@hasna/todos 0.15.9 → 0.15.10

package/dist/server/index.js

@@ -70,7 +70,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.9",
+    version: "0.15.10",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -112,6 +112,10 @@ var init_package = __esm(() => {
       "./project-registration": {
         types: "./dist/project-registration.d.ts",
         import: "./dist/project-registration.js"
+      },
+      "./task-manifest": {
+        types: "./dist/task-manifest.d.ts",
+        import: "./dist/task-manifest.js"
       }
     },
     workspaces: [
@@ -124,8 +128,8 @@ var init_package = __esm(() => {
       "README.md"
     ],
     scripts: {
-      build: "rm -rf dist dashboard/dist && cd dashboard && bun install --frozen-lockfile && bun run build && cd .. && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && tsc --emitDeclarationOnly --outDir dist",
-      "build:server": "rm -rf dist && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*'",
+      build: "rm -rf dist dashboard/dist && cd dashboard && bun install --frozen-lockfile && bun run build && cd .. && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts src/task-manifest.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && tsc --emitDeclarationOnly --outDir dist",
+      "build:server": "rm -rf dist && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts src/task-manifest.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*'",
       migrate: "bun run src/server/index.ts migrate",
       "backfill:comment-redaction": "bun run src/server/index.ts redact-comments",
       "generate:sdk": "bun run scripts/generate-sdk.ts",
@@ -1122,6 +1126,62 @@ var init_creator_identity = __esm(() => {
   init_sync_utils();
 });
 
+// src/lib/plan-project-link-contract.ts
+import { createHash as createHash2 } from "crypto";
+function canonicalPlanProjectLinkJson(value) {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value);
+  if (Array.isArray(value))
+    return `[${value.map(canonicalPlanProjectLinkJson).join(",")}]`;
+  return `{${Object.entries(value).filter(([, item]) => item !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonicalPlanProjectLinkJson(item)}`).join(",")}}`;
+}
+function planProjectLinkDigest(value) {
+  return createHash2("sha256").update(canonicalPlanProjectLinkJson(value)).digest("hex");
+}
+function normalizePlanProjectLinkIdempotencyKey(value) {
+  const key = value?.trim() ?? "";
+  if (key.length < 8 || key.length > 128 || !/^[A-Za-z0-9._:-]+$/.test(key)) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_KEY_INVALID", "idempotency_key must be 8-128 ASCII letters, digits, dots, underscores, colons, or hyphens");
+  }
+  return key;
+}
+function planProjectLinkReceiptId(idempotencyKey) {
+  return `pplr_${planProjectLinkDigest({ idempotency_key: idempotencyKey }).slice(0, 48)}`;
+}
+function planProjectLinkRollbackReceiptId(receiptId) {
+  return `pplr_inverse_${planProjectLinkDigest({ accepted_receipt_id: receiptId }).slice(0, 38)}`;
+}
+function planProjectLinkRequestHash(planId, projectId) {
+  return planProjectLinkDigest({ plan_id: planId, project_id: projectId });
+}
+function planProjectLinkResultDigest(plan, tasks) {
+  return planProjectLinkDigest({
+    plan_id: plan.id,
+    plan_project_id: plan.project_id,
+    tasks: tasks.map((task) => ({ id: task.id, plan_id: task.plan_id, project_id: task.project_id })).sort((left, right) => left.id.localeCompare(right.id))
+  });
+}
+function assertPlanProjectLinkReceipt(value) {
+  const receipt = value;
+  if (!receipt || typeof receipt !== "object" || receipt.schema_version !== PLAN_PROJECT_LINK_SCHEMA_VERSION || typeof receipt.receipt_id !== "string" || typeof receipt.idempotency_key !== "string" || typeof receipt.plan_id !== "string" || typeof receipt.project_id !== "string" || !Array.isArray(receipt.task_ids) || receipt.task_ids.some((id) => typeof id !== "string") || !receipt.prior_task_project_ids || typeof receipt.prior_task_project_ids !== "object" || typeof receipt.result_digest !== "string") {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RECEIPT_NOT_FOUND", "Stored plan-project-link receipt is invalid");
+  }
+  return receipt;
+}
+var PLAN_PROJECT_LINK_SCHEMA_VERSION = "todos.plan-project-link.v1", PlanProjectLinkError;
+var init_plan_project_link_contract = __esm(() => {
+  PlanProjectLinkError = class PlanProjectLinkError extends Error {
+    code;
+    details;
+    constructor(code, message, details = {}) {
+      super(message);
+      this.code = code;
+      this.details = details;
+      this.name = "PlanProjectLinkError";
+    }
+  };
+});
+
 // src/lib/slugs.ts
 function normalizeSlug(value) {
   return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
@@ -1219,6 +1279,21 @@ function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABL
       RETURNS text
       LANGUAGE sql IMMUTABLE PARALLEL SAFE STRICT
       AS $$ SELECT unaccent('unaccent', $1) $$`,
+    `CREATE OR REPLACE FUNCTION todos_try_timestamptz(text)
+      RETURNS timestamptz
+      LANGUAGE plpgsql IMMUTABLE PARALLEL SAFE
+      SET DateStyle TO 'ISO, YMD'
+      AS $$
+      BEGIN
+        RETURN CASE
+          WHEN $1 ~ '(Z|[+-][0-9]{2}:?[0-9]{2})$' THEN $1::timestamptz
+          ELSE ($1::timestamp AT TIME ZONE 'UTC')
+        END;
+      EXCEPTION WHEN others THEN RETURN NULL; END $$`,
+    `DROP INDEX IF EXISTS ${tableName}_task_updated_at_idx`,
+    `CREATE INDEX IF NOT EXISTS ${tableName}_task_updated_at_utc_idx
+      ON ${tableName} (todos_try_timestamptz(payload->>'updated_at'))
+      WHERE object_type = 'tasks' AND deleted_at IS NULL`,
     `ALTER TABLE ${tableName}
       ADD COLUMN IF NOT EXISTS task_search_tsv tsvector
       GENERATED ALWAYS AS (
@@ -2018,6 +2093,12 @@ function createPostgresTodosStorageAdapter(options) {
       update: (id, input) => updatePlan(id, input, store),
       delete: (id, context) => store.deletePlan(id, context)
     },
+    planProjectLinks: {
+      apply: (input, context) => store.applyPlanProjectLink(input, context),
+      rollback: (input, context) => store.rollbackPlanProjectLink(input, context),
+      getReceipt: (receiptId) => store.getPlanProjectLinkReceipt(receiptId),
+      getReceiptByIdempotencyKey: (key) => store.getPlanProjectLinkReceiptByIdempotencyKey(key)
+    },
     agents: {
       register: (input, context) => registerAgent(input, store, context),
       get: (id) => store.get("agents", id),
@@ -2200,6 +2281,9 @@ class PostgresJsonRecordStore {
       conds.push(`LOWER(payload->>'created_by') = LOWER(${p(filter.created_by)})`);
     if (filter.not_created_by !== undefined)
       conds.push(`(payload->>'created_by' IS NULL OR LOWER(payload->>'created_by') <> LOWER(${p(filter.not_created_by)}))`);
+    if (filter.updated_after !== undefined) {
+      conds.push(`(todos_try_timestamptz(payload->>'updated_at') IS NULL ` + `OR todos_try_timestamptz(payload->>'updated_at') > ${p(filter.updated_after)}::timestamptz)`);
+    }
     if (filter.session_id !== undefined)
       conds.push(`payload->>'session_id' = ${p(filter.session_id)}`);
     if (filter.tags?.length) {
@@ -2384,6 +2468,115 @@ class PostgresJsonRecordStore {
     }
     return value;
   }
+  async upsertTaskWithPlanMembershipGuard(value, guardedPlanIds, explicitProject, context = {}) {
+    const planIds = [...new Set(guardedPlanIds.filter(Boolean))].sort();
+    if (planIds.length === 0)
+      return this.upsert("tasks", value, context);
+    await this.ensureSchema();
+    const updatedAt = value.updated_at;
+    const targetPlanId = value.plan_id;
+    const result = await this.options.client.query(`/* todos:task-plan-membership-guard */ WITH
+       locked_plans AS MATERIALIZED (
+         SELECT object_id, payload FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'plans' AND deleted_at IS NULL
+           AND object_id IN (SELECT value FROM jsonb_array_elements_text($7::jsonb))
+         ORDER BY object_id
+         FOR UPDATE
+       ), validation AS (
+         SELECT
+           (SELECT count(*) FROM locked_plans) = jsonb_array_length($7::jsonb) AS all_plans_found,
+           ($8::text IS NULL OR EXISTS (SELECT 1 FROM locked_plans WHERE object_id = $8)) AS target_plan_found,
+           (SELECT payload->>'project_id' FROM locked_plans WHERE object_id = $8) AS target_project_id
+       ), guarded AS (
+         SELECT
+           validation.*,
+           ($9::boolean AND validation.target_project_id IS NOT NULL
+             AND ($3::jsonb->>'project_id') IS DISTINCT FROM validation.target_project_id) AS project_conflict,
+           CASE
+             WHEN validation.target_project_id IS NULL THEN $3::jsonb
+             ELSE jsonb_set($3::jsonb, '{project_id}', to_jsonb(validation.target_project_id), true)
+           END AS payload
+         FROM validation
+       ), stored AS (
+         INSERT INTO ${this.tableName} (
+           service, object_type, object_id, payload, updated_at,
+           deleted_at, source_machine_id, version
+         )
+         SELECT $1, 'tasks', $2, guarded.payload, $4::timestamptz, NULL, $5, $6
+         FROM guarded
+         WHERE guarded.all_plans_found AND guarded.target_plan_found AND NOT guarded.project_conflict
+         ON CONFLICT (service, object_type, object_id) DO UPDATE SET
+           payload = EXCLUDED.payload,
+           updated_at = EXCLUDED.updated_at,
+           deleted_at = NULL,
+           source_machine_id = EXCLUDED.source_machine_id,
+           version = EXCLUDED.version
+         WHERE ${this.tableName}.updated_at IS NULL
+            OR ${this.tableName}.updated_at < EXCLUDED.updated_at
+            OR (${this.tableName}.updated_at = EXCLUDED.updated_at
+                AND COALESCE(${this.tableName}.version, 0) <= COALESCE(EXCLUDED.version, 0))
+         RETURNING payload
+       )
+       SELECT guarded.all_plans_found, guarded.target_plan_found, guarded.project_conflict,
+              (SELECT payload FROM stored) AS payload
+       FROM guarded`, [
+      this.service,
+      value.id,
+      jsonbParam(value),
+      updatedAt,
+      context.requestId ?? this.sourceMachineId ?? null,
+      numberValue2(value.version),
+      jsonbParam(planIds),
+      targetPlanId,
+      explicitProject
+    ]);
+    const row = result.rows[0];
+    if (!row?.all_plans_found || !row.target_plan_found) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan membership changed through a missing plan: ${targetPlanId ?? planIds.join(", ")}`, { plan_ids: planIds, target_plan_id: targetPlanId });
+    }
+    if (row.project_conflict) {
+      throw new ResourceConflictError("PLAN_PROJECT_LINK_CONFLICT", `Task project conflicts with linked plan ${targetPlanId}`);
+    }
+    if (!row.payload) {
+      return await requireRecord("tasks", value.id, this);
+    }
+    return payloadRecord2(row.payload);
+  }
+  async updatePlanWithProjectLinkGuard(value, context = {}) {
+    await this.ensureSchema();
+    const result = await this.options.client.query(`/* todos:plan-update-project-link-guard */ WITH locked_plan AS MATERIALIZED (
+         SELECT payload FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'plans' AND object_id = $2 AND deleted_at IS NULL
+         FOR UPDATE
+       ), stored AS (
+         UPDATE ${this.tableName} r SET
+           payload = jsonb_set(
+             $3::jsonb,
+             '{project_id}',
+             COALESCE((SELECT payload->'project_id' FROM locked_plan), 'null'::jsonb),
+             true
+           ),
+           updated_at = $4::timestamptz,
+           deleted_at = NULL,
+           source_machine_id = COALESCE($5, r.source_machine_id),
+           version = COALESCE(r.version, 0) + 1
+         FROM locked_plan
+         WHERE r.service = $1 AND r.object_type = 'plans' AND r.object_id = $2 AND r.deleted_at IS NULL
+         RETURNING r.payload
+       )
+       SELECT EXISTS (SELECT 1 FROM locked_plan) AS plan_found,
+              (SELECT payload FROM stored) AS payload`, [
+      this.service,
+      value.id,
+      jsonbParam(value),
+      value.updated_at,
+      context.requestId ?? this.sourceMachineId ?? null
+    ]);
+    const row = result.rows[0];
+    if (!row?.plan_found || !row.payload)
+      throw new PlanNotFoundError(value.id);
+    return payloadRecord2(row.payload);
+  }
   async createTemplateWithTasks(template, tasks, context = {}) {
     await this.ensureSchema();
     const records = [
@@ -2622,6 +2815,333 @@ class PostgresJsonRecordStore {
       version: numberValue2(existing["version"])
     }, context);
   }
+  async getPlanProjectLinkReceipt(receiptId) {
+    const value = await this.get("plan_project_link_receipts", receiptId);
+    return value ? assertPlanProjectLinkReceipt(value) : null;
+  }
+  async getPlanProjectLinkReceiptByIdempotencyKey(idempotencyKey) {
+    await this.ensureSchema();
+    const result = await this.options.client.query(`/* todos:plan-project-link-receipt-by-key */ SELECT payload FROM ${this.tableName}
+       WHERE service = $1 AND object_type = 'plan_project_link_receipts' AND deleted_at IS NULL
+         AND payload->>'idempotency_key' = $2
+       LIMIT 2`, [this.service, idempotencyKey]);
+    if (result.rows.length > 1) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "More than one immutable receipt carries this idempotency key", { idempotency_key: idempotencyKey });
+    }
+    return result.rows[0] ? assertPlanProjectLinkReceipt(result.rows[0].payload) : null;
+  }
+  async currentPlanProjectLinkResult(receipt, action) {
+    const [plan, project, tasks] = await Promise.all([
+      this.get("plans", receipt.plan_id),
+      this.get("projects", receipt.project_id),
+      this.listTasks({ plan_id: receipt.plan_id, include_subtasks: true })
+    ]);
+    const sortedTasks = tasks.sort((left, right) => left.id.localeCompare(right.id));
+    if (!plan || !project || planProjectLinkResultDigest(plan, sortedTasks) !== receipt.result_digest) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RESULT_DRIFT", "The accepted plan-project-link result has drifted", { receipt_id: receipt.receipt_id });
+    }
+    return { mode: "apply", action, plan, project, tasks: sortedTasks, receipt };
+  }
+  async applyPlanProjectLink(input, context = {}) {
+    await this.ensureSchema();
+    const existing = await this.getPlanProjectLinkReceipt(input.receipt_id);
+    if (existing) {
+      if (existing.plan_id !== input.plan_id || existing.project_id !== input.project_id) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The idempotency key was already accepted for a different plan-project link", { idempotency_key: input.idempotency_key, receipt_id: existing.receipt_id });
+      }
+      const rolledBack = await this.get("plan_project_link_rollback_receipts", planProjectLinkRollbackReceiptId(input.receipt_id));
+      if (rolledBack) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The accepted plan-project link has already been rolled back", { receipt_id: input.receipt_id });
+      }
+      return this.currentPlanProjectLinkResult(existing, "already_linked");
+    }
+    const [plan, project, tasks, scopedPlans] = await Promise.all([
+      this.get("plans", input.plan_id),
+      this.get("projects", input.project_id),
+      this.listTasks({ plan_id: input.plan_id, include_subtasks: true }),
+      this.list("plans")
+    ]);
+    if (!plan)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan not found: ${input.plan_id}`);
+    if (!project)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_NOT_FOUND", `Project not found: ${input.project_id}`);
+    if (plan.updated_at !== input.expected_plan_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed after the link plan; fetch a fresh plan before applying", { expected_plan_revision: input.expected_plan_revision, current_plan_revision: plan.updated_at });
+    }
+    if (project.updated_at !== input.expected_project_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_REVISION_CONFLICT", "Destination project changed after the link plan; fetch a fresh plan before applying", { expected_project_revision: input.expected_project_revision, current_project_revision: project.updated_at });
+    }
+    const collision = scopedPlans.find((candidate) => candidate.id !== plan.id && candidate.project_id === project.id && candidate.slug !== null && candidate.slug === plan.slug);
+    if (collision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_SCOPE_COLLISION", "Another plan already owns this slug in the destination project", { conflicting_plan_id: collision.id, slug: plan.slug });
+    }
+    const sortedTasks = tasks.sort((left, right) => left.id.localeCompare(right.id));
+    const priorTaskProjectIds = Object.fromEntries(sortedTasks.map((task) => [task.id, task.project_id]));
+    const projectedPlan = { ...plan, project_id: project.id, updated_at: input.created_at };
+    const projectedTasks = sortedTasks.map((task) => task.project_id === project.id ? task : { ...task, project_id: project.id, updated_at: input.created_at, version: task.version + 1 });
+    const alreadyLinked = plan.project_id === project.id && sortedTasks.every((task) => task.project_id === project.id);
+    const receipt = {
+      schema_version: PLAN_PROJECT_LINK_SCHEMA_VERSION,
+      receipt_id: input.receipt_id,
+      idempotency_key: input.idempotency_key,
+      plan_id: plan.id,
+      project_id: project.id,
+      prior_plan_project_id: plan.project_id,
+      prior_task_project_ids: priorTaskProjectIds,
+      task_ids: sortedTasks.map((task) => task.id),
+      task_count: sortedTasks.length,
+      result_plan_revision: projectedPlan.updated_at,
+      result_digest: planProjectLinkResultDigest(projectedPlan, projectedTasks),
+      rollback_supported: true,
+      created_at: input.created_at
+    };
+    let mutation;
+    try {
+      mutation = await this.options.client.query(`/* todos:plan-project-link-atomic */ WITH
+         target_plan AS MATERIALIZED (
+           SELECT payload FROM ${this.tableName}
+           WHERE service = $1 AND object_type = 'plans' AND object_id = $2 AND deleted_at IS NULL
+           FOR UPDATE
+         ), target_project AS (
+           SELECT payload FROM ${this.tableName}
+           WHERE service = $1 AND object_type = 'projects' AND object_id = $3 AND deleted_at IS NULL
+           FOR UPDATE
+         ), member_tasks AS MATERIALIZED (
+           SELECT object_id, payload FROM ${this.tableName}
+           WHERE service = $1 AND object_type = 'tasks' AND deleted_at IS NULL
+             AND payload->>'plan_id' = $2
+             AND EXISTS (SELECT 1 FROM target_plan)
+           FOR UPDATE
+         ), existing AS (
+           SELECT payload FROM ${this.tableName}
+           WHERE service = $1 AND object_type = 'plan_project_link_receipts'
+             AND object_id = $6 AND deleted_at IS NULL
+           FOR UPDATE
+         ), collision AS (
+           SELECT 1 FROM ${this.tableName} r, target_plan p
+           WHERE r.service = $1 AND r.object_type = 'plans' AND r.deleted_at IS NULL
+             AND r.object_id <> $2 AND r.payload->>'project_id' = $3
+             AND r.payload->>'slug' IS NOT DISTINCT FROM p.payload->>'slug'
+             AND p.payload->>'slug' IS NOT NULL
+           LIMIT 1
+         ), checks AS (
+           SELECT
+             EXISTS (SELECT 1 FROM target_plan) AS plan_found,
+             EXISTS (SELECT 1 FROM target_project) AS project_found,
+             COALESCE((SELECT payload->>'updated_at' = $4 FROM target_plan), false) AS plan_revision_ok,
+             COALESCE((SELECT payload->>'updated_at' = $5 FROM target_project), false) AS project_revision_ok,
+             COALESCE((SELECT jsonb_object_agg(object_id, COALESCE(payload->'project_id', 'null'::jsonb) ORDER BY object_id) FROM member_tasks), '{}'::jsonb) = $8::jsonb
+               AND COALESCE((SELECT jsonb_agg(object_id ORDER BY object_id) FROM member_tasks), '[]'::jsonb) = $9::jsonb AS membership_ok,
+             EXISTS (SELECT 1 FROM collision) AS collision,
+             EXISTS (SELECT 1 FROM existing) AS has_existing
+         ), updated_plan AS (
+           UPDATE ${this.tableName} r SET
+             payload = r.payload || jsonb_build_object('project_id', $3::text, 'updated_at', $10::text),
+             updated_at = $10::timestamptz,
+             version = COALESCE(r.version, 0) + 1,
+             source_machine_id = COALESCE($11, r.source_machine_id)
+           FROM checks
+           WHERE r.service = $1 AND r.object_type = 'plans' AND r.object_id = $2 AND r.deleted_at IS NULL
+             AND checks.plan_found AND checks.project_found AND checks.plan_revision_ok
+             AND checks.project_revision_ok AND checks.membership_ok AND NOT checks.collision AND NOT checks.has_existing
+           RETURNING r.payload
+         ), updated_tasks AS (
+           UPDATE ${this.tableName} r SET
+             payload = r.payload || jsonb_build_object(
+               'project_id', $3::text,
+               'updated_at', $10::text,
+               'version', COALESCE((r.payload->>'version')::int, 0) + 1
+             ),
+             updated_at = $10::timestamptz,
+             version = COALESCE(r.version, 0) + 1,
+             source_machine_id = COALESCE($11, r.source_machine_id)
+           WHERE r.service = $1 AND r.object_type = 'tasks' AND r.deleted_at IS NULL
+             AND r.payload->>'plan_id' = $2
+             AND r.payload->>'project_id' IS DISTINCT FROM $3
+             AND EXISTS (SELECT 1 FROM updated_plan)
+           RETURNING 1
+         ), task_gate AS (
+           SELECT count(*) AS count FROM updated_tasks
+         ), inserted AS (
+           INSERT INTO ${this.tableName}
+             (service, object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version)
+           SELECT $1, 'plan_project_link_receipts', $6, $7::jsonb, $10::timestamptz, NULL, $11, 1
+           FROM checks, task_gate
+           WHERE NOT checks.has_existing AND EXISTS (SELECT 1 FROM updated_plan)
+           RETURNING payload
+         ) SELECT
+           checks.plan_found,
+           checks.project_found,
+           checks.plan_revision_ok,
+           checks.project_revision_ok,
+           checks.membership_ok,
+           checks.collision,
+           (SELECT payload FROM existing) AS existing_receipt,
+           (SELECT payload FROM inserted) AS inserted_receipt
+         FROM checks`, [
+        this.service,
+        plan.id,
+        project.id,
+        input.expected_plan_revision,
+        input.expected_project_revision,
+        receipt.receipt_id,
+        jsonbParam(receipt),
+        jsonbParam(priorTaskProjectIds),
+        jsonbParam(receipt.task_ids),
+        input.created_at,
+        this.machineId(context)
+      ]);
+    } catch (error) {
+      if (isPostgresUniqueViolation(error)) {
+        const raced = await this.getPlanProjectLinkReceipt(input.receipt_id);
+        if (raced && raced.plan_id === input.plan_id && raced.project_id === input.project_id) {
+          return this.currentPlanProjectLinkResult(raced, "already_linked");
+        }
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The idempotency key raced with a different plan-project link", { idempotency_key: input.idempotency_key });
+      }
+      throw error;
+    }
+    const row = mutation.rows[0];
+    if (!row?.plan_found)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan not found: ${plan.id}`);
+    if (!row.project_found)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_NOT_FOUND", `Project not found: ${project.id}`);
+    if (!row.plan_revision_ok)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed during the atomic link");
+    if (!row.project_revision_ok)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_REVISION_CONFLICT", "Project changed during the atomic link");
+    if (!row.membership_ok)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RESULT_DRIFT", "Plan membership changed during the atomic link");
+    if (row.collision)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_SCOPE_COLLISION", "Another plan owns this slug in the destination project");
+    const accepted = assertPlanProjectLinkReceipt(row.existing_receipt ?? row.inserted_receipt);
+    if (accepted.plan_id !== plan.id || accepted.project_id !== project.id) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The idempotency key was accepted for a different target");
+    }
+    return this.currentPlanProjectLinkResult(accepted, alreadyLinked ? "already_linked" : "linked");
+  }
+  async rollbackPlanProjectLink(input, context = {}) {
+    await this.ensureSchema();
+    const existingRollback = await this.get("plan_project_link_rollback_receipts", input.rollback_receipt_id);
+    if (existingRollback)
+      return existingRollback;
+    const receipt = await this.getPlanProjectLinkReceipt(input.receipt_id);
+    if (!receipt || receipt.plan_id !== input.plan_id || receipt.project_id !== input.project_id) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RECEIPT_NOT_FOUND", "No exact plan-project-link receipt matches this rollback request", { receipt_id: input.receipt_id });
+    }
+    const [plan, tasks] = await Promise.all([
+      this.get("plans", input.plan_id),
+      this.listTasks({ plan_id: input.plan_id, include_subtasks: true })
+    ]);
+    const sortedTasks = tasks.sort((left, right) => left.id.localeCompare(right.id));
+    if (!plan || plan.updated_at !== input.expected_plan_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed after the accepted link; fetch an exact readback before rollback");
+    }
+    if (planProjectLinkResultDigest(plan, sortedTasks) !== receipt.result_digest) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Plan membership or project linkage drifted; refusing conditional rollback");
+    }
+    const projectedPlan = { ...plan, project_id: receipt.prior_plan_project_id, updated_at: input.restored_at };
+    const projectedTasks = sortedTasks.map((task) => ({
+      ...task,
+      project_id: receipt.prior_task_project_ids[task.id] ?? null,
+      updated_at: input.restored_at,
+      version: task.version + 1
+    }));
+    const rollback = {
+      schema_version: PLAN_PROJECT_LINK_SCHEMA_VERSION,
+      action: "restored",
+      plan: projectedPlan,
+      tasks: projectedTasks,
+      accepted_receipt_id: receipt.receipt_id,
+      rollback_receipt_id: input.rollback_receipt_id,
+      restored_at: input.restored_at
+    };
+    const currentTaskProjects = Object.fromEntries(sortedTasks.map((task) => [task.id, task.project_id]));
+    const result = await this.options.client.query(`/* todos:plan-project-link-rollback-atomic */ WITH
+       target_plan AS MATERIALIZED (
+         SELECT payload FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'plans' AND object_id = $2 AND deleted_at IS NULL
+         FOR UPDATE
+       ), member_tasks AS MATERIALIZED (
+         SELECT object_id, payload FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'tasks' AND deleted_at IS NULL
+           AND payload->>'plan_id' = $2
+           AND EXISTS (SELECT 1 FROM target_plan)
+         FOR UPDATE
+       ), existing AS (
+         SELECT payload FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'plan_project_link_rollback_receipts'
+           AND object_id = $5 AND deleted_at IS NULL
+         FOR UPDATE
+       ), checks AS (
+         SELECT
+           EXISTS (SELECT 1 FROM target_plan) AS plan_found,
+           COALESCE((SELECT payload->>'updated_at' = $3 FROM target_plan), false) AS plan_revision_ok,
+           COALESCE((SELECT jsonb_object_agg(object_id, COALESCE(payload->'project_id', 'null'::jsonb) ORDER BY object_id) FROM member_tasks), '{}'::jsonb) = $7::jsonb
+             AND COALESCE((SELECT jsonb_agg(object_id ORDER BY object_id) FROM member_tasks), '[]'::jsonb) = $8::jsonb AS membership_ok,
+           EXISTS (SELECT 1 FROM existing) AS has_existing
+       ), updated_plan AS (
+         UPDATE ${this.tableName} r SET
+           payload = r.payload || jsonb_build_object('project_id', $9::jsonb, 'updated_at', $10::text),
+           updated_at = $10::timestamptz,
+           version = COALESCE(r.version, 0) + 1,
+           source_machine_id = COALESCE($11, r.source_machine_id)
+         FROM checks
+         WHERE r.service = $1 AND r.object_type = 'plans' AND r.object_id = $2 AND r.deleted_at IS NULL
+           AND checks.plan_found AND checks.plan_revision_ok AND checks.membership_ok AND NOT checks.has_existing
+         RETURNING 1
+       ), updated_tasks AS (
+         UPDATE ${this.tableName} r SET
+           payload = r.payload || jsonb_build_object(
+             'project_id', COALESCE($12::jsonb -> r.object_id, 'null'::jsonb),
+             'updated_at', $10::text,
+             'version', COALESCE((r.payload->>'version')::int, 0) + 1
+           ),
+           updated_at = $10::timestamptz,
+           version = COALESCE(r.version, 0) + 1,
+           source_machine_id = COALESCE($11, r.source_machine_id)
+         WHERE r.service = $1 AND r.object_type = 'tasks' AND r.deleted_at IS NULL
+           AND r.payload->>'plan_id' = $2 AND EXISTS (SELECT 1 FROM updated_plan)
+         RETURNING 1
+       ), task_gate AS (SELECT count(*) AS count FROM updated_tasks), inserted AS (
+         INSERT INTO ${this.tableName}
+           (service, object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version)
+         SELECT $1, 'plan_project_link_rollback_receipts', $5, $6::jsonb, $10::timestamptz, NULL, $11, 1
+         FROM checks, task_gate
+         WHERE NOT checks.has_existing AND EXISTS (SELECT 1 FROM updated_plan)
+         RETURNING payload
+       ) SELECT
+         checks.plan_found,
+         checks.plan_revision_ok,
+         checks.membership_ok,
+         (SELECT payload FROM existing) AS existing_rollback,
+         (SELECT payload FROM inserted) AS inserted_rollback
+       FROM checks`, [
+      this.service,
+      input.plan_id,
+      input.expected_plan_revision,
+      input.receipt_id,
+      input.rollback_receipt_id,
+      jsonbParam(rollback),
+      jsonbParam(currentTaskProjects),
+      jsonbParam(receipt.task_ids),
+      jsonbParam(receipt.prior_plan_project_id),
+      input.restored_at,
+      this.machineId(context),
+      jsonbParam(receipt.prior_task_project_ids)
+    ]);
+    const row = result.rows[0];
+    if (!row?.plan_found)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan not found: ${input.plan_id}`);
+    if (!row.plan_revision_ok)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed during rollback");
+    if (!row.membership_ok)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Plan membership changed during rollback");
+    const accepted = row.existing_rollback ?? row.inserted_rollback;
+    if (!accepted)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Rollback did not produce an immutable receipt");
+    return accepted;
+  }
   async deletePlan(id, context = {}) {
     await this.ensureSchema();
     const timestamp = new Date().toISOString();
@@ -2716,11 +3236,17 @@ class PostgresJsonRecordStore {
 }
 async function createTask(input, store, context) {
   const timestamp = new Date().toISOString();
-  const shortId = input.project_id ? await nextTaskShortId(input.project_id, store, context) : null;
+  const linkedPlan = input.plan_id ? await store.get("plans", input.plan_id) : null;
+  const requestedProjectId = input.project_id ?? context?.projectId ?? null;
+  if (linkedPlan?.project_id && requestedProjectId && requestedProjectId !== linkedPlan.project_id) {
+    throw new ResourceConflictError("PLAN_PROJECT_LINK_CONFLICT", `Task project conflicts with linked plan ${input.plan_id}: expected ${linkedPlan.project_id}`);
+  }
+  const effectiveProjectId = linkedPlan?.project_id ?? requestedProjectId;
+  const shortId = effectiveProjectId ? await nextTaskShortId(effectiveProjectId, store, context) : null;
   const task = {
     id: randomUUID(),
     short_id: shortId,
-    project_id: input.project_id ?? context?.projectId ?? null,
+    project_id: effectiveProjectId,
     parent_id: input.parent_id ?? null,
     plan_id: input.plan_id ?? null,
     task_list_id: input.task_list_id ?? context?.taskListId ?? null,
@@ -2774,15 +3300,27 @@ async function createTask(input, store, context) {
     synced_at: null,
     archived_at: null
   };
-  await store.upsert("tasks", task, context);
-  await logTaskChange(task.id, "created", "status", null, task.status, task.assigned_by ?? task.agent_id, store, context);
-  return task;
+  const storedTask = await store.upsertTaskWithPlanMembershipGuard(task, task.plan_id ? [task.plan_id] : [], input.project_id !== undefined || context?.projectId !== undefined, context);
+  await logTaskChange(storedTask.id, "created", "status", null, storedTask.status, storedTask.assigned_by ?? storedTask.agent_id, store, context);
+  return storedTask;
 }
 async function updateTask(id, input, store) {
   const existing = await requireRecord("tasks", id, store);
   if (existing.version !== input.version) {
     throw new Error(`Task ${id} version conflict: expected ${existing.version}, got ${input.version}`);
   }
+  const effectivePlanId = input.plan_id !== undefined ? input.plan_id : existing.plan_id;
+  const linkedPlan = effectivePlanId ? await store.get("plans", effectivePlanId) : null;
+  if (linkedPlan?.project_id) {
+    const effectiveProjectId = input.project_id !== undefined ? input.project_id : existing.project_id;
+    if (effectiveProjectId !== linkedPlan.project_id) {
+      if (input.project_id === undefined && (input.plan_id !== undefined || existing.project_id === null)) {
+        input = { ...input, project_id: linkedPlan.project_id };
+      } else {
+        throw new ResourceConflictError("PLAN_PROJECT_LINK_CONFLICT", `Task project conflicts with linked plan ${effectivePlanId}: expected ${linkedPlan.project_id}`);
+      }
+    }
+  }
   const reopened = existing.status === "completed" && input.status !== undefined && input.status !== "completed" && input.completed_at === undefined;
   const terminalNow = input.status !== undefined && isTerminalStatus(input.status);
   const task = {
@@ -2798,8 +3336,7 @@ async function updateTask(id, input, store) {
     created_by: existing.created_by,
     completed_at: reopened ? null : input.completed_at !== undefined ? input.completed_at : existing.completed_at
   };
-  await store.upsert("tasks", task);
-  return task;
+  return store.upsertTaskWithPlanMembershipGuard(task, [existing.plan_id, effectivePlanId].filter((planId) => Boolean(planId)), input.project_id !== undefined);
 }
 async function startTask(id, agentId, store) {
   const task = await requireRecord("tasks", id, store);
@@ -2863,8 +3400,7 @@ async function patchTask(task, patch, store) {
     version: task.version + 1,
     updated_at: new Date().toISOString()
   };
-  await store.upsert("tasks", updated);
-  return updated;
+  return store.upsertTaskWithPlanMembershipGuard(updated, [task.plan_id, updated.plan_id].filter((planId) => Boolean(planId)), Object.prototype.hasOwnProperty.call(patch, "project_id"));
 }
 function sameCloudLockHolder(stored, incoming) {
   if (!stored || !incoming)
@@ -3126,7 +3662,12 @@ async function updatePlan(id, input, store) {
       excludeId: id
     });
   }
-  return store.upsert("plans", { ...plan, ...patch, updated_at: new Date().toISOString() });
+  return store.updatePlanWithProjectLinkGuard({
+    ...plan,
+    ...patch,
+    project_id: plan.project_id,
+    updated_at: new Date().toISOString()
+  });
 }
 function matchAgentByName(agents, name, options) {
   const target = normalizeAgentNameInput(name);
@@ -3514,6 +4055,7 @@ var CLOUD_LOCK_EXPIRY_MINUTES = 30, TASK_ORDER_TIEBREAK = "CASE payload->>'prior
 var init_postgres_adapter = __esm(() => {
   init_types();
   init_creator_identity();
+  init_plan_project_link_contract();
   init_postgres_sync();
   init_integrity();
   init_redaction();
@@ -3536,9 +4078,9 @@ var init_types2 = __esm(() => {
 });
 
 // src/pr-groups/ledger.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 function sha256(value) {
-  return createHash2("sha256").update(value).digest("hex");
+  return createHash3("sha256").update(value).digest("hex");
 }
 function stableValue(value) {
   if (Array.isArray(value))
@@ -7610,6 +8152,29 @@ var init_migrations = __esm(() => {
   ${sqliteTodosProjectRegistrationSchemaSql()}
   INSERT OR IGNORE INTO _migrations (id) VALUES (69);
   COMMIT;
+  `,
+    `BEGIN;
+  CREATE TABLE IF NOT EXISTS plan_project_link_receipts (
+    receipt_id TEXT PRIMARY KEY,
+    idempotency_key TEXT NOT NULL UNIQUE,
+    plan_id TEXT NOT NULL,
+    project_id TEXT NOT NULL,
+    payload_hash TEXT NOT NULL,
+    payload TEXT NOT NULL,
+    created_at TEXT NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS idx_plan_project_link_receipts_plan
+    ON plan_project_link_receipts(plan_id, created_at);
+
+  CREATE TABLE IF NOT EXISTS plan_project_link_rollback_receipts (
+    rollback_receipt_id TEXT PRIMARY KEY,
+    accepted_receipt_id TEXT NOT NULL UNIQUE
+      REFERENCES plan_project_link_receipts(receipt_id) ON DELETE RESTRICT,
+    payload TEXT NOT NULL,
+    created_at TEXT NOT NULL
+  );
+  INSERT OR IGNORE INTO _migrations (id) VALUES (70);
+  COMMIT;
   `
   ];
 });
@@ -10952,7 +11517,7 @@ var init_runner_sandbox = __esm(() => {
 });
 
 // src/lib/event-hooks.ts
-import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
 import { appendFileSync, mkdirSync as mkdirSync3 } from "fs";
 import { dirname as dirname3, resolve as resolve6 } from "path";
 import { createConnection } from "net";
@@ -11019,7 +11584,7 @@ function buildEnvelope(type, payload, timestamp2 = new Date().toISOString()) {
     payload: redactValue(payload ?? {}),
     source: { package: "@hasna/todos", local_only: true }
   };
-  const digest = createHash3("sha256").update(canonicalEvent(base)).digest("hex");
+  const digest = createHash4("sha256").update(canonicalEvent(base)).digest("hex");
   return { ...base, integrity: { algorithm: "sha256", digest } };
 }
 function summarize(value) {
@@ -12838,6 +13403,14 @@ var init_checklists = __esm(() => {
   init_database();
 });
 
+// src/db/plan-row-serialization.ts
+function guardPlanRowsSqlite(planIds, db) {
+  const ids = [...new Set(planIds.filter((id) => Boolean(id)))].sort();
+  for (const id of ids) {
+    db.run("/* todos:sqlite-plan-row-guard */ UPDATE plans SET id = id WHERE id = ?", [id]);
+  }
+}
+
 // src/lib/recurrence.ts
 function parseRecurrenceRule(rule) {
   const normalized = rule.trim().toLowerCase();
@@ -14176,9 +14749,23 @@ function sanitizeUpdateTaskInput(input) {
     metadata: input.metadata !== undefined ? sanitizePreWriteValue(input.metadata, "task.metadata") : undefined
   };
 }
-function createTask2(input, db) {
-  input = sanitizeCreateTaskInput(input);
-  const d = db || getDatabase();
+function linkedPlanProjectId(planId, db) {
+  if (!planId)
+    return null;
+  const row = db.query("SELECT project_id FROM plans WHERE id = ?").get(planId);
+  return row?.project_id ?? null;
+}
+function resolveCreateProjectForPlan(input, db) {
+  const linkedProjectId = linkedPlanProjectId(input.plan_id, db);
+  if (!linkedProjectId)
+    return input.project_id || null;
+  if (input.project_id !== undefined && input.project_id !== linkedProjectId) {
+    throw new ResourceConflictError("PLAN_PROJECT_LINK_CONFLICT", `Task project conflicts with linked plan ${input.plan_id}: expected ${linkedProjectId}`);
+  }
+  return linkedProjectId;
+}
+function createTaskStored(input, d) {
+  const effectiveProjectId = resolveCreateProjectForPlan(input, d);
   const timestamp2 = now();
   const tags = input.tags || [];
   const machineId = currentStorageMachineId(d);
@@ -14192,7 +14779,7 @@ function createTask2(input, db) {
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
         id,
         null,
-        input.project_id || null,
+        effectiveProjectId,
         input.parent_id || null,
         input.plan_id || null,
         input.task_list_id || null,
@@ -14242,7 +14829,15 @@ function createTask2(input, db) {
   if (tags.length > 0) {
     insertTaskTags(id, tags, d);
   }
-  const task = getTask(id, d);
+  return getTask(id, d);
+}
+function createTask2(input, db) {
+  input = sanitizeCreateTaskInput(input);
+  const d = db || getDatabase();
+  const task = input.plan_id ? d.transaction(() => {
+    guardPlanRowsSqlite([input.plan_id], d);
+    return createTaskStored(input, d);
+  })() : createTaskStored(input, d);
   const payload = taskEventData(task);
   const databasePath = databasePathFromDatabase(d);
   dispatchWebhook2("task.created", payload, d).catch(() => {});
@@ -14342,6 +14937,10 @@ function listTasks2(filter = {}, db) {
     conditions.push("(created_by IS NULL OR LOWER(created_by) != LOWER(?))");
     params.push(filter.not_created_by);
   }
+  if (filter.updated_after) {
+    conditions.push("(julianday(updated_at) IS NULL OR julianday(updated_at) > julianday(?))");
+    params.push(filter.updated_after);
+  }
   if (filter.session_id) {
     conditions.push("session_id = ?");
     params.push(filter.session_id);
@@ -14502,6 +15101,10 @@ function countTasks(filter = {}, db) {
     conditions.push("(created_by IS NULL OR LOWER(created_by) != LOWER(?))");
     params.push(filter.not_created_by);
   }
+  if (filter.updated_after) {
+    conditions.push("(julianday(updated_at) IS NULL OR julianday(updated_at) > julianday(?))");
+    params.push(filter.updated_after);
+  }
   if (filter.session_id) {
     conditions.push("session_id = ?");
     params.push(filter.session_id);
@@ -14541,7 +15144,7 @@ function countTasks(filter = {}, db) {
   const row = d.query(`SELECT COUNT(*) as count FROM tasks ${where}`).get(...params);
   return row.count;
 }
-function updateTask2(id, input, db) {
+function updateTaskStored(id, input, db) {
   const d = db || getDatabase();
   const task = getTask(id, d);
   if (!task)
@@ -14550,6 +15153,18 @@ function updateTask2(id, input, db) {
     throw new VersionConflictError(id, input.version, task.version);
   }
   input = sanitizeUpdateTaskInput(input);
+  const effectivePlanId = input.plan_id !== undefined ? input.plan_id : task.plan_id;
+  const linkedProjectId = linkedPlanProjectId(effectivePlanId, d);
+  if (linkedProjectId) {
+    const effectiveProjectId = input.project_id !== undefined ? input.project_id : task.project_id;
+    if (effectiveProjectId !== linkedProjectId) {
+      if (input.project_id === undefined && (input.plan_id !== undefined || task.project_id === null)) {
+        input = { ...input, project_id: linkedProjectId };
+      } else {
+        throw new ResourceConflictError("PLAN_PROJECT_LINK_CONFLICT", `Task project conflicts with linked plan ${effectivePlanId}: expected ${linkedProjectId}`);
+      }
+    }
+  }
   const timestamp2 = now();
   const completionTimestamp = input.completed_at ?? timestamp2;
   const sets = ["version = version + 1", "updated_at = ?"];
@@ -14757,6 +15372,21 @@ function updateTask2(id, input, db) {
   emitSharedTaskEventQuiet({ type: "task.updated", task: updatedTask, databasePath });
   return updatedTask;
 }
+function updateTask2(id, input, db) {
+  const d = db || getDatabase();
+  const before = getTask(id, d);
+  if (!before)
+    throw new TaskNotFoundError(id);
+  const guardedPlanIds = [before.plan_id, input.plan_id];
+  if (!guardedPlanIds.some(Boolean))
+    return updateTaskStored(id, input, d);
+  return d.transaction(() => {
+    guardPlanRowsSqlite(guardedPlanIds, d);
+    const current = getTask(id, d);
+    guardPlanRowsSqlite([current?.plan_id, input.plan_id], d);
+    return updateTaskStored(id, input, d);
+  })();
+}
 function deleteTask(id, db) {
   const d = db || getDatabase();
   const row = d.query("SELECT * FROM tasks WHERE id = ?").get(id);
@@ -15563,7 +16193,7 @@ function listPlans(projectId, db) {
   }
   return d.query("SELECT * FROM plans ORDER BY created_at DESC").all();
 }
-function updatePlan2(id, input, db) {
+function updatePlanStored(id, input, db) {
   const d = db || getDatabase();
   const plan = getPlan(id, d);
   if (!plan)
@@ -15608,6 +16238,13 @@ function updatePlan2(id, input, db) {
   });
   return updated;
 }
+function updatePlan2(id, input, db) {
+  const d = db || getDatabase();
+  return d.transaction(() => {
+    guardPlanRowsSqlite([id], d);
+    return updatePlanStored(id, input, d);
+  })();
+}
 function deletePlan(id, db) {
   const d = db || getDatabase();
   const plan = getPlan(id, d);
@@ -16032,7 +16669,7 @@ var init_boards = __esm(() => {
 });
 
 // src/lib/artifact-store.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync2, rmSync as rmSync2, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
 import { basename, dirname as dirname4, join as join6, resolve as resolve7 } from "path";
 import { tmpdir as tmpdir2 } from "os";
@@ -16057,7 +16694,7 @@ function artifactStorePath(relativePath) {
   return join6(artifactStoreRoot(), normalized);
 }
 function sha2562(buffer) {
-  return createHash4("sha256").update(buffer).digest("hex");
+  return createHash5("sha256").update(buffer).digest("hex");
 }
 function isTextLike(buffer, path) {
   if (buffer.includes(0))
@@ -18344,6 +18981,187 @@ var init_integrity2 = __esm(() => {
   REQUIRED_TABLES = { tasks: true, task_lists: true, projects: true };
 });
 
+// src/db/plan-project-links.ts
+function getPlanProjectLinkReceipt(receiptId, db) {
+  const d = db || getDatabase();
+  const row = d.query("SELECT payload FROM plan_project_link_receipts WHERE receipt_id = ?").get(receiptId);
+  return row ? assertPlanProjectLinkReceipt(JSON.parse(row.payload)) : null;
+}
+function getPlanProjectLinkReceiptByIdempotencyKey(idempotencyKey, db) {
+  const d = db || getDatabase();
+  const row = d.query("SELECT payload FROM plan_project_link_receipts WHERE idempotency_key = ?").get(idempotencyKey);
+  return row ? assertPlanProjectLinkReceipt(JSON.parse(row.payload)) : null;
+}
+function exactTasks(planId, db) {
+  return listTasks2({ plan_id: planId, include_subtasks: true, include_archived: true }, db).sort((left, right) => left.id.localeCompare(right.id));
+}
+function currentResult(planId, projectId, receipt, db, action) {
+  const plan = getPlan(planId, db);
+  const project = getProject(projectId, db);
+  if (!plan || !project) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RESULT_DRIFT", "An accepted plan-project-link target no longer resolves", { plan_id: planId, project_id: projectId, receipt_id: receipt.receipt_id });
+  }
+  const tasks = exactTasks(planId, db);
+  if (planProjectLinkResultDigest(plan, tasks) !== receipt.result_digest) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RESULT_DRIFT", "The accepted plan-project-link result has drifted", { plan_id: planId, project_id: projectId, receipt_id: receipt.receipt_id });
+  }
+  return { mode: "apply", action, plan, project, tasks, receipt };
+}
+function applyPlanProjectLinkSqlite(input, db) {
+  const d = db || getDatabase();
+  const mutate = d.transaction(() => {
+    guardPlanRowsSqlite([input.plan_id], d);
+    const requestHash = planProjectLinkRequestHash(input.plan_id, input.project_id);
+    const existingRow = d.query("SELECT payload_hash, payload FROM plan_project_link_receipts WHERE idempotency_key = ?").get(input.idempotency_key);
+    if (existingRow) {
+      if (existingRow.payload_hash !== requestHash) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The idempotency key was already accepted for a different plan-project link", { idempotency_key: input.idempotency_key });
+      }
+      const rolledBack = d.query("SELECT rollback_receipt_id FROM plan_project_link_rollback_receipts WHERE accepted_receipt_id = ?").get(input.receipt_id);
+      if (rolledBack) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The accepted plan-project link has already been rolled back", { receipt_id: input.receipt_id });
+      }
+      return currentResult(input.plan_id, input.project_id, assertPlanProjectLinkReceipt(JSON.parse(existingRow.payload)), d, "already_linked");
+    }
+    const plan = getPlan(input.plan_id, d);
+    if (!plan) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan not found: ${input.plan_id}`);
+    }
+    const project = getProject(input.project_id, d);
+    if (!project) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_NOT_FOUND", `Project not found: ${input.project_id}`);
+    }
+    if (plan.updated_at !== input.expected_plan_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed after the link plan; fetch a fresh plan before applying", { expected_plan_revision: input.expected_plan_revision, current_plan_revision: plan.updated_at });
+    }
+    if (project.updated_at !== input.expected_project_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_REVISION_CONFLICT", "Destination project changed after the link plan; fetch a fresh plan before applying", { expected_project_revision: input.expected_project_revision, current_project_revision: project.updated_at });
+    }
+    if (plan.slug) {
+      const collision = d.query("SELECT id FROM plans WHERE project_id = ? AND slug = ? AND id <> ? LIMIT 1").get(project.id, plan.slug, plan.id);
+      if (collision) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_SCOPE_COLLISION", "Another plan already owns this slug in the destination project", { conflicting_plan_id: collision.id, slug: plan.slug });
+      }
+    }
+    const beforeTasks = exactTasks(plan.id, d);
+    const alreadyLinked = plan.project_id === project.id && beforeTasks.every((task) => task.project_id === project.id);
+    const priorTaskProjectIds = Object.fromEntries(beforeTasks.map((task) => [task.id, task.project_id]));
+    const timestamp2 = input.created_at;
+    if (plan.project_id !== project.id) {
+      d.run("UPDATE plans SET project_id = ?, updated_at = ? WHERE id = ? AND updated_at = ?", [
+        project.id,
+        timestamp2,
+        plan.id,
+        input.expected_plan_revision
+      ]);
+    }
+    for (const task of beforeTasks) {
+      if (task.project_id === project.id)
+        continue;
+      d.run("UPDATE tasks SET project_id = ?, updated_at = ?, version = version + 1 WHERE id = ? AND plan_id = ?", [project.id, timestamp2, task.id, plan.id]);
+    }
+    const linkedPlan = getPlan(plan.id, d);
+    const linkedTasks = exactTasks(plan.id, d);
+    if (linkedPlan.project_id !== project.id || linkedTasks.length !== beforeTasks.length || linkedTasks.some((task) => task.project_id !== project.id)) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RESULT_DRIFT", "Atomic plan-project link readback did not preserve the exact plan membership", { plan_id: plan.id, project_id: project.id });
+    }
+    const receipt = {
+      schema_version: PLAN_PROJECT_LINK_SCHEMA_VERSION,
+      receipt_id: input.receipt_id,
+      idempotency_key: input.idempotency_key,
+      plan_id: plan.id,
+      project_id: project.id,
+      prior_plan_project_id: plan.project_id,
+      prior_task_project_ids: priorTaskProjectIds,
+      task_ids: beforeTasks.map((task) => task.id),
+      task_count: beforeTasks.length,
+      result_plan_revision: linkedPlan.updated_at,
+      result_digest: planProjectLinkResultDigest(linkedPlan, linkedTasks),
+      rollback_supported: true,
+      created_at: input.created_at
+    };
+    d.run(`INSERT INTO plan_project_link_receipts
+       (receipt_id, idempotency_key, plan_id, project_id, payload_hash, payload, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?)`, [
+      receipt.receipt_id,
+      receipt.idempotency_key,
+      receipt.plan_id,
+      receipt.project_id,
+      requestHash,
+      JSON.stringify(receipt),
+      receipt.created_at
+    ]);
+    return {
+      mode: "apply",
+      action: alreadyLinked ? "already_linked" : "linked",
+      plan: linkedPlan,
+      project,
+      tasks: linkedTasks,
+      receipt
+    };
+  });
+  return mutate();
+}
+function rollbackPlanProjectLinkSqlite(input, db) {
+  const d = db || getDatabase();
+  return d.transaction(() => {
+    guardPlanRowsSqlite([input.plan_id], d);
+    const priorRollback = d.query("SELECT payload FROM plan_project_link_rollback_receipts WHERE accepted_receipt_id = ?").get(input.receipt_id);
+    if (priorRollback)
+      return JSON.parse(priorRollback.payload);
+    const receipt = getPlanProjectLinkReceipt(input.receipt_id, d);
+    if (!receipt || receipt.plan_id !== input.plan_id || receipt.project_id !== input.project_id) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RECEIPT_NOT_FOUND", "No exact plan-project-link receipt matches this rollback request", { receipt_id: input.receipt_id, plan_id: input.plan_id, project_id: input.project_id });
+    }
+    const plan = getPlan(input.plan_id, d);
+    if (!plan || plan.updated_at !== input.expected_plan_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed after the accepted link; fetch an exact readback before rollback", { expected_plan_revision: input.expected_plan_revision, current_plan_revision: plan?.updated_at ?? null });
+    }
+    const tasks = exactTasks(plan.id, d);
+    if (planProjectLinkResultDigest(plan, tasks) !== receipt.result_digest || tasks.length !== receipt.task_ids.length || tasks.some((task, index) => task.id !== receipt.task_ids[index])) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Plan membership or project linkage drifted; refusing conditional rollback", { receipt_id: receipt.receipt_id });
+    }
+    d.run("UPDATE plans SET project_id = ?, updated_at = ? WHERE id = ? AND updated_at = ?", [
+      receipt.prior_plan_project_id,
+      input.restored_at,
+      plan.id,
+      input.expected_plan_revision
+    ]);
+    for (const task of tasks) {
+      const priorProjectId = receipt.prior_task_project_ids[task.id];
+      if (priorProjectId === undefined && !(task.id in receipt.prior_task_project_ids)) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Receipt does not contain the exact prior project for every member task", { task_id: task.id, receipt_id: receipt.receipt_id });
+      }
+      d.run("UPDATE tasks SET project_id = ?, updated_at = ?, version = version + 1 WHERE id = ? AND plan_id = ?", [priorProjectId, input.restored_at, task.id, plan.id]);
+    }
+    const restoredPlan = getPlan(plan.id, d);
+    const restoredTasks = exactTasks(plan.id, d);
+    if (restoredPlan.project_id !== receipt.prior_plan_project_id || restoredTasks.some((task) => task.project_id !== receipt.prior_task_project_ids[task.id])) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Rollback readback did not restore every exact prior project id", { receipt_id: receipt.receipt_id });
+    }
+    const result = {
+      schema_version: PLAN_PROJECT_LINK_SCHEMA_VERSION,
+      action: "restored",
+      plan: restoredPlan,
+      tasks: restoredTasks,
+      accepted_receipt_id: receipt.receipt_id,
+      rollback_receipt_id: input.rollback_receipt_id,
+      restored_at: input.restored_at
+    };
+    d.run(`INSERT INTO plan_project_link_rollback_receipts
+       (rollback_receipt_id, accepted_receipt_id, payload, created_at)
+       VALUES (?, ?, ?, ?)`, [result.rollback_receipt_id, result.accepted_receipt_id, JSON.stringify(result), result.restored_at]);
+    return result;
+  })();
+}
+var init_plan_project_links = __esm(() => {
+  init_plan_project_link_contract();
+  init_database();
+  init_plans();
+  init_projects();
+  init_tasks();
+});
+
 // src/storage/sqlite-snapshot.ts
 function exportSqliteTodosStorageSnapshot(db) {
   const d = db ?? getDatabase();
@@ -18850,6 +19668,12 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       update: (id, input) => updatePlan2(id, input, database()),
       delete: (id) => deletePlan(id, database())
     },
+    planProjectLinks: {
+      apply: (input) => applyPlanProjectLinkSqlite(input, database()),
+      rollback: (input) => rollbackPlanProjectLinkSqlite(input, database()),
+      getReceipt: (receiptId) => getPlanProjectLinkReceipt(receiptId, database()),
+      getReceiptByIdempotencyKey: (key) => getPlanProjectLinkReceiptByIdempotencyKey(key, database())
+    },
     agents: {
       register: (input) => registerAgent2(input, database()),
       get: (id) => getAgent(id, database()),
@@ -18924,6 +19748,7 @@ var init_local_sqlite = __esm(() => {
   init_comments();
   init_database();
   init_integrity2();
+  init_plan_project_links();
   init_sqlite_snapshot();
   TASK_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 });
@@ -19533,7 +20358,7 @@ var init_sqlite = __esm(() => {
 });
 
 // src/project-registration/authority.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 function canonicalProjectRegistrationJson(value) {
   return JSON.stringify(canonicalize(value));
 }
@@ -19551,7 +20376,7 @@ function canonicalize(value) {
   return out;
 }
 function digestProjectRegistrationValue(value) {
-  return createHash5("sha256").update(canonicalProjectRegistrationJson(value)).digest("hex");
+  return createHash6("sha256").update(canonicalProjectRegistrationJson(value)).digest("hex");
 }
 function deriveTodosProjectRegistrationIdempotencyKey(input) {
   return `prk_${digestProjectRegistrationValue({
@@ -20829,7 +21654,7 @@ var init_cloud = __esm(() => {
 });
 
 // src/db/api-keys.ts
-import { createHash as createHash6, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHash as createHash7, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual3 } from "crypto";
 function rowToRecord2(row) {
   return {
     id: row.id,
@@ -20843,7 +21668,7 @@ function rowToRecord2(row) {
   };
 }
 function hashApiKey(key) {
-  return createHash6("sha256").update(key).digest("hex");
+  return createHash7("sha256").update(key).digest("hex");
 }
 function safeEqualHex(a, b) {
   if (a.length !== b.length)
@@ -20851,8 +21676,8 @@ function safeEqualHex(a, b) {
   return timingSafeEqual3(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
 }
 function safeEqualStrings(a, b) {
-  const ah = createHash6("sha256").update(a, "utf8").digest();
-  const bh = createHash6("sha256").update(b, "utf8").digest();
+  const ah = createHash7("sha256").update(a, "utf8").digest();
+  const bh = createHash7("sha256").update(b, "utf8").digest();
   return timingSafeEqual3(ah, bh);
 }
 function hasActiveApiKeys(db) {
@@ -22878,6 +23703,9 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
         ProjectTaskListRollbackResult: projectTaskListRollbackResultSchema,
         TaskComment: taskCommentSchema,
         Plan: planSchema,
+        PlanProjectLinkReceipt: planProjectLinkReceiptSchema,
+        PlanProjectLinkResult: planProjectLinkResultSchema,
+        PlanProjectLinkRollbackResult: planProjectLinkRollbackResultSchema,
         Template: templateSchema,
         TemplateTask: templateTaskSchema,
         TemplateVariable: templateVariableSchema,
@@ -22891,6 +23719,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             status: { type: "string" },
             priority: { type: "string" },
             project_id: { type: "string" },
+            plan_id: { type: "string" },
             assigned_to: { type: "string" },
             agent_id: { type: "string" },
             tags: { type: "array", items: { type: "string" } }
@@ -22905,6 +23734,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             priority: { type: "string" },
             assigned_to: { type: "string" },
             project_id: { type: "string", nullable: true },
+            plan_id: { type: "string", nullable: true },
             task_list_id: { type: "string", nullable: true },
             version: { type: "number" }
           }
@@ -22976,6 +23806,32 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             expected_task_list_revision: { type: "string", minLength: 1 }
           }
         },
+        PlanProjectLinkApplyInput: {
+          type: "object",
+          additionalProperties: false,
+          required: ["project_id", "expected_plan_revision", "expected_project_revision", "idempotency_key"],
+          properties: {
+            project_id: { type: "string", minLength: 1 },
+            expected_plan_revision: { type: "string", minLength: 1 },
+            expected_project_revision: { type: "string", minLength: 1 },
+            idempotency_key: {
+              type: "string",
+              minLength: 8,
+              maxLength: 128,
+              pattern: "^[A-Za-z0-9._:-]+$"
+            }
+          }
+        },
+        PlanProjectLinkRollbackInput: {
+          type: "object",
+          additionalProperties: false,
+          required: ["project_id", "receipt_id", "expected_plan_revision"],
+          properties: {
+            project_id: { type: "string", minLength: 1 },
+            receipt_id: { type: "string", minLength: 1 },
+            expected_plan_revision: { type: "string", minLength: 1 }
+          }
+        },
         ErrorResponse: {
           type: "object",
           required: ["error"],
@@ -23859,6 +24715,12 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             { name: "assigned_to", in: "query", schema: { type: "string" } },
             { name: "agent_id", in: "query", schema: { type: "string" } },
             { name: "tags", in: "query", schema: { type: "string" }, description: "Comma-separated tags; matches tasks carrying any of them" },
+            {
+              name: "updated_after",
+              in: "query",
+              schema: { type: "string", format: "date-time" },
+              description: "Since-cursor. Returns only tasks whose updated_at is strictly after this instant, and `total` respects it too. " + "Intended for pollers: re-read what changed instead of the whole table. Must be a full RFC 3339 date-time with " + "an explicit offset (e.g. 2026-08-07T12:00:00Z or 2026-08-07T12:00:00+03:00); a reduced-precision value such as " + "`2026` or `2026-08`, or any other malformed value, is rejected with 400 rather than ignored. Timestamps stored " + "without an offset are read as UTC on every backend."
+            },
             { name: "limit", in: "query", schema: { type: "integer", minimum: 1 } },
             { name: "offset", in: "query", schema: { type: "integer", minimum: 0 } }
           ],
@@ -24187,6 +25049,54 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { deleted: { type: "boolean" }, id: { type: "string" } } } } } } }
         }
       },
+      "/v1/plans/{id}/project-link": {
+        get: {
+          operationId: "planPlanProjectLink",
+          summary: "Plan atomic linkage of an existing plan and every current member task to a project",
+          parameters: [
+            { name: "id", in: "path", required: true, schema: { type: "string" } },
+            { name: "project_id", in: "query", required: true, schema: { type: "string" } }
+          ],
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/PlanProjectLinkResult" } } } },
+            "404": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "409": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
+        },
+        post: {
+          operationId: "applyPlanProjectLink",
+          summary: "Atomically and idempotently link an existing plan and every current member task to a project",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/PlanProjectLinkApplyInput" } } }
+          },
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/PlanProjectLinkResult" } } } },
+            "201": { content: { "application/json": { schema: { $ref: "#/components/schemas/PlanProjectLinkResult" } } } },
+            "400": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "404": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "409": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
+        }
+      },
+      "/v1/plans/{id}/project-link/rollback": {
+        post: {
+          operationId: "rollbackPlanProjectLink",
+          summary: "Conditionally restore every exact prior project link from an accepted receipt",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/PlanProjectLinkRollbackInput" } } }
+          },
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/PlanProjectLinkRollbackResult" } } } },
+            "400": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "404": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "409": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
+        }
+      },
       "/v1/templates": {
         get: {
           operationId: "listTemplates",
@@ -24404,7 +25314,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
     }
   };
 }
-var taskSchema, projectSchema, taskListSchema, projectTaskListEnsureReceiptSchema, projectTaskListEnsureResultSchema, projectTaskListRollbackResultSchema, taskCommentSchema, planSchema, templateTaskSchema, templateSchema, templateVariableSchema, createTemplateTaskInputSchema;
+var taskSchema, projectSchema, taskListSchema, projectTaskListEnsureReceiptSchema, projectTaskListEnsureResultSchema, projectTaskListRollbackResultSchema, taskCommentSchema, planSchema, planProjectLinkReceiptSchema, planProjectLinkResultSchema, planProjectLinkRollbackResultSchema, templateTaskSchema, templateSchema, templateVariableSchema, createTemplateTaskInputSchema;
 var init_openapi = __esm(() => {
   init_package_version();
   init_types();
@@ -24556,6 +25466,75 @@ var init_openapi = __esm(() => {
       updated_at: { type: "string", format: "date-time" }
     }
   };
+  planProjectLinkReceiptSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "schema_version",
+      "receipt_id",
+      "idempotency_key",
+      "plan_id",
+      "project_id",
+      "prior_plan_project_id",
+      "prior_task_project_ids",
+      "task_ids",
+      "task_count",
+      "result_plan_revision",
+      "result_digest",
+      "rollback_supported",
+      "created_at"
+    ],
+    properties: {
+      schema_version: { type: "string", enum: ["todos.plan-project-link.v1"] },
+      receipt_id: { type: "string" },
+      idempotency_key: { type: "string" },
+      plan_id: { type: "string" },
+      project_id: { type: "string" },
+      prior_plan_project_id: { type: "string", nullable: true },
+      prior_task_project_ids: {
+        type: "object",
+        additionalProperties: { type: "string", nullable: true }
+      },
+      task_ids: { type: "array", items: { type: "string" } },
+      task_count: { type: "integer", minimum: 0 },
+      result_plan_revision: { type: "string" },
+      result_digest: { type: "string" },
+      rollback_supported: { type: "boolean", enum: [true] },
+      created_at: { type: "string", format: "date-time" }
+    }
+  };
+  planProjectLinkResultSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: ["mode", "action", "plan", "project", "tasks", "receipt"],
+    properties: {
+      mode: { type: "string", enum: ["plan", "apply"] },
+      action: { type: "string", enum: ["would_link", "linked", "already_linked"] },
+      plan: { $ref: "#/components/schemas/Plan" },
+      project: { $ref: "#/components/schemas/Project" },
+      tasks: { type: "array", items: { $ref: "#/components/schemas/Task" } },
+      receipt: {
+        oneOf: [
+          { $ref: "#/components/schemas/PlanProjectLinkReceipt" },
+          { type: "null" }
+        ]
+      }
+    }
+  };
+  planProjectLinkRollbackResultSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: ["schema_version", "action", "plan", "tasks", "accepted_receipt_id", "rollback_receipt_id", "restored_at"],
+    properties: {
+      schema_version: { type: "string", enum: ["todos.plan-project-link.v1"] },
+      action: { type: "string", enum: ["restored"] },
+      plan: { $ref: "#/components/schemas/Plan" },
+      tasks: { type: "array", items: { $ref: "#/components/schemas/Task" } },
+      accepted_receipt_id: { type: "string" },
+      rollback_receipt_id: { type: "string" },
+      restored_at: { type: "string", format: "date-time" }
+    }
+  };
   templateTaskSchema = {
     type: "object",
     required: ["id", "template_id", "position", "title_pattern", "priority", "tags", "depends_on_positions", "metadata", "created_at"],
@@ -24760,7 +25739,7 @@ function decodeCommentCursor(value) {
 var MAX_COMMENT_CURSOR_LENGTH = 1024;
 
 // src/lib/project-task-list-ensure.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 function canonicalJson(value) {
   if (value === null || typeof value !== "object")
     return JSON.stringify(value);
@@ -24769,7 +25748,7 @@ function canonicalJson(value) {
   return `{${Object.entries(value).filter(([, item]) => item !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`).join(",")}}`;
 }
 function digest(value) {
-  return createHash7("sha256").update(canonicalJson(value)).digest("hex");
+  return createHash8("sha256").update(canonicalJson(value)).digest("hex");
 }
 function deriveIdempotencyKey(projectId, slug) {
   return `ptlk_${digest({ project_id: projectId, slug }).slice(0, 48)}`;
@@ -25014,6 +25993,75 @@ var init_project_task_list_ensure = __esm(() => {
   };
 });
 
+// src/lib/plan-project-link.ts
+async function exactPlanProjectLinkState(store, planId, projectId) {
+  const [plan, project] = await Promise.all([
+    store.plans.get(planId),
+    store.projects.get(projectId)
+  ]);
+  if (!plan) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan not found: ${planId}`, { plan_id: planId });
+  }
+  if (!project) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_NOT_FOUND", `Project not found: ${projectId}`, { project_id: projectId });
+  }
+  const [tasks, projectPlans] = await Promise.all([
+    store.tasks.list({ plan_id: plan.id, include_subtasks: true, include_archived: true }),
+    store.plans.list(project.id)
+  ]);
+  const collision = projectPlans.find((candidate) => candidate.id !== plan.id && candidate.slug !== null && candidate.slug === plan.slug);
+  if (collision) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_SCOPE_COLLISION", "Another plan already owns this slug in the destination project", { plan_id: plan.id, project_id: project.id, conflicting_plan_id: collision.id, slug: plan.slug });
+  }
+  return {
+    plan,
+    project,
+    tasks: tasks.sort((left, right) => left.id.localeCompare(right.id))
+  };
+}
+async function planPlanProjectLink(store, planId, projectId) {
+  const state = await exactPlanProjectLinkState(store, planId, projectId);
+  const alreadyLinked = state.plan.project_id === state.project.id && state.tasks.every((task) => task.project_id === state.project.id);
+  return {
+    mode: "plan",
+    action: alreadyLinked ? "already_linked" : "would_link",
+    ...state,
+    receipt: null
+  };
+}
+async function applyPlanProjectLink(store, planId, projectId, options) {
+  if (!store.planProjectLinks) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_UNSUPPORTED", "This storage backend cannot atomically link an existing plan and its tasks", { storage_kind: store.kind });
+  }
+  const key = normalizePlanProjectLinkIdempotencyKey(options.idempotency_key);
+  return store.planProjectLinks.apply({
+    plan_id: planId,
+    project_id: projectId,
+    expected_plan_revision: options.expected_plan_revision,
+    expected_project_revision: options.expected_project_revision,
+    idempotency_key: key,
+    receipt_id: planProjectLinkReceiptId(key),
+    created_at: new Date().toISOString()
+  });
+}
+async function rollbackPlanProjectLink(store, planId, projectId, options) {
+  if (!store.planProjectLinks) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_UNSUPPORTED", "This storage backend cannot atomically roll back an existing plan project link", { storage_kind: store.kind });
+  }
+  return store.planProjectLinks.rollback({
+    plan_id: planId,
+    project_id: projectId,
+    receipt_id: options.receipt_id,
+    expected_plan_revision: options.expected_plan_revision,
+    rollback_receipt_id: planProjectLinkRollbackReceiptId(options.receipt_id),
+    restored_at: new Date().toISOString()
+  });
+}
+var init_plan_project_link = __esm(() => {
+  init_plan_project_link_contract();
+  init_plan_project_link_contract();
+});
+
 // src/server/v1.ts
 var exports_v1 = {};
 __export(exports_v1, {
@@ -25036,6 +26084,21 @@ function enumQueryParam(url, name, vocabulary) {
     return { ok: false, response: error(400, result.message) };
   return { ok: true, value: collapseEnumValues(result.values) };
 }
+function parseSinceCursor(raw) {
+  const shape = `updated_after must be an RFC 3339 date-time with an explicit offset, ` + `e.g. 2026-08-07T12:00:00Z or 2026-08-07T12:00:00+03:00; got ${JSON.stringify(raw)}`;
+  const match = RFC3339_DATE_TIME.exec(raw);
+  if (!match)
+    return { ok: false, message: shape };
+  const parsed = Date.parse(raw);
+  if (Number.isNaN(parsed))
+    return { ok: false, message: shape };
+  const [, year, month, day] = match;
+  const probe = new Date(Date.UTC(Number(year), Number(month) - 1, Number(day)));
+  if (probe.getUTCFullYear() !== Number(year) || probe.getUTCMonth() !== Number(month) - 1 || probe.getUTCDate() !== Number(day)) {
+    return { ok: false, message: `updated_after names a date that does not exist: ${JSON.stringify(raw)}` };
+  }
+  return { ok: true, value: new Date(parsed).toISOString() };
+}
 function validateTaskCompletion(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return { ok: false, message: "completion body must be an object" };
@@ -25445,7 +26508,13 @@ async function handleV1Request(req, url, dependencies = {}) {
           const priorityParam = enumQueryParam(url, "priority", TASK_PRIORITIES);
           if (!priorityParam.ok)
             return priorityParam.response;
+          const updatedAfterRaw = url.searchParams.get("updated_after");
+          const updatedAfter = updatedAfterRaw === null ? null : parseSinceCursor(updatedAfterRaw);
+          if (updatedAfter !== null && !updatedAfter.ok) {
+            return error(400, updatedAfter.message);
+          }
           const filter = {
+            ...updatedAfter !== null && updatedAfter.ok ? { updated_after: updatedAfter.value } : {},
             ...url.searchParams.get("q") ? { query: url.searchParams.get("q") } : {},
             ...statusParam.value !== undefined ? { status: statusParam.value } : {},
             ...priorityParam.value !== undefined ? { priority: priorityParam.value } : {},
@@ -25907,6 +26976,54 @@ async function handleV1Request(req, url, dependencies = {}) {
         const plan = await store.plans.create(validated.input, contextFromPrincipal(principal, validated.input));
         return json4({ plan }, 201);
       }
+      if (id && action === "project-link" && !subId) {
+        if (method === "GET") {
+          const projectId = url.searchParams.get("project_id");
+          if (!projectId?.trim())
+            return error(400, "project_id query parameter is required");
+          return json4(await planPlanProjectLink(store, id, projectId));
+        }
+        if (method !== "POST")
+          return error(405, `method ${method} not allowed on /v1/plans/:id/project-link`);
+        const body = await readJson3(req);
+        if (!body)
+          return error(400, "invalid JSON body");
+        const allowed = new Set(["project_id", "expected_plan_revision", "expected_project_revision", "idempotency_key"]);
+        const unknown = Object.keys(body).find((key) => !allowed.has(key));
+        if (unknown)
+          return error(400, `unknown plan-project-link field: ${unknown}`);
+        for (const field of ["project_id", "expected_plan_revision", "expected_project_revision", "idempotency_key"]) {
+          if (typeof body[field] !== "string" || !body[field].trim()) {
+            return error(400, `${field} must be a non-empty string`);
+          }
+        }
+        const result = await applyPlanProjectLink(store, id, body.project_id, {
+          expected_plan_revision: body.expected_plan_revision,
+          expected_project_revision: body.expected_project_revision,
+          idempotency_key: body.idempotency_key
+        });
+        return json4(result, result.action === "linked" ? 201 : 200);
+      }
+      if (id && action === "project-link" && subId === "rollback") {
+        if (method !== "POST")
+          return error(405, `method ${method} not allowed on /v1/plans/:id/project-link/rollback`);
+        const body = await readJson3(req);
+        if (!body)
+          return error(400, "invalid JSON body");
+        const allowed = new Set(["project_id", "receipt_id", "expected_plan_revision"]);
+        const unknown = Object.keys(body).find((key) => !allowed.has(key));
+        if (unknown)
+          return error(400, `unknown plan-project-link rollback field: ${unknown}`);
+        for (const field of ["project_id", "receipt_id", "expected_plan_revision"]) {
+          if (typeof body[field] !== "string" || !body[field].trim()) {
+            return error(400, `${field} must be a non-empty string`);
+          }
+        }
+        return json4(await rollbackPlanProjectLink(store, id, body.project_id, {
+          receipt_id: body.receipt_id,
+          expected_plan_revision: body.expected_plan_revision
+        }));
+      }
       if (id && method === "GET") {
         const plan = await store.plans.get(id);
         return plan ? json4({ plan }) : error(404, "plan not found");
@@ -26185,6 +27302,10 @@ async function handleV1Request(req, url, dependencies = {}) {
     }
     return error(404, `unknown /v1 resource: ${resource ?? "(root)"}`);
   } catch (e) {
+    if (e instanceof PlanProjectLinkError) {
+      const status = e.code === "PLAN_PROJECT_LINK_PLAN_NOT_FOUND" || e.code === "PLAN_PROJECT_LINK_PROJECT_NOT_FOUND" || e.code === "PLAN_PROJECT_LINK_RECEIPT_NOT_FOUND" ? 404 : e.code === "PLAN_PROJECT_LINK_IDEMPOTENCY_KEY_INVALID" ? 400 : e.code === "PLAN_PROJECT_LINK_UNSUPPORTED" ? 501 : 409;
+      return error(status, e.message, { code: e.code, conflict: status === 409, ...e.details });
+    }
     if (e instanceof ProjectTaskListEnsureError) {
       const status = e.code === "PROJECT_NOT_FOUND" || e.code === "PROJECT_TASK_LIST_RECEIPT_NOT_FOUND" ? 404 : e.code === "PROJECT_TASK_LIST_IDEMPOTENCY_KEY_INVALID" ? 400 : 409;
       return error(status, e.message, { code: e.code, conflict: status === 409, ...e.details });
@@ -26208,7 +27329,7 @@ async function handleV1Request(req, url, dependencies = {}) {
     return error(500, e.message || "internal error");
   }
 }
-var JSON_HEADERS3, DEFAULT_COMMENT_PAGE_SIZE = 100, MAX_COMMENT_PAGE_SIZE = 500, LEGACY_COMMENT_RESPONSE_LIMIT = 500;
+var JSON_HEADERS3, DEFAULT_COMMENT_PAGE_SIZE = 100, MAX_COMMENT_PAGE_SIZE = 500, LEGACY_COMMENT_RESPONSE_LIMIT = 500, RFC3339_DATE_TIME;
 var init_v1 = __esm(() => {
   init_types();
   init_cloud();
@@ -26216,7 +27337,9 @@ var init_v1 = __esm(() => {
   init_project_registration();
   init_redaction();
   init_project_task_list_ensure();
+  init_plan_project_link();
   JSON_HEADERS3 = { "Content-Type": "application/json" };
+  RFC3339_DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})[Tt]\d{2}:\d{2}:\d{2}(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;
 });
 
 // node_modules/.bun/zod@3.25.76/node_modules/zod/v4/core/core.js
@@ -63870,12 +64993,12 @@ var init_local_notifications = __esm(() => {
 });
 
 // src/lib/local-encryption.ts
-import { createCipheriv, createDecipheriv, createHash as createHash8, randomBytes as randomBytes3, scryptSync, timingSafeEqual as timingSafeEqual4 } from "crypto";
+import { createCipheriv, createDecipheriv, createHash as createHash9, randomBytes as randomBytes3, scryptSync, timingSafeEqual as timingSafeEqual4 } from "crypto";
 function now3() {
   return new Date().toISOString();
 }
 function sha2563(value) {
-  return createHash8("sha256").update(value).digest("hex");
+  return createHash9("sha256").update(value).digest("hex");
 }
 function normalizeProfileName(value) {
   const name = (value || DEFAULT_ENCRYPTION_PROFILE).trim();
@@ -66013,7 +67136,7 @@ var init_capacity_forecasts = __esm(() => {
 });
 
 // src/lib/audit-ledger.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 function canonicalize2(value) {
   if (value === null || typeof value !== "object")
     return JSON.stringify(value);
@@ -66023,7 +67146,7 @@ function canonicalize2(value) {
   return `{${Object.keys(object4).sort().map((key) => `${JSON.stringify(key)}:${canonicalize2(object4[key])}`).join(",")}}`;
 }
 function hash(value) {
-  return createHash9("sha256").update(value).digest("hex");
+  return createHash10("sha256").update(value).digest("hex");
 }
 function parsePayload3(value) {
   if (!value)
@@ -99124,7 +100247,7 @@ var init_local_bridge = __esm(() => {
 });
 
 // src/lib/local-backups.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
 import { dirname as dirname7, resolve as resolve13 } from "path";
 import { mkdirSync as mkdirSync6 } from "fs";
@@ -99137,7 +100260,7 @@ function stableJson2(value) {
   return `{${Object.keys(record3).sort().map((key) => `${JSON.stringify(key)}:${stableJson2(record3[key])}`).join(",")}}`;
 }
 function sha2564(value) {
-  return createHash10("sha256").update(stableJson2(value)).digest("hex");
+  return createHash11("sha256").update(stableJson2(value)).digest("hex");
 }
 function sqliteIntegrity(db) {
   let quick = "unknown";
@@ -99787,7 +100910,7 @@ var init_onboarding_fixtures = __esm(() => {
 });
 
 // src/lib/local-snapshots.ts
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 function source(version2) {
   return {
     packageName: "@hasna/todos",
@@ -99811,7 +100934,7 @@ function stable(value) {
   return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => [key, stable(item)]));
 }
 function sha2565(value) {
-  return createHash11("sha256").update(JSON.stringify(stable(value))).digest("hex");
+  return createHash12("sha256").update(JSON.stringify(stable(value))).digest("hex");
 }
 function latestTimestamp2(items, fallback) {
   const timestamps = [];
@@ -100377,7 +101500,7 @@ var init_retrospectives = __esm(() => {
 });
 
 // src/lib/agent-replay-simulator.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 function isObject2(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -100398,7 +101521,7 @@ function stable2(value) {
   return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stable2(value[key])]));
 }
 function fingerprint2(value) {
-  return createHash12("sha256").update(JSON.stringify(stable2(value))).digest("hex");
+  return createHash13("sha256").update(JSON.stringify(stable2(value))).digest("hex");
 }
 function unpackFixture(input) {
   if (!isObject2(input))
@@ -100685,7 +101808,7 @@ __export(exports_local_extensions, {
   getLocalExtension: () => getLocalExtension,
   discoverLocalExtensions: () => discoverLocalExtensions
 });
-import { createHash as createHash13, createVerify } from "crypto";
+import { createHash as createHash14, createVerify } from "crypto";
 import { existsSync as existsSync13, readdirSync as readdirSync3, readFileSync as readFileSync9, statSync as statSync6 } from "fs";
 import { basename as basename5, join as join12, resolve as resolve14 } from "path";
 function isObject3(value) {
@@ -100771,7 +101894,7 @@ function parseJson(path) {
   return JSON.parse(readFileSync9(path, "utf8"));
 }
 function sha2566(bytes) {
-  return `sha256:${createHash13("sha256").update(bytes).digest("hex")}`;
+  return `sha256:${createHash14("sha256").update(bytes).digest("hex")}`;
 }
 function compareVersions(a, b) {
   const left = a.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -101246,7 +102369,7 @@ function issueToTask(issue2, opts) {
 var init_github = () => {};
 
 // src/db/inbox.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 function parseMetadata3(value) {
   if (!value)
     return {};
@@ -101266,7 +102389,7 @@ function compactWhitespace(value) {
 function fingerprintInboxInput(input) {
   const sourceType = input.source_type || detectInboxSourceType(input.body, input.source_url);
   const normalized = compactWhitespace(sanitizePreWriteText(input.body, "inbox.fingerprint")).slice(0, 8000);
-  return createHash14("sha256").update(`${sourceType}
+  return createHash15("sha256").update(`${sourceType}
 ${input.source_url || ""}
 ${normalized}`).digest("hex");
 }
@@ -105466,10 +106589,10 @@ __export(exports_extract, {
   EXTRACT_TAGS: () => EXTRACT_TAGS
 });
 import { existsSync as existsSync14, readFileSync as readFileSync10, statSync as statSync7 } from "fs";
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash16 } from "crypto";
 import { relative as relative5, resolve as resolve15, join as join13 } from "path";
 function stableHash(value) {
-  return createHash15("sha256").update(value).digest("hex");
+  return createHash16("sha256").update(value).digest("hex");
 }
 function normalizePathForMatch(value) {
   return value.replace(/\\/g, "/").replace(/^\.\//, "");
@@ -107193,13 +108316,13 @@ __export(exports_environment_snapshots, {
   compareEnvironmentSnapshotFiles: () => compareEnvironmentSnapshotFiles,
   captureEnvironmentSnapshot: () => captureEnvironmentSnapshot
 });
-import { createHash as createHash16 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 import { existsSync as existsSync15, readFileSync as readFileSync11, statSync as statSync8 } from "fs";
 import { hostname as hostname3, platform, arch } from "os";
 import { dirname as dirname8, join as join15, resolve as resolve16 } from "path";
 import { tmpdir as tmpdir3 } from "os";
 function sha2567(value) {
-  return createHash16("sha256").update(value).digest("hex");
+  return createHash17("sha256").update(value).digest("hex");
 }
 function fileRecord(root, relativePath) {
   const path = join15(root, relativePath);