@hasna/todos 0.15.6 → 0.15.7

package/dist/mcp/index.js

@@ -228,6 +228,206 @@ var init_types = __esm(() => {
   };
 });
 
+// src/project-registration/schema.ts
+function sqliteTodosProjectRegistrationSchemaSql() {
+  return `
+    CREATE TABLE IF NOT EXISTS todos_project_registration_receipts (
+      receipt_id TEXT PRIMARY KEY,
+      authority TEXT NOT NULL CHECK(authority = 'todos'),
+      route TEXT NOT NULL,
+      package_version TEXT NOT NULL,
+      authority_id TEXT NOT NULL,
+      tenant_id TEXT NOT NULL,
+      corpus_id TEXT NOT NULL,
+      operation_id TEXT NOT NULL,
+      step_id TEXT NOT NULL,
+      resource_kind TEXT NOT NULL CHECK(resource_kind IN ('project', 'task_list')),
+      direction TEXT NOT NULL CHECK(direction IN ('forward', 'inverse')),
+      target_selector TEXT NOT NULL,
+      idempotency_key TEXT NOT NULL,
+      request_digest TEXT NOT NULL,
+      precondition_digest TEXT NOT NULL,
+      normalized_call_digest TEXT NOT NULL,
+      outcome TEXT NOT NULL CHECK(outcome IN (
+        'accepted', 'duplicate_of_accepted', 'terminal_nonacceptance'
+      )),
+      reason TEXT,
+      target_id TEXT,
+      result_revision TEXT,
+      result_digest TEXT,
+      duplicate_of_receipt_id TEXT,
+      accepted_receipt_id TEXT,
+      created_by_operation INTEGER NOT NULL CHECK(created_by_operation IN (0, 1)),
+      created_at TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_todos_project_registration_receipts_lookup
+      ON todos_project_registration_receipts (
+        authority_id, tenant_id, corpus_id, operation_id, step_id,
+        resource_kind, direction, idempotency_key
+      );
+    CREATE INDEX IF NOT EXISTS idx_todos_project_registration_receipts_step
+      ON todos_project_registration_receipts (
+        authority_id, tenant_id, corpus_id, operation_id, step_id,
+        resource_kind, direction, outcome
+      );
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_todos_project_registration_receipts_accepted_step
+      ON todos_project_registration_receipts (
+        authority_id, tenant_id, corpus_id, operation_id, step_id,
+        resource_kind, direction
+      )
+      WHERE outcome = 'accepted';
+    CREATE INDEX IF NOT EXISTS idx_todos_project_registration_receipts_target
+      ON todos_project_registration_receipts (
+        authority_id, tenant_id, corpus_id, resource_kind, target_id
+      );
+
+    CREATE TABLE IF NOT EXISTS todos_project_registration_bindings (
+      authority_id TEXT NOT NULL,
+      tenant_id TEXT NOT NULL,
+      corpus_id TEXT NOT NULL,
+      resource_kind TEXT NOT NULL CHECK(resource_kind IN ('project', 'task_list')),
+      target_selector TEXT NOT NULL,
+      operation_id TEXT NOT NULL,
+      step_id TEXT NOT NULL,
+      direction TEXT NOT NULL CHECK(direction = 'forward'),
+      idempotency_key TEXT NOT NULL,
+      request_digest TEXT NOT NULL,
+      precondition_digest TEXT NOT NULL,
+      normalized_call_digest TEXT NOT NULL,
+      state TEXT NOT NULL CHECK(state IN (
+        'pending', 'accepted', 'terminal_nonacceptance', 'removed'
+      )),
+      target_id TEXT,
+      accepted_receipt_id TEXT,
+      result_revision TEXT,
+      result_digest TEXT,
+      removed_receipt_id TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      PRIMARY KEY(
+        authority_id, tenant_id, corpus_id, resource_kind, target_selector
+      ),
+      UNIQUE(accepted_receipt_id)
+    );
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_todos_project_registration_binding_target
+      ON todos_project_registration_bindings(
+        authority_id, tenant_id, corpus_id, resource_kind, target_id
+      )
+      WHERE target_id IS NOT NULL;
+
+    CREATE TRIGGER IF NOT EXISTS todos_project_registration_receipts_immutable_update
+    BEFORE UPDATE ON todos_project_registration_receipts
+    BEGIN
+      SELECT RAISE(ABORT, 'todos project registration receipts are immutable');
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS todos_project_registration_receipts_immutable_delete
+    BEFORE DELETE ON todos_project_registration_receipts
+    BEGIN
+      SELECT RAISE(ABORT, 'todos project registration receipts are immutable');
+    END;
+  `;
+}
+function postgresTodosProjectRegistrationSchemaSql() {
+  return [
+    `CREATE TABLE IF NOT EXISTS todos_project_registration_receipts (
+      receipt_id text PRIMARY KEY,
+      authority text NOT NULL CHECK(authority = 'todos'),
+      route text NOT NULL,
+      package_version text NOT NULL,
+      authority_id text NOT NULL,
+      tenant_id text NOT NULL,
+      corpus_id text NOT NULL,
+      operation_id text NOT NULL,
+      step_id text NOT NULL,
+      resource_kind text NOT NULL CHECK(resource_kind IN ('project', 'task_list')),
+      direction text NOT NULL CHECK(direction IN ('forward', 'inverse')),
+      target_selector text NOT NULL,
+      idempotency_key text NOT NULL,
+      request_digest text NOT NULL,
+      precondition_digest text NOT NULL,
+      normalized_call_digest text NOT NULL,
+      outcome text NOT NULL CHECK(outcome IN (
+        'accepted', 'duplicate_of_accepted', 'terminal_nonacceptance'
+      )),
+      reason text,
+      target_id text,
+      result_revision text,
+      result_digest text,
+      duplicate_of_receipt_id text,
+      accepted_receipt_id text,
+      created_by_operation boolean NOT NULL,
+      created_at timestamptz NOT NULL
+    )`,
+    `CREATE INDEX IF NOT EXISTS todos_project_registration_receipts_lookup_idx
+      ON todos_project_registration_receipts (
+        authority_id, tenant_id, corpus_id, operation_id, step_id,
+        resource_kind, direction, idempotency_key
+      )`,
+    `CREATE INDEX IF NOT EXISTS todos_project_registration_receipts_step_idx
+      ON todos_project_registration_receipts (
+        authority_id, tenant_id, corpus_id, operation_id, step_id,
+        resource_kind, direction, outcome
+      )`,
+    `CREATE UNIQUE INDEX IF NOT EXISTS todos_project_registration_receipts_accepted_step_uidx
+      ON todos_project_registration_receipts (
+        authority_id, tenant_id, corpus_id, operation_id, step_id,
+        resource_kind, direction
+      )
+      WHERE outcome = 'accepted'`,
+    `CREATE INDEX IF NOT EXISTS todos_project_registration_receipts_target_idx
+      ON todos_project_registration_receipts (
+        authority_id, tenant_id, corpus_id, resource_kind, target_id
+      )`,
+    `CREATE TABLE IF NOT EXISTS todos_project_registration_bindings (
+      authority_id text NOT NULL,
+      tenant_id text NOT NULL,
+      corpus_id text NOT NULL,
+      resource_kind text NOT NULL CHECK(resource_kind IN ('project', 'task_list')),
+      target_selector text NOT NULL,
+      operation_id text NOT NULL,
+      step_id text NOT NULL,
+      direction text NOT NULL CHECK(direction = 'forward'),
+      idempotency_key text NOT NULL,
+      request_digest text NOT NULL,
+      precondition_digest text NOT NULL,
+      normalized_call_digest text NOT NULL,
+      state text NOT NULL CHECK(state IN (
+        'pending', 'accepted', 'terminal_nonacceptance', 'removed'
+      )),
+      target_id text,
+      accepted_receipt_id text UNIQUE,
+      result_revision text,
+      result_digest text,
+      removed_receipt_id text,
+      created_at timestamptz NOT NULL,
+      updated_at timestamptz NOT NULL,
+      PRIMARY KEY(
+        authority_id, tenant_id, corpus_id, resource_kind, target_selector
+      )
+    )`,
+    `CREATE UNIQUE INDEX IF NOT EXISTS todos_project_registration_binding_target_uidx
+      ON todos_project_registration_bindings(
+        authority_id, tenant_id, corpus_id, resource_kind, target_id
+      )
+      WHERE target_id IS NOT NULL`,
+    `CREATE OR REPLACE FUNCTION todos_project_registration_receipts_immutable()
+      RETURNS trigger
+      LANGUAGE plpgsql
+      AS $$
+      BEGIN
+        RAISE EXCEPTION 'todos project registration receipts are immutable';
+      END;
+      $$`,
+    `DROP TRIGGER IF EXISTS todos_project_registration_receipts_immutable
+      ON todos_project_registration_receipts`,
+    `CREATE TRIGGER todos_project_registration_receipts_immutable
+      BEFORE UPDATE OR DELETE ON todos_project_registration_receipts
+      FOR EACH ROW EXECUTE FUNCTION todos_project_registration_receipts_immutable()`
+  ];
+}
+
 // src/db/migrations.ts
 var MIGRATIONS;
 var init_migrations = __esm(() => {
@@ -1833,6 +2033,11 @@ var init_migrations = __esm(() => {
   INSERT OR IGNORE INTO _migrations (id) VALUES (68);
   COMMIT;
   PRAGMA foreign_keys = ON;
+  `,
+    `BEGIN;
+  ${sqliteTodosProjectRegistrationSchemaSql()}
+  INSERT OR IGNORE INTO _migrations (id) VALUES (69);
+  COMMIT;
   `
   ];
 });
@@ -3035,6 +3240,7 @@ function ensureSchema(db) {
     )`);
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_api_keys_prefix ON api_keys(prefix)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_api_keys_active ON api_keys(revoked_at, expires_at)");
+  db.exec(sqliteTodosProjectRegistrationSchemaSql());
   ensureTable("pr_groups", `
     CREATE TABLE pr_groups (
       schema_version INTEGER NOT NULL DEFAULT 1,
@@ -20684,6 +20890,16 @@ async function cloudListProjects(client) {
   const envelope = res.raw;
   return Array.isArray(envelope?.projects) ? envelope.projects : res.items;
 }
+function unwrapProject(raw) {
+  if (raw && typeof raw === "object" && "project" in raw) {
+    return raw.project;
+  }
+  return raw;
+}
+async function cloudGetProjectById(client, id) {
+  const raw = await client.get("projects", id);
+  return raw == null ? null : unwrapProject(raw);
+}
 function cloudProjectSlug(value) {
   return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 }
@@ -20790,29 +21006,63 @@ async function cloudListTaskLists(client, projectId) {
     return envelope.taskLists;
   return Array.isArray(raw) ? raw : [];
 }
+function unwrapTaskList(raw) {
+  if (raw && typeof raw === "object" && "task_list" in raw) {
+    return raw.task_list;
+  }
+  return raw;
+}
+async function cloudGetTaskList(client, id) {
+  const raw = await client.get("task-lists", id);
+  return raw == null ? null : unwrapTaskList(raw);
+}
+function resolveTaskListFromCandidates(lists, input) {
+  const normalizedIdRef = input.toLowerCase();
+  const matchGroups = [
+    lists.filter((list) => list.id.toLowerCase() === normalizedIdRef),
+    lists.filter((list) => list.slug === input),
+    lists.filter((list) => list.id.toLowerCase().startsWith(normalizedIdRef))
+  ];
+  for (const matches of matchGroups) {
+    if (matches.length === 1)
+      return matches[0].id;
+    if (matches.length > 1) {
+      throw new Error(`Task list reference is ambiguous: "${input}"`);
+    }
+  }
+  return null;
+}
+async function legacyProjectTaskLists(client, projectId) {
+  const project = await cloudGetProjectById(client, projectId);
+  if (!project?.task_list_id)
+    return [];
+  return (await cloudListTaskLists(client)).filter((list) => list.project_id == null && list.slug === project.task_list_id);
+}
 async function cloudResolveTaskListRef(client, ref, projectId) {
   const input = ref.trim();
   const normalizedIdRef = input.toLowerCase();
   if (UUID_RE.test(input) && !projectId)
     return normalizedIdRef;
-  const lists = await cloudListTaskLists(client, projectId);
-  const exactIds = lists.filter((list) => list.id.toLowerCase() === normalizedIdRef);
-  if (exactIds.length === 1)
-    return exactIds[0].id;
-  if (exactIds.length > 1) {
-    throw new Error(`Task list reference is ambiguous: "${input}"`);
-  }
-  const slugs = lists.filter((list) => list.slug === input);
-  if (slugs.length === 1)
-    return slugs[0].id;
-  if (slugs.length > 1) {
-    throw new Error(`Task list reference is ambiguous: "${input}"`);
-  }
-  const prefixes = lists.filter((list) => list.id.toLowerCase().startsWith(normalizedIdRef));
-  if (prefixes.length === 1)
-    return prefixes[0].id;
-  if (prefixes.length > 1) {
-    throw new Error(`Task list reference is ambiguous: "${input}"`);
+  if (UUID_RE.test(input) && projectId) {
+    const direct = await cloudGetTaskList(client, normalizedIdRef);
+    if (direct?.id?.toLowerCase() === normalizedIdRef) {
+      if (direct.project_id === projectId)
+        return direct.id;
+      if (direct.project_id == null) {
+        const project = await cloudGetProjectById(client, projectId);
+        if (project?.task_list_id === direct.slug)
+          return direct.id;
+      }
+      throw new Error(`Task list not found: "${input}"`);
+    }
+  }
+  const scopedMatch = resolveTaskListFromCandidates(await cloudListTaskLists(client, projectId), input);
+  if (scopedMatch)
+    return scopedMatch;
+  if (projectId) {
+    const legacyMatch = resolveTaskListFromCandidates(await legacyProjectTaskLists(client, projectId), input);
+    if (legacyMatch)
+      return legacyMatch;
   }
   throw new Error(`Task list not found: "${input}"`);
 }
@@ -34926,7 +35176,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.6",
+    version: "0.15.7",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -34964,6 +35214,10 @@ var init_package = __esm(() => {
       "./testing": {
         types: "./dist/testing.d.ts",
         import: "./dist/testing.js"
+      },
+      "./project-registration": {
+        types: "./dist/project-registration.d.ts",
+        import: "./dist/project-registration.js"
       }
     },
     workspaces: [
@@ -34976,8 +35230,8 @@ var init_package = __esm(() => {
       "README.md"
     ],
     scripts: {
-      build: "rm -rf dist dashboard/dist && cd dashboard && bun install --frozen-lockfile && bun run build && cd .. && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && tsc --emitDeclarationOnly --outDir dist",
-      "build:server": "rm -rf dist && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*'",
+      build: "rm -rf dist dashboard/dist && cd dashboard && bun install --frozen-lockfile && bun run build && cd .. && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && tsc --emitDeclarationOnly --outDir dist",
+      "build:server": "rm -rf dist && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*'",
       migrate: "bun run src/server/index.ts migrate",
       "backfill:comment-redaction": "bun run src/server/index.ts redact-comments",
       "generate:sdk": "bun run scripts/generate-sdk.ts",
@@ -47723,6 +47977,1433 @@ var init_postgres = __esm(() => {
   init_types3();
 });
 
+// src/project-registration/types.ts
+var TODOS_PROJECT_REGISTRATION_ROUTE = "todos.project-registration.v1", TODOS_PROJECT_REGISTRATION_CALLER_ROUTE = "projects.full-registration.v1", TodosProjectRegistrationError;
+var init_types4 = __esm(() => {
+  TodosProjectRegistrationError = class TodosProjectRegistrationError extends Error {
+    code;
+    details;
+    constructor(code, message, details = {}) {
+      super(message);
+      this.code = code;
+      this.details = details;
+      this.name = "TodosProjectRegistrationError";
+    }
+  };
+});
+
+// src/project-registration/postgres.ts
+function safeIdentifier(value, field) {
+  if (!/^[a-z_][a-z0-9_]*$/.test(value)) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", `${field} must be a safe PostgreSQL identifier`);
+  }
+  return value;
+}
+function normalizeTimestamp2(value) {
+  return value instanceof Date ? value.toISOString() : new Date(String(value)).toISOString();
+}
+function parsePayload3(value) {
+  if (typeof value === "string")
+    return JSON.parse(value);
+  return value;
+}
+function receiptFromRow(row) {
+  return {
+    ...row,
+    authority: "todos",
+    created_by_operation: Boolean(row["created_by_operation"]),
+    created_at: normalizeTimestamp2(row["created_at"])
+  };
+}
+function bindingFromRow(row) {
+  return {
+    ...row,
+    created_at: normalizeTimestamp2(row["created_at"]),
+    updated_at: normalizeTimestamp2(row["updated_at"])
+  };
+}
+
+class PostgresTodosProjectRegistrationTransaction {
+  client;
+  service;
+  tableName;
+  storage;
+  constructor(client, service, tableName, cursorTableName) {
+    this.client = client;
+    this.service = service;
+    this.tableName = tableName;
+    this.storage = createPostgresTodosStorageAdapter({
+      client,
+      service,
+      tableName,
+      cursorTableName
+    });
+  }
+  async lockStep(identity) {
+    const key = [
+      identity.authority_id,
+      identity.tenant_id,
+      identity.corpus_id,
+      identity.operation_id,
+      identity.step_id,
+      identity.resource_kind,
+      identity.direction
+    ].join("\x1F");
+    await this.client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [key]);
+  }
+  async getReceiptForLookup(identity) {
+    const result = await this.client.query(`
+      SELECT * FROM todos_project_registration_receipts
+      WHERE authority_id = $1 AND tenant_id = $2 AND corpus_id = $3
+        AND operation_id = $4 AND step_id = $5 AND resource_kind = $6
+        AND direction = $7 AND idempotency_key = $8 AND target_selector = $9
+      ORDER BY CASE outcome
+        WHEN 'terminal_nonacceptance' THEN 0
+        WHEN 'duplicate_of_accepted' THEN 1
+        ELSE 2
+      END, created_at DESC, receipt_id DESC
+      LIMIT 1
+    `, [
+      identity.authority_id,
+      identity.tenant_id,
+      identity.corpus_id,
+      identity.operation_id,
+      identity.step_id,
+      identity.resource_kind,
+      identity.direction,
+      identity.idempotency_key,
+      identity.target_selector
+    ]);
+    return result.rows[0] ? receiptFromRow(result.rows[0]) : null;
+  }
+  async getReceiptById(receiptId) {
+    const result = await this.client.query("SELECT * FROM todos_project_registration_receipts WHERE receipt_id = $1 LIMIT 1", [receiptId]);
+    return result.rows[0] ? receiptFromRow(result.rows[0]) : null;
+  }
+  async getAcceptedReceiptForStep(identity) {
+    const result = await this.client.query(`
+      SELECT * FROM todos_project_registration_receipts
+      WHERE authority_id = $1 AND tenant_id = $2 AND corpus_id = $3
+        AND operation_id = $4 AND step_id = $5 AND resource_kind = $6
+        AND direction = $7 AND outcome = 'accepted'
+      ORDER BY created_at ASC, receipt_id ASC
+      LIMIT 1
+      FOR UPDATE
+    `, [
+      identity.authority_id,
+      identity.tenant_id,
+      identity.corpus_id,
+      identity.operation_id,
+      identity.step_id,
+      identity.resource_kind,
+      identity.direction
+    ]);
+    return result.rows[0] ? receiptFromRow(result.rows[0]) : null;
+  }
+  async insertReceipt(receipt) {
+    const result = await this.client.query(`
+      INSERT INTO todos_project_registration_receipts (
+        receipt_id, authority, route, package_version, authority_id, tenant_id,
+        corpus_id, operation_id, step_id, resource_kind, direction,
+        target_selector, idempotency_key, request_digest, precondition_digest,
+        normalized_call_digest, outcome, reason, target_id, result_revision,
+        result_digest, duplicate_of_receipt_id, accepted_receipt_id,
+        created_by_operation, created_at
+      ) VALUES (
+        $1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,
+        $19,$20,$21,$22,$23,$24,$25
+      )
+      ON CONFLICT (receipt_id) DO NOTHING
+      RETURNING receipt_id
+    `, [
+      receipt.receipt_id,
+      receipt.authority,
+      receipt.route,
+      receipt.package_version,
+      receipt.authority_id,
+      receipt.tenant_id,
+      receipt.corpus_id,
+      receipt.operation_id,
+      receipt.step_id,
+      receipt.resource_kind,
+      receipt.direction,
+      receipt.target_selector,
+      receipt.idempotency_key,
+      receipt.request_digest,
+      receipt.precondition_digest,
+      receipt.normalized_call_digest,
+      receipt.outcome,
+      receipt.reason,
+      receipt.target_id,
+      receipt.result_revision,
+      receipt.result_digest,
+      receipt.duplicate_of_receipt_id,
+      receipt.accepted_receipt_id,
+      receipt.created_by_operation,
+      receipt.created_at
+    ]);
+    return result.rows.length === 1;
+  }
+  async getBinding(scope, resourceKind, targetSelector) {
+    const result = await this.client.query(`
+      SELECT * FROM todos_project_registration_bindings
+      WHERE authority_id = $1 AND tenant_id = $2 AND corpus_id = $3
+        AND resource_kind = $4 AND target_selector = $5
+      LIMIT 1
+      FOR UPDATE
+    `, [
+      scope.authority_id,
+      scope.tenant_id,
+      scope.corpus_id,
+      resourceKind,
+      targetSelector
+    ]);
+    return result.rows[0] ? bindingFromRow(result.rows[0]) : null;
+  }
+  async claimBinding(binding) {
+    const result = await this.client.query(`
+      INSERT INTO todos_project_registration_bindings (
+        authority_id, tenant_id, corpus_id, resource_kind, target_selector,
+        operation_id, step_id, direction, idempotency_key, request_digest,
+        precondition_digest, normalized_call_digest, state, target_id,
+        accepted_receipt_id, result_revision, result_digest, removed_receipt_id,
+        created_at, updated_at
+      ) VALUES (
+        $1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,
+        $18,$19,$20
+      )
+      ON CONFLICT (
+        authority_id, tenant_id, corpus_id, resource_kind, target_selector
+      ) DO NOTHING
+      RETURNING target_selector
+    `, [
+      binding.authority_id,
+      binding.tenant_id,
+      binding.corpus_id,
+      binding.resource_kind,
+      binding.target_selector,
+      binding.operation_id,
+      binding.step_id,
+      binding.direction,
+      binding.idempotency_key,
+      binding.request_digest,
+      binding.precondition_digest,
+      binding.normalized_call_digest,
+      binding.state,
+      binding.target_id,
+      binding.accepted_receipt_id,
+      binding.result_revision,
+      binding.result_digest,
+      binding.removed_receipt_id,
+      binding.created_at,
+      binding.updated_at
+    ]);
+    return result.rows.length === 1;
+  }
+  async setBindingAccepted(scope, resourceKind, targetSelector, update) {
+    const result = await this.client.query(`
+      UPDATE todos_project_registration_bindings
+      SET state = 'accepted', target_id = $1, accepted_receipt_id = $2,
+        result_revision = $3, result_digest = $4, updated_at = $5
+      WHERE authority_id = $6 AND tenant_id = $7 AND corpus_id = $8
+        AND resource_kind = $9 AND target_selector = $10 AND state = 'pending'
+      RETURNING target_selector
+    `, [
+      update.target_id,
+      update.accepted_receipt_id,
+      update.result_revision,
+      update.result_digest,
+      update.updated_at,
+      scope.authority_id,
+      scope.tenant_id,
+      scope.corpus_id,
+      resourceKind,
+      targetSelector
+    ]);
+    if (result.rows.length !== 1) {
+      throw new Error("Todos project registration binding was not pending at acceptance");
+    }
+  }
+  async setBindingTerminal(scope, resourceKind, targetSelector, updatedAt) {
+    await this.client.query(`
+      UPDATE todos_project_registration_bindings
+      SET state = 'terminal_nonacceptance', updated_at = $1
+      WHERE authority_id = $2 AND tenant_id = $3 AND corpus_id = $4
+        AND resource_kind = $5 AND target_selector = $6 AND state = 'pending'
+    `, [
+      updatedAt,
+      scope.authority_id,
+      scope.tenant_id,
+      scope.corpus_id,
+      resourceKind,
+      targetSelector
+    ]);
+  }
+  async setBindingRemoved(scope, resourceKind, targetSelector, removedReceiptId, updatedAt) {
+    const result = await this.client.query(`
+      UPDATE todos_project_registration_bindings
+      SET state = 'removed', removed_receipt_id = $1, updated_at = $2
+      WHERE authority_id = $3 AND tenant_id = $4 AND corpus_id = $5
+        AND resource_kind = $6 AND target_selector = $7 AND state = 'accepted'
+      RETURNING target_selector
+    `, [
+      removedReceiptId,
+      updatedAt,
+      scope.authority_id,
+      scope.tenant_id,
+      scope.corpus_id,
+      resourceKind,
+      targetSelector
+    ]);
+    if (result.rows.length !== 1) {
+      throw new Error("Todos project registration binding was not accepted at removal");
+    }
+  }
+  async findProjectConflict(path, taskListSlug) {
+    const result = await this.client.query(`
+      SELECT payload FROM ${this.tableName}
+      WHERE service = $1 AND object_type = 'projects' AND deleted_at IS NULL
+        AND (payload->>'path' = $2 OR payload->>'task_list_id' = $3)
+      ORDER BY payload->>'created_at' ASC, object_id ASC
+      LIMIT 1
+    `, [this.service, path, taskListSlug]);
+    return result.rows[0] ? parsePayload3(result.rows[0].payload) : null;
+  }
+  async findTaskListConflict(projectId, slug) {
+    const result = await this.client.query(`
+      SELECT payload FROM ${this.tableName}
+      WHERE service = $1 AND object_type = 'task_lists' AND deleted_at IS NULL
+        AND payload->>'project_id' = $2 AND payload->>'slug' = $3
+      ORDER BY payload->>'created_at' ASC, object_id ASC
+      LIMIT 1
+    `, [this.service, projectId, slug]);
+    return result.rows[0] ? parsePayload3(result.rows[0].payload) : null;
+  }
+  async createProject(input) {
+    return await this.storage.projects.create(input);
+  }
+  async createTaskList(input) {
+    return await this.storage.taskLists.create(input);
+  }
+  async getProject(id) {
+    return await this.storage.projects.get(id);
+  }
+  async getTaskList(id) {
+    return await this.storage.taskLists.get(id);
+  }
+  async lockCompensationWrites() {
+    await this.client.query(`LOCK TABLE ${this.tableName} IN SHARE ROW EXCLUSIVE MODE`);
+  }
+  async hasDependents(resourceKind, targetId) {
+    const referencePredicate = resourceKind === "project" ? `(
+          payload->>'project_id' = $2
+          OR payload->>'active_project_id' = $2
+          OR payload->>'assigned_from_project' = $2
+          OR payload->>'external_project_id' = $2
+        )` : "payload->>'task_list_id' = $2";
+    const result = await this.client.query(`
+      SELECT EXISTS (
+        SELECT 1 FROM ${this.tableName}
+        WHERE service = $1 AND deleted_at IS NULL
+          AND ${referencePredicate}
+        LIMIT 1
+      ) AS exists
+    `, [this.service, targetId]);
+    return result.rows[0]?.exists === true;
+  }
+  async deleteProject(id) {
+    return await this.storage.projects.delete(id);
+  }
+  async deleteTaskList(id) {
+    return await this.storage.taskLists.delete(id);
+  }
+}
+
+class PostgresTodosProjectRegistrationBackend {
+  client;
+  kind = "postgresql";
+  service;
+  tableName;
+  cursorTableName;
+  schemaReady = null;
+  constructor(client, options = {}) {
+    this.client = client;
+    this.service = options.service ?? "todos";
+    this.tableName = safeIdentifier(options.tableName ?? "todos_sync_records", "tableName");
+    this.cursorTableName = safeIdentifier(options.cursorTableName ?? "todos_sync_cursors", "cursorTableName");
+  }
+  async ensureSchema() {
+    this.schemaReady ??= (async () => {
+      for (const statement of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
+        await this.client.query(statement);
+      }
+      for (const statement of postgresTodosProjectRegistrationSchemaSql()) {
+        await this.client.query(statement);
+      }
+    })();
+    await this.schemaReady;
+  }
+  async transaction(fn) {
+    await this.ensureSchema();
+    if (typeof this.client.transaction !== "function") {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_ATOMICITY_UNAVAILABLE", "PostgreSQL project registration requires an authoritative transaction");
+    }
+    return this.client.transaction((transaction) => fn(new PostgresTodosProjectRegistrationTransaction(transaction, this.service, this.tableName, this.cursorTableName)));
+  }
+  async direct() {
+    await this.ensureSchema();
+    return new PostgresTodosProjectRegistrationTransaction(this.client, this.service, this.tableName, this.cursorTableName);
+  }
+  async getReceiptForLookup(identity) {
+    return (await this.direct()).getReceiptForLookup(identity);
+  }
+  async getReceiptById(receiptId) {
+    return (await this.direct()).getReceiptById(receiptId);
+  }
+  async getBinding(scope, resourceKind, targetSelector) {
+    return (await this.direct()).getBinding(scope, resourceKind, targetSelector);
+  }
+  async getProject(id) {
+    return (await this.direct()).getProject(id);
+  }
+  async getTaskList(id) {
+    return (await this.direct()).getTaskList(id);
+  }
+}
+var init_postgres2 = __esm(() => {
+  init_postgres_adapter();
+  init_postgres_sync();
+  init_types4();
+});
+
+// src/project-registration/sqlite.ts
+var sqliteTransactionTails, PROJECT_REFERENCE_COLUMNS, TASK_LIST_REFERENCE_COLUMNS;
+var init_sqlite = __esm(() => {
+  init_local_sqlite();
+  sqliteTransactionTails = new WeakMap;
+  PROJECT_REFERENCE_COLUMNS = new Set([
+    "project_id",
+    "active_project_id",
+    "assigned_from_project",
+    "external_project_id"
+  ]);
+  TASK_LIST_REFERENCE_COLUMNS = new Set(["task_list_id"]);
+});
+
+// src/project-registration/authority.ts
+import { createHash as createHash14 } from "crypto";
+function canonicalProjectRegistrationJson(value) {
+  return JSON.stringify(canonicalize2(value));
+}
+function canonicalize2(value) {
+  if (Array.isArray(value))
+    return value.map(canonicalize2);
+  if (!value || typeof value !== "object")
+    return value;
+  const out = {};
+  for (const key of Object.keys(value).sort()) {
+    const entry2 = value[key];
+    if (entry2 !== undefined)
+      out[key] = canonicalize2(entry2);
+  }
+  return out;
+}
+function digestProjectRegistrationValue(value) {
+  return createHash14("sha256").update(canonicalProjectRegistrationJson(value)).digest("hex");
+}
+function deriveTodosProjectRegistrationIdempotencyKey(input) {
+  return `prk_${digestProjectRegistrationValue({
+    route: TODOS_PROJECT_REGISTRATION_CALLER_ROUTE,
+    ...input
+  }).slice(0, 48)}`;
+}
+function responseBytes(value) {
+  return Buffer.byteLength(JSON.stringify(value), "utf8");
+}
+function assertBounds(bounds) {
+  if (!Number.isSafeInteger(bounds.response_byte_limit) || bounds.response_byte_limit <= 0) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_BOUNDS", "response_byte_limit must be a positive integer");
+  }
+  if (!Number.isSafeInteger(bounds.time_budget_ms) || bounds.time_budget_ms <= 0) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_BOUNDS", "time_budget_ms must be a positive integer");
+  }
+}
+function assertResourceKind(value) {
+  if (value !== "project" && value !== "task_list") {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "resource_kind must be project or task_list");
+  }
+}
+function assertDirection(value) {
+  if (value !== "forward" && value !== "inverse") {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "direction must be forward or inverse");
+  }
+}
+function assertWithinBounds(value, bounds, startedAt) {
+  const bytes = responseBytes(value);
+  if (bytes > bounds.response_byte_limit) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_RESPONSE_TOO_LARGE", `registration response requires ${bytes} bytes but the bound is ${bounds.response_byte_limit}`, { response_bytes: bytes, response_byte_limit: bounds.response_byte_limit });
+  }
+  const elapsed = Date.now() - startedAt;
+  if (elapsed > bounds.time_budget_ms) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_TIME_BUDGET_EXCEEDED", `registration call took ${elapsed}ms but the bound is ${bounds.time_budget_ms}ms`, { elapsed_ms: elapsed, time_budget_ms: bounds.time_budget_ms });
+  }
+  return { response_bytes: bytes, elapsed_ms: elapsed };
+}
+function withResponseControl(payload, bounds, startedAt) {
+  const envelope = {
+    ...payload,
+    response_control: {
+      response_byte_limit: bounds.response_byte_limit,
+      time_budget_ms: bounds.time_budget_ms,
+      response_bytes: 0,
+      elapsed_ms: 0,
+      complete: true,
+      truncated: false
+    }
+  };
+  for (let attempt = 0;attempt < 8; attempt += 1) {
+    const measured = assertWithinBounds(envelope, bounds, startedAt);
+    const stable3 = envelope.response_control.response_bytes === measured.response_bytes && envelope.response_control.elapsed_ms === measured.elapsed_ms;
+    envelope.response_control = {
+      response_byte_limit: bounds.response_byte_limit,
+      time_budget_ms: bounds.time_budget_ms,
+      response_bytes: measured.response_bytes,
+      elapsed_ms: measured.elapsed_ms,
+      complete: true,
+      truncated: false
+    };
+    if (stable3)
+      break;
+  }
+  const finalMeasurement = assertWithinBounds(envelope, bounds, startedAt);
+  envelope.response_control.response_bytes = finalMeasurement.response_bytes;
+  envelope.response_control.elapsed_ms = finalMeasurement.elapsed_ms;
+  return envelope;
+}
+function requireString(value, field, options = {}) {
+  const min = options.min ?? 1;
+  const max = options.max ?? 512;
+  if (typeof value !== "string" || value.length < min || value.length > max || /[\u0000-\u001f]/.test(value) || options.pattern && !options.pattern.test(value)) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", `${field} is not a valid bounded registration identifier`);
+  }
+  return value;
+}
+function exactKeys(value, expected, field) {
+  const actual = Object.keys(value).sort();
+  const wanted = [...expected].sort();
+  if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", `${field} must contain exactly: ${wanted.join(", ")}`);
+  }
+}
+function publicReceipt(row) {
+  const {
+    target_selector: _targetSelector,
+    normalized_call_digest: _normalizedCallDigest,
+    ...receipt
+  } = row;
+  return receipt;
+}
+function projectRegistrationPath(projectId) {
+  return `hasna-project://${encodeURIComponent(projectId)}`;
+}
+function taskListSlug(projectSlug) {
+  const slug = normalizeSlug(projectSlug);
+  if (!slug || slug !== projectSlug) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "project_slug must be canonical kebab-case");
+  }
+  return `todos-${slug}`;
+}
+function deterministicTaskPrefix(projectSlug) {
+  const letters = projectSlug.replace(/[^a-z0-9]/gi, "").toUpperCase();
+  return (letters.slice(0, 3) || "PRJ").padEnd(3, "X");
+}
+function projectRecord(project) {
+  return {
+    target_id: project.id,
+    revision: project.updated_at,
+    digest: digestProjectRegistrationValue({
+      id: project.id,
+      name: project.name,
+      path: project.path,
+      description: project.description,
+      task_list_id: project.task_list_id,
+      task_prefix: project.task_prefix,
+      task_counter: project.task_counter,
+      created_at: project.created_at,
+      updated_at: project.updated_at
+    })
+  };
+}
+function taskListRecord(taskList) {
+  return {
+    target_id: taskList.id,
+    revision: taskList.updated_at,
+    digest: digestProjectRegistrationValue({
+      id: taskList.id,
+      project_id: taskList.project_id,
+      slug: taskList.slug,
+      name: taskList.name,
+      description: taskList.description,
+      metadata: taskList.metadata,
+      created_at: taskList.created_at,
+      updated_at: taskList.updated_at
+    })
+  };
+}
+function receiptId(input) {
+  return `tpr_${digestProjectRegistrationValue(input).slice(0, 40)}`;
+}
+function capabilityMatches(request, capability) {
+  return request.authority_route === capability.route && request.package_version === capability.package_version && request.authority_id === capability.authority_id && request.tenant_id === capability.tenant_id && request.corpus_id === capability.corpus_id;
+}
+function authorityScope(capability) {
+  return {
+    authority_id: capability.authority_id,
+    tenant_id: capability.tenant_id,
+    corpus_id: capability.corpus_id
+  };
+}
+function assertCapabilityRequest(request, capability) {
+  if (!capabilityMatches(request, capability)) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CAPABILITY_MISMATCH", "registration request does not match this authority capability identity");
+  }
+}
+function normalizedCallDigest(request) {
+  return digestProjectRegistrationValue({
+    authority_route: request.authority_route,
+    package_version: request.package_version,
+    authority_id: request.authority_id,
+    tenant_id: request.tenant_id,
+    corpus_id: request.corpus_id,
+    operation_id: request.operation_id,
+    step_id: request.step_id,
+    resource_kind: request.resource_kind,
+    direction: request.direction,
+    target_selector: request.target_selector,
+    idempotency_key: request.idempotency_key,
+    request_digest: request.request_digest,
+    precondition_digest: request.precondition_digest,
+    project_id: request.project_id,
+    project_slug: request.project_slug,
+    project_name: request.project_name,
+    desired: request.desired,
+    accepted_receipt_id: request.accepted_receipt?.receipt_id ?? null
+  });
+}
+function assertCommonRequest(request, capability) {
+  assertBounds(request);
+  assertResourceKind(request.resource_kind);
+  assertDirection(request.direction);
+  assertCapabilityRequest(request, capability);
+  requireString(request.operation_id, "operation_id", {
+    min: 8,
+    max: 128,
+    pattern: OPERATION_PATTERN
+  });
+  requireString(request.step_id, "step_id", {
+    min: 3,
+    max: 128,
+    pattern: STEP_PATTERN
+  });
+  requireString(request.target_selector, "target_selector", { max: 512 });
+  requireString(request.project_id, "project_id", {
+    min: 16,
+    max: 128,
+    pattern: WORKSPACE_ID_PATTERN
+  });
+  requireString(request.project_name, "project_name", { max: 256 });
+  requireString(request.project_slug, "project_slug", { max: 128 });
+  requireString(request.request_digest, "request_digest", {
+    min: 64,
+    max: 64,
+    pattern: SHA256_PATTERN
+  });
+  requireString(request.precondition_digest, "precondition_digest", {
+    min: 64,
+    max: 64,
+    pattern: SHA256_PATTERN
+  });
+  requireString(request.idempotency_key, "idempotency_key", {
+    min: 52,
+    max: 52,
+    pattern: IDEMPOTENCY_PATTERN
+  });
+  if (!request.desired || typeof request.desired !== "object" || Array.isArray(request.desired)) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "desired must be a JSON object");
+  }
+  const expectedKey = deriveTodosProjectRegistrationIdempotencyKey({
+    operation_id: request.operation_id,
+    step_id: request.step_id,
+    direction: request.direction,
+    target_selector: request.target_selector,
+    request_digest: request.request_digest,
+    precondition_digest: request.precondition_digest
+  });
+  if (request.idempotency_key !== expectedKey) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_IDEMPOTENCY_MISMATCH", "idempotency_key does not match the deterministic operation/step/direction payload", { expected: expectedKey });
+  }
+  taskListSlug(request.project_slug);
+}
+function assertForwardRequest(request, capability) {
+  assertCommonRequest(request, capability);
+  if (request.direction !== "forward") {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "create requires direction=forward");
+  }
+  const expectedRequestDigest = digestProjectRegistrationValue(request.desired);
+  const expectedPreconditionDigest = digestProjectRegistrationValue({
+    target_selector: request.target_selector,
+    expected: "absent"
+  });
+  if (request.request_digest !== expectedRequestDigest || request.precondition_digest !== expectedPreconditionDigest) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_DIGEST_MISMATCH", "request_digest or precondition_digest does not match normalized forward semantics", {
+      expected_request_digest: expectedRequestDigest,
+      expected_precondition_digest: expectedPreconditionDigest
+    });
+  }
+  if (request.resource_kind === "project") {
+    exactKeys(request.desired, ["source_project_id", "source_project_slug", "name"], "project desired");
+    if (request.desired["source_project_id"] !== request.project_id || request.desired["source_project_slug"] !== request.project_slug || request.desired["name"] !== request.project_name || request.target_selector !== request.project_id) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "project desired state and target selector must match the complete Projects identity");
+    }
+    return;
+  }
+  if (request.resource_kind === "task_list") {
+    exactKeys(request.desired, ["todos_project_id", "source_project_id", "name"], "task-list desired");
+    const todosProjectId = request.desired["todos_project_id"];
+    if (typeof todosProjectId !== "string" || !UUID_PATTERN.test(todosProjectId)) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_EXACT_ID_REQUIRED", "task-list create requires the exact full Todos project UUID");
+    }
+    if (request.target_selector !== `${todosProjectId}:default` || request.desired["source_project_id"] !== request.project_id || request.desired["name"] !== request.project_name) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "task-list desired state must bind the exact Todos project id and Projects identity");
+    }
+    return;
+  }
+  throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "unsupported registration resource kind");
+}
+function assertInverseRequest(request, capability) {
+  assertCommonRequest(request, capability);
+  if (request.direction !== "inverse") {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "compensate requires direction=inverse");
+  }
+  const accepted = request.accepted_receipt;
+  if (!accepted || accepted.authority !== "todos" || accepted.route !== capability.route || accepted.package_version !== capability.package_version || accepted.authority_id !== capability.authority_id || accepted.tenant_id !== capability.tenant_id || accepted.corpus_id !== capability.corpus_id || accepted.operation_id !== request.operation_id || accepted.step_id !== request.step_id || accepted.resource_kind !== request.resource_kind || accepted.direction !== "forward" || accepted.outcome !== "accepted" || !accepted.created_by_operation || !accepted.target_id || !accepted.result_revision || !accepted.result_digest) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "inverse requires the complete accepted forward receipt created by this operation");
+  }
+  exactKeys(request.desired, ["accepted_receipt_id", "target_id"], "inverse desired");
+  const expectedDesired = {
+    accepted_receipt_id: accepted.receipt_id,
+    target_id: accepted.target_id
+  };
+  const expectedPrecondition = {
+    expected_revision: accepted.result_revision,
+    expected_digest: accepted.result_digest
+  };
+  const expectedRequestDigest = digestProjectRegistrationValue(expectedDesired);
+  const expectedPreconditionDigest = digestProjectRegistrationValue(expectedPrecondition);
+  if (canonicalProjectRegistrationJson(request.desired) !== canonicalProjectRegistrationJson(expectedDesired) || request.request_digest !== expectedRequestDigest || request.precondition_digest !== expectedPreconditionDigest || request.target_selector !== accepted.target_id) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_DIGEST_MISMATCH", "inverse request does not match the accepted receipt and exact readback precondition");
+  }
+  return accepted;
+}
+function makeReceipt(input, createdAt2) {
+  return {
+    ...input,
+    receipt_id: receiptId(input),
+    created_at: createdAt2
+  };
+}
+function receiptBase(request, callDigest, capability) {
+  return {
+    authority: "todos",
+    route: capability.route,
+    package_version: capability.package_version,
+    authority_id: capability.authority_id,
+    tenant_id: capability.tenant_id,
+    corpus_id: capability.corpus_id,
+    operation_id: request.operation_id,
+    step_id: request.step_id,
+    resource_kind: request.resource_kind,
+    direction: request.direction,
+    target_selector: request.target_selector,
+    idempotency_key: request.idempotency_key,
+    request_digest: request.request_digest,
+    precondition_digest: request.precondition_digest,
+    normalized_call_digest: callDigest
+  };
+}
+function makeAcceptedReceipt(request, callDigest, capability, record, createdAt2) {
+  return makeReceipt({
+    ...receiptBase(request, callDigest, capability),
+    outcome: "accepted",
+    reason: null,
+    target_id: record.target_id,
+    result_revision: record.revision,
+    result_digest: record.digest,
+    duplicate_of_receipt_id: null,
+    accepted_receipt_id: request.direction === "inverse" ? request.accepted_receipt.receipt_id : null,
+    created_by_operation: true
+  }, createdAt2);
+}
+function makeDuplicateReceipt(request, callDigest, capability, accepted, createdAt2) {
+  return makeReceipt({
+    ...receiptBase(request, callDigest, capability),
+    outcome: "duplicate_of_accepted",
+    reason: null,
+    target_id: accepted.target_id,
+    result_revision: accepted.result_revision,
+    result_digest: accepted.result_digest,
+    duplicate_of_receipt_id: accepted.receipt_id,
+    accepted_receipt_id: null,
+    created_by_operation: false
+  }, createdAt2);
+}
+function makeTerminalReceipt(request, callDigest, capability, reason, createdAt2, options = {}) {
+  return makeReceipt({
+    ...receiptBase(request, callDigest, capability),
+    outcome: "terminal_nonacceptance",
+    reason,
+    target_id: options.targetId ?? null,
+    result_revision: null,
+    result_digest: null,
+    duplicate_of_receipt_id: null,
+    accepted_receipt_id: options.acceptedReceiptId ?? null,
+    created_by_operation: false
+  }, createdAt2);
+}
+async function insertDeterministicReceipt(transaction, receipt) {
+  if (await transaction.insertReceipt(receipt))
+    return receipt;
+  const existing = await transaction.getReceiptById(receipt.receipt_id);
+  const { created_at: _existingCreatedAt, ...existingContent } = existing ?? {};
+  const { created_at: _receiptCreatedAt, ...receiptContent } = receipt;
+  if (!existing || canonicalProjectRegistrationJson(existingContent) !== canonicalProjectRegistrationJson(receiptContent)) {
+    throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CONFLICT", "deterministic receipt id is occupied by different immutable content", { receipt_id: receipt.receipt_id });
+  }
+  return existing;
+}
+function bindingFor(request, callDigest, timestamp4, capability) {
+  return {
+    ...authorityScope(capability),
+    resource_kind: request.resource_kind,
+    target_selector: request.target_selector,
+    operation_id: request.operation_id,
+    step_id: request.step_id,
+    direction: "forward",
+    idempotency_key: request.idempotency_key,
+    request_digest: request.request_digest,
+    precondition_digest: request.precondition_digest,
+    normalized_call_digest: callDigest,
+    state: "pending",
+    target_id: null,
+    accepted_receipt_id: null,
+    result_revision: null,
+    result_digest: null,
+    removed_receipt_id: null,
+    created_at: timestamp4,
+    updated_at: timestamp4
+  };
+}
+
+class PackageOwnedTodosProjectRegistrationAuthority {
+  backend;
+  authority = "todos";
+  capabilityValue;
+  now;
+  faultInjector;
+  constructor(backend, options = {}) {
+    this.backend = backend;
+    this.capabilityValue = {
+      authority: "todos",
+      route: TODOS_PROJECT_REGISTRATION_ROUTE,
+      package_version: options.packageVersion ?? getPackageVersion(import.meta.url),
+      authority_id: options.authorityId ?? "todos",
+      tenant_id: options.tenantId ?? backend.kind,
+      corpus_id: options.corpusId ?? `todos:${backend.kind}`,
+      supported_resources: ["project", "task_list"],
+      conditional_create: true,
+      immutable_receipts: true,
+      exact_terminal_lookup: true,
+      exact_readback: true,
+      conditional_inverse: true,
+      ambiguous_outcome_reconciliation: true
+    };
+    this.now = options.now ?? (() => new Date().toISOString());
+    this.faultInjector = options.faultInjector;
+  }
+  async capability() {
+    return {
+      ...this.capabilityValue,
+      supported_resources: [...this.capabilityValue.supported_resources]
+    };
+  }
+  async fault(point, request) {
+    if (!this.faultInjector)
+      return;
+    try {
+      await this.faultInjector(point, {
+        operation_id: request.operation_id,
+        step_id: request.step_id,
+        resource_kind: request.resource_kind,
+        direction: request.direction
+      });
+    } catch (cause) {
+      throw new WriteBoundaryError(point, cause);
+    }
+  }
+  async afterCommit(request) {
+    await this.faultInjector?.("after_commit", {
+      operation_id: request.operation_id,
+      step_id: request.step_id,
+      resource_kind: request.resource_kind,
+      direction: request.direction
+    });
+  }
+  async duplicateFor(transaction, request, callDigest, accepted) {
+    const duplicate = makeDuplicateReceipt(request, callDigest, this.capabilityValue, accepted, this.now());
+    return insertDeterministicReceipt(transaction, duplicate);
+  }
+  async terminalFor(transaction, request, callDigest, reason, options = {}) {
+    return insertDeterministicReceipt(transaction, makeTerminalReceipt(request, callDigest, this.capabilityValue, reason, this.now(), options));
+  }
+  async existingForwardResolution(transaction, request, callDigest) {
+    const exact = await transaction.getReceiptForLookup({
+      ...authorityScope(this.capabilityValue),
+      operation_id: request.operation_id,
+      step_id: request.step_id,
+      resource_kind: request.resource_kind,
+      direction: request.direction,
+      idempotency_key: request.idempotency_key,
+      target_selector: request.target_selector
+    });
+    if (exact) {
+      if (exact.outcome === "terminal_nonacceptance")
+        return exact;
+      const accepted2 = exact.outcome === "accepted" ? exact : await transaction.getReceiptById(exact.duplicate_of_receipt_id);
+      if (!accepted2) {
+        throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CONFLICT", "duplicate receipt points to a missing accepted receipt");
+      }
+      if (accepted2.normalized_call_digest !== callDigest) {
+        return this.terminalFor(transaction, request, callDigest, "operation_step_semantics_changed", { targetId: accepted2.target_id });
+      }
+      return this.duplicateFor(transaction, request, callDigest, accepted2);
+    }
+    const accepted = await transaction.getAcceptedReceiptForStep({
+      ...authorityScope(this.capabilityValue),
+      operation_id: request.operation_id,
+      step_id: request.step_id,
+      resource_kind: request.resource_kind,
+      direction: "forward"
+    });
+    if (!accepted)
+      return null;
+    if (accepted.normalized_call_digest === callDigest) {
+      return this.duplicateFor(transaction, request, callDigest, accepted);
+    }
+    return this.terminalFor(transaction, request, callDigest, "operation_step_semantics_changed", { targetId: accepted.target_id });
+  }
+  async createObject(transaction, request) {
+    if (request.resource_kind === "project") {
+      const path = projectRegistrationPath(request.project_id);
+      const slug2 = taskListSlug(request.project_slug);
+      const conflict2 = await transaction.findProjectConflict(path, slug2);
+      if (conflict2) {
+        return this.terminalFor(transaction, request, normalizedCallDigest(request), "target_already_exists", { targetId: conflict2.id });
+      }
+      await this.fault("before_object_write", request);
+      const project = await transaction.createProject({
+        name: request.project_name,
+        path,
+        description: `Registered from Projects workspace ${request.project_id}`,
+        task_list_id: slug2,
+        task_prefix: deterministicTaskPrefix(request.project_slug)
+      });
+      await this.fault("after_object_write", request);
+      return projectRecord(project);
+    }
+    const todosProjectId = String(request.desired["todos_project_id"]);
+    const sourceBinding = await transaction.getBinding(authorityScope(this.capabilityValue), "project", request.project_id);
+    if (!sourceBinding || sourceBinding.state !== "accepted" || sourceBinding.target_id !== todosProjectId) {
+      return this.terminalFor(transaction, request, normalizedCallDigest(request), "exact_parent_registration_missing", { targetId: todosProjectId });
+    }
+    const parent = await transaction.getProject(todosProjectId);
+    if (!parent) {
+      return this.terminalFor(transaction, request, normalizedCallDigest(request), "exact_parent_project_missing", { targetId: todosProjectId });
+    }
+    const slug = taskListSlug(request.project_slug);
+    const conflict = await transaction.findTaskListConflict(todosProjectId, slug);
+    if (conflict) {
+      return this.terminalFor(transaction, request, normalizedCallDigest(request), "target_already_exists", { targetId: conflict.id });
+    }
+    await this.fault("before_object_write", request);
+    const taskList = await transaction.createTaskList({
+      name: request.project_name,
+      slug,
+      project_id: todosProjectId,
+      metadata: {
+        source_project_id: request.project_id,
+        registration_authority: "todos"
+      }
+    });
+    await this.fault("after_object_write", request);
+    if (taskList.project_id !== todosProjectId) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CONFLICT", "task-list create did not preserve the exact full Todos project id");
+    }
+    return taskListRecord(taskList);
+  }
+  async create(request) {
+    const startedAt = Date.now();
+    assertForwardRequest(request, this.capabilityValue);
+    const callDigest = normalizedCallDigest(request);
+    try {
+      const row = await this.backend.transaction(async (transaction) => {
+        await transaction.lockStep({
+          ...authorityScope(this.capabilityValue),
+          operation_id: request.operation_id,
+          step_id: request.step_id,
+          resource_kind: request.resource_kind,
+          direction: request.direction
+        });
+        const resolved = await this.existingForwardResolution(transaction, request, callDigest);
+        if (resolved)
+          return resolved;
+        const timestamp4 = this.now();
+        const claimed = await transaction.claimBinding(bindingFor(request, callDigest, timestamp4, this.capabilityValue));
+        if (!claimed) {
+          const binding = await transaction.getBinding(authorityScope(this.capabilityValue), request.resource_kind, request.target_selector);
+          if (binding?.state === "accepted" && binding.normalized_call_digest === callDigest && binding.accepted_receipt_id) {
+            const accepted2 = await transaction.getReceiptById(binding.accepted_receipt_id);
+            if (accepted2) {
+              return this.duplicateFor(transaction, request, callDigest, accepted2);
+            }
+          }
+          return this.terminalFor(transaction, request, callDigest, binding?.state === "removed" ? "target_registration_was_removed" : "target_already_registered", { targetId: binding?.target_id ?? null });
+        }
+        const recordOrTerminal = await this.createObject(transaction, request);
+        if ("outcome" in recordOrTerminal) {
+          await transaction.setBindingTerminal(authorityScope(this.capabilityValue), request.resource_kind, request.target_selector, this.now());
+          return recordOrTerminal;
+        }
+        const accepted = makeAcceptedReceipt(request, callDigest, this.capabilityValue, recordOrTerminal, this.now());
+        await this.fault("before_receipt_write", request);
+        const stored = await insertDeterministicReceipt(transaction, accepted);
+        await this.fault("after_receipt_write", request);
+        await transaction.setBindingAccepted(authorityScope(this.capabilityValue), request.resource_kind, request.target_selector, {
+          target_id: recordOrTerminal.target_id,
+          accepted_receipt_id: stored.receipt_id,
+          result_revision: recordOrTerminal.revision,
+          result_digest: recordOrTerminal.digest,
+          updated_at: this.now()
+        });
+        return stored;
+      });
+      await this.afterCommit(request);
+      const receipt = publicReceipt(row);
+      assertWithinBounds(receipt, request, startedAt);
+      return receipt;
+    } catch (error) {
+      if (!(error instanceof WriteBoundaryError))
+        throw error;
+      const terminal = await this.recordWriteFailure(request, callDigest, error.point);
+      const receipt = publicReceipt(terminal);
+      assertWithinBounds(receipt, request, startedAt);
+      return receipt;
+    }
+  }
+  async recordWriteFailure(request, callDigest, point) {
+    return this.backend.transaction(async (transaction) => {
+      await transaction.lockStep({
+        ...authorityScope(this.capabilityValue),
+        operation_id: request.operation_id,
+        step_id: request.step_id,
+        resource_kind: request.resource_kind,
+        direction: request.direction
+      });
+      const exact = await transaction.getReceiptForLookup({
+        ...authorityScope(this.capabilityValue),
+        operation_id: request.operation_id,
+        step_id: request.step_id,
+        resource_kind: request.resource_kind,
+        direction: request.direction,
+        idempotency_key: request.idempotency_key,
+        target_selector: request.target_selector
+      });
+      if (exact)
+        return exact;
+      const accepted = await transaction.getAcceptedReceiptForStep({
+        ...authorityScope(this.capabilityValue),
+        operation_id: request.operation_id,
+        step_id: request.step_id,
+        resource_kind: request.resource_kind,
+        direction: request.direction
+      });
+      if (accepted) {
+        return accepted.normalized_call_digest === callDigest ? this.duplicateFor(transaction, request, callDigest, accepted) : this.terminalFor(transaction, request, callDigest, "operation_step_semantics_changed", { targetId: accepted.target_id });
+      }
+      const timestamp4 = this.now();
+      const claimed = await transaction.claimBinding(bindingFor(request, callDigest, timestamp4, this.capabilityValue));
+      const terminal = await this.terminalFor(transaction, request, callDigest, `write_failed:${point}`);
+      if (claimed) {
+        await transaction.setBindingTerminal(authorityScope(this.capabilityValue), request.resource_kind, request.target_selector, this.now());
+      }
+      return terminal;
+    });
+  }
+  async readExact(request) {
+    const startedAt = Date.now();
+    assertBounds(request);
+    assertResourceKind(request.resource_kind);
+    if (!UUID_PATTERN.test(request.target_id)) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_EXACT_ID_REQUIRED", "exact readback requires a complete Todos object UUID");
+    }
+    const record = request.resource_kind === "project" ? await this.backend.getProject(request.target_id).then((value) => value ? projectRecord(value) : null) : await this.backend.getTaskList(request.target_id).then((value) => value ? taskListRecord(value) : null);
+    if (!record) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_RECORD_NOT_FOUND", `registered ${request.resource_kind} was not found by exact id`, { target_id: request.target_id });
+    }
+    assertWithinBounds(record, request, startedAt);
+    return record;
+  }
+  async lookupReceipt(request) {
+    const startedAt = Date.now();
+    assertBounds(request);
+    assertResourceKind(request.resource_kind);
+    assertDirection(request.direction);
+    if (request.max_items !== 1) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_BOUNDS", "max_items must be exactly 1 for terminal receipt lookup");
+    }
+    if (request.authority !== "todos" || request.authority_route !== this.capabilityValue.route || request.package_version !== this.capabilityValue.package_version || request.authority_id !== this.capabilityValue.authority_id || request.tenant_id !== this.capabilityValue.tenant_id || request.corpus_id !== this.capabilityValue.corpus_id) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CAPABILITY_MISMATCH", "receipt lookup does not match this authority capability identity");
+    }
+    requireString(request.operation_id, "operation_id", {
+      min: 8,
+      max: 128,
+      pattern: OPERATION_PATTERN
+    });
+    requireString(request.step_id, "step_id", {
+      min: 3,
+      max: 128,
+      pattern: STEP_PATTERN
+    });
+    requireString(request.target_selector, "target_selector", { max: 512 });
+    requireString(request.idempotency_key, "idempotency_key", {
+      min: 52,
+      max: 52,
+      pattern: IDEMPOTENCY_PATTERN
+    });
+    if (request.target_id !== undefined && !UUID_PATTERN.test(request.target_id)) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_EXACT_ID_REQUIRED", "receipt lookup target_id must be a complete Todos object UUID");
+    }
+    const receipt = await this.backend.getReceiptForLookup({
+      ...authorityScope(this.capabilityValue),
+      operation_id: request.operation_id,
+      step_id: request.step_id,
+      resource_kind: request.resource_kind,
+      direction: request.direction,
+      idempotency_key: request.idempotency_key,
+      target_selector: request.target_selector
+    });
+    if (!receipt || request.target_id && receipt.target_id !== request.target_id) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_RECEIPT_NOT_FOUND", "no exact terminal receipt matched the bounded lookup");
+    }
+    return withResponseControl({ receipt: publicReceipt(receipt) }, request, startedAt);
+  }
+  async storedAcceptedReceipt(request, supplied) {
+    const stored = await this.backend.getReceiptById(supplied.receipt_id);
+    if (!stored || stored.outcome !== "accepted" || !stored.created_by_operation || canonicalProjectRegistrationJson(publicReceipt(stored)) !== canonicalProjectRegistrationJson(supplied)) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_ACCEPTED_RECEIPT_NOT_FOUND", "accepted receipt is not an exact immutable receipt owned by this authority", { receipt_id: supplied.receipt_id });
+    }
+    if (stored.operation_id !== request.operation_id || stored.step_id !== request.step_id || stored.resource_kind !== request.resource_kind || stored.target_id !== supplied.target_id) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_ACCEPTED_RECEIPT_NOT_FOUND", "accepted receipt does not own this exact operation step and target");
+    }
+    return stored;
+  }
+  async compensate(request) {
+    const startedAt = Date.now();
+    const suppliedAccepted = assertInverseRequest(request, this.capabilityValue);
+    const accepted = await this.storedAcceptedReceipt(request, suppliedAccepted);
+    const callDigest = normalizedCallDigest(request);
+    try {
+      const row = await this.backend.transaction(async (transaction) => {
+        await transaction.lockStep({
+          ...authorityScope(this.capabilityValue),
+          operation_id: request.operation_id,
+          step_id: request.step_id,
+          resource_kind: request.resource_kind,
+          direction: request.direction
+        });
+        const exact = await transaction.getReceiptForLookup({
+          ...authorityScope(this.capabilityValue),
+          operation_id: request.operation_id,
+          step_id: request.step_id,
+          resource_kind: request.resource_kind,
+          direction: "inverse",
+          idempotency_key: request.idempotency_key,
+          target_selector: request.target_selector
+        });
+        if (exact)
+          return exact;
+        const storedAccepted = await transaction.getReceiptById(accepted.receipt_id);
+        if (!storedAccepted || storedAccepted.outcome !== "accepted" || !storedAccepted.created_by_operation) {
+          throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_ACCEPTED_RECEIPT_NOT_FOUND", "accepted receipt disappeared before conditional inverse");
+        }
+        const binding = await transaction.getBinding(authorityScope(this.capabilityValue), accepted.resource_kind, accepted.target_selector);
+        if (!binding || binding.state !== "accepted" || binding.accepted_receipt_id !== accepted.receipt_id || binding.target_id !== accepted.target_id) {
+          return this.terminalFor(transaction, request, callDigest, "target_not_owned_by_receipt", {
+            targetId: accepted.target_id,
+            acceptedReceiptId: accepted.receipt_id
+          });
+        }
+        await transaction.lockCompensationWrites();
+        const object = request.resource_kind === "project" ? await transaction.getProject(accepted.target_id) : await transaction.getTaskList(accepted.target_id);
+        if (!object) {
+          return this.terminalFor(transaction, request, callDigest, "target_missing_before_inverse", {
+            targetId: accepted.target_id,
+            acceptedReceiptId: accepted.receipt_id
+          });
+        }
+        const current = request.resource_kind === "project" ? projectRecord(object) : taskListRecord(object);
+        if (current.revision !== accepted.result_revision || current.digest !== accepted.result_digest) {
+          return this.terminalFor(transaction, request, callDigest, "target_drifted", {
+            targetId: accepted.target_id,
+            acceptedReceiptId: accepted.receipt_id
+          });
+        }
+        if (await transaction.hasDependents(request.resource_kind, accepted.target_id)) {
+          return this.terminalFor(transaction, request, callDigest, "target_has_dependents", {
+            targetId: accepted.target_id,
+            acceptedReceiptId: accepted.receipt_id
+          });
+        }
+        await this.fault("before_object_write", request);
+        const deleted = request.resource_kind === "project" ? await transaction.deleteProject(accepted.target_id) : await transaction.deleteTaskList(accepted.target_id);
+        if (!deleted) {
+          throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CONFLICT", "conditional inverse could not delete the exact accepted target");
+        }
+        await this.fault("after_object_write", request);
+        const inverseRecord = {
+          target_id: accepted.target_id,
+          revision: "absent",
+          digest: digestProjectRegistrationValue({
+            target_id: accepted.target_id,
+            accepted_receipt_id: accepted.receipt_id,
+            absent: true
+          })
+        };
+        const inverse = makeAcceptedReceipt(request, callDigest, this.capabilityValue, inverseRecord, this.now());
+        await this.fault("before_receipt_write", request);
+        const stored = await insertDeterministicReceipt(transaction, inverse);
+        await this.fault("after_receipt_write", request);
+        await transaction.setBindingRemoved(authorityScope(this.capabilityValue), accepted.resource_kind, accepted.target_selector, stored.receipt_id, this.now());
+        return stored;
+      });
+      await this.afterCommit(request);
+      const receipt = publicReceipt(row);
+      assertWithinBounds(receipt, request, startedAt);
+      return receipt;
+    } catch (error) {
+      if (!(error instanceof WriteBoundaryError))
+        throw error;
+      const terminal = await this.backend.transaction(async (transaction) => {
+        await transaction.lockStep({
+          ...authorityScope(this.capabilityValue),
+          operation_id: request.operation_id,
+          step_id: request.step_id,
+          resource_kind: request.resource_kind,
+          direction: request.direction
+        });
+        return this.terminalFor(transaction, request, callDigest, `write_failed:${error.point}`, {
+          targetId: accepted.target_id,
+          acceptedReceiptId: accepted.receipt_id
+        });
+      });
+      const receipt = publicReceipt(terminal);
+      assertWithinBounds(receipt, request, startedAt);
+      return receipt;
+    }
+  }
+  async verifyInverse(request) {
+    const startedAt = Date.now();
+    const accepted = assertInverseRequest(request, this.capabilityValue);
+    await this.storedAcceptedReceipt(request, accepted);
+    const receipt = await this.backend.getReceiptForLookup({
+      ...authorityScope(this.capabilityValue),
+      operation_id: request.operation_id,
+      step_id: request.step_id,
+      resource_kind: request.resource_kind,
+      direction: "inverse",
+      idempotency_key: request.idempotency_key,
+      target_selector: request.target_selector
+    });
+    if (!receipt || receipt.outcome !== "accepted" || receipt.accepted_receipt_id !== accepted.receipt_id || receipt.result_revision !== "absent" || !receipt.result_digest) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_RECEIPT_NOT_FOUND", "accepted conditional inverse receipt was not found");
+    }
+    const object = request.resource_kind === "project" ? await this.backend.getProject(accepted.target_id) : await this.backend.getTaskList(accepted.target_id);
+    if (object) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CONFLICT", "inverse verification found the accepted target still present");
+    }
+    const verification = {
+      target_id: accepted.target_id,
+      accepted_receipt_id: accepted.receipt_id,
+      absent: true,
+      digest: digestProjectRegistrationValue({
+        target_id: accepted.target_id,
+        accepted_receipt_id: accepted.receipt_id,
+        absent: true
+      })
+    };
+    assertWithinBounds(verification, request, startedAt);
+    if (verification.digest !== receipt.result_digest) {
+      throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CONFLICT", "inverse verification digest does not match the immutable receipt");
+    }
+    return verification;
+  }
+}
+function createPostgresTodosProjectRegistrationAuthority(client, options = {}) {
+  const {
+    service,
+    tableName,
+    cursorTableName,
+    ...authorityOptions
+  } = options;
+  return new PackageOwnedTodosProjectRegistrationAuthority(new PostgresTodosProjectRegistrationBackend(client, {
+    service,
+    tableName,
+    cursorTableName
+  }), authorityOptions);
+}
+var UUID_PATTERN, WORKSPACE_ID_PATTERN, OPERATION_PATTERN, STEP_PATTERN, SHA256_PATTERN, IDEMPOTENCY_PATTERN, WriteBoundaryError;
+var init_authority = __esm(() => {
+  init_package_version();
+  init_postgres2();
+  init_sqlite();
+  init_types4();
+  UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+  WORKSPACE_ID_PATTERN = /^wks_[A-Za-z0-9][A-Za-z0-9_-]{11,}$/;
+  OPERATION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/;
+  STEP_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{2,127}$/;
+  SHA256_PATTERN = /^[0-9a-f]{64}$/;
+  IDEMPOTENCY_PATTERN = /^prk_[0-9a-f]{48}$/;
+  WriteBoundaryError = class WriteBoundaryError extends Error {
+    point;
+    cause;
+    constructor(point, cause) {
+      super(`Todos project registration failed at ${point}`);
+      this.point = point;
+      this.cause = cause;
+    }
+  };
+});
+
+// src/project-registration/http.ts
+function json(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+}
+function errorStatus(error) {
+  switch (error.code) {
+    case "TODOS_PROJECT_REGISTRATION_INVALID_INPUT":
+    case "TODOS_PROJECT_REGISTRATION_INVALID_BOUNDS":
+    case "TODOS_PROJECT_REGISTRATION_CAPABILITY_MISMATCH":
+    case "TODOS_PROJECT_REGISTRATION_DIGEST_MISMATCH":
+    case "TODOS_PROJECT_REGISTRATION_IDEMPOTENCY_MISMATCH":
+    case "TODOS_PROJECT_REGISTRATION_EXACT_ID_REQUIRED":
+      return 400;
+    case "TODOS_PROJECT_REGISTRATION_RECEIPT_NOT_FOUND":
+    case "TODOS_PROJECT_REGISTRATION_RECORD_NOT_FOUND":
+    case "TODOS_PROJECT_REGISTRATION_ACCEPTED_RECEIPT_NOT_FOUND":
+      return 404;
+    case "TODOS_PROJECT_REGISTRATION_RESPONSE_TOO_LARGE":
+      return 413;
+    case "TODOS_PROJECT_REGISTRATION_TIME_BUDGET_EXCEEDED":
+      return 408;
+    case "TODOS_PROJECT_REGISTRATION_ATOMICITY_UNAVAILABLE":
+      return 503;
+    default:
+      return 409;
+  }
+}
+async function readJson(req) {
+  try {
+    const value = await req.json();
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+async function handleTodosProjectRegistrationHttpRequest(req, url, authority, basePath = "/v1/project-registration") {
+  const path = url.pathname;
+  if (path !== basePath && !path.startsWith(`${basePath}/`))
+    return null;
+  const action = path.slice(basePath.length).split("/").filter(Boolean).join("/");
+  const method = req.method.toUpperCase();
+  try {
+    if ((action === "" || action === "capability") && method === "GET") {
+      return json({ capability: await authority.capability() });
+    }
+    if (method !== "POST")
+      return json({ error: "method not allowed" }, 405);
+    const body = await readJson(req);
+    if (!body) {
+      return json({
+        error: "invalid JSON body",
+        code: "TODOS_PROJECT_REGISTRATION_INVALID_INPUT"
+      }, 400);
+    }
+    if (action === "create") {
+      return json({
+        receipt: await authority.create(body)
+      }, 201);
+    }
+    if (action === "receipts/lookup") {
+      return json(await authority.lookupReceipt(body));
+    }
+    if (action === "read-exact") {
+      return json({
+        record: await authority.readExact(body)
+      });
+    }
+    if (action === "compensate") {
+      return json({
+        receipt: await authority.compensate(body)
+      }, 201);
+    }
+    if (action === "verify-inverse") {
+      return json({
+        verification: await authority.verifyInverse(body)
+      });
+    }
+    return json({
+      error: "unknown Todos project-registration route",
+      code: "TODOS_PROJECT_REGISTRATION_RECEIPT_NOT_FOUND"
+    }, 404);
+  } catch (cause) {
+    if (cause instanceof TodosProjectRegistrationError) {
+      return json({
+        error: cause.message,
+        code: cause.code,
+        details: cause.details,
+        authoritative: true
+      }, errorStatus(cause));
+    }
+    return json({
+      error: cause instanceof Error ? cause.message : "internal registration error",
+      code: "TODOS_PROJECT_REGISTRATION_ATOMICITY_UNAVAILABLE"
+    }, 500);
+  }
+}
+var JSON_HEADERS;
+var init_http2 = __esm(() => {
+  init_types4();
+  JSON_HEADERS = { "Content-Type": "application/json" };
+});
+
+// src/project-registration/index.ts
+var init_project_registration = __esm(() => {
+  init_authority();
+  init_http2();
+  init_postgres2();
+  init_sqlite();
+  init_types4();
+});
+
 // src/storage/comment-redaction-backfill.ts
 function assertSafeIdentifier2(value) {
   if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
@@ -47831,6 +49512,7 @@ __export(exports_cloud, {
   isCloudModeEnabled: () => isCloudModeEnabled,
   getCloudVerifier: () => getCloudVerifier,
   getCloudStorageAdapter: () => getCloudStorageAdapter,
+  getCloudProjectRegistrationAuthority: () => getCloudProjectRegistrationAuthority,
   getCloudPrGroupLedger: () => getCloudPrGroupLedger,
   getApiKeyStore: () => getApiKeyStore,
   ensureCloudTaskShortIdIndex: () => ensureCloudTaskShortIdIndex,
@@ -47879,6 +49561,17 @@ function getCloudPrGroupLedger() {
   cachedPrGroupLedger = new PrGroupLedger(new PostgresPrGroupLedgerPersistence(getClient()));
   return cachedPrGroupLedger;
 }
+function getCloudProjectRegistrationAuthority() {
+  if (cachedProjectRegistrationAuthority)
+    return cachedProjectRegistrationAuthority;
+  cachedProjectRegistrationAuthority = createPostgresTodosProjectRegistrationAuthority(getClient(), {
+    service: TODOS_APP_SLUG,
+    authorityId: TODOS_APP_SLUG,
+    tenantId: process.env.HASNA_TODOS_TENANT_ID ?? "default",
+    corpusId: process.env.HASNA_TODOS_CORPUS_ID ?? `${TODOS_APP_SLUG}:postgresql`
+  });
+  return cachedProjectRegistrationAuthority;
+}
 function authClient() {
   const client = getClient();
   return {
@@ -47927,6 +49620,9 @@ async function ensureCloudSchema() {
     for (const sql of postgresPrGroupSchemaSql()) {
       await client.query(sql);
     }
+    for (const sql of postgresTodosProjectRegistrationSchemaSql()) {
+      await client.query(sql);
+    }
     await getApiKeyStore().ensureSchema();
   })();
   return schemaEnsured;
@@ -47967,14 +49663,16 @@ async function closeCloud() {
   cachedStore = null;
   cachedVerifier = null;
   cachedPrGroupLedger = null;
+  cachedProjectRegistrationAuthority = null;
   schemaEnsured = null;
 }
-var TODOS_APP_SLUG = "todos", cachedClient = null, cachedAdapter = null, cachedStore = null, cachedVerifier = null, cachedPrGroupLedger = null, schemaEnsured = null;
+var TODOS_APP_SLUG = "todos", cachedClient = null, cachedAdapter = null, cachedStore = null, cachedVerifier = null, cachedPrGroupLedger = null, cachedProjectRegistrationAuthority = null, schemaEnsured = null;
 var init_cloud = __esm(() => {
   init_cloud_client();
   init_postgres_adapter();
   init_ledger();
   init_postgres();
+  init_project_registration();
   init_postgres_sync();
   init_comment_redaction_backfill();
 });
@@ -48333,9 +50031,9 @@ function parseBoundedLimit(value, fallback, max) {
     return fallback;
   return Math.min(parsed, max);
 }
-function mapTaskError(e, json2) {
+function mapTaskError(e, json3) {
   if (e instanceof VersionConflictError) {
-    return json2({
+    return json3({
       error: e.message,
       code: VersionConflictError.code,
       expected_version: e.expectedVersion,
@@ -48343,23 +50041,23 @@ function mapTaskError(e, json2) {
     }, 409);
   }
   if (e instanceof TaskNotFoundError) {
-    return json2({ error: e.message, code: TaskNotFoundError.code }, 404);
+    return json3({ error: e.message, code: TaskNotFoundError.code }, 404);
   }
   if (e instanceof LockError) {
-    return json2({ error: e.message, code: LockError.code }, 409);
+    return json3({ error: e.message, code: LockError.code }, 409);
   }
   if (e instanceof CompletionGuardError) {
-    return json2({
+    return json3({
       error: e.message,
       code: CompletionGuardError.code,
       retry_after: e.retryAfterSeconds ?? null
     }, 409);
   }
   if (e instanceof TaskNotStartableError) {
-    return json2({ error: e.message, code: TaskNotStartableError.code }, 409);
+    return json3({ error: e.message, code: TaskNotStartableError.code }, 409);
   }
   if (e instanceof Error && / is blocked by /.test(e.message)) {
-    return json2({ error: e.message, code: "TASK_NOT_STARTABLE" }, 409);
+    return json3({ error: e.message, code: "TASK_NOT_STARTABLE" }, 409);
   }
   return null;
 }
@@ -48444,11 +50142,11 @@ data: ${JSON.stringify({ type: "connected", agent_id: agentId, timestamp: new Da
     }
   });
 }
-function handleHealth(_ctx, json2) {
+function handleHealth(_ctx, json3) {
   const stats2 = getTaskStats();
   const staleCount = getStaleTasks(30).length;
   const overdueRecurring = getOverdueTasks().filter((t) => t.recurrence_rule && t.status === "pending").length;
-  return json2({
+  return json3({
     status: staleCount === 0 && overdueRecurring === 0 ? "ok" : "warn",
     tasks: stats2.total,
     stale: staleCount,
@@ -48456,18 +50154,18 @@ function handleHealth(_ctx, json2) {
     timestamp: new Date().toISOString()
   });
 }
-function handleHeadlessBoundary(_ctx, json2) {
+function handleHeadlessBoundary(_ctx, json3) {
   const { getHeadlessBoundaryManifest: getHeadlessBoundaryManifest2 } = (init_headless_boundaries(), __toCommonJS(exports_headless_boundaries));
-  return json2(getHeadlessBoundaryManifest2());
+  return json3(getHeadlessBoundaryManifest2());
 }
-function handleStats(_ctx, json2) {
+function handleStats(_ctx, json3) {
   const stats2 = getTaskStats();
   const byStatus = stats2.by_status;
   const projects = listProjects();
   const agents = listAgents();
   const staleCount = getStaleTasks(30).length;
   const overdueRecurring = getOverdueTasks().filter((t) => t.recurrence_rule && t.status === "pending").length;
-  return json2({
+  return json3({
     total_tasks: stats2.total,
     pending: byStatus["pending"] ?? 0,
     in_progress: byStatus["in_progress"] ?? 0,
@@ -48490,10 +50188,10 @@ function taskStatusQueryParam(url) {
     return { ok: false, message: result.message };
   return { ok: true, value: collapseEnumValues(result.values) };
 }
-async function handleListTasks(_req, url, _ctx, json2, taskToSummary2) {
+async function handleListTasks(_req, url, _ctx, json3, taskToSummary2) {
   const statusParam = taskStatusQueryParam(url);
   if (!statusParam.ok)
-    return json2({ error: statusParam.message }, 400);
+    return json3({ error: statusParam.message }, 400);
   const projectId = url.searchParams.get("project_id") || undefined;
   const sessionId = url.searchParams.get("session_id") || undefined;
   const agentId = url.searchParams.get("agent_id") || undefined;
@@ -48508,13 +50206,13 @@ async function handleListTasks(_req, url, _ctx, json2, taskToSummary2) {
     limit: limitParam ? parseInt(limitParam, 10) : undefined,
     offset: offsetParam ? parseInt(offsetParam, 10) : undefined
   });
-  return json2(tasks.map((t) => taskToSummary2(t, fields)));
+  return json3(tasks.map((t) => taskToSummary2(t, fields)));
 }
-async function handleCreateTask(req, ctx, json2, taskToSummary2) {
+async function handleCreateTask(req, ctx, json3, taskToSummary2) {
   try {
     const body = await req.json();
     if (!body.title)
-      return json2({ error: "Missing 'title'" }, 400);
+      return json3({ error: "Missing 'title'" }, 400);
     const createdBy = body.created_by ?? body.agent_id ?? "dashboard";
     const task2 = createTask({
       title: body.title,
@@ -48526,19 +50224,19 @@ async function handleCreateTask(req, ctx, json2, taskToSummary2) {
       ...body.assigned_to ? { assigned_to: body.assigned_to } : {}
     });
     ctx.broadcastEvent({ type: "task", task_id: task2.id, action: "created", agent_id: task2.agent_id, project_id: task2.project_id });
-    return json2(taskToSummary2(task2), 201);
+    return json3(taskToSummary2(task2), 201);
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed to create task" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed to create task" }, 500);
   }
 }
-async function handleUpsertTask(req, ctx, json2, taskToSummary2) {
+async function handleUpsertTask(req, ctx, json3, taskToSummary2) {
   try {
     const body = await req.json();
     if (typeof body["fingerprint"] !== "string" || body["fingerprint"].trim() === "") {
-      return json2({ error: "Missing 'fingerprint'" }, 400);
+      return json3({ error: "Missing 'fingerprint'" }, 400);
     }
     if (typeof body["title"] !== "string" || body["title"].trim() === "") {
-      return json2({ error: "Missing 'title'" }, 400);
+      return json3({ error: "Missing 'title'" }, 400);
     }
     const metadata = body["metadata"] && typeof body["metadata"] === "object" && !Array.isArray(body["metadata"]) ? { ...body["metadata"] } : {};
     for (const key of ["expectation_id", "expectation_fingerprint", "evidence_paths", "origin_loop_id", "origin_run_id", "expected", "observed", "acceptance"]) {
@@ -48559,9 +50257,9 @@ async function handleUpsertTask(req, ctx, json2, taskToSummary2) {
       metadata
     });
     ctx.broadcastEvent({ type: "task", task_id: result.task.id, action: result.created ? "created" : "updated", agent_id: result.task.agent_id, project_id: result.task.project_id });
-    return json2({ created: result.created, task: taskToSummary2(result.task) }, result.created ? 201 : 200);
+    return json3({ created: result.created, task: taskToSummary2(result.task) }, result.created ? 201 : 200);
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed to upsert task" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed to upsert task" }, 500);
   }
 }
 function handleTasksExport(_req, url, _ctx, _json, taskToSummary2) {
@@ -48613,11 +50311,11 @@ function handleTasksExport(_req, url, _ctx, _json, taskToSummary2) {
     }
   });
 }
-async function handleTasksBulk(req, _ctx, json2) {
+async function handleTasksBulk(req, _ctx, json3) {
   try {
     const body = await req.json();
     if (!body.ids?.length || !body.action)
-      return json2({ error: "Missing ids or action" }, 400);
+      return json3({ error: "Missing ids or action" }, 400);
     const results = [];
     for (const id of body.ids) {
       try {
@@ -48635,66 +50333,66 @@ async function handleTasksBulk(req, _ctx, json2) {
         results.push({ id, success: false, error: e instanceof Error ? e.message : "Failed" });
       }
     }
-    return json2({ results, succeeded: results.filter((r) => r.success).length, failed: results.filter((r) => !r.success).length });
+    return json3({ results, succeeded: results.filter((r) => r.success).length, failed: results.filter((r) => !r.success).length });
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleTasksStatus(_req, url, _ctx, json2) {
+function handleTasksStatus(_req, url, _ctx, json3) {
   try {
     const projectId = url.searchParams.get("project_id") || undefined;
     const agentId = url.searchParams.get("agent_id") || undefined;
     const status = getStatus(projectId ? { project_id: projectId } : undefined, agentId);
-    return json2(status);
+    return json3(status);
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleTasksNext(_req, url, _ctx, json2, taskToSummary2) {
+function handleTasksNext(_req, url, _ctx, json3, taskToSummary2) {
   try {
     const projectId = url.searchParams.get("project_id") || undefined;
     const agentId = url.searchParams.get("agent_id") || undefined;
     const fields = parseFieldsParam(url);
     const task2 = getNextTask(agentId, projectId ? { project_id: projectId } : undefined);
-    return json2({ task: task2 ? taskToSummary2(task2, fields) : null });
+    return json3({ task: task2 ? taskToSummary2(task2, fields) : null });
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleTasksActive(_req, url, _ctx, json2) {
+function handleTasksActive(_req, url, _ctx, json3) {
   try {
     const projectId = url.searchParams.get("project_id") || undefined;
     const work = getActiveWork(projectId ? { project_id: projectId } : undefined);
-    return json2({ active: work, count: work.length });
+    return json3({ active: work, count: work.length });
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleTasksStale(_req, url, _ctx, json2, taskToSummary2) {
+function handleTasksStale(_req, url, _ctx, json3, taskToSummary2) {
   try {
     const projectId = url.searchParams.get("project_id") || undefined;
     const minutes2 = parseInt(url.searchParams.get("minutes") || "30", 10);
     const fields = parseFieldsParam(url);
     const tasks = getStaleTasks(minutes2, projectId ? { project_id: projectId } : undefined);
-    return json2({ tasks: tasks.map((t) => taskToSummary2(t, fields)), count: tasks.length });
+    return json3({ tasks: tasks.map((t) => taskToSummary2(t, fields)), count: tasks.length });
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleTasksChanged(_req, url, _ctx, json2, taskToSummary2) {
+function handleTasksChanged(_req, url, _ctx, json3, taskToSummary2) {
   try {
     const since = url.searchParams.get("since");
     if (!since)
-      return json2({ error: "since parameter required (ISO date string)" }, 400);
+      return json3({ error: "since parameter required (ISO date string)" }, 400);
     const projectId = url.searchParams.get("project_id") || undefined;
     const fields = parseFieldsParam(url);
     const tasks = getTasksChangedSince(since, projectId ? { project_id: projectId } : undefined);
-    return json2({ tasks: tasks.map((t) => taskToSummary2(t, fields)), count: tasks.length, since });
+    return json3({ tasks: tasks.map((t) => taskToSummary2(t, fields)), count: tasks.length, since });
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleTasksContext(_req, url, _ctx, json2, taskToSummary2) {
+function handleTasksContext(_req, url, _ctx, json3, taskToSummary2) {
   const agentId = url.searchParams.get("agent_id") || undefined;
   const projectId = url.searchParams.get("project_id") || undefined;
   const format = url.searchParams.get("format") || "text";
@@ -48703,7 +50401,7 @@ function handleTasksContext(_req, url, _ctx, json2, taskToSummary2) {
   const status = getStatus(filters, agentId);
   const next = getNextTask(agentId, filters);
   if (format === "json") {
-    return json2({ status, next_task: next ? taskToSummary2(next, fields) : null });
+    return json3({ status, next_task: next ? taskToSummary2(next, fields) : null });
   }
   const lines = [];
   lines.push(`Tasks: ${status.pending} pending | ${status.in_progress} active | ${status.completed} done`);
@@ -48720,18 +50418,18 @@ function handleTasksContext(_req, url, _ctx, json2, taskToSummary2) {
 `);
   return new Response(text2, { headers: { "Content-Type": "text/plain" } });
 }
-function handleTaskAttachments(id, _ctx, json2) {
+function handleTaskAttachments(id, _ctx, json3) {
   const task2 = getTask(id);
   if (!task2)
-    return json2({ error: "Task not found" }, 404);
+    return json3({ error: "Task not found" }, 404);
   const evidence = task2.metadata?._evidence || {};
   const attachmentIds = evidence.attachments || [];
-  return json2({ task_id: id, short_id: task2.short_id, attachment_ids: attachmentIds, count: attachmentIds.length, files_changed: evidence.files_changed, commit_hash: evidence.commit_hash, notes: evidence.notes });
+  return json3({ task_id: id, short_id: task2.short_id, attachment_ids: attachmentIds, count: attachmentIds.length, files_changed: evidence.files_changed, commit_hash: evidence.commit_hash, notes: evidence.notes });
 }
-async function handleTaskProgress(id, req, method, _ctx, json2, url) {
+async function handleTaskProgress(id, req, method, _ctx, json3, url) {
   const task2 = getTask(id);
   if (!task2)
-    return json2({ error: "Task not found" }, 404);
+    return json3({ error: "Task not found" }, 404);
   if (method === "GET") {
     const all = listComments(id);
     const progress = all.filter((c) => c.type === "progress");
@@ -48739,7 +50437,7 @@ async function handleTaskProgress(id, req, method, _ctx, json2, url) {
     const format = url?.searchParams.get("format") || "compact";
     const limit = parseBoundedLimit(url?.searchParams.get("limit") || null, 20, 200);
     const progressEntries = format === "full" ? progress : progress.slice(-limit);
-    return json2({
+    return json3({
       task_id: id,
       progress_entries: progressEntries,
       latest,
@@ -48756,27 +50454,27 @@ async function handleTaskProgress(id, req, method, _ctx, json2, url) {
     try {
       const body = await req.json();
       if (!body.message)
-        return json2({ error: "message required" }, 400);
+        return json3({ error: "message required" }, 400);
       const comment = logProgress(id, body.message, body.pct_complete, body.agent_id);
-      return json2(comment, 201);
+      return json3(comment, 201);
     } catch (e) {
-      return json2({ error: e instanceof Error ? e.message : "Failed to log progress" }, 500);
+      return json3({ error: e instanceof Error ? e.message : "Failed to log progress" }, 500);
     }
   }
   return null;
 }
-function handleGetTask(id, _ctx, json2, taskToSummary2, url) {
+function handleGetTask(id, _ctx, json3, taskToSummary2, url) {
   const task2 = getTask(id);
   if (!task2)
-    return json2({ error: "Task not found" }, 404);
-  return json2(taskToSummary2(task2, url ? parseFieldsParam(url) : undefined));
+    return json3({ error: "Task not found" }, 404);
+  return json3(taskToSummary2(task2, url ? parseFieldsParam(url) : undefined));
 }
-async function handlePatchTask(id, req, _ctx, json2, taskToSummary2) {
+async function handlePatchTask(id, req, _ctx, json3, taskToSummary2) {
   try {
     const body = await req.json();
     const task2 = getTask(id);
     if (!task2)
-      return json2({ error: "Task not found" }, 404);
+      return json3({ error: "Task not found" }, 404);
     const ALLOWED = new Set(["title", "description", "status", "priority", "assigned_to", "plan_id", "task_list_id", "tags", "metadata", "due_at", "estimated_minutes", "actual_minutes", "confidence", "retry_count", "max_retries", "retry_after", "task_type"]);
     const safeBody = {};
     for (const [key, value] of Object.entries(body)) {
@@ -48788,85 +50486,85 @@ async function handlePatchTask(id, req, _ctx, json2, taskToSummary2) {
       ...safeBody,
       version: clientVersion
     });
-    return json2(taskToSummary2(updated));
+    return json3(taskToSummary2(updated));
   } catch (e) {
-    const mapped = mapTaskError(e, json2);
+    const mapped = mapTaskError(e, json3);
     if (mapped)
       return mapped;
-    return json2({ error: e instanceof Error ? e.message : "Failed to update task" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed to update task" }, 500);
   }
 }
-function handleDeleteTask(id, _ctx, json2) {
+function handleDeleteTask(id, _ctx, json3) {
   const deleted = deleteTask(id);
   if (!deleted)
-    return json2({ error: "Task not found" }, 404);
-  return json2({ success: true });
+    return json3({ error: "Task not found" }, 404);
+  return json3({ success: true });
 }
-function handleStartTask(id, ctx, json2, taskToSummary2) {
+function handleStartTask(id, ctx, json3, taskToSummary2) {
   try {
     const task2 = startTask(id, "dashboard");
     ctx.broadcastEvent({ type: "task", task_id: task2.id, action: "started", agent_id: "dashboard", project_id: task2.project_id });
-    return json2(taskToSummary2(task2));
+    return json3(taskToSummary2(task2));
   } catch (e) {
-    const mapped = mapTaskError(e, json2);
+    const mapped = mapTaskError(e, json3);
     if (mapped)
       return mapped;
-    return json2({ error: e instanceof Error ? e.message : "Failed to start task" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed to start task" }, 500);
   }
 }
-async function handleFailTask(id, req, ctx, json2, taskToSummary2) {
+async function handleFailTask(id, req, ctx, json3, taskToSummary2) {
   try {
     const body = await req.json().catch(() => ({}));
     const result = failTask(id, body.agent_id, body.reason, { retry: body.retry, error_code: body.error_code });
     ctx.broadcastEvent({ type: "task", task_id: id, action: "failed", agent_id: body.agent_id || null, project_id: result.task.project_id });
-    return json2({ task: taskToSummary2(result.task), retry_task: result.retryTask ? taskToSummary2(result.retryTask) : null });
+    return json3({ task: taskToSummary2(result.task), retry_task: result.retryTask ? taskToSummary2(result.retryTask) : null });
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed to fail task" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed to fail task" }, 500);
   }
 }
-function handleCompleteTask(id, ctx, json2, taskToSummary2) {
+function handleCompleteTask(id, ctx, json3, taskToSummary2) {
   try {
     const task2 = completeTask(id, "dashboard");
     ctx.broadcastEvent({ type: "task", task_id: task2.id, action: "completed", agent_id: "dashboard", project_id: task2.project_id });
-    return json2(taskToSummary2(task2));
+    return json3(taskToSummary2(task2));
   } catch (e) {
-    const mapped = mapTaskError(e, json2);
+    const mapped = mapTaskError(e, json3);
     if (mapped)
       return mapped;
-    return json2({ error: e instanceof Error ? e.message : "Failed to complete task" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed to complete task" }, 500);
   }
 }
-function handleListProjects(url, _ctx, json2) {
+function handleListProjects(url, _ctx, json3) {
   const pFieldsParam = url.searchParams.get("fields");
   const pFields = pFieldsParam ? pFieldsParam.split(",").map((f) => f.trim()).filter(Boolean) : undefined;
   const projects = listProjects();
-  return json2(pFields ? projects.map((p) => Object.fromEntries(pFields.map((f) => [f, p[f] ?? null]))) : projects);
+  return json3(pFields ? projects.map((p) => Object.fromEntries(pFields.map((f) => [f, p[f] ?? null]))) : projects);
 }
-async function handleCreateProject(req, _ctx, json2) {
+async function handleCreateProject(req, _ctx, json3) {
   try {
     const body = await req.json();
     if (!body.name || !body.path)
-      return json2({ error: "Missing name or path" }, 400);
+      return json3({ error: "Missing name or path" }, 400);
     const project = createProject({ name: body.name, path: body.path, description: body.description });
-    return json2(project, 201);
+    return json3(project, 201);
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed to create project" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed to create project" }, 500);
   }
 }
-function handleDeleteProject(id, _ctx, json2) {
+function handleDeleteProject(id, _ctx, json3) {
   const deleted = deleteProject(id);
   if (!deleted)
-    return json2({ error: "Project not found" }, 404);
-  return json2({ success: true });
+    return json3({ error: "Project not found" }, 404);
+  return json3({ success: true });
 }
-async function handleAgentMe(_req, url, _ctx, json2, taskToSummary2) {
+async function handleAgentMe(_req, url, _ctx, json3, taskToSummary2) {
   try {
     const name = url.searchParams.get("name");
     if (!name)
-      return json2({ error: "Missing name param" }, 400);
+      return json3({ error: "Missing name param" }, 400);
     const agentResult = registerAgent({ name });
     if (isAgentConflict(agentResult))
-      return json2({ error: agentResult.message, conflict: true }, 409);
+      return json3({ error: agentResult.message, conflict: true }, 409);
     const agent = agentResult;
     const tasks = listTasks({ assigned_to: agent.name });
     const agentIdTasks = listTasks({ agent_id: agent.id });
@@ -48874,7 +50572,7 @@ async function handleAgentMe(_req, url, _ctx, json2, taskToSummary2) {
     const pending = allTasks.filter((t) => t.status === "pending");
     const inProgress = allTasks.filter((t) => t.status === "in_progress");
     const completed = allTasks.filter((t) => t.status === "completed");
-    return json2({
+    return json3({
       agent,
       pending_tasks: pending.map((t) => taskToSummary2(t)),
       in_progress_tasks: inProgress.map((t) => taskToSummary2(t)),
@@ -48888,132 +50586,132 @@ async function handleAgentMe(_req, url, _ctx, json2, taskToSummary2) {
     });
   } catch (e) {
     if (e instanceof InvalidAgentNameError)
-      return json2({ error: e.message, suggestions: e.suggestions }, 400);
-    return json2({ error: e instanceof Error ? e.message : "Failed to get agent profile" }, 500);
+      return json3({ error: e.message, suggestions: e.suggestions }, 400);
+    return json3({ error: e instanceof Error ? e.message : "Failed to get agent profile" }, 500);
   }
 }
-function handleAgentQueue(agentId, _ctx, json2, taskToSummary2) {
+function handleAgentQueue(agentId, _ctx, json3, taskToSummary2) {
   const aliasSet = assignedToAliasSet(getDatabase(), agentId);
   const pending = listTasks({ status: "pending" });
   const queue = pending.filter((t) => aliasSet.has((t.assigned_to ?? "").toLowerCase()) || t.agent_id === agentId || !t.assigned_to && !t.locked_by);
   const order = { critical: 0, high: 1, medium: 2, low: 3 };
   queue.sort((a, b) => (order[a.priority] ?? 4) - (order[b.priority] ?? 4) || new Date(a.created_at).getTime() - new Date(b.created_at).getTime());
-  return json2(queue.map((t) => taskToSummary2(t)));
+  return json3(queue.map((t) => taskToSummary2(t)));
 }
-async function handleClaimTask(req, _ctx, json2, taskToSummary2) {
+async function handleClaimTask(req, _ctx, json3, taskToSummary2) {
   try {
     const body = await req.json();
     const agentId = body.agent_id || "anonymous";
     const task2 = claimNextTask(agentId, body.project_id ? { project_id: body.project_id } : undefined);
-    return json2({ task: task2 ? taskToSummary2(task2) : null });
+    return json3({ task: task2 ? taskToSummary2(task2) : null });
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed to claim" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed to claim" }, 500);
   }
 }
-function handleListOrgs(_ctx, json2) {
-  return json2(listOrgs());
+function handleListOrgs(_ctx, json3) {
+  return json3(listOrgs());
 }
-async function handleCreateOrg(req, _ctx, json2) {
+async function handleCreateOrg(req, _ctx, json3) {
   try {
     const body = await req.json();
     if (!body.name)
-      return json2({ error: "Missing name" }, 400);
-    return json2(createOrg(body), 201);
+      return json3({ error: "Missing name" }, 400);
+    return json3(createOrg(body), 201);
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-async function handleUpdateOrg(id, req, _ctx, json2) {
+async function handleUpdateOrg(id, req, _ctx, json3) {
   try {
     const body = await req.json();
-    return json2(updateOrg(id, body));
+    return json3(updateOrg(id, body));
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleDeleteOrg(id, _ctx, json2) {
+function handleDeleteOrg(id, _ctx, json3) {
   const deleted = deleteOrg(id);
-  return json2(deleted ? { success: true } : { error: "Not found" }, deleted ? 200 : 404);
+  return json3(deleted ? { success: true } : { error: "Not found" }, deleted ? 200 : 404);
 }
-function handleOrgChart(_ctx, json2) {
-  return json2(getOrgChart());
+function handleOrgChart(_ctx, json3) {
+  return json3(getOrgChart());
 }
-function handleAgentTeam(agentId, _ctx, json2) {
-  return json2(getDirectReports(decodeURIComponent(agentId)));
+function handleAgentTeam(agentId, _ctx, json3) {
+  return json3(getDirectReports(decodeURIComponent(agentId)));
 }
-function handleListAgents(url, _ctx, json2) {
+function handleListAgents(url, _ctx, json3) {
   const aFieldsParam = url.searchParams.get("fields");
   const aFields = aFieldsParam ? aFieldsParam.split(",").map((f) => f.trim()).filter(Boolean) : undefined;
   const agents = listAgents();
-  return json2(aFields ? agents.map((a) => Object.fromEntries(aFields.map((f) => [f, a[f] ?? null]))) : agents);
+  return json3(aFields ? agents.map((a) => Object.fromEntries(aFields.map((f) => [f, a[f] ?? null]))) : agents);
 }
-async function handleRegisterAgent(req, _ctx, json2) {
+async function handleRegisterAgent(req, _ctx, json3) {
   try {
     const body = await req.json();
     if (!body.name)
-      return json2({ error: "Missing name" }, 400);
+      return json3({ error: "Missing name" }, 400);
     const result = registerAgent({ name: body.name, description: body.description, session_id: body.session_id, working_dir: body.working_dir });
     if (isAgentConflict(result))
-      return json2({ error: result.message, conflict: true }, 409);
-    return json2(result, 201);
+      return json3({ error: result.message, conflict: true }, 409);
+    return json3(result, 201);
   } catch (e) {
     if (e instanceof InvalidAgentNameError)
-      return json2({ error: e.message, suggestions: e.suggestions }, 400);
-    return json2({ error: e instanceof Error ? e.message : "Failed to register agent" }, 500);
+      return json3({ error: e.message, suggestions: e.suggestions }, 400);
+    return json3({ error: e instanceof Error ? e.message : "Failed to register agent" }, 500);
   }
 }
-async function handleUpdateAgent(id, req, _ctx, json2) {
+async function handleUpdateAgent(id, req, _ctx, json3) {
   try {
     const body = await req.json();
     const agent = updateAgent(id, body);
-    return json2(agent);
+    return json3(agent);
   } catch (e) {
     if (e instanceof InvalidAgentNameError)
-      return json2({ error: e.message, suggestions: e.suggestions }, 400);
-    return json2({ error: e instanceof Error ? e.message : "Failed to update agent" }, 500);
+      return json3({ error: e.message, suggestions: e.suggestions }, 400);
+    return json3({ error: e instanceof Error ? e.message : "Failed to update agent" }, 500);
   }
 }
-function handleDeleteAgent(id, _ctx, json2) {
+function handleDeleteAgent(id, _ctx, json3) {
   const deleted = deleteAgent(id);
   if (!deleted)
-    return json2({ error: "Agent not found" }, 404);
-  return json2({ success: true });
+    return json3({ error: "Agent not found" }, 404);
+  return json3({ success: true });
 }
-async function handleBulkDeleteAgents(req, _ctx, json2) {
+async function handleBulkDeleteAgents(req, _ctx, json3) {
   try {
     const body = await req.json();
     if (!body.ids?.length || body.action !== "delete")
-      return json2({ error: "Missing ids or invalid action" }, 400);
+      return json3({ error: "Missing ids or invalid action" }, 400);
     let succeeded = 0;
     for (const id of body.ids) {
       if (deleteAgent(id))
         succeeded++;
     }
-    return json2({ succeeded, failed: body.ids.length - succeeded });
+    return json3({ succeeded, failed: body.ids.length - succeeded });
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-async function handleBulkDeleteProjects(req, _ctx, json2) {
+async function handleBulkDeleteProjects(req, _ctx, json3) {
   try {
     const body = await req.json();
     if (!body.ids?.length || body.action !== "delete")
-      return json2({ error: "Missing ids or invalid action" }, 400);
+      return json3({ error: "Missing ids or invalid action" }, 400);
     let succeeded = 0;
     for (const id of body.ids) {
       if (deleteProject(id))
         succeeded++;
     }
-    return json2({ succeeded, failed: body.ids.length - succeeded });
+    return json3({ succeeded, failed: body.ids.length - succeeded });
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleDoctor(_ctx, json2) {
+function handleDoctor(_ctx, json3) {
   const { runTodosDoctor: runTodosDoctor2 } = (init_doctor(), __toCommonJS(exports_doctor));
-  return json2(runTodosDoctor2({ apply: false }));
+  return json3(runTodosDoctor2({ apply: false }));
 }
-function handleReport(_req, url, _ctx, json2) {
+function handleReport(_req, url, _ctx, json3) {
   const days = parseInt(url.searchParams.get("days") || "7", 10);
   const projectId = url.searchParams.get("project_id") || undefined;
   const since = new Date(Date.now() - days * 24 * 60 * 60 * 1000).toISOString();
@@ -49029,62 +50727,62 @@ function handleReport(_req, url, _ctx, json2) {
     byDay[day] = (byDay[day] || 0) + 1;
   }
   const completionRate = changed.length > 0 ? Math.round(completed.length / changed.length * 100) : 0;
-  return json2({ days, period_since: since, total: all.length, stats: stats2, changed: changed.length, completed: completed.length, failed: failed.length, completion_rate: completionRate, by_day: byDay });
+  return json3({ days, period_since: since, total: all.length, stats: stats2, changed: changed.length, completed: completed.length, failed: failed.length, completion_rate: completionRate, by_day: byDay });
 }
-function handleActivity(_req, url, _ctx, json2) {
+function handleActivity(_req, url, _ctx, json3) {
   const limit = parseInt(url.searchParams.get("limit") || "50", 10);
-  return json2(getRecentActivity(limit));
+  return json3(getRecentActivity(limit));
 }
-function handleTaskHistory(id, _ctx, json2, url) {
+function handleTaskHistory(id, _ctx, json3, url) {
   const history = getTaskHistory(id);
   const format = url?.searchParams.get("format") || "compact";
   const limit = parseBoundedLimit(url?.searchParams.get("limit") || null, 20, 500);
-  return json2(format === "full" ? history : history.slice(0, limit));
+  return json3(format === "full" ? history : history.slice(0, limit));
 }
-function handleListWebhooks(_ctx, json2) {
-  return json2(listWebhooks());
+function handleListWebhooks(_ctx, json3) {
+  return json3(listWebhooks());
 }
-async function handleCreateWebhook(req, _ctx, json2) {
+async function handleCreateWebhook(req, _ctx, json3) {
   try {
     const body = await req.json();
     if (!body.url)
-      return json2({ error: "Missing url" }, 400);
-    return json2(createWebhook(body), 201);
+      return json3({ error: "Missing url" }, 400);
+    return json3(createWebhook(body), 201);
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleDeleteWebhook(id, _ctx, json2) {
+function handleDeleteWebhook(id, _ctx, json3) {
   const deleted = deleteWebhook(id);
-  return json2(deleted ? { success: true } : { error: "Not found" }, deleted ? 200 : 404);
+  return json3(deleted ? { success: true } : { error: "Not found" }, deleted ? 200 : 404);
 }
-function handleListTemplates(_ctx, json2) {
-  return json2(listTemplates());
+function handleListTemplates(_ctx, json3) {
+  return json3(listTemplates());
 }
-async function handleCreateTemplate(req, _ctx, json2) {
+async function handleCreateTemplate(req, _ctx, json3) {
   try {
     const body = await req.json();
     if (!body.name || !body.title_pattern)
-      return json2({ error: "Missing name or title_pattern" }, 400);
-    return json2(createTemplate(body), 201);
+      return json3({ error: "Missing name or title_pattern" }, 400);
+    return json3(createTemplate(body), 201);
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleDeleteTemplate(id, _ctx, json2) {
+function handleDeleteTemplate(id, _ctx, json3) {
   const deleted = deleteTemplate(id);
-  return json2(deleted ? { success: true } : { error: "Not found" }, deleted ? 200 : 404);
+  return json3(deleted ? { success: true } : { error: "Not found" }, deleted ? 200 : 404);
 }
-function handleListPlans(url, _ctx, json2) {
+function handleListPlans(url, _ctx, json3) {
   const projectId = url.searchParams.get("project_id") || undefined;
   const plans = listPlans(projectId);
-  return json2(plans);
+  return json3(plans);
 }
-async function handleCreatePlan(req, _ctx, json2) {
+async function handleCreatePlan(req, _ctx, json3) {
   try {
     const body = await req.json();
     if (!body.name)
-      return json2({ error: "Missing 'name'" }, 400);
+      return json3({ error: "Missing 'name'" }, 400);
     const plan = createPlan({
       name: body.name,
       slug: body.slug,
@@ -49094,49 +50792,49 @@ async function handleCreatePlan(req, _ctx, json2) {
       agent_id: body.agent_id,
       status: body.status
     });
-    return json2(plan, 201);
+    return json3(plan, 201);
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed to create plan" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed to create plan" }, 500);
   }
 }
-async function handleBulkDeletePlans(req, _ctx, json2) {
+async function handleBulkDeletePlans(req, _ctx, json3) {
   try {
     const body = await req.json();
     if (!body.ids?.length || body.action !== "delete")
-      return json2({ error: "Missing ids or invalid action" }, 400);
+      return json3({ error: "Missing ids or invalid action" }, 400);
     let succeeded = 0;
     for (const id of body.ids) {
       if (deletePlan(id))
         succeeded++;
     }
-    return json2({ succeeded, failed: body.ids.length - succeeded });
+    return json3({ succeeded, failed: body.ids.length - succeeded });
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed" }, 500);
   }
 }
-function handleGetPlan(id, _ctx, json2, taskToSummary2) {
+function handleGetPlan(id, _ctx, json3, taskToSummary2) {
   const plan = getPlan(id);
   if (!plan)
-    return json2({ error: "Plan not found" }, 404);
+    return json3({ error: "Plan not found" }, 404);
   const tasks = listTasks({ plan_id: id });
-  return json2({ ...plan, tasks: tasks.map((t) => taskToSummary2(t)) });
+  return json3({ ...plan, tasks: tasks.map((t) => taskToSummary2(t)) });
 }
-async function handleUpdatePlan(id, req, _ctx, json2) {
+async function handleUpdatePlan(id, req, _ctx, json3) {
   try {
     const body = await req.json();
     const plan = updatePlan(id, body);
-    return json2(plan);
+    return json3(plan);
   } catch (e) {
-    return json2({ error: e instanceof Error ? e.message : "Failed to update plan" }, 500);
+    return json3({ error: e instanceof Error ? e.message : "Failed to update plan" }, 500);
   }
 }
-function handleDeletePlan(id, _ctx, json2) {
+function handleDeletePlan(id, _ctx, json3) {
   const deleted = deletePlan(id);
   if (!deleted)
-    return json2({ error: "Plan not found" }, 404);
-  return json2({ success: true });
+    return json3({ error: "Plan not found" }, 404);
+  return json3({ success: true });
 }
-function handleStaticFiles(path, method, ctx, json2, serveStaticFile2) {
+function handleStaticFiles(path, method, ctx, json3, serveStaticFile2) {
   if (!ctx.dashboardExists || method !== "GET" && method !== "HEAD")
     return null;
   if (path !== "/") {
@@ -49144,7 +50842,7 @@ function handleStaticFiles(path, method, ctx, json2, serveStaticFile2) {
     const resolvedFile = resolve16(filePath);
     const resolvedBase = resolve16(ctx.dashboardDir);
     if (!resolvedFile.startsWith(resolvedBase + sep3) && resolvedFile !== resolvedBase) {
-      return json2({ error: "Forbidden" }, 403);
+      return json3({ error: "Forbidden" }, 403);
     }
     const res2 = serveStaticFile2(filePath);
     if (res2)
@@ -50805,10 +52503,10 @@ var exports_pr_groups = {};
 __export(exports_pr_groups, {
   handlePrGroupHttpRequest: () => handlePrGroupHttpRequest
 });
-function json2(body, status = 200) {
-  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+function json3(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS2 });
 }
-function errorStatus(error) {
+function errorStatus2(error) {
   switch (error.code) {
     case "PR_GROUP_INVALID_INPUT":
     case "PR_GROUP_EXACT_HEAD_REQUIRED":
@@ -50822,7 +52520,7 @@ function errorStatus(error) {
       return 409;
   }
 }
-async function readJson(req) {
+async function readJson2(req) {
   try {
     const value = await req.json();
     return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -50840,26 +52538,26 @@ async function handlePrGroupHttpRequest(req, url, ledger, basePath, principal) {
   const method = req.method.toUpperCase();
   try {
     if (!groupId && method === "POST" && action === undefined) {
-      return json2({ error: "unknown PR-group route", code: "PR_GROUP_NOT_FOUND" }, 404);
+      return json3({ error: "unknown PR-group route", code: "PR_GROUP_NOT_FOUND" }, 404);
     }
     if (groupId === "admit" && !action) {
       if (method !== "POST")
-        return json2({ error: "method not allowed" }, 405);
-      const body = await readJson(req);
+        return json3({ error: "method not allowed" }, 405);
+      const body = await readJson2(req);
       if (!body)
-        return json2({ error: "invalid JSON body", code: "PR_GROUP_INVALID_INPUT" }, 400);
-      return json2(await ledger.admit(body), 201);
+        return json3({ error: "invalid JSON body", code: "PR_GROUP_INVALID_INPUT" }, 400);
+      return json3(await ledger.admit(body), 201);
     }
     if (!groupId)
-      return json2({ error: "PR group id is required", code: "PR_GROUP_INVALID_INPUT" }, 400);
+      return json3({ error: "PR group id is required", code: "PR_GROUP_INVALID_INPUT" }, 400);
     if (!action && method === "GET") {
-      return json2({ view: await ledger.get(groupId) });
+      return json3({ view: await ledger.get(groupId) });
     }
     if (action === "events") {
       if (method === "GET") {
         const limit = url.searchParams.has("limit") ? Number(url.searchParams.get("limit")) : undefined;
         const afterSequence = url.searchParams.has("after_sequence") ? Number(url.searchParams.get("after_sequence")) : undefined;
-        return json2({
+        return json3({
           history: await ledger.events(groupId, {
             ...limit !== undefined ? { limit } : {},
             ...afterSequence !== undefined ? { after_sequence: afterSequence } : {}
@@ -50867,49 +52565,49 @@ async function handlePrGroupHttpRequest(req, url, ledger, basePath, principal) {
         });
       }
       if (method === "POST") {
-        const body = await readJson(req);
+        const body = await readJson2(req);
         if (!body)
-          return json2({ error: "invalid JSON body", code: "PR_GROUP_INVALID_INPUT" }, 400);
-        return json2(await ledger.append({
+          return json3({ error: "invalid JSON body", code: "PR_GROUP_INVALID_INPUT" }, 400);
+        return json3(await ledger.append({
           ...body,
           group_id: groupId,
           authenticated_actor_id: principal?.actor_id ?? undefined,
           authenticated_actor_run_id: principal?.actor_run_id ?? undefined
         }), 201);
       }
-      return json2({ error: "method not allowed" }, 405);
+      return json3({ error: "method not allowed" }, 405);
     }
     if (action === "recover") {
       if (method !== "POST")
-        return json2({ error: "method not allowed" }, 405);
-      const body = await readJson(req);
+        return json3({ error: "method not allowed" }, 405);
+      const body = await readJson2(req);
       if (!body)
-        return json2({ error: "invalid JSON body", code: "PR_GROUP_INVALID_INPUT" }, 400);
-      return json2(await ledger.recover({
+        return json3({ error: "invalid JSON body", code: "PR_GROUP_INVALID_INPUT" }, 400);
+      return json3(await ledger.recover({
         ...body,
         group_id: groupId
       }), 201);
     }
-    return json2({ error: "unknown PR-group route", code: "PR_GROUP_NOT_FOUND" }, 404);
+    return json3({ error: "unknown PR-group route", code: "PR_GROUP_NOT_FOUND" }, 404);
   } catch (cause) {
     if (cause instanceof PrGroupLedgerError) {
-      return json2({
+      return json3({
         error: cause.message,
         code: cause.code,
         details: cause.details,
         authoritative: true
-      }, errorStatus(cause));
+      }, errorStatus2(cause));
     }
-    return json2({
+    return json3({
       error: cause instanceof Error ? cause.message : "internal PR-group error",
       code: "PR_GROUP_ATOMICITY_UNAVAILABLE"
     }, 500);
   }
 }
-var JSON_HEADERS;
+var JSON_HEADERS2;
 var init_pr_groups = __esm(() => {
   init_types3();
-  JSON_HEADERS = { "Content-Type": "application/json" };
+  JSON_HEADERS2 = { "Content-Type": "application/json" };
 });
 
 // src/lib/comment-cursor.ts
@@ -50942,11 +52640,11 @@ __export(exports_v1, {
   handleV1Request: () => handleV1Request,
   countSnapshotRecords: () => countSnapshotRecords
 });
-function json3(body, status = 200) {
-  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS2 });
+function json4(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS3 });
 }
 function error(status, message, extra) {
-  return json3({ error: message, ...extra ?? {} }, status);
+  return json4({ error: message, ...extra ?? {} }, status);
 }
 function enumQueryParam(url, name, vocabulary) {
   const raw = url.searchParams.get(name);
@@ -51197,7 +52895,7 @@ function validateTemplatePatch(value) {
     ...body.plan_id === null ? { plan_id: null } : {}
   } };
 }
-async function readJson2(req) {
+async function readJson3(req) {
   try {
     const text2 = await req.text();
     if (!text2)
@@ -51267,6 +52965,9 @@ async function handleV1Request(req, url, dependencies = {}) {
   if (path === "/v1/pr-groups" || path.startsWith("/v1/pr-groups/")) {
     return handlePrGroupHttpRequest(req, url, (dependencies.getPrGroupLedger ?? getCloudPrGroupLedger)(), "/v1/pr-groups", { actor_id: principal.agent, actor_run_id: principal.kid });
   }
+  if (path === "/v1/project-registration" || path.startsWith("/v1/project-registration/")) {
+    return handleTodosProjectRegistrationHttpRequest(req, url, (dependencies.getProjectRegistrationAuthority ?? getCloudProjectRegistrationAuthority)());
+  }
   const store = (dependencies.getStorageAdapter ?? getCloudStorageAdapter)();
   const segments = path.split("/").filter(Boolean);
   const resource = segments[1];
@@ -51278,7 +52979,7 @@ async function handleV1Request(req, url, dependencies = {}) {
       if (id === "exists" && !action) {
         if (method !== "POST")
           return error(405, `method ${method} not allowed on /v1/tasks/exists`);
-        const body = await readJson2(req);
+        const body = await readJson3(req);
         const ids2 = Array.isArray(body?.ids) ? Array.from(new Set(body.ids.filter((v) => typeof v === "string" && v.length > 0))) : [];
         if (ids2.length === 0)
           return error(400, "provide a non-empty string array `ids`");
@@ -51288,7 +52989,7 @@ async function handleV1Request(req, url, dependencies = {}) {
         const presentSet = new Set(found.map((t) => t.id));
         const present = ids2.filter((i) => presentSet.has(i));
         const missing = ids2.filter((i) => !presentSet.has(i));
-        return json3({
+        return json4({
           requested: ids2.length,
           present_count: present.length,
           missing_count: missing.length,
@@ -51301,7 +53002,7 @@ async function handleV1Request(req, url, dependencies = {}) {
         if (typeof store.tasks.getByFingerprint !== "function") {
           return error(501, "fingerprint upsert is not supported by this storage backend");
         }
-        const body = await readJson2(req) ?? {};
+        const body = await readJson3(req) ?? {};
         const fingerprint3 = typeof body.fingerprint === "string" ? body.fingerprint.trim() : "";
         if (!fingerprint3)
           return error(400, "fingerprint is required");
@@ -51338,11 +53039,11 @@ async function handleV1Request(req, url, dependencies = {}) {
         }
         if (!existing) {
           const task2 = await store.tasks.create({ ...fields, title: body.title }, contextFromPrincipal(principal, body));
-          return json3({ task: task2, created: true }, 201);
+          return json4({ task: task2, created: true }, 201);
         }
         try {
           const task2 = await store.tasks.update(existing.id, { ...fields, version: existing.version }, contextFromPrincipal(principal, body));
-          return json3({ task: task2, created: false });
+          return json4({ task: task2, created: false });
         } catch (e) {
           const msg = e.message || "";
           if (msg.includes("version conflict"))
@@ -51384,15 +53085,15 @@ async function handleV1Request(req, url, dependencies = {}) {
           const tasks = await store.tasks.list(filter);
           const { limit: _l, offset: _o, ...countFilter } = filter;
           const total = await store.tasks.count(countFilter);
-          return json3({ tasks, count: tasks.length, total });
+          return json4({ tasks, count: tasks.length, total });
         }
         if (method === "POST") {
-          const body = await readJson2(req);
+          const body = await readJson3(req);
           if (!body || typeof body.title !== "string" || !body.title.trim()) {
             return error(400, "title is required");
           }
           const task2 = await store.tasks.create(body, contextFromPrincipal(principal, body));
-          return json3({ task: task2 }, 201);
+          return json4({ task: task2 }, 201);
         }
         return error(405, `method ${method} not allowed on /v1/tasks`);
       }
@@ -51409,7 +53110,7 @@ async function handleV1Request(req, url, dependencies = {}) {
               if (legacyPage.length > LEGACY_COMMENT_RESPONSE_LIMIT) {
                 return error(426, "task has too many comments for this client; upgrade @hasna/todos to use cursor pagination");
               }
-              return json3({
+              return json4({
                 comments: legacyPage,
                 count: legacyPage.length,
                 has_more: false,
@@ -51434,7 +53135,7 @@ async function handleV1Request(req, url, dependencies = {}) {
             const page = (await store.audit.getCommentsPage(id, { limit: limit + 1, ...before ? { before } : {} }, contextFromPrincipal(principal))).map(redactComment3);
             const hasMore = page.length > limit;
             const comments = hasMore ? page.slice(1) : page;
-            return json3({
+            return json4({
               comments,
               count: comments.length,
               has_more: hasMore,
@@ -51442,7 +53143,7 @@ async function handleV1Request(req, url, dependencies = {}) {
             });
           }
           if (method === "POST") {
-            const body2 = await readJson2(req) ?? {};
+            const body2 = await readJson3(req) ?? {};
             if (typeof body2.content !== "string" || !body2.content.trim()) {
               return error(400, "content is required");
             }
@@ -51457,7 +53158,7 @@ async function handleV1Request(req, url, dependencies = {}) {
               type: body2.type,
               progress_pct: body2.progress_pct
             }, contextFromPrincipal(principal, body2));
-            return json3({ comment: redactComment3(comment) }, 201);
+            return json4({ comment: redactComment3(comment) }, 201);
           }
           return error(405, `method ${method} not allowed on /v1/tasks/:id/comments`);
         }
@@ -51467,19 +53168,19 @@ async function handleV1Request(req, url, dependencies = {}) {
           if (!await store.tasks.get(id))
             return error(404, "task not found");
           const history = await store.audit.getTaskHistory(id);
-          return json3({ history, count: history.length });
+          return json4({ history, count: history.length });
         }
         if (action === "lock" || action === "unlock") {
           if (method !== "POST")
             return error(405, `method ${method} not allowed on /v1/tasks/:id/${action}`);
-          const body2 = await readJson2(req) ?? {};
+          const body2 = await readJson3(req) ?? {};
           if (!await store.tasks.get(id))
             return error(404, "task not found");
           if (action === "lock") {
             if (typeof store.tasks.lock !== "function")
               return error(501, "task locking is not supported by this storage backend");
             const agentId3 = body2.agent_id || principal.agent || "todos-serve";
-            return json3({ result: await store.tasks.lock(id, agentId3) });
+            return json4({ result: await store.tasks.lock(id, agentId3) });
           }
           if (typeof store.tasks.unlock !== "function")
             return error(501, "task unlocking is not supported by this storage backend");
@@ -51487,7 +53188,7 @@ async function handleV1Request(req, url, dependencies = {}) {
             if (!principal.scopes.includes("todos:*"))
               return error(403, "force unlock requires todos:* scope");
             const released2 = await store.tasks.unlock(id);
-            return json3({ success: released2 });
+            return json4({ success: released2 });
           }
           if (body2.agent_id && body2.agent_id !== principal.agent && !principal.scopes.includes("todos:*")) {
             return error(403, "unlock agent_id must match the authenticated agent");
@@ -51496,7 +53197,7 @@ async function handleV1Request(req, url, dependencies = {}) {
           if (!agentId2)
             return error(403, "unlock requires an agent-bound key or force=true");
           const released = await store.tasks.unlock(id, agentId2);
-          return json3({ success: released });
+          return json4({ success: released });
         }
         if (action === "dependencies") {
           if (!store.dependencies)
@@ -51505,16 +53206,16 @@ async function handleV1Request(req, url, dependencies = {}) {
             if (!await store.tasks.get(id))
               return error(404, "task not found");
             const edges = await store.dependencies.list(id);
-            return json3(edges);
+            return json4(edges);
           }
           if (method === "POST") {
-            const body2 = await readJson2(req) ?? {};
+            const body2 = await readJson3(req) ?? {};
             if (typeof body2.depends_on !== "string" || !body2.depends_on.trim()) {
               return error(400, "depends_on is required");
             }
             try {
               const dependency = await store.dependencies.add(id, body2.depends_on, contextFromPrincipal(principal));
-              return json3({ dependency }, 201);
+              return json4({ dependency }, 201);
             } catch (e) {
               const msg = e.message || "";
               if (msg.includes("not found"))
@@ -51528,7 +53229,7 @@ async function handleV1Request(req, url, dependencies = {}) {
             if (!subId)
               return error(400, "dependency target id is required (/v1/tasks/:id/dependencies/:dep)");
             const removed = await store.dependencies.remove(id, subId);
-            return json3({ removed });
+            return json4({ removed });
           }
           return error(405, `method ${method} not allowed on /v1/tasks/:id/dependencies`);
         }
@@ -51539,10 +53240,10 @@ async function handleV1Request(req, url, dependencies = {}) {
             if (!await store.tasks.get(id))
               return error(404, "task not found");
             const verifications = await store.verifications.list(id);
-            return json3({ verifications, count: verifications.length });
+            return json4({ verifications, count: verifications.length });
           }
           if (method === "POST") {
-            const body2 = await readJson2(req) ?? {};
+            const body2 = await readJson3(req) ?? {};
             if (typeof body2.command !== "string" || !body2.command.trim()) {
               return error(400, "command is required");
             }
@@ -51555,7 +53256,7 @@ async function handleV1Request(req, url, dependencies = {}) {
                 artifact_path: body2.artifact_path,
                 agent_id: body2.agent_id
               }, contextFromPrincipal(principal, body2));
-              return json3({ verification }, 201);
+              return json4({ verification }, 201);
             } catch (e) {
               const msg = e.message || "";
               if (msg.includes("not found"))
@@ -51572,10 +53273,10 @@ async function handleV1Request(req, url, dependencies = {}) {
             if (!await store.tasks.get(id))
               return error(404, "task not found");
             const commits = await store.commits.list(id);
-            return json3({ commits, count: commits.length });
+            return json4({ commits, count: commits.length });
           }
           if (method === "POST") {
-            const body2 = await readJson2(req) ?? {};
+            const body2 = await readJson3(req) ?? {};
             if (typeof body2.sha !== "string" || !body2.sha.trim())
               return error(400, "sha is required");
             try {
@@ -51586,7 +53287,7 @@ async function handleV1Request(req, url, dependencies = {}) {
                 author: body2.author,
                 files_changed: Array.isArray(body2.files_changed) ? body2.files_changed : undefined
               }, contextFromPrincipal(principal));
-              return json3({ commit }, 201);
+              return json4({ commit }, 201);
             } catch (e) {
               const msg = e.message || "";
               if (msg.includes("not found"))
@@ -51603,10 +53304,10 @@ async function handleV1Request(req, url, dependencies = {}) {
             if (!await store.tasks.get(id))
               return error(404, "task not found");
             const refs = await store.gitRefs.list(id);
-            return json3({ refs, count: refs.length });
+            return json4({ refs, count: refs.length });
           }
           if (method === "POST") {
-            const body2 = await readJson2(req) ?? {};
+            const body2 = await readJson3(req) ?? {};
             const refType = body2.ref_type === "pull_request" || body2.ref_type === "branch" ? body2.ref_type : "branch";
             if (typeof body2.name !== "string" || !body2.name.trim())
               return error(400, "name is required");
@@ -51619,7 +53320,7 @@ async function handleV1Request(req, url, dependencies = {}) {
                 provider: body2.provider,
                 metadata: body2.metadata
               }, contextFromPrincipal(principal));
-              return json3({ ref }, 201);
+              return json4({ ref }, 201);
             } catch (e) {
               const msg = e.message || "";
               if (msg.includes("not found"))
@@ -51635,21 +53336,21 @@ async function handleV1Request(req, url, dependencies = {}) {
         const body = actionJson.value && typeof actionJson.value === "object" && !Array.isArray(actionJson.value) ? actionJson.value : {};
         const agentId = typeof body.agent_id === "string" ? body.agent_id : principal.agent || "todos-serve";
         if (action === "start" && method === "POST") {
-          return json3({ task: await store.tasks.start(id, agentId) });
+          return json4({ task: await store.tasks.start(id, agentId) });
         }
         if (action === "complete" && method === "POST") {
           const parsed = validateTaskCompletion(actionJson.value);
           if (!parsed.ok)
             return error(400, parsed.message);
-          return json3({
+          return json4({
             task: await store.tasks.complete(id, parsed.agentId || principal.agent || "todos-serve", parsed.options, contextFromPrincipal(principal, body))
           });
         }
         if (action === "fail" && method === "POST") {
-          return json3({ result: await store.tasks.fail(id, agentId, typeof body.reason === "string" ? body.reason : "failed", {}) });
+          return json4({ result: await store.tasks.fail(id, agentId, typeof body.reason === "string" ? body.reason : "failed", {}) });
         }
         if (action === "claim" && method === "POST") {
-          return json3({ task: await store.tasks.claimNext(agentId, {}) });
+          return json4({ task: await store.tasks.claimNext(agentId, {}) });
         }
         return error(404, `unknown task action: ${action}`);
       }
@@ -51672,10 +53373,10 @@ async function handleV1Request(req, url, dependencies = {}) {
             throw e;
           }
         }
-        return task2 ? json3({ task: task2 }) : error(404, "task not found");
+        return task2 ? json4({ task: task2 }) : error(404, "task not found");
       }
       if (method === "PATCH" || method === "PUT") {
-        const body = await readJson2(req);
+        const body = await readJson3(req);
         if (!body)
           return error(400, "invalid JSON body");
         const current = await store.tasks.get(id);
@@ -51687,7 +53388,7 @@ async function handleV1Request(req, url, dependencies = {}) {
         };
         try {
           const task2 = await store.tasks.update(id, patch);
-          return task2 ? json3({ task: task2 }) : error(404, "task not found");
+          return task2 ? json4({ task: task2 }) : error(404, "task not found");
         } catch (e) {
           const msg = e.message || "";
           if (msg.includes("version conflict"))
@@ -51697,7 +53398,7 @@ async function handleV1Request(req, url, dependencies = {}) {
       }
       if (method === "DELETE") {
         await store.tasks.delete(id, contextFromPrincipal(principal));
-        return json3({ deleted: true, id });
+        return json4({ deleted: true, id });
       }
       return error(405, `method ${method} not allowed on /v1/tasks/:id`);
     }
@@ -51705,24 +53406,24 @@ async function handleV1Request(req, url, dependencies = {}) {
       if (!id) {
         if (method === "GET") {
           const projects = await store.projects.list();
-          return json3({ projects, count: projects.length });
+          return json4({ projects, count: projects.length });
         }
         if (method === "POST") {
-          const body = await readJson2(req);
+          const body = await readJson3(req);
           if (!body)
             return error(400, "invalid JSON body");
           const validated = validateProjectCreate(body);
           if (!validated.ok)
             return error(400, validated.message);
           const project = await store.projects.create(validated.input, contextFromPrincipal(principal));
-          return json3({ project }, 201);
+          return json4({ project }, 201);
         }
         return error(405, `method ${method} not allowed on /v1/projects`);
       }
       if (action === "rename") {
         if (method !== "POST")
           return error(405, `method ${method} not allowed on /v1/projects/:id/rename`);
-        const body = await readJson2(req);
+        const body = await readJson3(req);
         if (!body || typeof body.new_slug !== "string" || !body.new_slug.trim() || !normalizeSlug(body.new_slug)) {
           return error(400, "new_slug must be a non-empty string");
         }
@@ -51732,14 +53433,14 @@ async function handleV1Request(req, url, dependencies = {}) {
         const unknownField = Object.keys(body).find((key) => !["new_slug", "name"].includes(key));
         if (unknownField)
           return error(400, `unknown project rename field: ${unknownField}`);
-        return json3(await store.projects.rename(id, body, contextFromPrincipal(principal)));
+        return json4(await store.projects.rename(id, body, contextFromPrincipal(principal)));
       }
       if (method === "GET") {
         const project = await store.projects.get(id);
-        return project ? json3({ project }) : error(404, "project not found");
+        return project ? json4({ project }) : error(404, "project not found");
       }
       if (method === "PATCH" || method === "PUT") {
-        const body = await readJson2(req);
+        const body = await readJson3(req);
         if (!body)
           return error(400, "invalid JSON body");
         const validated = validateProjectPatch(body);
@@ -51748,21 +53449,21 @@ async function handleV1Request(req, url, dependencies = {}) {
         if (!await store.projects.get(id))
           return error(404, "project not found");
         const project = await store.projects.update(id, validated.patch);
-        return json3({ project });
+        return json4({ project });
       }
       if (method === "DELETE") {
         await store.projects.delete(id, contextFromPrincipal(principal));
-        return json3({ deleted: true, id });
+        return json4({ deleted: true, id });
       }
       return error(405, `method ${method} not allowed on /v1/projects/:id`);
     }
     if (resource === "plans") {
       if (!id && method === "GET") {
         const plans = await store.plans.list(url.searchParams.get("project_id") ?? undefined);
-        return json3({ plans, count: plans.length });
+        return json4({ plans, count: plans.length });
       }
       if (!id && method === "POST") {
-        const body = await readJson2(req);
+        const body = await readJson3(req);
         const validated = validatePlanCreate(body);
         if (!validated.ok)
           return error(400, validated.message);
@@ -51777,14 +53478,14 @@ async function handleV1Request(req, url, dependencies = {}) {
           }
         }
         const plan = await store.plans.create(validated.input, contextFromPrincipal(principal, validated.input));
-        return json3({ plan }, 201);
+        return json4({ plan }, 201);
       }
       if (id && method === "GET") {
         const plan = await store.plans.get(id);
-        return plan ? json3({ plan }) : error(404, "plan not found");
+        return plan ? json4({ plan }) : error(404, "plan not found");
       }
       if (id && (method === "PATCH" || method === "PUT")) {
-        const body = await readJson2(req);
+        const body = await readJson3(req);
         if (!body || Object.keys(body).length === 0)
           return error(400, "plan patch is required");
         const allowed = new Set(["name", "slug", "description", "status", "task_list_id", "agent_id"]);
@@ -51821,12 +53522,12 @@ async function handleV1Request(req, url, dependencies = {}) {
           }
         }
         const plan = await store.plans.update(id, body);
-        return json3({ plan });
+        return json4({ plan });
       }
       if (id && method === "DELETE") {
         if (!await store.plans.delete(id, contextFromPrincipal(principal)))
           return error(404, "plan not found");
-        return json3({ deleted: true, id });
+        return json4({ deleted: true, id });
       }
       if (id)
         return error(405, `method ${method} not allowed on /v1/plans/:id`);
@@ -51835,50 +53536,50 @@ async function handleV1Request(req, url, dependencies = {}) {
       if (!id && method === "GET") {
         const projectId = url.searchParams.get("project_id");
         const templates = (await store.templates.list()).filter((template) => projectId === null || template.project_id === projectId);
-        return json3({ templates, count: templates.length });
+        return json4({ templates, count: templates.length });
       }
       if (!id && method === "POST") {
-        const body = await readJson2(req);
+        const body = await readJson3(req);
         const validated = validateTemplateCreate(body);
         if (!validated.ok)
           return error(400, validated.message);
         const template = await store.templates.create(validated.input, contextFromPrincipal(principal));
-        return json3({ template: await store.templates.getWithTasks(template.id) }, 201);
+        return json4({ template: await store.templates.getWithTasks(template.id) }, 201);
       }
       if (!id)
         return error(405, `method ${method} not allowed on /v1/templates`);
       if (method === "GET") {
         const template = await store.templates.getWithTasks(id);
-        return template ? json3({ template }) : error(404, "template not found");
+        return template ? json4({ template }) : error(404, "template not found");
       }
       if (method === "PATCH" || method === "PUT") {
-        const body = await readJson2(req);
+        const body = await readJson3(req);
         const validated = validateTemplatePatch(body);
         if (!validated.ok)
           return error(400, validated.message);
         const template = await store.templates.update(id, validated.patch, contextFromPrincipal(principal));
-        return template ? json3({ template: await store.templates.getWithTasks(id) }) : error(404, "template not found");
+        return template ? json4({ template: await store.templates.getWithTasks(id) }) : error(404, "template not found");
       }
       if (method === "DELETE") {
         const deleted = await store.templates.delete(id, contextFromPrincipal(principal));
-        return deleted ? json3({ deleted: true, id }) : error(404, "template not found");
+        return deleted ? json4({ deleted: true, id }) : error(404, "template not found");
       }
       return error(405, `method ${method} not allowed on /v1/templates/:id`);
     }
     if (resource === "agents") {
       if (!id && method === "GET") {
         const agents = await store.agents.list();
-        return json3({ agents, count: agents.length });
+        return json4({ agents, count: agents.length });
       }
       if (!id && method === "POST") {
-        const body = await readJson2(req);
+        const body = await readJson3(req);
         if (!body || typeof body.name !== "string" || !body.name.trim())
           return error(400, "name is required");
         const result = await store.agents.register(body, contextFromPrincipal(principal));
         if (result && typeof result === "object" && "conflict" in result) {
           return error(409, result.message ?? "agent name conflict", { conflict: true });
         }
-        return json3({ agent: result }, 201);
+        return json4({ agent: result }, 201);
       }
       if (id && action === "heartbeat") {
         if (method !== "POST")
@@ -51887,7 +53588,7 @@ async function handleV1Request(req, url, dependencies = {}) {
           return error(501, "agent heartbeat is not supported by this storage backend");
         }
         const agent = await store.agents.heartbeat(id, contextFromPrincipal(principal));
-        return agent ? json3({ agent }) : error(404, "agent not found");
+        return agent ? json4({ agent }) : error(404, "agent not found");
       }
       if (id && action === "release") {
         if (method !== "POST")
@@ -51895,18 +53596,18 @@ async function handleV1Request(req, url, dependencies = {}) {
         if (typeof store.agents.release !== "function") {
           return error(501, "agent release is not supported by this storage backend");
         }
-        const body = await readJson2(req) ?? {};
+        const body = await readJson3(req) ?? {};
         const result = await store.agents.release(id, body.session_id, contextFromPrincipal(principal));
         if (!result)
           return error(404, "agent not found");
         if (!result.released) {
           return error(409, "release denied: session_id does not match agent's current session", { released: false });
         }
-        return json3({ agent: result.agent, released: true });
+        return json4({ agent: result.agent, released: true });
       }
       if (id && method === "GET") {
         const agent = await store.agents.get(id);
-        return agent ? json3({ agent }) : error(404, "agent not found");
+        return agent ? json4({ agent }) : error(404, "agent not found");
       }
     }
     if (resource === "activity" && !id) {
@@ -51915,16 +53616,16 @@ async function handleV1Request(req, url, dependencies = {}) {
       const limitParam = url.searchParams.get("limit");
       const limit = limitParam ? Math.max(1, Math.min(1e4, Number(limitParam) || 50)) : 50;
       const activity = await store.audit.getRecentActivity(limit);
-      return json3({ activity, count: activity.length });
+      return json4({ activity, count: activity.length });
     }
     if (resource === "task-lists") {
       if (!id && method === "GET") {
         const projectId = url.searchParams.get("project_id") ?? undefined;
         const taskLists = await store.taskLists.list(projectId);
-        return json3({ task_lists: taskLists, count: taskLists.length });
+        return json4({ task_lists: taskLists, count: taskLists.length });
       }
       if (!id && method === "POST") {
-        const body = await readJson2(req);
+        const body = await readJson3(req);
         if (!body || typeof body.name !== "string" || !body.name.trim())
           return error(400, "name is required");
         const unknownField = Object.keys(body).find((key) => !["name", "slug", "project_id", "description", "metadata"].includes(key));
@@ -51943,14 +53644,14 @@ async function handleV1Request(req, url, dependencies = {}) {
           return error(400, "task-list slug must be non-empty kebab-case");
         }
         const taskList = await store.taskLists.create(body, contextFromPrincipal(principal));
-        return json3({ task_list: taskList }, 201);
+        return json4({ task_list: taskList }, 201);
       }
       if (id && method === "GET") {
         const taskList = await store.taskLists.get(id);
-        return taskList ? json3({ task_list: taskList }) : error(404, "task list not found");
+        return taskList ? json4({ task_list: taskList }) : error(404, "task list not found");
       }
       if (id && (method === "PATCH" || method === "PUT")) {
-        const body = await readJson2(req);
+        const body = await readJson3(req);
         if (!body)
           return error(400, "invalid JSON body");
         const unknownField = Object.keys(body).find((key) => !["slug", "name", "description", "metadata"].includes(key));
@@ -51970,11 +53671,11 @@ async function handleV1Request(req, url, dependencies = {}) {
         if (!await store.taskLists.get(id))
           return error(404, "task list not found");
         const taskList = await store.taskLists.update(id, body);
-        return json3({ task_list: taskList });
+        return json4({ task_list: taskList });
       }
       if (id && method === "DELETE") {
         const deleted = await store.taskLists.delete(id, contextFromPrincipal(principal));
-        return deleted ? json3({ deleted: true, id }) : error(404, "task list not found");
+        return deleted ? json4({ deleted: true, id }) : error(404, "task list not found");
       }
       return error(405, `method ${method} not allowed on /v1/task-lists${id ? "/:id" : ""}`);
     }
@@ -51985,7 +53686,7 @@ async function handleV1Request(req, url, dependencies = {}) {
         return error(501, "dependency edge listing is not supported by this storage backend");
       }
       const dependencies2 = await store.dependencies.listAll();
-      return json3({ dependencies: dependencies2, count: dependencies2.length });
+      return json4({ dependencies: dependencies2, count: dependencies2.length });
     }
     if (resource === "commits" && id) {
       if (method !== "GET")
@@ -51993,7 +53694,7 @@ async function handleV1Request(req, url, dependencies = {}) {
       if (!store.commits)
         return error(501, "commit links are not supported by this storage backend");
       const commit = await store.commits.find(id);
-      return json3({ commit: commit ?? null });
+      return json4({ commit: commit ?? null });
     }
     if (resource === "refs" && id) {
       if (method !== "GET")
@@ -52007,7 +53708,7 @@ async function handleV1Request(req, url, dependencies = {}) {
         return error(400, "ref path segment has invalid percent encoding");
       }
       const refs = await store.gitRefs.find(decodedRef);
-      return json3({ refs, count: refs.length });
+      return json4({ refs, count: refs.length });
     }
     if (resource === "next" && !id) {
       if (method !== "GET")
@@ -52019,7 +53720,7 @@ async function handleV1Request(req, url, dependencies = {}) {
         ...url.searchParams.get("plan_id") ? { plan_id: url.searchParams.get("plan_id") } : {}
       };
       const task2 = await store.tasks.getNext(agent, filters);
-      return json3({ task: task2 ?? null });
+      return json4({ task: task2 ?? null });
     }
     if (resource === "stats" && method === "GET") {
       const [tasks, tasksAll, projects] = await Promise.all([
@@ -52027,7 +53728,7 @@ async function handleV1Request(req, url, dependencies = {}) {
         store.tasks.count({ include_subtasks: true }),
         store.projects.list()
       ]);
-      return json3({ tasks, tasks_all: tasksAll, subtasks: tasksAll - tasks, projects: projects.length });
+      return json4({ tasks, tasks_all: tasksAll, subtasks: tasksAll - tasks, projects: projects.length });
     }
     if (resource === "integrity" && !id) {
       if (method !== "GET")
@@ -52036,7 +53737,7 @@ async function handleV1Request(req, url, dependencies = {}) {
         return error(501, "referential-integrity reporting is not supported by this storage backend");
       }
       const integrity = await store.integrity.report();
-      return json3({ integrity });
+      return json4({ integrity });
     }
     if (resource === "import") {
       if (method !== "POST")
@@ -52044,7 +53745,7 @@ async function handleV1Request(req, url, dependencies = {}) {
       if (typeof store.sync.importSnapshot !== "function") {
         return error(501, "snapshot import is not supported by this storage backend");
       }
-      const raw = await readJson2(req);
+      const raw = await readJson3(req);
       if (raw === null)
         return error(400, "invalid JSON body");
       const snapshot = normalizeImportSnapshot(raw);
@@ -52053,7 +53754,7 @@ async function handleV1Request(req, url, dependencies = {}) {
         return error(400, "empty snapshot: provide at least one record array (tasks/projects/plans/...)");
       }
       const result = await store.sync.importSnapshot(snapshot, contextFromPrincipal(principal));
-      return json3({ result, received });
+      return json4({ result, received });
     }
     return error(404, `unknown /v1 resource: ${resource ?? "(root)"}`);
   } catch (e) {
@@ -52076,13 +53777,14 @@ async function handleV1Request(req, url, dependencies = {}) {
     return error(500, e.message || "internal error");
   }
 }
-var JSON_HEADERS2, DEFAULT_COMMENT_PAGE_SIZE = 100, MAX_COMMENT_PAGE_SIZE = 500, LEGACY_COMMENT_RESPONSE_LIMIT = 500;
+var JSON_HEADERS3, DEFAULT_COMMENT_PAGE_SIZE = 100, MAX_COMMENT_PAGE_SIZE = 500, LEGACY_COMMENT_RESPONSE_LIMIT = 500;
 var init_v1 = __esm(() => {
   init_types();
   init_cloud();
   init_pr_groups();
+  init_project_registration();
   init_redaction();
-  JSON_HEADERS2 = { "Content-Type": "application/json" };
+  JSON_HEADERS3 = { "Content-Type": "application/json" };
 });
 
 // src/pr-groups/sqlite.ts
@@ -52241,12 +53943,12 @@ class SqlitePrGroupLedgerPersistence {
     this.tx = new SqlitePrGroupTransaction(db);
   }
   async transaction(fn) {
-    const previous = sqliteTransactionTails.get(this.db) ?? Promise.resolve();
+    const previous = sqliteTransactionTails2.get(this.db) ?? Promise.resolve();
     let release;
     const current = new Promise((resolve17) => {
       release = resolve17;
     });
-    sqliteTransactionTails.set(this.db, current);
+    sqliteTransactionTails2.set(this.db, current);
     await previous;
     try {
       this.db.exec("BEGIN IMMEDIATE");
@@ -52260,8 +53962,8 @@ class SqlitePrGroupLedgerPersistence {
       throw error2;
     } finally {
       release();
-      if (sqliteTransactionTails.get(this.db) === current)
-        sqliteTransactionTails.delete(this.db);
+      if (sqliteTransactionTails2.get(this.db) === current)
+        sqliteTransactionTails2.delete(this.db);
     }
   }
   getGroup(id) {
@@ -52291,9 +53993,9 @@ class SqlitePrGroupLedgerPersistence {
     return row ? eventFromRow2(row) : null;
   }
 }
-var sqliteTransactionTails;
-var init_sqlite = __esm(() => {
-  sqliteTransactionTails = new WeakMap;
+var sqliteTransactionTails2;
+var init_sqlite2 = __esm(() => {
+  sqliteTransactionTails2 = new WeakMap;
 });
 
 // src/pr-groups/index.ts
@@ -52323,10 +54025,10 @@ function createLocalPrGroupLedger(db = getDatabase()) {
 var init_pr_groups2 = __esm(() => {
   init_database();
   init_ledger();
-  init_sqlite();
+  init_sqlite2();
   init_types3();
   init_ledger();
-  init_sqlite();
+  init_sqlite2();
   init_http_client();
   init_postgres();
 });
@@ -52337,7 +54039,7 @@ __export(exports_serve, {
   taskToSummary: () => taskToSummary,
   startServer: () => startServer,
   serveStaticFile: () => serveStaticFile,
-  json: () => json,
+  json: () => json2,
   checkAuth: () => checkAuth,
   SECURITY_HEADERS: () => SECURITY_HEADERS,
   MIME_TYPES: () => MIME_TYPES
@@ -52423,7 +54125,7 @@ function checkRateLimit(ip) {
   }
   return { allowed: true };
 }
-function json(data, status = 200, headers) {
+function json2(data, status = 200, headers) {
   return new Response(JSON.stringify(data), {
     status,
     headers: {
@@ -52568,7 +54270,7 @@ Dashboard not found at: ${dashboardDir}`);
         "Access-Control-Allow-Headers": "Content-Type, X-API-Key, Authorization",
         Vary: "Origin"
       } : undefined;
-      const jsonWithCors = (data, status = 200) => json(data, status, corsHeaders);
+      const jsonWithCors = (data, status = 200) => json2(data, status, corsHeaders);
       if (method === "OPTIONS") {
         return new Response(null, {
           headers: corsHeaders || {
@@ -52649,13 +54351,13 @@ Dashboard not found at: ${dashboardDir}`);
           return res;
       }
       if (path === "/api/health" && method === "GET") {
-        return handleHealth(ctx, json);
+        return handleHealth(ctx, json2);
       }
       if (path === "/api/headless" && method === "GET") {
-        return handleHeadlessBoundary(ctx, json);
+        return handleHeadlessBoundary(ctx, json2);
       }
       if (path === "/api/stats" && method === "GET") {
-        return handleStats(ctx, json);
+        return handleStats(ctx, json2);
       }
       if (path === "/api/tasks" && method === "GET") {
         return handleListTasks(req, url, ctx, jsonWithCors, taskToSummary);
@@ -52670,16 +54372,16 @@ Dashboard not found at: ${dashboardDir}`);
         return handleTasksExport(req, url, ctx, jsonWithCors, taskToSummary);
       }
       if (path === "/api/tasks/bulk" && method === "POST") {
-        return handleTasksBulk(req, ctx, json);
+        return handleTasksBulk(req, ctx, json2);
       }
       if (path === "/api/tasks/status" && method === "GET") {
-        return handleTasksStatus(req, url, ctx, json);
+        return handleTasksStatus(req, url, ctx, json2);
       }
       if (path === "/api/tasks/next" && method === "GET") {
         return handleTasksNext(req, url, ctx, jsonWithCors, taskToSummary);
       }
       if (path === "/api/tasks/active" && method === "GET") {
-        return handleTasksActive(req, url, ctx, json);
+        return handleTasksActive(req, url, ctx, json2);
       }
       if (path === "/api/tasks/stale" && method === "GET") {
         return handleTasksStale(req, url, ctx, jsonWithCors, taskToSummary);
@@ -52692,11 +54394,11 @@ Dashboard not found at: ${dashboardDir}`);
       }
       const attachmentsMatch = path.match(/^\/api\/tasks\/([^/]+)\/attachments$/);
       if (attachmentsMatch && method === "GET") {
-        return handleTaskAttachments(attachmentsMatch[1], ctx, json);
+        return handleTaskAttachments(attachmentsMatch[1], ctx, json2);
       }
       const progressMatch = path.match(/^\/api\/tasks\/([^/]+)\/progress$/);
       if (progressMatch) {
-        const res = await handleTaskProgress(progressMatch[1], req, method, ctx, json, url);
+        const res = await handleTaskProgress(progressMatch[1], req, method, ctx, json2, url);
         if (res !== null)
           return res;
       }
@@ -52710,7 +54412,7 @@ Dashboard not found at: ${dashboardDir}`);
           return handlePatchTask(id, req, ctx, jsonWithCors, taskToSummary);
         }
         if (method === "DELETE") {
-          return handleDeleteTask(id, ctx, json);
+          return handleDeleteTask(id, ctx, json2);
         }
       }
       const startMatch = path.match(/^\/api\/tasks\/([^/]+)\/start$/);
@@ -52726,7 +54428,7 @@ Dashboard not found at: ${dashboardDir}`);
         return handleCompleteTask(completeMatch[1], ctx, jsonWithCors, taskToSummary);
       }
       if (path === "/api/projects" && method === "GET") {
-        return handleListProjects(url, ctx, json);
+        return handleListProjects(url, ctx, json2);
       }
       if (path === "/api/agents/me" && method === "GET") {
         return handleAgentMe(req, url, ctx, jsonWithCors, taskToSummary);
@@ -52739,92 +54441,92 @@ Dashboard not found at: ${dashboardDir}`);
         return handleClaimTask(req, ctx, jsonWithCors, taskToSummary);
       }
       if (path === "/api/orgs" && method === "GET") {
-        return handleListOrgs(ctx, json);
+        return handleListOrgs(ctx, json2);
       }
       if (path === "/api/orgs" && method === "POST") {
-        return handleCreateOrg(req, ctx, json);
+        return handleCreateOrg(req, ctx, json2);
       }
       const orgMatch = path.match(/^\/api\/orgs\/([^/]+)$/);
       if (orgMatch && method === "PATCH") {
-        return handleUpdateOrg(orgMatch[1], req, ctx, json);
+        return handleUpdateOrg(orgMatch[1], req, ctx, json2);
       }
       if (orgMatch && method === "DELETE") {
-        return handleDeleteOrg(orgMatch[1], ctx, json);
+        return handleDeleteOrg(orgMatch[1], ctx, json2);
       }
       if (path === "/api/org" && method === "GET") {
-        return handleOrgChart(ctx, json);
+        return handleOrgChart(ctx, json2);
       }
       const teamMatch = path.match(/^\/api\/agents\/([^/]+)\/team$/);
       if (teamMatch && method === "GET") {
-        return handleAgentTeam(teamMatch[1], ctx, json);
+        return handleAgentTeam(teamMatch[1], ctx, json2);
       }
       if (path === "/api/agents" && method === "GET") {
-        return handleListAgents(url, ctx, json);
+        return handleListAgents(url, ctx, json2);
       }
       if (path === "/api/projects" && method === "POST") {
-        return handleCreateProject(req, ctx, json);
+        return handleCreateProject(req, ctx, json2);
       }
       const projectDeleteMatch = path.match(/^\/api\/projects\/([^/]+)$/);
       if (projectDeleteMatch && method === "DELETE") {
-        return handleDeleteProject(projectDeleteMatch[1], ctx, json);
+        return handleDeleteProject(projectDeleteMatch[1], ctx, json2);
       }
       if (path === "/api/agents" && method === "POST") {
-        return handleRegisterAgent(req, ctx, json);
+        return handleRegisterAgent(req, ctx, json2);
       }
       const agentMatch = path.match(/^\/api\/agents\/([^/]+)$/);
       if (agentMatch && method === "PATCH") {
-        return handleUpdateAgent(agentMatch[1], req, ctx, json);
+        return handleUpdateAgent(agentMatch[1], req, ctx, json2);
       }
       if (agentMatch && method === "DELETE") {
-        return handleDeleteAgent(agentMatch[1], ctx, json);
+        return handleDeleteAgent(agentMatch[1], ctx, json2);
       }
       if (path === "/api/agents/bulk" && method === "POST") {
-        return handleBulkDeleteAgents(req, ctx, json);
+        return handleBulkDeleteAgents(req, ctx, json2);
       }
       if (path === "/api/projects/bulk" && method === "POST") {
-        return handleBulkDeleteProjects(req, ctx, json);
+        return handleBulkDeleteProjects(req, ctx, json2);
       }
       if (path === "/api/doctor" && method === "GET") {
-        return handleDoctor(ctx, json);
+        return handleDoctor(ctx, json2);
       }
       if (path === "/api/report" && method === "GET") {
-        return handleReport(req, url, ctx, json);
+        return handleReport(req, url, ctx, json2);
       }
       if (path === "/api/activity" && method === "GET") {
-        return handleActivity(req, url, ctx, json);
+        return handleActivity(req, url, ctx, json2);
       }
       const historyMatch = path.match(/^\/api\/tasks\/([^/]+)\/history$/);
       if (historyMatch && method === "GET") {
-        return handleTaskHistory(historyMatch[1], ctx, json, url);
+        return handleTaskHistory(historyMatch[1], ctx, json2, url);
       }
       if (path === "/api/webhooks" && method === "GET") {
-        return handleListWebhooks(ctx, json);
+        return handleListWebhooks(ctx, json2);
       }
       if (path === "/api/webhooks" && method === "POST") {
-        return handleCreateWebhook(req, ctx, json);
+        return handleCreateWebhook(req, ctx, json2);
       }
       const webhookMatch = path.match(/^\/api\/webhooks\/([^/]+)$/);
       if (webhookMatch && method === "DELETE") {
-        return handleDeleteWebhook(webhookMatch[1], ctx, json);
+        return handleDeleteWebhook(webhookMatch[1], ctx, json2);
       }
       if (path === "/api/templates" && method === "GET") {
-        return handleListTemplates(ctx, json);
+        return handleListTemplates(ctx, json2);
       }
       if (path === "/api/templates" && method === "POST") {
-        return handleCreateTemplate(req, ctx, json);
+        return handleCreateTemplate(req, ctx, json2);
       }
       const templateMatch = path.match(/^\/api\/templates\/([^/]+)$/);
       if (templateMatch && method === "DELETE") {
-        return handleDeleteTemplate(templateMatch[1], ctx, json);
+        return handleDeleteTemplate(templateMatch[1], ctx, json2);
       }
       if (path === "/api/plans" && method === "GET") {
-        return handleListPlans(url, ctx, json);
+        return handleListPlans(url, ctx, json2);
       }
       if (path === "/api/plans" && method === "POST") {
-        return handleCreatePlan(req, ctx, json);
+        return handleCreatePlan(req, ctx, json2);
       }
       if (path === "/api/plans/bulk" && method === "POST") {
-        return handleBulkDeletePlans(req, ctx, json);
+        return handleBulkDeletePlans(req, ctx, json2);
       }
       const planMatch = path.match(/^\/api\/plans\/([^/]+)$/);
       if (planMatch) {
@@ -52833,16 +54535,16 @@ Dashboard not found at: ${dashboardDir}`);
           return handleGetPlan(id, ctx, jsonWithCors, taskToSummary);
         }
         if (method === "PATCH") {
-          return handleUpdatePlan(id, req, ctx, json);
+          return handleUpdatePlan(id, req, ctx, json2);
         }
         if (method === "DELETE") {
-          return handleDeletePlan(id, ctx, json);
+          return handleDeletePlan(id, ctx, json2);
         }
       }
       const staticRes = handleStaticFiles(path, method, ctx, jsonWithCors, serveStaticFile);
       if (staticRes)
         return staticRes;
-      return json({ error: "Not found" }, 404);
+      return json2({ error: "Not found" }, 404);
     }
   });
   const shutdown = () => {