@hasna/todos 0.15.6 → 0.15.7

package/dist/index.js

@@ -39,6 +39,206 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
+// src/project-registration/schema.ts
+function sqliteTodosProjectRegistrationSchemaSql() {
+  return `
+    CREATE TABLE IF NOT EXISTS todos_project_registration_receipts (
+      receipt_id TEXT PRIMARY KEY,
+      authority TEXT NOT NULL CHECK(authority = 'todos'),
+      route TEXT NOT NULL,
+      package_version TEXT NOT NULL,
+      authority_id TEXT NOT NULL,
+      tenant_id TEXT NOT NULL,
+      corpus_id TEXT NOT NULL,
+      operation_id TEXT NOT NULL,
+      step_id TEXT NOT NULL,
+      resource_kind TEXT NOT NULL CHECK(resource_kind IN ('project', 'task_list')),
+      direction TEXT NOT NULL CHECK(direction IN ('forward', 'inverse')),
+      target_selector TEXT NOT NULL,
+      idempotency_key TEXT NOT NULL,
+      request_digest TEXT NOT NULL,
+      precondition_digest TEXT NOT NULL,
+      normalized_call_digest TEXT NOT NULL,
+      outcome TEXT NOT NULL CHECK(outcome IN (
+        'accepted', 'duplicate_of_accepted', 'terminal_nonacceptance'
+      )),
+      reason TEXT,
+      target_id TEXT,
+      result_revision TEXT,
+      result_digest TEXT,
+      duplicate_of_receipt_id TEXT,
+      accepted_receipt_id TEXT,
+      created_by_operation INTEGER NOT NULL CHECK(created_by_operation IN (0, 1)),
+      created_at TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_todos_project_registration_receipts_lookup
+      ON todos_project_registration_receipts (
+        authority_id, tenant_id, corpus_id, operation_id, step_id,
+        resource_kind, direction, idempotency_key
+      );
+    CREATE INDEX IF NOT EXISTS idx_todos_project_registration_receipts_step
+      ON todos_project_registration_receipts (
+        authority_id, tenant_id, corpus_id, operation_id, step_id,
+        resource_kind, direction, outcome
+      );
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_todos_project_registration_receipts_accepted_step
+      ON todos_project_registration_receipts (
+        authority_id, tenant_id, corpus_id, operation_id, step_id,
+        resource_kind, direction
+      )
+      WHERE outcome = 'accepted';
+    CREATE INDEX IF NOT EXISTS idx_todos_project_registration_receipts_target
+      ON todos_project_registration_receipts (
+        authority_id, tenant_id, corpus_id, resource_kind, target_id
+      );
+
+    CREATE TABLE IF NOT EXISTS todos_project_registration_bindings (
+      authority_id TEXT NOT NULL,
+      tenant_id TEXT NOT NULL,
+      corpus_id TEXT NOT NULL,
+      resource_kind TEXT NOT NULL CHECK(resource_kind IN ('project', 'task_list')),
+      target_selector TEXT NOT NULL,
+      operation_id TEXT NOT NULL,
+      step_id TEXT NOT NULL,
+      direction TEXT NOT NULL CHECK(direction = 'forward'),
+      idempotency_key TEXT NOT NULL,
+      request_digest TEXT NOT NULL,
+      precondition_digest TEXT NOT NULL,
+      normalized_call_digest TEXT NOT NULL,
+      state TEXT NOT NULL CHECK(state IN (
+        'pending', 'accepted', 'terminal_nonacceptance', 'removed'
+      )),
+      target_id TEXT,
+      accepted_receipt_id TEXT,
+      result_revision TEXT,
+      result_digest TEXT,
+      removed_receipt_id TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      PRIMARY KEY(
+        authority_id, tenant_id, corpus_id, resource_kind, target_selector
+      ),
+      UNIQUE(accepted_receipt_id)
+    );
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_todos_project_registration_binding_target
+      ON todos_project_registration_bindings(
+        authority_id, tenant_id, corpus_id, resource_kind, target_id
+      )
+      WHERE target_id IS NOT NULL;
+
+    CREATE TRIGGER IF NOT EXISTS todos_project_registration_receipts_immutable_update
+    BEFORE UPDATE ON todos_project_registration_receipts
+    BEGIN
+      SELECT RAISE(ABORT, 'todos project registration receipts are immutable');
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS todos_project_registration_receipts_immutable_delete
+    BEFORE DELETE ON todos_project_registration_receipts
+    BEGIN
+      SELECT RAISE(ABORT, 'todos project registration receipts are immutable');
+    END;
+  `;
+}
+function postgresTodosProjectRegistrationSchemaSql() {
+  return [
+    `CREATE TABLE IF NOT EXISTS todos_project_registration_receipts (
+      receipt_id text PRIMARY KEY,
+      authority text NOT NULL CHECK(authority = 'todos'),
+      route text NOT NULL,
+      package_version text NOT NULL,
+      authority_id text NOT NULL,
+      tenant_id text NOT NULL,
+      corpus_id text NOT NULL,
+      operation_id text NOT NULL,
+      step_id text NOT NULL,
+      resource_kind text NOT NULL CHECK(resource_kind IN ('project', 'task_list')),
+      direction text NOT NULL CHECK(direction IN ('forward', 'inverse')),
+      target_selector text NOT NULL,
+      idempotency_key text NOT NULL,
+      request_digest text NOT NULL,
+      precondition_digest text NOT NULL,
+      normalized_call_digest text NOT NULL,
+      outcome text NOT NULL CHECK(outcome IN (
+        'accepted', 'duplicate_of_accepted', 'terminal_nonacceptance'
+      )),
+      reason text,
+      target_id text,
+      result_revision text,
+      result_digest text,
+      duplicate_of_receipt_id text,
+      accepted_receipt_id text,
+      created_by_operation boolean NOT NULL,
+      created_at timestamptz NOT NULL
+    )`,
+    `CREATE INDEX IF NOT EXISTS todos_project_registration_receipts_lookup_idx
+      ON todos_project_registration_receipts (
+        authority_id, tenant_id, corpus_id, operation_id, step_id,
+        resource_kind, direction, idempotency_key
+      )`,
+    `CREATE INDEX IF NOT EXISTS todos_project_registration_receipts_step_idx
+      ON todos_project_registration_receipts (
+        authority_id, tenant_id, corpus_id, operation_id, step_id,
+        resource_kind, direction, outcome
+      )`,
+    `CREATE UNIQUE INDEX IF NOT EXISTS todos_project_registration_receipts_accepted_step_uidx
+      ON todos_project_registration_receipts (
+        authority_id, tenant_id, corpus_id, operation_id, step_id,
+        resource_kind, direction
+      )
+      WHERE outcome = 'accepted'`,
+    `CREATE INDEX IF NOT EXISTS todos_project_registration_receipts_target_idx
+      ON todos_project_registration_receipts (
+        authority_id, tenant_id, corpus_id, resource_kind, target_id
+      )`,
+    `CREATE TABLE IF NOT EXISTS todos_project_registration_bindings (
+      authority_id text NOT NULL,
+      tenant_id text NOT NULL,
+      corpus_id text NOT NULL,
+      resource_kind text NOT NULL CHECK(resource_kind IN ('project', 'task_list')),
+      target_selector text NOT NULL,
+      operation_id text NOT NULL,
+      step_id text NOT NULL,
+      direction text NOT NULL CHECK(direction = 'forward'),
+      idempotency_key text NOT NULL,
+      request_digest text NOT NULL,
+      precondition_digest text NOT NULL,
+      normalized_call_digest text NOT NULL,
+      state text NOT NULL CHECK(state IN (
+        'pending', 'accepted', 'terminal_nonacceptance', 'removed'
+      )),
+      target_id text,
+      accepted_receipt_id text UNIQUE,
+      result_revision text,
+      result_digest text,
+      removed_receipt_id text,
+      created_at timestamptz NOT NULL,
+      updated_at timestamptz NOT NULL,
+      PRIMARY KEY(
+        authority_id, tenant_id, corpus_id, resource_kind, target_selector
+      )
+    )`,
+    `CREATE UNIQUE INDEX IF NOT EXISTS todos_project_registration_binding_target_uidx
+      ON todos_project_registration_bindings(
+        authority_id, tenant_id, corpus_id, resource_kind, target_id
+      )
+      WHERE target_id IS NOT NULL`,
+    `CREATE OR REPLACE FUNCTION todos_project_registration_receipts_immutable()
+      RETURNS trigger
+      LANGUAGE plpgsql
+      AS $$
+      BEGIN
+        RAISE EXCEPTION 'todos project registration receipts are immutable';
+      END;
+      $$`,
+    `DROP TRIGGER IF EXISTS todos_project_registration_receipts_immutable
+      ON todos_project_registration_receipts`,
+    `CREATE TRIGGER todos_project_registration_receipts_immutable
+      BEFORE UPDATE OR DELETE ON todos_project_registration_receipts
+      FOR EACH ROW EXECUTE FUNCTION todos_project_registration_receipts_immutable()`
+  ];
+}
+
 // src/db/migrations.ts
 var MIGRATIONS;
 var init_migrations = __esm(() => {
@@ -1644,6 +1844,11 @@ var init_migrations = __esm(() => {
   INSERT OR IGNORE INTO _migrations (id) VALUES (68);
   COMMIT;
   PRAGMA foreign_keys = ON;
+  `,
+    `BEGIN;
+  ${sqliteTodosProjectRegistrationSchemaSql()}
+  INSERT OR IGNORE INTO _migrations (id) VALUES (69);
+  COMMIT;
   `
   ];
 });
@@ -2846,6 +3051,7 @@ function ensureSchema(db) {
     )`);
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_api_keys_prefix ON api_keys(prefix)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_api_keys_active ON api_keys(revoked_at, expires_at)");
+  db.exec(sqliteTodosProjectRegistrationSchemaSql());
   ensureTable("pr_groups", `
     CREATE TABLE pr_groups (
       schema_version INTEGER NOT NULL DEFAULT 1,
@@ -12157,7 +12363,7 @@ var init_dispatches = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.6",
+  version: "0.15.7",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",
@@ -12195,6 +12401,10 @@ var package_default = {
     "./testing": {
       types: "./dist/testing.d.ts",
       import: "./dist/testing.js"
+    },
+    "./project-registration": {
+      types: "./dist/project-registration.d.ts",
+      import: "./dist/project-registration.js"
     }
   },
   workspaces: [
@@ -12207,8 +12417,8 @@ var package_default = {
     "README.md"
   ],
   scripts: {
-    build: "rm -rf dist dashboard/dist && cd dashboard && bun install --frozen-lockfile && bun run build && cd .. && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && tsc --emitDeclarationOnly --outDir dist",
-    "build:server": "rm -rf dist && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*'",
+    build: "rm -rf dist dashboard/dist && cd dashboard && bun install --frozen-lockfile && bun run build && cd .. && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && tsc --emitDeclarationOnly --outDir dist",
+    "build:server": "rm -rf dist && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*'",
     migrate: "bun run src/server/index.ts migrate",
     "backfill:comment-redaction": "bun run src/server/index.ts redact-comments",
     "generate:sdk": "bun run scripts/generate-sdk.ts",
@@ -23851,6 +24061,13 @@ var TODOS_PACKAGE_EXPORTS = [
     types: "./dist/testing.d.ts",
     description: "Test-store isolation helpers that keep a consumer's test suite off a shared todos store.",
     stability: "stable"
+  },
+  {
+    subpath: "./project-registration",
+    import: "./dist/project-registration.js",
+    types: "./dist/project-registration.d.ts",
+    description: "Conditional Projects-to-Todos project and task-list registration authority.",
+    stability: "stable"
   }
 ];
 function source8(version) {
@@ -31896,6 +32113,1696 @@ class PrGroupHttpClient {
 function createLocalPrGroupLedger(db = getDatabase()) {
   return new PrGroupLedger(new SqlitePrGroupLedgerPersistence(db));
 }
+// src/project-registration/authority.ts
+import { createHash as createHash12 } from "crypto";
+// src/project-registration/types.ts
+var TODOS_PROJECT_REGISTRATION_ROUTE = "todos.project-registration.v1";
+var TODOS_PROJECT_REGISTRATION_CALLER_ROUTE = "projects.full-registration.v1";
+var TODOS_PROJECT_REGISTRATION_SCHEMA_VERSION = 1;
+
+class TodosProjectRegistrationError extends Error {
+  code;
+  details;
+  constructor(code, message, details = {}) {
+    super(message);
+    this.code = code;
+    this.details = details;
+    this.name = "TodosProjectRegistrationError";
+  }
+}
+
+// src/project-registration/postgres.ts
+function safeIdentifier(value, field2) {
+  if (!/^[a-z_][a-z0-9_]*$/.test(value)) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", `${field2} must be a safe PostgreSQL identifier`);
+  }
+  return value;
+}
+function normalizeTimestamp(value) {
+  return value instanceof Date ? value.toISOString() : new Date(String(value)).toISOString();
+}
+function parsePayload3(value) {
+  if (typeof value === "string")
+    return JSON.parse(value);
+  return value;
+}
+function receiptFromRow(row) {
+  return {
+    ...row,
+    authority: "todos",
+    created_by_operation: Boolean(row["created_by_operation"]),
+    created_at: normalizeTimestamp(row["created_at"])
+  };
+}
+function bindingFromRow(row) {
+  return {
+    ...row,
+    created_at: normalizeTimestamp(row["created_at"]),
+    updated_at: normalizeTimestamp(row["updated_at"])
+  };
+}
+
+class PostgresTodosProjectRegistrationTransaction {
+  client;
+  service;
+  tableName;
+  storage;
+  constructor(client, service, tableName, cursorTableName) {
+    this.client = client;
+    this.service = service;
+    this.tableName = tableName;
+    this.storage = createPostgresTodosStorageAdapter({
+      client,
+      service,
+      tableName,
+      cursorTableName
+    });
+  }
+  async lockStep(identity) {
+    const key = [
+      identity.authority_id,
+      identity.tenant_id,
+      identity.corpus_id,
+      identity.operation_id,
+      identity.step_id,
+      identity.resource_kind,
+      identity.direction
+    ].join("\x1F");
+    await this.client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [key]);
+  }
+  async getReceiptForLookup(identity) {
+    const result = await this.client.query(`
+      SELECT * FROM todos_project_registration_receipts
+      WHERE authority_id = $1 AND tenant_id = $2 AND corpus_id = $3
+        AND operation_id = $4 AND step_id = $5 AND resource_kind = $6
+        AND direction = $7 AND idempotency_key = $8 AND target_selector = $9
+      ORDER BY CASE outcome
+        WHEN 'terminal_nonacceptance' THEN 0
+        WHEN 'duplicate_of_accepted' THEN 1
+        ELSE 2
+      END, created_at DESC, receipt_id DESC
+      LIMIT 1
+    `, [
+      identity.authority_id,
+      identity.tenant_id,
+      identity.corpus_id,
+      identity.operation_id,
+      identity.step_id,
+      identity.resource_kind,
+      identity.direction,
+      identity.idempotency_key,
+      identity.target_selector
+    ]);
+    return result.rows[0] ? receiptFromRow(result.rows[0]) : null;
+  }
+  async getReceiptById(receiptId) {
+    const result = await this.client.query("SELECT * FROM todos_project_registration_receipts WHERE receipt_id = $1 LIMIT 1", [receiptId]);
+    return result.rows[0] ? receiptFromRow(result.rows[0]) : null;
+  }
+  async getAcceptedReceiptForStep(identity) {
+    const result = await this.client.query(`
+      SELECT * FROM todos_project_registration_receipts
+      WHERE authority_id = $1 AND tenant_id = $2 AND corpus_id = $3
+        AND operation_id = $4 AND step_id = $5 AND resource_kind = $6
+        AND direction = $7 AND outcome = 'accepted'
+      ORDER BY created_at ASC, receipt_id ASC
+      LIMIT 1
+      FOR UPDATE
+    `, [
+      identity.authority_id,
+      identity.tenant_id,
+      identity.corpus_id,
+      identity.operation_id,
+      identity.step_id,
+      identity.resource_kind,
+      identity.direction
+    ]);
+    return result.rows[0] ? receiptFromRow(result.rows[0]) : null;
+  }
+  async insertReceipt(receipt) {
+    const result = await this.client.query(`
+      INSERT INTO todos_project_registration_receipts (
+        receipt_id, authority, route, package_version, authority_id, tenant_id,
+        corpus_id, operation_id, step_id, resource_kind, direction,
+        target_selector, idempotency_key, request_digest, precondition_digest,
+        normalized_call_digest, outcome, reason, target_id, result_revision,
+        result_digest, duplicate_of_receipt_id, accepted_receipt_id,
+        created_by_operation, created_at
+      ) VALUES (
+        $1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,
+        $19,$20,$21,$22,$23,$24,$25
+      )
+      ON CONFLICT (receipt_id) DO NOTHING
+      RETURNING receipt_id
+    `, [
+      receipt.receipt_id,
+      receipt.authority,
+      receipt.route,
+      receipt.package_version,
+      receipt.authority_id,
+      receipt.tenant_id,
+      receipt.corpus_id,
+      receipt.operation_id,
+      receipt.step_id,
+      receipt.resource_kind,
+      receipt.direction,
+      receipt.target_selector,
+      receipt.idempotency_key,
+      receipt.request_digest,
+      receipt.precondition_digest,
+      receipt.normalized_call_digest,
+      receipt.outcome,
+      receipt.reason,
+      receipt.target_id,
+      receipt.result_revision,
+      receipt.result_digest,
+      receipt.duplicate_of_receipt_id,
+      receipt.accepted_receipt_id,
+      receipt.created_by_operation,
+      receipt.created_at
+    ]);
+    return result.rows.length === 1;
+  }
+  async getBinding(scope, resourceKind, targetSelector) {
+    const result = await this.client.query(`
+      SELECT * FROM todos_project_registration_bindings
+      WHERE authority_id = $1 AND tenant_id = $2 AND corpus_id = $3
+        AND resource_kind = $4 AND target_selector = $5
+      LIMIT 1
+      FOR UPDATE
+    `, [
+      scope.authority_id,
+      scope.tenant_id,
+      scope.corpus_id,
+      resourceKind,
+      targetSelector
+    ]);
+    return result.rows[0] ? bindingFromRow(result.rows[0]) : null;
+  }
+  async claimBinding(binding) {
+    const result = await this.client.query(`
+      INSERT INTO todos_project_registration_bindings (
+        authority_id, tenant_id, corpus_id, resource_kind, target_selector,
+        operation_id, step_id, direction, idempotency_key, request_digest,
+        precondition_digest, normalized_call_digest, state, target_id,
+        accepted_receipt_id, result_revision, result_digest, removed_receipt_id,
+        created_at, updated_at
+      ) VALUES (
+        $1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,
+        $18,$19,$20
+      )
+      ON CONFLICT (
+        authority_id, tenant_id, corpus_id, resource_kind, target_selector
+      ) DO NOTHING
+      RETURNING target_selector
+    `, [
+      binding.authority_id,
+      binding.tenant_id,
+      binding.corpus_id,
+      binding.resource_kind,
+      binding.target_selector,
+      binding.operation_id,
+      binding.step_id,
+      binding.direction,
+      binding.idempotency_key,
+      binding.request_digest,
+      binding.precondition_digest,
+      binding.normalized_call_digest,
+      binding.state,
+      binding.target_id,
+      binding.accepted_receipt_id,
+      binding.result_revision,
+      binding.result_digest,
+      binding.removed_receipt_id,
+      binding.created_at,
+      binding.updated_at
+    ]);
+    return result.rows.length === 1;
+  }
+  async setBindingAccepted(scope, resourceKind, targetSelector, update) {
+    const result = await this.client.query(`
+      UPDATE todos_project_registration_bindings
+      SET state = 'accepted', target_id = $1, accepted_receipt_id = $2,
+        result_revision = $3, result_digest = $4, updated_at = $5
+      WHERE authority_id = $6 AND tenant_id = $7 AND corpus_id = $8
+        AND resource_kind = $9 AND target_selector = $10 AND state = 'pending'
+      RETURNING target_selector
+    `, [
+      update.target_id,
+      update.accepted_receipt_id,
+      update.result_revision,
+      update.result_digest,
+      update.updated_at,
+      scope.authority_id,
+      scope.tenant_id,
+      scope.corpus_id,
+      resourceKind,
+      targetSelector
+    ]);
+    if (result.rows.length !== 1) {
+      throw new Error("Todos project registration binding was not pending at acceptance");
+    }
+  }
+  async setBindingTerminal(scope, resourceKind, targetSelector, updatedAt) {
+    await this.client.query(`
+      UPDATE todos_project_registration_bindings
+      SET state = 'terminal_nonacceptance', updated_at = $1
+      WHERE authority_id = $2 AND tenant_id = $3 AND corpus_id = $4
+        AND resource_kind = $5 AND target_selector = $6 AND state = 'pending'
+    `, [
+      updatedAt,
+      scope.authority_id,
+      scope.tenant_id,
+      scope.corpus_id,
+      resourceKind,
+      targetSelector
+    ]);
+  }
+  async setBindingRemoved(scope, resourceKind, targetSelector, removedReceiptId, updatedAt) {
+    const result = await this.client.query(`
+      UPDATE todos_project_registration_bindings
+      SET state = 'removed', removed_receipt_id = $1, updated_at = $2
+      WHERE authority_id = $3 AND tenant_id = $4 AND corpus_id = $5
+        AND resource_kind = $6 AND target_selector = $7 AND state = 'accepted'
+      RETURNING target_selector
+    `, [
+      removedReceiptId,
+      updatedAt,
+      scope.authority_id,
+      scope.tenant_id,
+      scope.corpus_id,
+      resourceKind,
+      targetSelector
+    ]);
+    if (result.rows.length !== 1) {
+      throw new Error("Todos project registration binding was not accepted at removal");
+    }
+  }
+  async findProjectConflict(path, taskListSlug) {
+    const result = await this.client.query(`
+      SELECT payload FROM ${this.tableName}
+      WHERE service = $1 AND object_type = 'projects' AND deleted_at IS NULL
+        AND (payload->>'path' = $2 OR payload->>'task_list_id' = $3)
+      ORDER BY payload->>'created_at' ASC, object_id ASC
+      LIMIT 1
+    `, [this.service, path, taskListSlug]);
+    return result.rows[0] ? parsePayload3(result.rows[0].payload) : null;
+  }
+  async findTaskListConflict(projectId, slug) {
+    const result = await this.client.query(`
+      SELECT payload FROM ${this.tableName}
+      WHERE service = $1 AND object_type = 'task_lists' AND deleted_at IS NULL
+        AND payload->>'project_id' = $2 AND payload->>'slug' = $3
+      ORDER BY payload->>'created_at' ASC, object_id ASC
+      LIMIT 1
+    `, [this.service, projectId, slug]);
+    return result.rows[0] ? parsePayload3(result.rows[0].payload) : null;
+  }
+  async createProject(input) {
+    return await this.storage.projects.create(input);
+  }
+  async createTaskList(input) {
+    return await this.storage.taskLists.create(input);
+  }
+  async getProject(id) {
+    return await this.storage.projects.get(id);
+  }
+  async getTaskList(id) {
+    return await this.storage.taskLists.get(id);
+  }
+  async lockCompensationWrites() {
+    await this.client.query(`LOCK TABLE ${this.tableName} IN SHARE ROW EXCLUSIVE MODE`);
+  }
+  async hasDependents(resourceKind, targetId) {
+    const referencePredicate = resourceKind === "project" ? `(
+          payload->>'project_id' = $2
+          OR payload->>'active_project_id' = $2
+          OR payload->>'assigned_from_project' = $2
+          OR payload->>'external_project_id' = $2
+        )` : "payload->>'task_list_id' = $2";
+    const result = await this.client.query(`
+      SELECT EXISTS (
+        SELECT 1 FROM ${this.tableName}
+        WHERE service = $1 AND deleted_at IS NULL
+          AND ${referencePredicate}
+        LIMIT 1
+      ) AS exists
+    `, [this.service, targetId]);
+    return result.rows[0]?.exists === true;
+  }
+  async deleteProject(id) {
+    return await this.storage.projects.delete(id);
+  }
+  async deleteTaskList(id) {
+    return await this.storage.taskLists.delete(id);
+  }
+}
+
+class PostgresTodosProjectRegistrationBackend {
+  client;
+  kind = "postgresql";
+  service;
+  tableName;
+  cursorTableName;
+  schemaReady = null;
+  constructor(client, options = {}) {
+    this.client = client;
+    this.service = options.service ?? "todos";
+    this.tableName = safeIdentifier(options.tableName ?? "todos_sync_records", "tableName");
+    this.cursorTableName = safeIdentifier(options.cursorTableName ?? "todos_sync_cursors", "cursorTableName");
+  }
+  async ensureSchema() {
+    this.schemaReady ??= (async () => {
+      for (const statement of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
+        await this.client.query(statement);
+      }
+      for (const statement of postgresTodosProjectRegistrationSchemaSql()) {
+        await this.client.query(statement);
+      }
+    })();
+    await this.schemaReady;
+  }
+  async transaction(fn) {
+    await this.ensureSchema();
+    if (typeof this.client.transaction !== "function") {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_ATOMICITY_UNAVAILABLE", "PostgreSQL project registration requires an authoritative transaction");
+    }
+    return this.client.transaction((transaction) => fn(new PostgresTodosProjectRegistrationTransaction(transaction, this.service, this.tableName, this.cursorTableName)));
+  }
+  async direct() {
+    await this.ensureSchema();
+    return new PostgresTodosProjectRegistrationTransaction(this.client, this.service, this.tableName, this.cursorTableName);
+  }
+  async getReceiptForLookup(identity) {
+    return (await this.direct()).getReceiptForLookup(identity);
+  }
+  async getReceiptById(receiptId) {
+    return (await this.direct()).getReceiptById(receiptId);
+  }
+  async getBinding(scope, resourceKind, targetSelector) {
+    return (await this.direct()).getBinding(scope, resourceKind, targetSelector);
+  }
+  async getProject(id) {
+    return (await this.direct()).getProject(id);
+  }
+  async getTaskList(id) {
+    return (await this.direct()).getTaskList(id);
+  }
+}
+
+// src/project-registration/sqlite.ts
+var sqliteTransactionTails2 = new WeakMap;
+var PROJECT_REFERENCE_COLUMNS = new Set([
+  "project_id",
+  "active_project_id",
+  "assigned_from_project",
+  "external_project_id"
+]);
+var TASK_LIST_REFERENCE_COLUMNS = new Set(["task_list_id"]);
+function quoteSqliteIdentifier(value) {
+  return `"${value.replaceAll('"', '""')}"`;
+}
+function receiptFromRow2(row) {
+  return {
+    ...row,
+    authority: "todos",
+    created_by_operation: Number(row["created_by_operation"]) === 1
+  };
+}
+function bindingFromRow2(row) {
+  return row;
+}
+
+class SqliteTodosProjectRegistrationTransaction {
+  db;
+  storage;
+  constructor(db) {
+    this.db = db;
+    this.storage = createLocalSqliteTodosStorageAdapter({ db });
+  }
+  async lockStep(_identity) {}
+  async getReceiptForLookup(identity) {
+    const row = this.db.query(`
+      SELECT * FROM todos_project_registration_receipts
+      WHERE authority_id = ? AND tenant_id = ? AND corpus_id = ?
+        AND operation_id = ? AND step_id = ? AND resource_kind = ?
+        AND direction = ? AND idempotency_key = ? AND target_selector = ?
+      ORDER BY CASE outcome
+        WHEN 'terminal_nonacceptance' THEN 0
+        WHEN 'duplicate_of_accepted' THEN 1
+        ELSE 2
+      END, created_at DESC, receipt_id DESC
+      LIMIT 1
+    `).get(identity.authority_id, identity.tenant_id, identity.corpus_id, identity.operation_id, identity.step_id, identity.resource_kind, identity.direction, identity.idempotency_key, identity.target_selector);
+    return row ? receiptFromRow2(row) : null;
+  }
+  async getReceiptById(receiptId) {
+    const row = this.db.query("SELECT * FROM todos_project_registration_receipts WHERE receipt_id = ? LIMIT 1").get(receiptId);
+    return row ? receiptFromRow2(row) : null;
+  }
+  async getAcceptedReceiptForStep(identity) {
+    const row = this.db.query(`
+      SELECT * FROM todos_project_registration_receipts
+      WHERE authority_id = ? AND tenant_id = ? AND corpus_id = ?
+        AND operation_id = ? AND step_id = ? AND resource_kind = ?
+        AND direction = ? AND outcome = 'accepted'
+      ORDER BY created_at ASC, receipt_id ASC
+      LIMIT 1
+    `).get(identity.authority_id, identity.tenant_id, identity.corpus_id, identity.operation_id, identity.step_id, identity.resource_kind, identity.direction);
+    return row ? receiptFromRow2(row) : null;
+  }
+  async insertReceipt(receipt) {
+    const result = this.db.query(`
+      INSERT OR IGNORE INTO todos_project_registration_receipts (
+        receipt_id, authority, route, package_version, authority_id, tenant_id,
+        corpus_id, operation_id, step_id, resource_kind, direction,
+        target_selector, idempotency_key, request_digest, precondition_digest,
+        normalized_call_digest, outcome, reason, target_id, result_revision,
+        result_digest, duplicate_of_receipt_id, accepted_receipt_id,
+        created_by_operation, created_at
+      ) VALUES (
+        ?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?
+      )
+    `).run(receipt.receipt_id, receipt.authority, receipt.route, receipt.package_version, receipt.authority_id, receipt.tenant_id, receipt.corpus_id, receipt.operation_id, receipt.step_id, receipt.resource_kind, receipt.direction, receipt.target_selector, receipt.idempotency_key, receipt.request_digest, receipt.precondition_digest, receipt.normalized_call_digest, receipt.outcome, receipt.reason, receipt.target_id, receipt.result_revision, receipt.result_digest, receipt.duplicate_of_receipt_id, receipt.accepted_receipt_id, receipt.created_by_operation ? 1 : 0, receipt.created_at);
+    return result.changes === 1;
+  }
+  async getBinding(scope, resourceKind, targetSelector) {
+    const row = this.db.query(`
+      SELECT * FROM todos_project_registration_bindings
+      WHERE authority_id = ? AND tenant_id = ? AND corpus_id = ?
+        AND resource_kind = ? AND target_selector = ?
+      LIMIT 1
+    `).get(scope.authority_id, scope.tenant_id, scope.corpus_id, resourceKind, targetSelector);
+    return row ? bindingFromRow2(row) : null;
+  }
+  async claimBinding(binding) {
+    const result = this.db.query(`
+      INSERT OR IGNORE INTO todos_project_registration_bindings (
+        authority_id, tenant_id, corpus_id, resource_kind, target_selector,
+        operation_id, step_id, direction, idempotency_key, request_digest,
+        precondition_digest, normalized_call_digest, state, target_id,
+        accepted_receipt_id, result_revision, result_digest, removed_receipt_id,
+        created_at, updated_at
+      ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+    `).run(binding.authority_id, binding.tenant_id, binding.corpus_id, binding.resource_kind, binding.target_selector, binding.operation_id, binding.step_id, binding.direction, binding.idempotency_key, binding.request_digest, binding.precondition_digest, binding.normalized_call_digest, binding.state, binding.target_id, binding.accepted_receipt_id, binding.result_revision, binding.result_digest, binding.removed_receipt_id, binding.created_at, binding.updated_at);
+    return result.changes === 1;
+  }
+  async setBindingAccepted(scope, resourceKind, targetSelector, update) {
+    const result = this.db.query(`
+      UPDATE todos_project_registration_bindings
+      SET state = 'accepted', target_id = ?, accepted_receipt_id = ?,
+        result_revision = ?, result_digest = ?, updated_at = ?
+      WHERE authority_id = ? AND tenant_id = ? AND corpus_id = ?
+        AND resource_kind = ? AND target_selector = ? AND state = 'pending'
+    `).run(update.target_id, update.accepted_receipt_id, update.result_revision, update.result_digest, update.updated_at, scope.authority_id, scope.tenant_id, scope.corpus_id, resourceKind, targetSelector);
+    if (result.changes !== 1) {
+      throw new Error("Todos project registration binding was not pending at acceptance");
+    }
+  }
+  async setBindingTerminal(scope, resourceKind, targetSelector, updatedAt) {
+    this.db.query(`
+      UPDATE todos_project_registration_bindings
+      SET state = 'terminal_nonacceptance', updated_at = ?
+      WHERE authority_id = ? AND tenant_id = ? AND corpus_id = ?
+        AND resource_kind = ? AND target_selector = ? AND state = 'pending'
+    `).run(updatedAt, scope.authority_id, scope.tenant_id, scope.corpus_id, resourceKind, targetSelector);
+  }
+  async setBindingRemoved(scope, resourceKind, targetSelector, removedReceiptId, updatedAt) {
+    const result = this.db.query(`
+      UPDATE todos_project_registration_bindings
+      SET state = 'removed', removed_receipt_id = ?, updated_at = ?
+      WHERE authority_id = ? AND tenant_id = ? AND corpus_id = ?
+        AND resource_kind = ? AND target_selector = ? AND state = 'accepted'
+    `).run(removedReceiptId, updatedAt, scope.authority_id, scope.tenant_id, scope.corpus_id, resourceKind, targetSelector);
+    if (result.changes !== 1) {
+      throw new Error("Todos project registration binding was not accepted at removal");
+    }
+  }
+  async findProjectConflict(path, taskListSlug) {
+    const row = this.db.query(`
+      SELECT * FROM projects
+      WHERE path = ? OR task_list_id = ?
+      ORDER BY created_at ASC, id ASC
+      LIMIT 1
+    `).get(path, taskListSlug);
+    return row ?? null;
+  }
+  async findTaskListConflict(projectId, slug) {
+    return await this.storage.taskLists.getBySlug(slug, projectId);
+  }
+  async createProject(input) {
+    return await this.storage.projects.create(input);
+  }
+  async createTaskList(input) {
+    return await this.storage.taskLists.create(input);
+  }
+  async getProject(id) {
+    return await this.storage.projects.get(id);
+  }
+  async getTaskList(id) {
+    return await this.storage.taskLists.get(id);
+  }
+  async lockCompensationWrites() {}
+  async hasDependents(resourceKind, targetId) {
+    const targetTable = resourceKind === "project" ? "projects" : "task_lists";
+    const semanticColumns = resourceKind === "project" ? PROJECT_REFERENCE_COLUMNS : TASK_LIST_REFERENCE_COLUMNS;
+    const tables = this.db.query(`
+      SELECT name FROM sqlite_schema
+      WHERE type = 'table' AND name NOT LIKE 'sqlite_%'
+      ORDER BY name
+    `).all();
+    for (const { name: tableName } of tables) {
+      const quotedTable = quoteSqliteIdentifier(tableName);
+      const columns = this.db.query(`PRAGMA table_info(${quotedTable})`).all();
+      const foreignKeys = this.db.query(`PRAGMA foreign_key_list(${quotedTable})`).all();
+      const referenceColumns = columns.map((column) => column.name).filter((columnName) => semanticColumns.has(columnName) || foreignKeys.some((foreignKey) => foreignKey.from === columnName && foreignKey.table === targetTable));
+      for (const columnName of referenceColumns) {
+        const row = this.db.query(`
+          SELECT 1 AS found
+          FROM ${quotedTable}
+          WHERE ${quoteSqliteIdentifier(columnName)} = ?
+          LIMIT 1
+        `).get(targetId);
+        if (row)
+          return true;
+      }
+    }
+    return false;
+  }
+  async deleteProject(id) {
+    return await this.storage.projects.delete(id);
+  }
+  async deleteTaskList(id) {
+    return await this.storage.taskLists.delete(id);
+  }
+}
+
+class SqliteTodosProjectRegistrationBackend {
+  db;
+  kind = "sqlite";
+  direct;
+  constructor(db) {
+    this.db = db;
+    db.exec(sqliteTodosProjectRegistrationSchemaSql());
+    this.direct = new SqliteTodosProjectRegistrationTransaction(db);
+  }
+  async transaction(fn) {
+    const previous = sqliteTransactionTails2.get(this.db) ?? Promise.resolve();
+    let release;
+    const current = new Promise((resolve10) => {
+      release = resolve10;
+    });
+    sqliteTransactionTails2.set(this.db, current);
+    await previous;
+    try {
+      this.db.exec("BEGIN IMMEDIATE");
+      const result = await fn(new SqliteTodosProjectRegistrationTransaction(this.db));
+      this.db.exec("COMMIT");
+      return result;
+    } catch (error) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {}
+      throw error;
+    } finally {
+      release();
+      if (sqliteTransactionTails2.get(this.db) === current) {
+        sqliteTransactionTails2.delete(this.db);
+      }
+    }
+  }
+  getReceiptForLookup(identity) {
+    return this.direct.getReceiptForLookup(identity);
+  }
+  getReceiptById(receiptId) {
+    return this.direct.getReceiptById(receiptId);
+  }
+  getBinding(scope, resourceKind, targetSelector) {
+    return this.direct.getBinding(scope, resourceKind, targetSelector);
+  }
+  getProject(id) {
+    return this.direct.getProject(id);
+  }
+  getTaskList(id) {
+    return this.direct.getTaskList(id);
+  }
+}
+
+// src/project-registration/authority.ts
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var WORKSPACE_ID_PATTERN = /^wks_[A-Za-z0-9][A-Za-z0-9_-]{11,}$/;
+var OPERATION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/;
+var STEP_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{2,127}$/;
+var SHA256_PATTERN = /^[0-9a-f]{64}$/;
+var IDEMPOTENCY_PATTERN = /^prk_[0-9a-f]{48}$/;
+
+class WriteBoundaryError extends Error {
+  point;
+  cause;
+  constructor(point, cause) {
+    super(`Todos project registration failed at ${point}`);
+    this.point = point;
+    this.cause = cause;
+  }
+}
+function canonicalProjectRegistrationJson(value) {
+  return JSON.stringify(canonicalize3(value));
+}
+function canonicalize3(value) {
+  if (Array.isArray(value))
+    return value.map(canonicalize3);
+  if (!value || typeof value !== "object")
+    return value;
+  const out = {};
+  for (const key of Object.keys(value).sort()) {
+    const entry2 = value[key];
+    if (entry2 !== undefined)
+      out[key] = canonicalize3(entry2);
+  }
+  return out;
+}
+function digestProjectRegistrationValue(value) {
+  return createHash12("sha256").update(canonicalProjectRegistrationJson(value)).digest("hex");
+}
+function deriveTodosProjectRegistrationIdempotencyKey(input) {
+  return `prk_${digestProjectRegistrationValue({
+    route: TODOS_PROJECT_REGISTRATION_CALLER_ROUTE,
+    ...input
+  }).slice(0, 48)}`;
+}
+function responseBytes(value) {
+  return Buffer.byteLength(JSON.stringify(value), "utf8");
+}
+function assertBounds(bounds) {
+  if (!Number.isSafeInteger(bounds.response_byte_limit) || bounds.response_byte_limit <= 0) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_BOUNDS", "response_byte_limit must be a positive integer");
+  }
+  if (!Number.isSafeInteger(bounds.time_budget_ms) || bounds.time_budget_ms <= 0) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_BOUNDS", "time_budget_ms must be a positive integer");
+  }
+}
+function assertResourceKind(value) {
+  if (value !== "project" && value !== "task_list") {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "resource_kind must be project or task_list");
+  }
+}
+function assertDirection(value) {
+  if (value !== "forward" && value !== "inverse") {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "direction must be forward or inverse");
+  }
+}
+function assertWithinBounds(value, bounds, startedAt) {
+  const bytes = responseBytes(value);
+  if (bytes > bounds.response_byte_limit) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_RESPONSE_TOO_LARGE", `registration response requires ${bytes} bytes but the bound is ${bounds.response_byte_limit}`, { response_bytes: bytes, response_byte_limit: bounds.response_byte_limit });
+  }
+  const elapsed = Date.now() - startedAt;
+  if (elapsed > bounds.time_budget_ms) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_TIME_BUDGET_EXCEEDED", `registration call took ${elapsed}ms but the bound is ${bounds.time_budget_ms}ms`, { elapsed_ms: elapsed, time_budget_ms: bounds.time_budget_ms });
+  }
+  return { response_bytes: bytes, elapsed_ms: elapsed };
+}
+function withResponseControl(payload, bounds, startedAt) {
+  const envelope = {
+    ...payload,
+    response_control: {
+      response_byte_limit: bounds.response_byte_limit,
+      time_budget_ms: bounds.time_budget_ms,
+      response_bytes: 0,
+      elapsed_ms: 0,
+      complete: true,
+      truncated: false
+    }
+  };
+  for (let attempt = 0;attempt < 8; attempt += 1) {
+    const measured = assertWithinBounds(envelope, bounds, startedAt);
+    const stable2 = envelope.response_control.response_bytes === measured.response_bytes && envelope.response_control.elapsed_ms === measured.elapsed_ms;
+    envelope.response_control = {
+      response_byte_limit: bounds.response_byte_limit,
+      time_budget_ms: bounds.time_budget_ms,
+      response_bytes: measured.response_bytes,
+      elapsed_ms: measured.elapsed_ms,
+      complete: true,
+      truncated: false
+    };
+    if (stable2)
+      break;
+  }
+  const finalMeasurement = assertWithinBounds(envelope, bounds, startedAt);
+  envelope.response_control.response_bytes = finalMeasurement.response_bytes;
+  envelope.response_control.elapsed_ms = finalMeasurement.elapsed_ms;
+  return envelope;
+}
+function requireString(value, field2, options = {}) {
+  const min = options.min ?? 1;
+  const max = options.max ?? 512;
+  if (typeof value !== "string" || value.length < min || value.length > max || /[\u0000-\u001f]/.test(value) || options.pattern && !options.pattern.test(value)) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", `${field2} is not a valid bounded registration identifier`);
+  }
+  return value;
+}
+function exactKeys(value, expected, field2) {
+  const actual = Object.keys(value).sort();
+  const wanted = [...expected].sort();
+  if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", `${field2} must contain exactly: ${wanted.join(", ")}`);
+  }
+}
+function publicReceipt(row) {
+  const {
+    target_selector: _targetSelector,
+    normalized_call_digest: _normalizedCallDigest,
+    ...receipt
+  } = row;
+  return receipt;
+}
+function projectRegistrationPath(projectId) {
+  return `hasna-project://${encodeURIComponent(projectId)}`;
+}
+function taskListSlug(projectSlug) {
+  const slug = normalizeSlug(projectSlug);
+  if (!slug || slug !== projectSlug) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "project_slug must be canonical kebab-case");
+  }
+  return `todos-${slug}`;
+}
+function deterministicTaskPrefix(projectSlug) {
+  const letters = projectSlug.replace(/[^a-z0-9]/gi, "").toUpperCase();
+  return (letters.slice(0, 3) || "PRJ").padEnd(3, "X");
+}
+function projectRecord(project) {
+  return {
+    target_id: project.id,
+    revision: project.updated_at,
+    digest: digestProjectRegistrationValue({
+      id: project.id,
+      name: project.name,
+      path: project.path,
+      description: project.description,
+      task_list_id: project.task_list_id,
+      task_prefix: project.task_prefix,
+      task_counter: project.task_counter,
+      created_at: project.created_at,
+      updated_at: project.updated_at
+    })
+  };
+}
+function taskListRecord(taskList) {
+  return {
+    target_id: taskList.id,
+    revision: taskList.updated_at,
+    digest: digestProjectRegistrationValue({
+      id: taskList.id,
+      project_id: taskList.project_id,
+      slug: taskList.slug,
+      name: taskList.name,
+      description: taskList.description,
+      metadata: taskList.metadata,
+      created_at: taskList.created_at,
+      updated_at: taskList.updated_at
+    })
+  };
+}
+function receiptId(input) {
+  return `tpr_${digestProjectRegistrationValue(input).slice(0, 40)}`;
+}
+function capabilityMatches(request, capability2) {
+  return request.authority_route === capability2.route && request.package_version === capability2.package_version && request.authority_id === capability2.authority_id && request.tenant_id === capability2.tenant_id && request.corpus_id === capability2.corpus_id;
+}
+function authorityScope(capability2) {
+  return {
+    authority_id: capability2.authority_id,
+    tenant_id: capability2.tenant_id,
+    corpus_id: capability2.corpus_id
+  };
+}
+function assertCapabilityRequest(request, capability2) {
+  if (!capabilityMatches(request, capability2)) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CAPABILITY_MISMATCH", "registration request does not match this authority capability identity");
+  }
+}
+function normalizedCallDigest(request) {
+  return digestProjectRegistrationValue({
+    authority_route: request.authority_route,
+    package_version: request.package_version,
+    authority_id: request.authority_id,
+    tenant_id: request.tenant_id,
+    corpus_id: request.corpus_id,
+    operation_id: request.operation_id,
+    step_id: request.step_id,
+    resource_kind: request.resource_kind,
+    direction: request.direction,
+    target_selector: request.target_selector,
+    idempotency_key: request.idempotency_key,
+    request_digest: request.request_digest,
+    precondition_digest: request.precondition_digest,
+    project_id: request.project_id,
+    project_slug: request.project_slug,
+    project_name: request.project_name,
+    desired: request.desired,
+    accepted_receipt_id: request.accepted_receipt?.receipt_id ?? null
+  });
+}
+function assertCommonRequest(request, capability2) {
+  assertBounds(request);
+  assertResourceKind(request.resource_kind);
+  assertDirection(request.direction);
+  assertCapabilityRequest(request, capability2);
+  requireString(request.operation_id, "operation_id", {
+    min: 8,
+    max: 128,
+    pattern: OPERATION_PATTERN
+  });
+  requireString(request.step_id, "step_id", {
+    min: 3,
+    max: 128,
+    pattern: STEP_PATTERN
+  });
+  requireString(request.target_selector, "target_selector", { max: 512 });
+  requireString(request.project_id, "project_id", {
+    min: 16,
+    max: 128,
+    pattern: WORKSPACE_ID_PATTERN
+  });
+  requireString(request.project_name, "project_name", { max: 256 });
+  requireString(request.project_slug, "project_slug", { max: 128 });
+  requireString(request.request_digest, "request_digest", {
+    min: 64,
+    max: 64,
+    pattern: SHA256_PATTERN
+  });
+  requireString(request.precondition_digest, "precondition_digest", {
+    min: 64,
+    max: 64,
+    pattern: SHA256_PATTERN
+  });
+  requireString(request.idempotency_key, "idempotency_key", {
+    min: 52,
+    max: 52,
+    pattern: IDEMPOTENCY_PATTERN
+  });
+  if (!request.desired || typeof request.desired !== "object" || Array.isArray(request.desired)) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "desired must be a JSON object");
+  }
+  const expectedKey = deriveTodosProjectRegistrationIdempotencyKey({
+    operation_id: request.operation_id,
+    step_id: request.step_id,
+    direction: request.direction,
+    target_selector: request.target_selector,
+    request_digest: request.request_digest,
+    precondition_digest: request.precondition_digest
+  });
+  if (request.idempotency_key !== expectedKey) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_IDEMPOTENCY_MISMATCH", "idempotency_key does not match the deterministic operation/step/direction payload", { expected: expectedKey });
+  }
+  taskListSlug(request.project_slug);
+}
+function assertForwardRequest(request, capability2) {
+  assertCommonRequest(request, capability2);
+  if (request.direction !== "forward") {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "create requires direction=forward");
+  }
+  const expectedRequestDigest = digestProjectRegistrationValue(request.desired);
+  const expectedPreconditionDigest = digestProjectRegistrationValue({
+    target_selector: request.target_selector,
+    expected: "absent"
+  });
+  if (request.request_digest !== expectedRequestDigest || request.precondition_digest !== expectedPreconditionDigest) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_DIGEST_MISMATCH", "request_digest or precondition_digest does not match normalized forward semantics", {
+      expected_request_digest: expectedRequestDigest,
+      expected_precondition_digest: expectedPreconditionDigest
+    });
+  }
+  if (request.resource_kind === "project") {
+    exactKeys(request.desired, ["source_project_id", "source_project_slug", "name"], "project desired");
+    if (request.desired["source_project_id"] !== request.project_id || request.desired["source_project_slug"] !== request.project_slug || request.desired["name"] !== request.project_name || request.target_selector !== request.project_id) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "project desired state and target selector must match the complete Projects identity");
+    }
+    return;
+  }
+  if (request.resource_kind === "task_list") {
+    exactKeys(request.desired, ["todos_project_id", "source_project_id", "name"], "task-list desired");
+    const todosProjectId = request.desired["todos_project_id"];
+    if (typeof todosProjectId !== "string" || !UUID_PATTERN.test(todosProjectId)) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_EXACT_ID_REQUIRED", "task-list create requires the exact full Todos project UUID");
+    }
+    if (request.target_selector !== `${todosProjectId}:default` || request.desired["source_project_id"] !== request.project_id || request.desired["name"] !== request.project_name) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "task-list desired state must bind the exact Todos project id and Projects identity");
+    }
+    return;
+  }
+  throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "unsupported registration resource kind");
+}
+function assertInverseRequest(request, capability2) {
+  assertCommonRequest(request, capability2);
+  if (request.direction !== "inverse") {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "compensate requires direction=inverse");
+  }
+  const accepted = request.accepted_receipt;
+  if (!accepted || accepted.authority !== "todos" || accepted.route !== capability2.route || accepted.package_version !== capability2.package_version || accepted.authority_id !== capability2.authority_id || accepted.tenant_id !== capability2.tenant_id || accepted.corpus_id !== capability2.corpus_id || accepted.operation_id !== request.operation_id || accepted.step_id !== request.step_id || accepted.resource_kind !== request.resource_kind || accepted.direction !== "forward" || accepted.outcome !== "accepted" || !accepted.created_by_operation || !accepted.target_id || !accepted.result_revision || !accepted.result_digest) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "inverse requires the complete accepted forward receipt created by this operation");
+  }
+  exactKeys(request.desired, ["accepted_receipt_id", "target_id"], "inverse desired");
+  const expectedDesired = {
+    accepted_receipt_id: accepted.receipt_id,
+    target_id: accepted.target_id
+  };
+  const expectedPrecondition = {
+    expected_revision: accepted.result_revision,
+    expected_digest: accepted.result_digest
+  };
+  const expectedRequestDigest = digestProjectRegistrationValue(expectedDesired);
+  const expectedPreconditionDigest = digestProjectRegistrationValue(expectedPrecondition);
+  if (canonicalProjectRegistrationJson(request.desired) !== canonicalProjectRegistrationJson(expectedDesired) || request.request_digest !== expectedRequestDigest || request.precondition_digest !== expectedPreconditionDigest || request.target_selector !== accepted.target_id) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_DIGEST_MISMATCH", "inverse request does not match the accepted receipt and exact readback precondition");
+  }
+  return accepted;
+}
+function makeReceipt(input, createdAt2) {
+  return {
+    ...input,
+    receipt_id: receiptId(input),
+    created_at: createdAt2
+  };
+}
+function receiptBase(request, callDigest, capability2) {
+  return {
+    authority: "todos",
+    route: capability2.route,
+    package_version: capability2.package_version,
+    authority_id: capability2.authority_id,
+    tenant_id: capability2.tenant_id,
+    corpus_id: capability2.corpus_id,
+    operation_id: request.operation_id,
+    step_id: request.step_id,
+    resource_kind: request.resource_kind,
+    direction: request.direction,
+    target_selector: request.target_selector,
+    idempotency_key: request.idempotency_key,
+    request_digest: request.request_digest,
+    precondition_digest: request.precondition_digest,
+    normalized_call_digest: callDigest
+  };
+}
+function makeAcceptedReceipt(request, callDigest, capability2, record, createdAt2) {
+  return makeReceipt({
+    ...receiptBase(request, callDigest, capability2),
+    outcome: "accepted",
+    reason: null,
+    target_id: record.target_id,
+    result_revision: record.revision,
+    result_digest: record.digest,
+    duplicate_of_receipt_id: null,
+    accepted_receipt_id: request.direction === "inverse" ? request.accepted_receipt.receipt_id : null,
+    created_by_operation: true
+  }, createdAt2);
+}
+function makeDuplicateReceipt(request, callDigest, capability2, accepted, createdAt2) {
+  return makeReceipt({
+    ...receiptBase(request, callDigest, capability2),
+    outcome: "duplicate_of_accepted",
+    reason: null,
+    target_id: accepted.target_id,
+    result_revision: accepted.result_revision,
+    result_digest: accepted.result_digest,
+    duplicate_of_receipt_id: accepted.receipt_id,
+    accepted_receipt_id: null,
+    created_by_operation: false
+  }, createdAt2);
+}
+function makeTerminalReceipt(request, callDigest, capability2, reason, createdAt2, options = {}) {
+  return makeReceipt({
+    ...receiptBase(request, callDigest, capability2),
+    outcome: "terminal_nonacceptance",
+    reason,
+    target_id: options.targetId ?? null,
+    result_revision: null,
+    result_digest: null,
+    duplicate_of_receipt_id: null,
+    accepted_receipt_id: options.acceptedReceiptId ?? null,
+    created_by_operation: false
+  }, createdAt2);
+}
+async function insertDeterministicReceipt(transaction, receipt) {
+  if (await transaction.insertReceipt(receipt))
+    return receipt;
+  const existing = await transaction.getReceiptById(receipt.receipt_id);
+  const { created_at: _existingCreatedAt, ...existingContent } = existing ?? {};
+  const { created_at: _receiptCreatedAt, ...receiptContent } = receipt;
+  if (!existing || canonicalProjectRegistrationJson(existingContent) !== canonicalProjectRegistrationJson(receiptContent)) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CONFLICT", "deterministic receipt id is occupied by different immutable content", { receipt_id: receipt.receipt_id });
+  }
+  return existing;
+}
+function bindingFor(request, callDigest, timestamp3, capability2) {
+  return {
+    ...authorityScope(capability2),
+    resource_kind: request.resource_kind,
+    target_selector: request.target_selector,
+    operation_id: request.operation_id,
+    step_id: request.step_id,
+    direction: "forward",
+    idempotency_key: request.idempotency_key,
+    request_digest: request.request_digest,
+    precondition_digest: request.precondition_digest,
+    normalized_call_digest: callDigest,
+    state: "pending",
+    target_id: null,
+    accepted_receipt_id: null,
+    result_revision: null,
+    result_digest: null,
+    removed_receipt_id: null,
+    created_at: timestamp3,
+    updated_at: timestamp3
+  };
+}
+
+class PackageOwnedTodosProjectRegistrationAuthority {
+  backend;
+  authority = "todos";
+  capabilityValue;
+  now;
+  faultInjector;
+  constructor(backend, options = {}) {
+    this.backend = backend;
+    this.capabilityValue = {
+      authority: "todos",
+      route: TODOS_PROJECT_REGISTRATION_ROUTE,
+      package_version: options.packageVersion ?? getPackageVersion(import.meta.url),
+      authority_id: options.authorityId ?? "todos",
+      tenant_id: options.tenantId ?? backend.kind,
+      corpus_id: options.corpusId ?? `todos:${backend.kind}`,
+      supported_resources: ["project", "task_list"],
+      conditional_create: true,
+      immutable_receipts: true,
+      exact_terminal_lookup: true,
+      exact_readback: true,
+      conditional_inverse: true,
+      ambiguous_outcome_reconciliation: true
+    };
+    this.now = options.now ?? (() => new Date().toISOString());
+    this.faultInjector = options.faultInjector;
+  }
+  async capability() {
+    return {
+      ...this.capabilityValue,
+      supported_resources: [...this.capabilityValue.supported_resources]
+    };
+  }
+  async fault(point, request) {
+    if (!this.faultInjector)
+      return;
+    try {
+      await this.faultInjector(point, {
+        operation_id: request.operation_id,
+        step_id: request.step_id,
+        resource_kind: request.resource_kind,
+        direction: request.direction
+      });
+    } catch (cause) {
+      throw new WriteBoundaryError(point, cause);
+    }
+  }
+  async afterCommit(request) {
+    await this.faultInjector?.("after_commit", {
+      operation_id: request.operation_id,
+      step_id: request.step_id,
+      resource_kind: request.resource_kind,
+      direction: request.direction
+    });
+  }
+  async duplicateFor(transaction, request, callDigest, accepted) {
+    const duplicate = makeDuplicateReceipt(request, callDigest, this.capabilityValue, accepted, this.now());
+    return insertDeterministicReceipt(transaction, duplicate);
+  }
+  async terminalFor(transaction, request, callDigest, reason, options = {}) {
+    return insertDeterministicReceipt(transaction, makeTerminalReceipt(request, callDigest, this.capabilityValue, reason, this.now(), options));
+  }
+  async existingForwardResolution(transaction, request, callDigest) {
+    const exact = await transaction.getReceiptForLookup({
+      ...authorityScope(this.capabilityValue),
+      operation_id: request.operation_id,
+      step_id: request.step_id,
+      resource_kind: request.resource_kind,
+      direction: request.direction,
+      idempotency_key: request.idempotency_key,
+      target_selector: request.target_selector
+    });
+    if (exact) {
+      if (exact.outcome === "terminal_nonacceptance")
+        return exact;
+      const accepted2 = exact.outcome === "accepted" ? exact : await transaction.getReceiptById(exact.duplicate_of_receipt_id);
+      if (!accepted2) {
+        throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CONFLICT", "duplicate receipt points to a missing accepted receipt");
+      }
+      if (accepted2.normalized_call_digest !== callDigest) {
+        return this.terminalFor(transaction, request, callDigest, "operation_step_semantics_changed", { targetId: accepted2.target_id });
+      }
+      return this.duplicateFor(transaction, request, callDigest, accepted2);
+    }
+    const accepted = await transaction.getAcceptedReceiptForStep({
+      ...authorityScope(this.capabilityValue),
+      operation_id: request.operation_id,
+      step_id: request.step_id,
+      resource_kind: request.resource_kind,
+      direction: "forward"
+    });
+    if (!accepted)
+      return null;
+    if (accepted.normalized_call_digest === callDigest) {
+      return this.duplicateFor(transaction, request, callDigest, accepted);
+    }
+    return this.terminalFor(transaction, request, callDigest, "operation_step_semantics_changed", { targetId: accepted.target_id });
+  }
+  async createObject(transaction, request) {
+    if (request.resource_kind === "project") {
+      const path = projectRegistrationPath(request.project_id);
+      const slug2 = taskListSlug(request.project_slug);
+      const conflict2 = await transaction.findProjectConflict(path, slug2);
+      if (conflict2) {
+        return this.terminalFor(transaction, request, normalizedCallDigest(request), "target_already_exists", { targetId: conflict2.id });
+      }
+      await this.fault("before_object_write", request);
+      const project = await transaction.createProject({
+        name: request.project_name,
+        path,
+        description: `Registered from Projects workspace ${request.project_id}`,
+        task_list_id: slug2,
+        task_prefix: deterministicTaskPrefix(request.project_slug)
+      });
+      await this.fault("after_object_write", request);
+      return projectRecord(project);
+    }
+    const todosProjectId = String(request.desired["todos_project_id"]);
+    const sourceBinding = await transaction.getBinding(authorityScope(this.capabilityValue), "project", request.project_id);
+    if (!sourceBinding || sourceBinding.state !== "accepted" || sourceBinding.target_id !== todosProjectId) {
+      return this.terminalFor(transaction, request, normalizedCallDigest(request), "exact_parent_registration_missing", { targetId: todosProjectId });
+    }
+    const parent = await transaction.getProject(todosProjectId);
+    if (!parent) {
+      return this.terminalFor(transaction, request, normalizedCallDigest(request), "exact_parent_project_missing", { targetId: todosProjectId });
+    }
+    const slug = taskListSlug(request.project_slug);
+    const conflict = await transaction.findTaskListConflict(todosProjectId, slug);
+    if (conflict) {
+      return this.terminalFor(transaction, request, normalizedCallDigest(request), "target_already_exists", { targetId: conflict.id });
+    }
+    await this.fault("before_object_write", request);
+    const taskList = await transaction.createTaskList({
+      name: request.project_name,
+      slug,
+      project_id: todosProjectId,
+      metadata: {
+        source_project_id: request.project_id,
+        registration_authority: "todos"
+      }
+    });
+    await this.fault("after_object_write", request);
+    if (taskList.project_id !== todosProjectId) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CONFLICT", "task-list create did not preserve the exact full Todos project id");
+    }
+    return taskListRecord(taskList);
+  }
+  async create(request) {
+    const startedAt = Date.now();
+    assertForwardRequest(request, this.capabilityValue);
+    const callDigest = normalizedCallDigest(request);
+    try {
+      const row = await this.backend.transaction(async (transaction) => {
+        await transaction.lockStep({
+          ...authorityScope(this.capabilityValue),
+          operation_id: request.operation_id,
+          step_id: request.step_id,
+          resource_kind: request.resource_kind,
+          direction: request.direction
+        });
+        const resolved = await this.existingForwardResolution(transaction, request, callDigest);
+        if (resolved)
+          return resolved;
+        const timestamp3 = this.now();
+        const claimed = await transaction.claimBinding(bindingFor(request, callDigest, timestamp3, this.capabilityValue));
+        if (!claimed) {
+          const binding = await transaction.getBinding(authorityScope(this.capabilityValue), request.resource_kind, request.target_selector);
+          if (binding?.state === "accepted" && binding.normalized_call_digest === callDigest && binding.accepted_receipt_id) {
+            const accepted2 = await transaction.getReceiptById(binding.accepted_receipt_id);
+            if (accepted2) {
+              return this.duplicateFor(transaction, request, callDigest, accepted2);
+            }
+          }
+          return this.terminalFor(transaction, request, callDigest, binding?.state === "removed" ? "target_registration_was_removed" : "target_already_registered", { targetId: binding?.target_id ?? null });
+        }
+        const recordOrTerminal = await this.createObject(transaction, request);
+        if ("outcome" in recordOrTerminal) {
+          await transaction.setBindingTerminal(authorityScope(this.capabilityValue), request.resource_kind, request.target_selector, this.now());
+          return recordOrTerminal;
+        }
+        const accepted = makeAcceptedReceipt(request, callDigest, this.capabilityValue, recordOrTerminal, this.now());
+        await this.fault("before_receipt_write", request);
+        const stored = await insertDeterministicReceipt(transaction, accepted);
+        await this.fault("after_receipt_write", request);
+        await transaction.setBindingAccepted(authorityScope(this.capabilityValue), request.resource_kind, request.target_selector, {
+          target_id: recordOrTerminal.target_id,
+          accepted_receipt_id: stored.receipt_id,
+          result_revision: recordOrTerminal.revision,
+          result_digest: recordOrTerminal.digest,
+          updated_at: this.now()
+        });
+        return stored;
+      });
+      await this.afterCommit(request);
+      const receipt = publicReceipt(row);
+      assertWithinBounds(receipt, request, startedAt);
+      return receipt;
+    } catch (error) {
+      if (!(error instanceof WriteBoundaryError))
+        throw error;
+      const terminal = await this.recordWriteFailure(request, callDigest, error.point);
+      const receipt = publicReceipt(terminal);
+      assertWithinBounds(receipt, request, startedAt);
+      return receipt;
+    }
+  }
+  async recordWriteFailure(request, callDigest, point) {
+    return this.backend.transaction(async (transaction) => {
+      await transaction.lockStep({
+        ...authorityScope(this.capabilityValue),
+        operation_id: request.operation_id,
+        step_id: request.step_id,
+        resource_kind: request.resource_kind,
+        direction: request.direction
+      });
+      const exact = await transaction.getReceiptForLookup({
+        ...authorityScope(this.capabilityValue),
+        operation_id: request.operation_id,
+        step_id: request.step_id,
+        resource_kind: request.resource_kind,
+        direction: request.direction,
+        idempotency_key: request.idempotency_key,
+        target_selector: request.target_selector
+      });
+      if (exact)
+        return exact;
+      const accepted = await transaction.getAcceptedReceiptForStep({
+        ...authorityScope(this.capabilityValue),
+        operation_id: request.operation_id,
+        step_id: request.step_id,
+        resource_kind: request.resource_kind,
+        direction: request.direction
+      });
+      if (accepted) {
+        return accepted.normalized_call_digest === callDigest ? this.duplicateFor(transaction, request, callDigest, accepted) : this.terminalFor(transaction, request, callDigest, "operation_step_semantics_changed", { targetId: accepted.target_id });
+      }
+      const timestamp3 = this.now();
+      const claimed = await transaction.claimBinding(bindingFor(request, callDigest, timestamp3, this.capabilityValue));
+      const terminal = await this.terminalFor(transaction, request, callDigest, `write_failed:${point}`);
+      if (claimed) {
+        await transaction.setBindingTerminal(authorityScope(this.capabilityValue), request.resource_kind, request.target_selector, this.now());
+      }
+      return terminal;
+    });
+  }
+  async readExact(request) {
+    const startedAt = Date.now();
+    assertBounds(request);
+    assertResourceKind(request.resource_kind);
+    if (!UUID_PATTERN.test(request.target_id)) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_EXACT_ID_REQUIRED", "exact readback requires a complete Todos object UUID");
+    }
+    const record = request.resource_kind === "project" ? await this.backend.getProject(request.target_id).then((value) => value ? projectRecord(value) : null) : await this.backend.getTaskList(request.target_id).then((value) => value ? taskListRecord(value) : null);
+    if (!record) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_RECORD_NOT_FOUND", `registered ${request.resource_kind} was not found by exact id`, { target_id: request.target_id });
+    }
+    assertWithinBounds(record, request, startedAt);
+    return record;
+  }
+  async lookupReceipt(request) {
+    const startedAt = Date.now();
+    assertBounds(request);
+    assertResourceKind(request.resource_kind);
+    assertDirection(request.direction);
+    if (request.max_items !== 1) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_BOUNDS", "max_items must be exactly 1 for terminal receipt lookup");
+    }
+    if (request.authority !== "todos" || request.authority_route !== this.capabilityValue.route || request.package_version !== this.capabilityValue.package_version || request.authority_id !== this.capabilityValue.authority_id || request.tenant_id !== this.capabilityValue.tenant_id || request.corpus_id !== this.capabilityValue.corpus_id) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CAPABILITY_MISMATCH", "receipt lookup does not match this authority capability identity");
+    }
+    requireString(request.operation_id, "operation_id", {
+      min: 8,
+      max: 128,
+      pattern: OPERATION_PATTERN
+    });
+    requireString(request.step_id, "step_id", {
+      min: 3,
+      max: 128,
+      pattern: STEP_PATTERN
+    });
+    requireString(request.target_selector, "target_selector", { max: 512 });
+    requireString(request.idempotency_key, "idempotency_key", {
+      min: 52,
+      max: 52,
+      pattern: IDEMPOTENCY_PATTERN
+    });
+    if (request.target_id !== undefined && !UUID_PATTERN.test(request.target_id)) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_EXACT_ID_REQUIRED", "receipt lookup target_id must be a complete Todos object UUID");
+    }
+    const receipt = await this.backend.getReceiptForLookup({
+      ...authorityScope(this.capabilityValue),
+      operation_id: request.operation_id,
+      step_id: request.step_id,
+      resource_kind: request.resource_kind,
+      direction: request.direction,
+      idempotency_key: request.idempotency_key,
+      target_selector: request.target_selector
+    });
+    if (!receipt || request.target_id && receipt.target_id !== request.target_id) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_RECEIPT_NOT_FOUND", "no exact terminal receipt matched the bounded lookup");
+    }
+    return withResponseControl({ receipt: publicReceipt(receipt) }, request, startedAt);
+  }
+  async storedAcceptedReceipt(request, supplied) {
+    const stored = await this.backend.getReceiptById(supplied.receipt_id);
+    if (!stored || stored.outcome !== "accepted" || !stored.created_by_operation || canonicalProjectRegistrationJson(publicReceipt(stored)) !== canonicalProjectRegistrationJson(supplied)) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_ACCEPTED_RECEIPT_NOT_FOUND", "accepted receipt is not an exact immutable receipt owned by this authority", { receipt_id: supplied.receipt_id });
+    }
+    if (stored.operation_id !== request.operation_id || stored.step_id !== request.step_id || stored.resource_kind !== request.resource_kind || stored.target_id !== supplied.target_id) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_ACCEPTED_RECEIPT_NOT_FOUND", "accepted receipt does not own this exact operation step and target");
+    }
+    return stored;
+  }
+  async compensate(request) {
+    const startedAt = Date.now();
+    const suppliedAccepted = assertInverseRequest(request, this.capabilityValue);
+    const accepted = await this.storedAcceptedReceipt(request, suppliedAccepted);
+    const callDigest = normalizedCallDigest(request);
+    try {
+      const row = await this.backend.transaction(async (transaction) => {
+        await transaction.lockStep({
+          ...authorityScope(this.capabilityValue),
+          operation_id: request.operation_id,
+          step_id: request.step_id,
+          resource_kind: request.resource_kind,
+          direction: request.direction
+        });
+        const exact = await transaction.getReceiptForLookup({
+          ...authorityScope(this.capabilityValue),
+          operation_id: request.operation_id,
+          step_id: request.step_id,
+          resource_kind: request.resource_kind,
+          direction: "inverse",
+          idempotency_key: request.idempotency_key,
+          target_selector: request.target_selector
+        });
+        if (exact)
+          return exact;
+        const storedAccepted = await transaction.getReceiptById(accepted.receipt_id);
+        if (!storedAccepted || storedAccepted.outcome !== "accepted" || !storedAccepted.created_by_operation) {
+          throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_ACCEPTED_RECEIPT_NOT_FOUND", "accepted receipt disappeared before conditional inverse");
+        }
+        const binding = await transaction.getBinding(authorityScope(this.capabilityValue), accepted.resource_kind, accepted.target_selector);
+        if (!binding || binding.state !== "accepted" || binding.accepted_receipt_id !== accepted.receipt_id || binding.target_id !== accepted.target_id) {
+          return this.terminalFor(transaction, request, callDigest, "target_not_owned_by_receipt", {
+            targetId: accepted.target_id,
+            acceptedReceiptId: accepted.receipt_id
+          });
+        }
+        await transaction.lockCompensationWrites();
+        const object = request.resource_kind === "project" ? await transaction.getProject(accepted.target_id) : await transaction.getTaskList(accepted.target_id);
+        if (!object) {
+          return this.terminalFor(transaction, request, callDigest, "target_missing_before_inverse", {
+            targetId: accepted.target_id,
+            acceptedReceiptId: accepted.receipt_id
+          });
+        }
+        const current = request.resource_kind === "project" ? projectRecord(object) : taskListRecord(object);
+        if (current.revision !== accepted.result_revision || current.digest !== accepted.result_digest) {
+          return this.terminalFor(transaction, request, callDigest, "target_drifted", {
+            targetId: accepted.target_id,
+            acceptedReceiptId: accepted.receipt_id
+          });
+        }
+        if (await transaction.hasDependents(request.resource_kind, accepted.target_id)) {
+          return this.terminalFor(transaction, request, callDigest, "target_has_dependents", {
+            targetId: accepted.target_id,
+            acceptedReceiptId: accepted.receipt_id
+          });
+        }
+        await this.fault("before_object_write", request);
+        const deleted = request.resource_kind === "project" ? await transaction.deleteProject(accepted.target_id) : await transaction.deleteTaskList(accepted.target_id);
+        if (!deleted) {
+          throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CONFLICT", "conditional inverse could not delete the exact accepted target");
+        }
+        await this.fault("after_object_write", request);
+        const inverseRecord = {
+          target_id: accepted.target_id,
+          revision: "absent",
+          digest: digestProjectRegistrationValue({
+            target_id: accepted.target_id,
+            accepted_receipt_id: accepted.receipt_id,
+            absent: true
+          })
+        };
+        const inverse = makeAcceptedReceipt(request, callDigest, this.capabilityValue, inverseRecord, this.now());
+        await this.fault("before_receipt_write", request);
+        const stored = await insertDeterministicReceipt(transaction, inverse);
+        await this.fault("after_receipt_write", request);
+        await transaction.setBindingRemoved(authorityScope(this.capabilityValue), accepted.resource_kind, accepted.target_selector, stored.receipt_id, this.now());
+        return stored;
+      });
+      await this.afterCommit(request);
+      const receipt = publicReceipt(row);
+      assertWithinBounds(receipt, request, startedAt);
+      return receipt;
+    } catch (error) {
+      if (!(error instanceof WriteBoundaryError))
+        throw error;
+      const terminal = await this.backend.transaction(async (transaction) => {
+        await transaction.lockStep({
+          ...authorityScope(this.capabilityValue),
+          operation_id: request.operation_id,
+          step_id: request.step_id,
+          resource_kind: request.resource_kind,
+          direction: request.direction
+        });
+        return this.terminalFor(transaction, request, callDigest, `write_failed:${error.point}`, {
+          targetId: accepted.target_id,
+          acceptedReceiptId: accepted.receipt_id
+        });
+      });
+      const receipt = publicReceipt(terminal);
+      assertWithinBounds(receipt, request, startedAt);
+      return receipt;
+    }
+  }
+  async verifyInverse(request) {
+    const startedAt = Date.now();
+    const accepted = assertInverseRequest(request, this.capabilityValue);
+    await this.storedAcceptedReceipt(request, accepted);
+    const receipt = await this.backend.getReceiptForLookup({
+      ...authorityScope(this.capabilityValue),
+      operation_id: request.operation_id,
+      step_id: request.step_id,
+      resource_kind: request.resource_kind,
+      direction: "inverse",
+      idempotency_key: request.idempotency_key,
+      target_selector: request.target_selector
+    });
+    if (!receipt || receipt.outcome !== "accepted" || receipt.accepted_receipt_id !== accepted.receipt_id || receipt.result_revision !== "absent" || !receipt.result_digest) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_RECEIPT_NOT_FOUND", "accepted conditional inverse receipt was not found");
+    }
+    const object = request.resource_kind === "project" ? await this.backend.getProject(accepted.target_id) : await this.backend.getTaskList(accepted.target_id);
+    if (object) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CONFLICT", "inverse verification found the accepted target still present");
+    }
+    const verification = {
+      target_id: accepted.target_id,
+      accepted_receipt_id: accepted.receipt_id,
+      absent: true,
+      digest: digestProjectRegistrationValue({
+        target_id: accepted.target_id,
+        accepted_receipt_id: accepted.receipt_id,
+        absent: true
+      })
+    };
+    assertWithinBounds(verification, request, startedAt);
+    if (verification.digest !== receipt.result_digest) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CONFLICT", "inverse verification digest does not match the immutable receipt");
+    }
+    return verification;
+  }
+}
+function createLocalTodosProjectRegistrationAuthority(db, options = {}) {
+  return new PackageOwnedTodosProjectRegistrationAuthority(new SqliteTodosProjectRegistrationBackend(db), options);
+}
+function createPostgresTodosProjectRegistrationAuthority(client, options = {}) {
+  const {
+    service,
+    tableName,
+    cursorTableName,
+    ...authorityOptions
+  } = options;
+  return new PackageOwnedTodosProjectRegistrationAuthority(new PostgresTodosProjectRegistrationBackend(client, {
+    service,
+    tableName,
+    cursorTableName
+  }), authorityOptions);
+}
+// src/project-registration/http.ts
+var JSON_HEADERS = { "Content-Type": "application/json" };
+function json(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+}
+function errorStatus(error) {
+  switch (error.code) {
+    case "TODOS_PROJECT_REGISTRATION_INVALID_INPUT":
+    case "TODOS_PROJECT_REGISTRATION_INVALID_BOUNDS":
+    case "TODOS_PROJECT_REGISTRATION_CAPABILITY_MISMATCH":
+    case "TODOS_PROJECT_REGISTRATION_DIGEST_MISMATCH":
+    case "TODOS_PROJECT_REGISTRATION_IDEMPOTENCY_MISMATCH":
+    case "TODOS_PROJECT_REGISTRATION_EXACT_ID_REQUIRED":
+      return 400;
+    case "TODOS_PROJECT_REGISTRATION_RECEIPT_NOT_FOUND":
+    case "TODOS_PROJECT_REGISTRATION_RECORD_NOT_FOUND":
+    case "TODOS_PROJECT_REGISTRATION_ACCEPTED_RECEIPT_NOT_FOUND":
+      return 404;
+    case "TODOS_PROJECT_REGISTRATION_RESPONSE_TOO_LARGE":
+      return 413;
+    case "TODOS_PROJECT_REGISTRATION_TIME_BUDGET_EXCEEDED":
+      return 408;
+    case "TODOS_PROJECT_REGISTRATION_ATOMICITY_UNAVAILABLE":
+      return 503;
+    default:
+      return 409;
+  }
+}
+async function readJson(req) {
+  try {
+    const value = await req.json();
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+async function handleTodosProjectRegistrationHttpRequest(req, url, authority, basePath = "/v1/project-registration") {
+  const path = url.pathname;
+  if (path !== basePath && !path.startsWith(`${basePath}/`))
+    return null;
+  const action = path.slice(basePath.length).split("/").filter(Boolean).join("/");
+  const method = req.method.toUpperCase();
+  try {
+    if ((action === "" || action === "capability") && method === "GET") {
+      return json({ capability: await authority.capability() });
+    }
+    if (method !== "POST")
+      return json({ error: "method not allowed" }, 405);
+    const body = await readJson(req);
+    if (!body) {
+      return json({
+        error: "invalid JSON body",
+        code: "TODOS_PROJECT_REGISTRATION_INVALID_INPUT"
+      }, 400);
+    }
+    if (action === "create") {
+      return json({
+        receipt: await authority.create(body)
+      }, 201);
+    }
+    if (action === "receipts/lookup") {
+      return json(await authority.lookupReceipt(body));
+    }
+    if (action === "read-exact") {
+      return json({
+        record: await authority.readExact(body)
+      });
+    }
+    if (action === "compensate") {
+      return json({
+        receipt: await authority.compensate(body)
+      }, 201);
+    }
+    if (action === "verify-inverse") {
+      return json({
+        verification: await authority.verifyInverse(body)
+      });
+    }
+    return json({
+      error: "unknown Todos project-registration route",
+      code: "TODOS_PROJECT_REGISTRATION_RECEIPT_NOT_FOUND"
+    }, 404);
+  } catch (cause) {
+    if (cause instanceof TodosProjectRegistrationError) {
+      return json({
+        error: cause.message,
+        code: cause.code,
+        details: cause.details,
+        authoritative: true
+      }, errorStatus(cause));
+    }
+    return json({
+      error: cause instanceof Error ? cause.message : "internal registration error",
+      code: "TODOS_PROJECT_REGISTRATION_ATOMICITY_UNAVAILABLE"
+    }, 500);
+  }
+}
+function withoutTarget(value) {
+  const { target: _target, ...serializable } = value;
+  return serializable;
+}
+
+class TodosProjectRegistrationHttpClient {
+  authority = "todos";
+  baseUrl;
+  fetchImpl;
+  headers;
+  constructor(options) {
+    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+    this.fetchImpl = options.fetch ?? globalThis.fetch;
+    this.headers = {
+      ...options.headers,
+      ...options.apiKey ? { Authorization: `Bearer ${options.apiKey}` } : {},
+      "Content-Type": "application/json"
+    };
+  }
+  async request(action, init = {}) {
+    const response = await this.fetchImpl(`${this.baseUrl}/v1/project-registration${action}`, {
+      ...init,
+      headers: { ...this.headers, ...init.headers ?? {} }
+    });
+    const body = await response.json();
+    if (!response.ok) {
+      throw new TodosProjectRegistrationError(typeof body["code"] === "string" ? body["code"] : "TODOS_PROJECT_REGISTRATION_ATOMICITY_UNAVAILABLE", typeof body["error"] === "string" ? body["error"] : `Todos project registration HTTP ${response.status}`, body["details"] && typeof body["details"] === "object" ? body["details"] : {});
+    }
+    return body;
+  }
+  async capability() {
+    const body = await this.request("/capability");
+    return body.capability;
+  }
+  async create(request) {
+    const body = await this.request("/create", { method: "POST", body: JSON.stringify(withoutTarget(request)) });
+    return body.receipt;
+  }
+  async readExact(request) {
+    const body = await this.request("/read-exact", { method: "POST", body: JSON.stringify(withoutTarget(request)) });
+    return body.record;
+  }
+  async lookupReceipt(request) {
+    return this.request("/receipts/lookup", { method: "POST", body: JSON.stringify(request) });
+  }
+  async compensate(request) {
+    const body = await this.request("/compensate", { method: "POST", body: JSON.stringify(withoutTarget(request)) });
+    return body.receipt;
+  }
+  async verifyInverse(request) {
+    const body = await this.request("/verify-inverse", {
+      method: "POST",
+      body: JSON.stringify(withoutTarget(request))
+    });
+    return body.verification;
+  }
+}
+function createTodosProjectRegistrationHttpClient(options) {
+  return new TodosProjectRegistrationHttpClient(options);
+}
 // src/lib/native-storage-status.ts
 function getNativeStorageStatus(env = process.env) {
   const issues = [];
@@ -32031,7 +33938,7 @@ init_task_lifecycle();
 init_task_crud();
 init_redaction();
 import { Database as Database3 } from "bun:sqlite";
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import { existsSync as existsSync9, readdirSync as readdirSync2, statSync as statSync4 } from "fs";
 import { basename as basename2, dirname as dirname6, join as join9, resolve as resolve10 } from "path";
 
@@ -32314,7 +34221,7 @@ function normalizePath3(input) {
   return resolve10(input);
 }
 function sourceStoreId(sourceDbPath) {
-  const digest = createHash12("sha256").update(sourceDbPath).digest("hex").slice(0, 16);
+  const digest = createHash13("sha256").update(sourceDbPath).digest("hex").slice(0, 16);
   return `sqlite:${digest}`;
 }
 function inferSourceRepoPath(sourceDbPath) {
@@ -34192,7 +36099,7 @@ function addSourceOnce(projectId, type, name, uri, metadata, db) {
 function bootstrapProject(options = {}, db) {
   const d = db || getDatabase();
   const discovery = discoverProjectWorkspace(options.path);
-  const taskListSlug = options.taskListSlug || `todos-${slugify(options.name || discovery.projectName)}`;
+  const taskListSlug2 = options.taskListSlug || `todos-${slugify(options.name || discovery.projectName)}`;
   if (options.dryRun) {
     return {
       dryRun: true,
@@ -34206,15 +36113,15 @@ function bootstrapProject(options = {}, db) {
   const beforeProject = getProjectByCanonicalPath(discovery.projectPath, d);
   let project = ensureProject(options.name || discovery.projectName, discovery.projectPath, d);
   const createdProject = !beforeProject;
-  if (project.task_list_id !== taskListSlug || options.name && project.name !== options.name) {
+  if (project.task_list_id !== taskListSlug2 || options.name && project.name !== options.name) {
     project = renameProject(project.id, {
       name: options.name ?? project.name,
-      new_slug: taskListSlug
+      new_slug: taskListSlug2
     }, d).project;
   }
   setMachineLocalPath(project.id, discovery.projectPath, d);
-  const beforeTaskList = d.query("SELECT id FROM task_lists WHERE project_id = ? AND slug = ?").get(project.id, taskListSlug);
-  let taskList = ensureTaskList(`${project.name} Tasks`, taskListSlug, project.id, d);
+  const beforeTaskList = d.query("SELECT id FROM task_lists WHERE project_id = ? AND slug = ?").get(project.id, taskListSlug2);
+  let taskList = ensureTaskList(`${project.name} Tasks`, taskListSlug2, project.id, d);
   if (options.routeEnabled && taskList.metadata.route_enabled !== true) {
     taskList = updateTaskList(taskList.id, {
       metadata: {
@@ -34276,7 +36183,7 @@ init_comments();
 
 // src/db/api-keys.ts
 init_database();
-import { createHash as createHash13, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHash as createHash14, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual3 } from "crypto";
 function rowToRecord(row) {
   return {
     id: row.id,
@@ -34290,7 +36197,7 @@ function rowToRecord(row) {
   };
 }
 function hashApiKey(key) {
-  return createHash13("sha256").update(key).digest("hex");
+  return createHash14("sha256").update(key).digest("hex");
 }
 function safeEqualHex(a, b) {
   if (a.length !== b.length)
@@ -37350,10 +39257,10 @@ function extractEmbeddedBridge(markdown) {
   const match = markdown.match(/<!--\s*hasna\.todos\.bridge\s*\n([\s\S]*?)\n\s*-->/);
   if (!match)
     return null;
-  const json = match[1].split(`
+  const json2 = match[1].split(`
 `).map((line) => line.replace(/^  /, "")).join(`
 `);
-  return JSON.parse(json);
+  return JSON.parse(json2);
 }
 function frontmatterValue(markdown, key) {
   const match = markdown.match(/^---\n([\s\S]*?)\n---/);
@@ -38737,7 +40644,7 @@ init_database();
 init_tasks();
 import { existsSync as existsSync17, readFileSync as readFileSync13 } from "fs";
 import { basename as basename5 } from "path";
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 init_secret_redaction();
 var INBOX_INTAKE_SCHEMA = "todos.inbox_intake.v1";
 var INTAKE_SOURCE_TYPES = [
@@ -38750,7 +40657,7 @@ var INTAKE_SOURCE_TYPES = [
 ];
 var INTAKE_TRIAGE_STATUSES = ["preview", "triaged", "duplicate", "created"];
 function fingerprint2(text) {
-  return createHash14("sha256").update(text).digest("hex").slice(0, 16);
+  return createHash15("sha256").update(text).digest("hex").slice(0, 16);
 }
 function loadRawContent(input) {
   if (input.github_url) {
@@ -44210,7 +46117,7 @@ init_database();
 init_tasks();
 init_redaction();
 init_sync_utils();
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash16 } from "crypto";
 import { existsSync as existsSync22, readFileSync as readFileSync19, statSync as statSync9 } from "fs";
 import { hostname as hostname3, platform, arch } from "os";
 import { dirname as dirname15, join as join18, resolve as resolve17 } from "path";
@@ -44232,7 +46139,7 @@ var CONFIG_FILES = [
   "dashboard/vite.config.ts"
 ];
 function sha2566(value) {
-  return createHash15("sha256").update(value).digest("hex");
+  return createHash16("sha256").update(value).digest("hex");
 }
 function fileRecord(root, relativePath) {
   const path = join18(root, relativePath);
@@ -44484,7 +46391,7 @@ function compareEnvironmentSnapshotFiles(leftPath, rightPath) {
 init_database();
 init_projects();
 init_plans();
-import { createHash as createHash16 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 import { mkdirSync as mkdirSync18, writeFileSync as writeFileSync16 } from "fs";
 import { dirname as dirname16, join as join19 } from "path";
 var DECISION_RECORD_SCHEMA = "todos.decision_record.v1";
@@ -44540,7 +46447,7 @@ function rowToDecisionRecord(row) {
 }
 function stableSnapshotHash(payload) {
   const { captured_at: _capturedAt, ...rest } = payload;
-  return createHash16("sha256").update(JSON.stringify(rest)).digest("hex");
+  return createHash17("sha256").update(JSON.stringify(rest)).digest("hex");
 }
 function createDecisionRecord(input, db) {
   const d = db || getDatabase();
@@ -49031,7 +50938,7 @@ function syncWithAgents(agents, taskListIdByAgent, projectId, direction = "both"
 init_tasks();
 init_task_files();
 import { existsSync as existsSync27, readFileSync as readFileSync23, statSync as statSync10 } from "fs";
-import { createHash as createHash17 } from "crypto";
+import { createHash as createHash18 } from "crypto";
 import { relative as relative6, resolve as resolve18, join as join25 } from "path";
 var EXTRACT_TAGS = ["TODO", "FIXME", "HACK", "XXX", "BUG", "NOTE"];
 var DEFAULT_EXTENSIONS = new Set([
@@ -49096,7 +51003,7 @@ var SKIP_DIRS2 = new Set([
   ".parcel-cache"
 ]);
 function stableHash(value) {
-  return createHash17("sha256").update(value).digest("hex");
+  return createHash18("sha256").update(value).digest("hex");
 }
 function normalizePathForMatch(value) {
   return value.replace(/\\/g, "/").replace(/^\.\//, "");
@@ -49994,7 +51901,7 @@ function renderWorkflowStatesMarkdown(states = listWorkflowStates()) {
 }
 // src/lib/agent-replay-simulator.ts
 init_redaction();
-import { createHash as createHash18 } from "crypto";
+import { createHash as createHash19 } from "crypto";
 import { readFileSync as readFileSync24 } from "fs";
 function isObject(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
@@ -50016,7 +51923,7 @@ function stable2(value) {
   return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stable2(value[key])]));
 }
 function fingerprint3(value) {
-  return createHash18("sha256").update(JSON.stringify(stable2(value))).digest("hex");
+  return createHash19("sha256").update(JSON.stringify(stable2(value))).digest("hex");
 }
 function unpackFixture(input) {
   if (!isObject(input))
@@ -50255,7 +52162,7 @@ function renderAgentReplaySimulationMarkdown(simulation) {
 }
 // src/lib/local-extensions.ts
 init_config2();
-import { createHash as createHash19, createVerify } from "crypto";
+import { createHash as createHash20, createVerify } from "crypto";
 import { existsSync as existsSync28, readdirSync as readdirSync6, readFileSync as readFileSync25, statSync as statSync11 } from "fs";
 import { basename as basename6, join as join26, resolve as resolve19 } from "path";
 init_redaction();
@@ -50343,7 +52250,7 @@ function parseJson2(path) {
   return JSON.parse(readFileSync25(path, "utf8"));
 }
 function sha2567(bytes) {
-  return `sha256:${createHash19("sha256").update(bytes).digest("hex")}`;
+  return `sha256:${createHash20("sha256").update(bytes).digest("hex")}`;
 }
 function compareVersions(a, b) {
   const left = a.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -52976,6 +54883,7 @@ export {
   startTaskRun,
   startTask,
   startFocusSession,
+  sqliteTodosProjectRegistrationSchemaSql,
   softDeleteArtifact,
   snoozeReminder,
   slugify,
@@ -53164,6 +55072,7 @@ export {
   previewInboxIntake,
   previewBuiltinTemplate,
   postgresTodosSyncSchemaSql,
+  postgresTodosProjectRegistrationSchemaSql,
   pollLocalSnapshots,
   planRunArtifactsS3Sync,
   pauseFocusSession,
@@ -53354,6 +55263,7 @@ export {
   importActivityLog,
   hasSecretFindings,
   hasActiveApiKeys,
+  handleTodosProjectRegistrationHttpRequest,
   getWorkspaceTrustStatus,
   getWorkflowPrompt,
   getWebhook,
@@ -53657,6 +55567,7 @@ export {
   discoverTaskRouteSources,
   discoverProjectWorkspace,
   discoverLocalExtensions,
+  digestProjectRegistrationValue,
   deterministicPrGroupId,
   deterministicPrGroupAttemptId,
   detectSourceType,
@@ -53665,6 +55576,7 @@ export {
   detectInboxSourceType,
   detectCyclesFromEdges,
   describeTerminalNotificationRule,
+  deriveTodosProjectRegistrationIdempotencyKey,
   deriveInboxTitle,
   deleteWebhook,
   deleteTemplate,
@@ -53699,6 +55611,7 @@ export {
   createTodosStorageAdapter,
   createTodosS3ArtifactStore,
   createTodosRegistry,
+  createTodosProjectRegistrationHttpClient,
   createTemplate,
   createTaskList,
   createTaskBoard,
@@ -53719,6 +55632,7 @@ export {
   createProject,
   createPostgresTodosSyncStore,
   createPostgresTodosStorageAdapter,
+  createPostgresTodosProjectRegistrationAuthority,
   createPlanWithSteps,
   createPlan,
   createOrg,
@@ -53726,6 +55640,7 @@ export {
   createMilestone,
   createMcpManifest,
   createLocalUsageLedger,
+  createLocalTodosProjectRegistrationAuthority,
   createLocalSqliteTodosStorageAdapter,
   createLocalReport,
   createLocalPrGroupLedger,
@@ -53799,6 +55714,7 @@ export {
   categorizeMcpTool,
   captureKnowledgeSnapshot,
   captureEnvironmentSnapshot,
+  canonicalProjectRegistrationJson,
   cancelDispatch,
   cancelAgentRunDispatch,
   cancelAgentRun,
@@ -53876,6 +55792,8 @@ export {
   VersionConflictError,
   VERIFICATION_EVIDENCE_SCHEMA,
   USER_SCAFFOLD_SCHEMA,
+  TodosProjectRegistrationHttpClient,
+  TodosProjectRegistrationError,
   TodosClient,
   TaskNotFoundError,
   TaskListNotFoundError,
@@ -53887,6 +55805,9 @@ export {
   TODOS_SDK_INTEGRATION_FIXTURE_SCHEMA_VERSION,
   TODOS_SDK_INTEGRATION_FIXTURE_GENERATED_AT,
   TODOS_REGISTRY,
+  TODOS_PROJECT_REGISTRATION_SCHEMA_VERSION,
+  TODOS_PROJECT_REGISTRATION_ROUTE,
+  TODOS_PROJECT_REGISTRATION_CALLER_ROUTE,
   TODOS_PACKAGE_EXPORTS,
   TODOS_ONBOARDING_FIXTURE_SOURCE,
   TODOS_ONBOARDING_FIXTURE_LIBRARY_VERSION,
@@ -53925,6 +55846,7 @@ export {
   TASK_FINDING_SCHEMA_VERSION,
   TASK_FINDING_RESOLVE_MISSING_SCHEMA_VERSION,
   TASK_DEPENDENCY_EDGES_SCHEMA,
+  SqliteTodosProjectRegistrationBackend,
   STORAGE_TABLES,
   SECRET_REDACTION_SCHEMA,
   SCHEMA_SEMVER,
@@ -53951,7 +55873,9 @@ export {
   PrGroupLedgerError,
   PrGroupLedger,
   PrGroupHttpClient,
+  PostgresTodosProjectRegistrationBackend,
   PlanNotFoundError,
+  PackageOwnedTodosProjectRegistrationAuthority,
   PROJECT_DEPENDENCY_GRAPH_SCHEMA,
   PREWRITE_SECRET_SCAN_SCHEMA,
   PLAN_STATUSES,