_outbox o
+        JOIN todos_task_manifest_receipts r
+          ON r.receipt_id = o.apply_receipt_id
+        WHERE r.tenant_id = ?
+          AND r.authority = 'todos'
+          AND r.route = 'todos.task-manifest.v1'
+          AND r.schema_version = 1
+          AND r.kind = 'apply'
+          AND o.id = ?
+        LIMIT 1`).get(this.tenantId, outboxId);
+      if (existing?.status === "delivered")
+        return;
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", `Pending outbox row not found: ${outboxId}`);
+    });
+  }
+  async compensate(input, receipt, compensationReceiptId, requestDigest, now4) {
+    return this.serialized(() => {
+      const existing = this.db.query(`SELECT apply_receipt_id, request_digest, result_json
+        FROM todos_task_manifest_receipts
+        WHERE tenant_id = ? AND kind = 'compensate' AND idempotency_key = ?
+        LIMIT 1`).get(this.tenantId, input.idempotency_key);
+      if (existing) {
+        if (existing.apply_receipt_id !== input.receipt_id || existing.request_digest !== requestDigest) {
+          throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_IDEMPOTENCY_CONFLICT", "Compensation idempotency key is already used");
+        }
+        return { ...JSON.parse(existing.result_json), duplicate: true };
+      }
+      const row = this.db.query("SELECT * FROM todos_task_manifest_receipts WHERE tenant_id = ? AND receipt_id = ? AND kind = 'apply' LIMIT 1").get(this.tenantId, input.receipt_id);
+      if (!row)
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_RECEIPT_NOT_FOUND", "Apply receipt not found");
+      const binding = this.db.query("SELECT * FROM todos_task_manifest_bindings WHERE tenant_id = ? AND operation_id = ? LIMIT 1").get(this.tenantId, String(row["operation_id"]));
+      if (!binding || Number(binding["version"]) !== input.if_binding_version) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_CAS_CONFLICT", "Binding version changed before compensation");
+      }
+      if (binding["state"] !== "applied")
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Graph is not in applied state");
+      const delivered = this.db.query(`SELECT o.id FROM todos_task_manifest_outbox o
+        JOIN todos_task_manifest_receipts r ON r.receipt_id = o.apply_receipt_id
+        WHERE r.tenant_id = ? AND o.apply_receipt_id = ? AND o.status = 'delivered'
+        LIMIT 1`).get(this.tenantId, input.receipt_id);
+      if (delivered)
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: delivered outbox row exists");
+      const applyResult = parseApplyResult(String(row["result_json"]), false);
+      const manifest = JSON.parse(String(row["manifest_json"]));
+      const expectedEffects = [
+        {
+          topic: "todos.task-manifest.applied",
+          payload: { operation_id: manifest.operation_id, project_id: manifest.project_id }
+        },
+        ...(manifest.effects ?? []).map((effect2) => ({ topic: effect2.topic, payload: effect2.payload }))
+      ];
+      const storedOutbox = this.db.query(`SELECT id, topic, payload, payload_digest, status, attempts, delivered_at
+        FROM todos_task_manifest_outbox
+        WHERE apply_receipt_id = ?
+          AND EXISTS (
+            SELECT 1 FROM todos_task_manifest_receipts r
+            WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
+              AND r.tenant_id = ?
+          )
+        ORDER BY id`).all(input.receipt_id, this.tenantId);
+      if (storedOutbox.length !== expectedEffects.length) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: outbox changed since apply");
+      }
+      const outboxById = new Map(storedOutbox.map((entry2) => [String(entry2["id"]), entry2]));
+      for (const [index, expectedEffect] of expectedEffects.entries()) {
+        const stored = outboxById.get(applyResult.outbox_ids[index]);
+        const expectedPayload = canonicalJson2(expectedEffect.payload);
+        if (!stored || stored["topic"] !== expectedEffect.topic || stored["payload"] !== expectedPayload || stored["payload_digest"] !== canonicalDigest(expectedEffect) || stored["status"] !== "pending" || Number(stored["attempts"]) !== 0 || stored["delivered_at"] !== null) {
+          throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: outbox changed since apply");
+        }
+      }
+      const taskIds = Object.values(applyResult.graph.task_ids);
+      const placeholders4 = taskIds.map(() => "?").join(",");
+      const foreignReference = findSqliteTaskManifestForeignReference(this.db, {
+        plan_id: applyResult.graph.plan_id,
+        task_ids: taskIds,
+        dependency_ids: applyResult.graph.dependency_ids,
+        comment_ids: applyResult.graph.comment_ids,
+        verification_ids: applyResult.graph.verification_ids
+      });
+      if (foreignReference) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", `Compensation refused: foreign reference at ${foreignReference.surface}.${foreignReference.field} would be changed by ${foreignReference.on_delete}`, { ...foreignReference });
+      }
+      const actualReadback = this.readback(applyResult.graph);
+      if (canonicalJson2(actualReadback) !== canonicalJson2(applyResult.readback)) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: graph changed since apply", { actualReadback });
+      }
+      const plan = this.db.query("SELECT project_id, name, description, status, task_list_id, slug FROM plans WHERE id = ? LIMIT 1").get(applyResult.graph.plan_id);
+      if (!plan || plan["project_id"] !== manifest.project_id || plan["name"] !== manifest.plan.name || plan["description"] !== (manifest.plan.description ?? null) || plan["status"] !== (manifest.plan.status ?? "active") || plan["task_list_id"] !== (manifest.task_list_id ?? null) || plan["slug"] !== taskManifestPlanSlug(manifest, applyResult.graph.plan_id)) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: plan changed since apply");
+      }
+      for (const task2 of manifest.tasks) {
+        const stored = this.db.query("SELECT title, description, status, priority, assigned_to, tags, metadata, created_by FROM tasks WHERE id = ? LIMIT 1").get(applyResult.graph.task_ids[task2.key]);
+        if (!stored || stored["title"] !== task2.title || stored["description"] !== (task2.description ?? null) || stored["status"] !== (task2.status ?? "pending") || stored["priority"] !== (task2.priority ?? "medium") || stored["assigned_to"] !== (task2.assigned_to ?? null) || stored["tags"] !== JSON.stringify(task2.tags ?? []) || stored["metadata"] !== canonicalJson2(task2.metadata ?? {}) || stored["created_by"] !== (task2.created_by ?? null)) {
+          throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", `Compensation refused: task ${task2.key} changed since apply`);
+        }
+        const storedTags = this.db.query("SELECT tag FROM task_tags WHERE task_id = ? ORDER BY tag").all(applyResult.graph.task_ids[task2.key]).map((row2) => row2.tag);
+        const expectedTags = [...new Set(task2.tags ?? [])].sort();
+        if (canonicalJson2(storedTags) !== canonicalJson2(expectedTags)) {
+          throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", `Compensation refused: task ${task2.key} tags changed since apply`);
+        }
+      }
+      const storedDependencies = this.db.query(`SELECT task_id, depends_on FROM task_dependencies
+        WHERE task_id IN (${placeholders4}) AND depends_on IN (${placeholders4}) ORDER BY task_id, depends_on`).all(...taskIds, ...taskIds);
+      const expectedDependencies = (manifest.dependencies ?? []).map((edge) => ({
+        task_id: applyResult.graph.task_ids[edge.task],
+        depends_on: applyResult.graph.task_ids[edge.depends_on]
+      })).sort((left, right) => left.task_id.localeCompare(right.task_id) || left.depends_on.localeCompare(right.depends_on));
+      if (canonicalJson2(storedDependencies) !== canonicalJson2(expectedDependencies)) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: dependencies changed since apply");
+      }
+      let expectedCommentIndex = 0;
+      for (const task2 of manifest.tasks)
+        for (const comment2 of task2.comments ?? []) {
+          const stored = this.db.query(`SELECT task_id, agent_id, session_id, content, type, progress_pct
+          FROM task_comments WHERE id = ? LIMIT 1`).get(applyResult.graph.comment_ids[expectedCommentIndex]);
+          const expected = {
+            task_id: applyResult.graph.task_ids[task2.key],
+            agent_id: comment2.agent_id ?? null,
+            session_id: comment2.session_id ?? null,
+            content: comment2.content,
+            type: comment2.type ?? "comment",
+            progress_pct: comment2.progress_pct ?? null
+          };
+          if (!stored || canonicalJson2(stored) !== canonicalJson2(expected)) {
+            throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: comment changed since apply");
+          }
+          expectedCommentIndex += 1;
+        }
+      let expectedVerificationIndex = 0;
+      for (const task2 of manifest.tasks)
+        for (const verification2 of task2.verifications ?? []) {
+          const stored = this.db.query(`SELECT task_id, command, status, output_summary, artifact_path, agent_id
+          FROM task_verifications WHERE id = ? LIMIT 1`).get(applyResult.graph.verification_ids[expectedVerificationIndex]);
+          const expected = {
+            task_id: applyResult.graph.task_ids[task2.key],
+            command: verification2.command,
+            status: verification2.status ?? "unknown",
+            output_summary: verification2.output_summary ?? null,
+            artifact_path: verification2.artifact_path ?? null,
+            agent_id: verification2.agent_id ?? null
+          };
+          if (!stored || canonicalJson2(stored) !== canonicalJson2(expected)) {
+            throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: verification changed since apply");
+          }
+          expectedVerificationIndex += 1;
+        }
+      this.db.query(`UPDATE todos_task_manifest_outbox
+        SET status = 'cancelled'
+        WHERE apply_receipt_id = ? AND status = 'pending'
+          AND EXISTS (
+            SELECT 1 FROM todos_task_manifest_receipts r
+            WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
+              AND r.tenant_id = ?
+          )`).run(input.receipt_id, this.tenantId);
+      for (const table of ["task_tags", "task_dependencies", "task_comments", "task_verifications"]) {
+        const column = table === "task_dependencies" ? "task_id" : "task_id";
+        this.db.query(`DELETE FROM ${table} WHERE ${column} IN (${placeholders4})`).run(...taskIds);
+      }
+      this.db.query(`DELETE FROM tasks WHERE id IN (${placeholders4})`).run(...taskIds);
+      this.db.query("DELETE FROM plans WHERE id = ?").run(applyResult.graph.plan_id);
+      const readback = this.readback(applyResult.graph);
+      const result = { duplicate: false, receipt, absent: true, readback };
+      const resultJson2 = canonicalJson2(result);
+      this.db.query(`INSERT INTO todos_task_manifest_receipts (
+        receipt_id, tenant_id, authority, route, schema_version, kind, operation_id, idempotency_key,
+        request_digest, result_digest, binding_version, apply_receipt_id, manifest_json, result_json, created_at
+      ) VALUES (?, ?, 'todos', 'todos.task-manifest.v1', 1, 'compensate', ?, ?, ?, ?, ?, ?, NULL, ?, ?)`).run(compensationReceiptId, this.tenantId, receipt.operation_id, input.idempotency_key, requestDigest, receipt.result_digest, receipt.binding_version, input.receipt_id, resultJson2, now4);
+      const updated = this.db.query(`UPDATE todos_task_manifest_bindings SET state = 'compensated', version = ?, compensation_receipt_id = ?, updated_at = ?
+        WHERE tenant_id = ? AND operation_id = ? AND state = 'applied' AND version = ?`).run(receipt.binding_version, compensationReceiptId, now4, this.tenantId, receipt.operation_id, input.if_binding_version);
+      if (updated.changes !== 1) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_CAS_CONFLICT", "Binding changed during compensation");
+      }
+      return result;
+    });
+  }
+  readback(graph) {
+    const taskIds = Object.values(graph.task_ids);
+    const placeholders4 = taskIds.map(() => "?").join(",");
+    const count = (sql, ...values) => Number(this.db.query(sql).get(...values).count);
+    return {
+      plans: count("SELECT count(*) AS count FROM plans WHERE id = ?", graph.plan_id),
+      tasks: count(`SELECT count(*) AS count FROM tasks WHERE id IN (${placeholders4})`, ...taskIds),
+      dependencies: count(`SELECT count(*) AS count FROM task_dependencies WHERE task_id IN (${placeholders4}) AND depends_on IN (${placeholders4})`, ...taskIds, ...taskIds),
+      comments: count(`SELECT count(*) AS count FROM task_comments WHERE id IN (${graph.comment_ids.map(() => "?").join(",") || "NULL"})`, ...graph.comment_ids),
+      verifications: count(`SELECT count(*) AS count FROM task_verifications WHERE id IN (${graph.verification_ids.map(() => "?").join(",") || "NULL"})`, ...graph.verification_ids),
+      complete: true
+    };
+  }
+}
 var sqliteTails;
 var init_sqlite2 = __esm(() => {
   init_canonical();
+  init_plan_slug();
   init_backend();
   init_types5();
   sqliteTails = new WeakMap;
@@ -46239,7 +46835,7 @@ function parseJson2(value) {
 function timestamp2(value) {
   return value instanceof Date ? value.toISOString() : new Date(String(value)).toISOString();
 }
-function fault(faults, point) {
+function fault2(faults, point) {
   if (faults.points.has(point))
     throw new Error(`Injected task-manifest fault at ${point}`);
 }
@@ -46321,7 +46917,7 @@ function taskPayload(manifest, task2, taskId, planId, now4) {
 function planPayload(input) {
   return {
     id: input.graph.plan_id,
-    slug: null,
+    slug: taskManifestPlanSlug(input.manifest, input.graph.plan_id),
     project_id: input.manifest.project_id,
     task_list_id: input.manifest.task_list_id ?? null,
     agent_id: null,
@@ -46334,7 +46930,7 @@ function planPayload(input) {
     synced_at: null
   };
 }
-function placeholders3(start, count) {
+function placeholders4(start, count) {
   return Array.from({ length: count }, (_, index) => `$${start + index}`).join(",");
 }
 
@@ -46408,15 +47004,15 @@ class PostgresTodosTaskManifestBackend {
       }
       const objectIds = [input.graph.plan_id, ...Object.values(input.graph.task_ids), ...input.graph.comment_ids, ...input.graph.verification_ids, ...input.graph.dependency_ids];
       const conflict = await tx.query(`SELECT object_id FROM ${this.tableName}
-        WHERE service = $1 AND object_id IN (${placeholders3(2, objectIds.length)}) LIMIT 1`, [this.service, ...objectIds]);
+        WHERE service = $1 AND object_id IN (${placeholders4(2, objectIds.length)}) LIMIT 1`, [this.service, ...objectIds]);
       if (conflict.rows[0])
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", "A deterministic graph id already exists");
       await this.insertSync(tx, "plans", input.graph.plan_id, planPayload(input), input.now);
-      fault(faults, "after_plan_write");
+      fault2(faults, "after_plan_write");
       for (const task2 of manifest.tasks) {
         await this.insertSync(tx, "tasks", input.graph.task_ids[task2.key], taskPayload(manifest, task2, input.graph.task_ids[task2.key], input.graph.plan_id, input.now), input.now);
       }
-      fault(faults, "after_task_write");
+      fault2(faults, "after_task_write");
       for (const [index, edge] of (manifest.dependencies ?? []).entries()) {
         await this.insertSync(tx, "dependencies", input.graph.dependency_ids[index], {
           id: input.graph.dependency_ids[index],
@@ -46426,7 +47022,7 @@ class PostgresTodosTaskManifestBackend {
           updated_at: input.now
         }, input.now);
       }
-      fault(faults, "after_dependency_write");
+      fault2(faults, "after_dependency_write");
       let commentIndex = 0;
       for (const task2 of manifest.tasks)
         for (const comment2 of task2.comments ?? []) {
@@ -46442,7 +47038,7 @@ class PostgresTodosTaskManifestBackend {
             created_at: input.now
           }, input.now);
         }
-      fault(faults, "after_comment_write");
+      fault2(faults, "after_comment_write");
       let verificationIndex = 0;
       for (const task2 of manifest.tasks)
         for (const verification2 of task2.verifications ?? []) {
@@ -46460,7 +47056,7 @@ class PostgresTodosTaskManifestBackend {
             updated_at: input.now
           }, input.now);
         }
-      fault(faults, "after_verification_write");
+      fault2(faults, "after_verification_write");
       const readback = await this.readback(tx, input.graph);
       const expected = {
         plans: 1,
@@ -46523,7 +47119,7 @@ class PostgresTodosTaskManifestBackend {
           input.now
         ]);
       }
-      fault(faults, "after_outbox_write");
+      fault2(faults, "after_outbox_write");
       await tx.query(`INSERT INTO todos_task_manifest_bindings (
         operation_id, tenant_id, idempotency_key, request_digest, result_digest, apply_receipt_id,
         manifest_json, result_json, state, version, created_at, updated_at
@@ -46538,7 +47134,7 @@ class PostgresTodosTaskManifestBackend {
         resultJson2,
         input.now
       ]);
-      fault(faults, "after_receipt_write");
+      fault2(faults, "after_receipt_write");
       return result;
     });
   }
@@ -46778,7 +47374,7 @@ class PostgresTodosTaskManifestBackend {
         }
       const managedIds = [...expectedPayloads.keys()];
       const stored = await tx.query(`SELECT object_type, object_id, payload FROM ${this.tableName}
-        WHERE service = $1 AND object_id IN (${placeholders3(2, managedIds.length)})`, [this.service, ...managedIds]);
+        WHERE service = $1 AND object_id IN (${placeholders4(2, managedIds.length)})`, [this.service, ...managedIds]);
       for (const row of stored.rows) {
         const expected = expectedPayloads.get(String(row["object_id"]));
         if (!expected || expected.type !== row["object_type"] || expected.payload !== canonicalJson2(parseJson2(row["payload"]))) {
@@ -46815,7 +47411,7 @@ class PostgresTodosTaskManifestBackend {
         if (!ids.length)
           continue;
         await tx.query(`DELETE FROM ${this.tableName} WHERE service = $1 AND object_type = $2
-          AND object_id IN (${placeholders3(3, ids.length)})`, [this.service, objectType2, ...ids]);
+          AND object_id IN (${placeholders4(3, ids.length)})`, [this.service, objectType2, ...ids]);
       }
       const readback = await this.readback(tx, applyResult.graph);
       const result = { duplicate: false, receipt, absent: true, readback };
@@ -46855,7 +47451,7 @@ class PostgresTodosTaskManifestBackend {
         return 0;
       const result = await tx.query(`SELECT count(*) AS count FROM ${this.tableName}
         WHERE service = $1 AND object_type = $2 AND deleted_at IS NULL
-          AND object_id IN (${placeholders3(3, ids.length)})`, [this.service, objectType2, ...ids]);
+          AND object_id IN (${placeholders4(3, ids.length)})`, [this.service, objectType2, ...ids]);
       return Number(result.rows[0]?.count ?? 0);
     };
     return {
@@ -46870,6 +47466,7 @@ class PostgresTodosTaskManifestBackend {
 }
 var init_postgres3 = __esm(() => {
   init_canonical();
+  init_plan_slug();
   init_backend();
   init_postgres_sync();
   init_types5();
@@ -47072,6 +47669,13 @@ class PackageOwnedTodosTaskManifestAuthority {
     return result;
   }
 }
+function createSqliteTodosTaskManifestAuthority(options) {
+  if (!options?.database) {
+    throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_ATOMICITY_UNAVAILABLE", "An explicit SQLite Database is required");
+  }
+  const tenantId = resolveTenantId(options.tenantId);
+  return new PackageOwnedTodosTaskManifestAuthority(new SqliteTodosTaskManifestBackend(options.database, tenantId), { ...options, tenantId });
+}
 function createPostgresTodosTaskManifestAuthority(client, options = {}) {
   if (!client || typeof client.transaction !== "function") {
     throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_ATOMICITY_UNAVAILABLE", "An authoritative PostgreSQL transaction(callback) client is required");
@@ -60183,18 +60787,18 @@ function createSessionRecoveryHandoff(input, db) {
     LIMIT ?
   `).all(...params, limit);
   const taskIds = tasks.map((task2) => task2.id);
-  const placeholders4 = taskIds.map(() => "?").join(",");
+  const placeholders5 = taskIds.map(() => "?").join(",");
   const files = taskIds.length ? d.query(`
         SELECT DISTINCT path
         FROM task_files
-        WHERE task_id IN (${placeholders4}) AND status != 'removed'
+        WHERE task_id IN (${placeholders5}) AND status != 'removed'
         ORDER BY updated_at DESC, path
         LIMIT ?
       `).all(...taskIds, limit).map((row) => row.path) : [];
   const runs = taskIds.length ? d.query(`
         SELECT id
         FROM task_runs
-        WHERE task_id IN (${placeholders4})
+        WHERE task_id IN (${placeholders5})
         ORDER BY started_at DESC, created_at DESC
         LIMIT ?
       `).all(...taskIds, limit).map((row) => row.id) : [];
@@ -69765,8 +70369,8 @@ function findPath(sourceId, targetId, opts, db) {
     let sql = "SELECT * FROM kg_edges WHERE source_id = ?";
     const params = [current.id];
     if (opts?.relation_types && opts.relation_types.length > 0) {
-      const placeholders4 = opts.relation_types.map(() => "?").join(",");
-      sql += ` AND relation_type IN (${placeholders4})`;
+      const placeholders5 = opts.relation_types.map(() => "?").join(",");
+      sql += ` AND relation_type IN (${placeholders5})`;
       params.push(...opts.relation_types);
     }
     const edges = d.query(sql).all(...params).map(rowToEdge);
@@ -69801,8 +70405,8 @@ function getImpactAnalysis(entityId, opts, db) {
     let sql = "SELECT * FROM kg_edges WHERE source_id = ?";
     const params = [current.id];
     if (opts?.relation_types && opts.relation_types.length > 0) {
-      const placeholders4 = opts.relation_types.map(() => "?").join(",");
-      sql += ` AND relation_type IN (${placeholders4})`;
+      const placeholders5 = opts.relation_types.map(() => "?").join(",");
+      sql += ` AND relation_type IN (${placeholders5})`;
       params.push(...opts.relation_types);
     }
     const edges = d.query(sql).all(...params).map(rowToEdge);
@@ -90964,6 +91568,156 @@ var init_pr_group_commands = __esm(() => {
   init_helpers();
 });
 
+// src/cli/commands/task-manifest-commands.ts
+var exports_task_manifest_commands = {};
+__export(exports_task_manifest_commands, {
+  registerTaskManifestCommands: () => registerTaskManifestCommands
+});
+import chalk32 from "chalk";
+import { readFileSync as readFileSync26 } from "fs";
+function globalOptions11(program2) {
+  const command = program2;
+  return command.optsWithGlobals?.() ?? program2.opts();
+}
+function jsonRequested(program2, opts) {
+  return opts.json === true || globalOptions11(program2)["json"] === true;
+}
+function parseJsonFile(path) {
+  try {
+    return JSON.parse(readFileSync26(path, "utf8"));
+  } catch (error2) {
+    throw new Error(`task-manifest input must be a readable JSON file: ${error2 instanceof Error ? error2.message : String(error2)}`);
+  }
+}
+function parseInteger2(value, label, min) {
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < min) {
+    throw new Error(`${label} must be an integer >= ${min}`);
+  }
+  return parsed;
+}
+async function localAuthority(tenantId) {
+  return createSqliteTodosTaskManifestAuthority({
+    database: getDatabase(),
+    ...tenantId ? { tenantId } : {}
+  });
+}
+async function currentTenantId(remote, authority, explicit) {
+  if (explicit)
+    return explicit;
+  const capability = remote ? await cloudTaskManifestCapability(remote) : await authority.capability();
+  return capability.tenant_id;
+}
+function registerTaskManifestCommands(program2) {
+  const taskManifest = program2.command("task-manifest").description("Apply and inspect package-owned task-manifest safe mutations");
+  taskManifest.command("capability").description("Show the current task-manifest authority capability").option("-j, --json", "Output as JSON").option("--tenant-id <id>", "Tenant id for local SQLite authority").action(async (opts) => {
+    try {
+      const remote = getTodosCloudClient();
+      const result = remote ? await cloudTaskManifestCapability(remote) : await (await localAuthority(opts.tenantId)).capability();
+      if (jsonRequested(program2, opts)) {
+        output({ capability: result }, true);
+        return;
+      }
+      console.log(`${chalk32.bold(result.route)} tenant=${result.tenant_id} backend=${result.backend}`);
+    } catch (error2) {
+      handleError(error2);
+    }
+  });
+  taskManifest.command("apply").description("Apply a task-manifest JSON file exactly once by operation/idempotency key").requiredOption("--file <path>", "Task manifest JSON file").option("-j, --json", "Output as JSON").option("--tenant-id <id>", "Tenant id for local SQLite authority").action(async (opts) => {
+    try {
+      const manifest = parseJsonFile(opts.file);
+      const remote = getTodosCloudClient();
+      const result = remote ? await cloudApplyTaskManifest(remote, manifest) : await (await localAuthority(opts.tenantId)).apply(manifest);
+      if (jsonRequested(program2, opts)) {
+        output({ result }, true);
+        return;
+      }
+      console.log(`${result.duplicate ? "duplicate" : "applied"} receipt=${result.receipt.receipt_id}`);
+      console.log(`plan=${result.graph.plan_id} tasks=${Object.keys(result.graph.task_ids).length}`);
+    } catch (error2) {
+      handleError(error2);
+    }
+  });
+  taskManifest.command("read-exact <receipt-id>").description("Read one immutable task-manifest apply receipt by full receipt id").option("-j, --json", "Output as JSON").option("--tenant-id <id>", "Tenant id for local SQLite authority").action(async (receiptId3, opts) => {
+    try {
+      const remote = getTodosCloudClient();
+      const result = remote ? await cloudReadExactTaskManifest(remote, receiptId3) : await (await localAuthority(opts.tenantId)).readExact(receiptId3);
+      if (jsonRequested(program2, opts)) {
+        output({ result }, true);
+        return;
+      }
+      console.log(`receipt=${result.receipt.receipt_id} duplicate=${String(result.duplicate)}`);
+      console.log(`readback=${JSON.stringify(result.readback)}`);
+    } catch (error2) {
+      handleError(error2);
+    }
+  });
+  taskManifest.command("lookup").description("Recover one exact managed apply receipt from a full plan id").requiredOption("--plan-id <uuid>", "Full managed plan UUID").option("--tenant-id <id>", "Authority tenant id; defaults to capability tenant").option("-j, --json", "Output as JSON").action(async (opts) => {
+    try {
+      const remote = getTodosCloudClient();
+      const authority = remote ? null : await localAuthority(opts.tenantId);
+      const tenantId = await currentTenantId(remote, authority, opts.tenantId);
+      const request = {
+        authority: "todos",
+        route: TODOS_TASK_MANIFEST_ROUTE,
+        schema_version: TODOS_TASK_MANIFEST_SCHEMA_VERSION,
+        tenant_id: tenantId,
+        plan_id: opts.planId,
+        max_items: 1
+      };
+      const result = remote ? await cloudLookupTaskManifestBinding(remote, request) : await authority.lookupBinding(request);
+      if (jsonRequested(program2, opts)) {
+        output({ result }, true);
+        return;
+      }
+      console.log(`plan=${result.plan_id} receipt=${result.apply_receipt_id} state=${result.state}`);
+    } catch (error2) {
+      handleError(error2);
+    }
+  });
+  taskManifest.command("compensate").description("Compensate an untouched task-manifest graph with CAS protection").requiredOption("--receipt-id <uuid>", "Full apply receipt UUID").requiredOption("--idempotency-key <key>", "Stable compensation idempotency key").requiredOption("--if-binding-version <n>", "Expected current binding version").option("-j, --json", "Output as JSON").option("--tenant-id <id>", "Tenant id for local SQLite authority").action(async (opts) => {
+    try {
+      const request = {
+        receipt_id: opts.receiptId,
+        idempotency_key: opts.idempotencyKey,
+        if_binding_version: parseInteger2(opts.ifBindingVersion, "--if-binding-version", 1)
+      };
+      const remote = getTodosCloudClient();
+      const result = remote ? await cloudCompensateTaskManifest(remote, request) : await (await localAuthority(opts.tenantId)).compensate(request);
+      if (jsonRequested(program2, opts)) {
+        output({ result }, true);
+        return;
+      }
+      console.log(`${result.duplicate ? "duplicate" : "compensated"} receipt=${result.receipt.receipt_id}`);
+      console.log(`absent=${String(result.absent)} readback=${JSON.stringify(result.readback)}`);
+    } catch (error2) {
+      handleError(error2);
+    }
+  });
+  taskManifest.command("outbox-delivered <outbox-id>").description("Mark one task-manifest outbox effect delivered").option("-j, --json", "Output as JSON").option("--tenant-id <id>", "Tenant id for local SQLite authority").action(async (outboxId, opts) => {
+    try {
+      const remote = getTodosCloudClient();
+      if (remote)
+        await cloudMarkTaskManifestOutboxDelivered(remote, outboxId);
+      else
+        await (await localAuthority(opts.tenantId)).markOutboxDelivered(outboxId);
+      if (jsonRequested(program2, opts)) {
+        output({ delivered: true }, true);
+        return;
+      }
+      console.log(`delivered=${outboxId}`);
+    } catch (error2) {
+      handleError(error2);
+    }
+  });
+}
+var init_task_manifest_commands = __esm(() => {
+  init_database();
+  init_task_manifest();
+  init_cloud_router();
+  init_helpers();
+});
+
 // src/lib/cli-help.ts
 function optionEntry(option) {
   return {
@@ -91227,7 +91981,7 @@ var exports_help_commands = {};
 __export(exports_help_commands, {
   registerHelpCommands: () => registerHelpCommands
 });
-function globalOptions11(program2) {
+function globalOptions12(program2) {
   const command = program2;
   return command.optsWithGlobals?.() ?? program2.opts();
 }
@@ -91246,7 +92000,7 @@ function registerHelpCommands(program2, route = "local", remoteCapabilities = ne
   });
   program2.command("manual").description("Print the complete local CLI manual").option("--format <format>", "markdown or json", "markdown").option("-j, --json", "Output as JSON").action((opts) => {
     try {
-      const globalOpts = globalOptions11(program2);
+      const globalOpts = globalOptions12(program2);
       const manual = createCliManual(program2, {
         isCommandVisible: (command) => isTodosCliCommandVisibleForRoute(command, route, remoteCapabilities),
         localOnly: route === "local"
@@ -91381,6 +92135,7 @@ var [
   { registerStorageCommands: registerStorageCommands2 },
   { registerScaleHardeningCommands: registerScaleHardeningCommands2 },
   { registerPrGroupCommands: registerPrGroupCommands2 },
+  { registerTaskManifestCommands: registerTaskManifestCommands2 },
   { registerHelpCommands: registerHelpCommands2 }
 ] = await Promise.all([
   Promise.resolve().then(() => (init_helpers(), exports_helpers)),
@@ -91414,6 +92169,7 @@ var [
   Promise.resolve().then(() => (init_storage_commands(), exports_storage_commands)),
   Promise.resolve().then(() => (init_scale_hardening_commands(), exports_scale_hardening_commands)),
   Promise.resolve().then(() => (init_pr_group_commands(), exports_pr_group_commands)),
+  Promise.resolve().then(() => (init_task_manifest_commands(), exports_task_manifest_commands)),
   Promise.resolve().then(() => (init_help_commands(), exports_help_commands))
 ]);
 registerTaskCommands2(program2);
@@ -91446,6 +92202,7 @@ registerLocalBackupCommands2(program2);
 registerStorageCommands2(program2);
 registerScaleHardeningCommands2(program2);
 registerPrGroupCommands2(program2);
+registerTaskManifestCommands2(program2);
 await registerOptionalEventsCommands(program2);
 registerHelpCommands2(program2, authority.route, remoteCommandCapabilities);
 applyTodosCliHelpVisibility(program2, authority.route, remoteCommandCapabilities);