@hasna/loops 0.4.28 → 0.4.29

package/dist/lib/advancement.d.ts

@@ -0,0 +1,52 @@
+import type { Loop, LoopRun } from "../types.js";
+export declare const MAX_RETRY_DELAY_MS: number;
+export declare const DEFAULT_CIRCUIT_BREAKER_THRESHOLD = 5;
+export declare const CIRCUIT_BREAKER_REASON_PREFIX = "circuit breaker open";
+export type CircuitBreakerThreshold = number | ((loop: Loop) => number | undefined);
+export type LoopAdvancementPatch = Partial<Pick<Loop, "status" | "nextRunAt" | "retryScheduledFor">>;
+export type LoopAdvancementPlan = {
+    kind: "none";
+    reason: "running" | "missing" | "inactive" | "archived" | "stale" | "already_applied";
+} | {
+    kind: "update";
+    reason: "retry" | "deferred_retry" | "recurrence";
+    patch: LoopAdvancementPatch;
+} | {
+    kind: "circuit_breaker";
+    failures: number;
+    reason: string;
+    markerScheduledFor: string;
+    patch: LoopAdvancementPatch;
+};
+export declare function loopAdvancementPatchMatchesCurrent(current: Loop, patch: LoopAdvancementPatch): boolean;
+/**
+ * Exponential retry backoff with jitter:
+ * delay = retryDelayMs * 2^(attempt-1) * (0.5 + random), capped at 6h.
+ * Provider-gated failures back off 4x harder.
+ */
+export declare function retryBackoffDelayMs(loop: Loop, run: LoopRun, random?: () => number): number;
+export declare function resolveBreakerThreshold(loop: Loop, override?: CircuitBreakerThreshold): number;
+/**
+ * Count consecutive final failures from newest-first run history.
+ *
+ * Retryable failures are neutral, a success resets the streak, and the newest
+ * circuit-breaker marker is a watermark so a manual resume starts a fresh
+ * streak.
+ */
+export declare function consecutiveFailureCountFromRuns(runs: readonly LoopRun[], maxAttempts?: number): number;
+/**
+ * Pure scheduling policy shared by the local scheduler and hosted API.
+ * Callers gather current loop state, deferred retry state, and recent history,
+ * then apply the returned storage mutations using their native sync/async API.
+ */
+export declare function planLoopAdvancement(input: {
+    current: Loop | undefined;
+    run: LoopRun;
+    finishedAt: Date;
+    succeeded: boolean;
+    deferredRetry?: LoopRun;
+    retryIntentRun?: LoopRun;
+    recentRuns?: readonly LoopRun[];
+    retryRandom?: number;
+    circuitBreakerThreshold?: CircuitBreakerThreshold;
+}): LoopAdvancementPlan;

package/dist/lib/agent-adapter.d.ts

@@ -1,8 +1,10 @@
-import type { AgentProvider, AgentSandbox, AgentTarget } from "../types.js";
+import type { AgentAllowlistEnforcement, AgentProvider, AgentSandbox, AgentSessionContract, AgentTarget, WorkflowStep } from "../types.js";
 export type ProviderPromptChannel = "stdin" | "argv";
 export interface ProviderCapabilities {
     /** Sandbox values the provider CLI accepts; empty when sandboxing is unsupported. */
     sandbox: readonly AgentSandbox[];
+    /** Tool/command restrictions exposed by this adapter. Metadata-only means advisory, not provider-enforced. */
+    allowlist: ProviderAllowlistCapabilities;
     /** Whether the provider runs as a durable background agent instead of a one-shot process. */
     durable: boolean;
     /** Whether the provider can be dispatched to a remote machine transport. */
@@ -10,6 +12,10 @@ export interface ProviderCapabilities {
     /** How the prompt reaches the provider process. */
     promptChannel: ProviderPromptChannel;
 }
+export interface ProviderAllowlistCapabilities {
+    tools: AgentAllowlistEnforcement;
+    commands: AgentAllowlistEnforcement;
+}
 export interface AgentInvocation {
     command: string;
     args: string[];
@@ -18,16 +24,28 @@ export interface AgentInvocation {
     /** Executables of which at least one must exist besides the command itself. */
     preflightAnyOf?: string[];
 }
+export interface PreparedAgentInvocation {
+    /** Invocation built from the first validated snapshot. */
+    invocation: AgentInvocation;
+    /** Rebuild only cwd-dependent fields while reusing that same snapshot. */
+    forCwd(cwd: string): AgentInvocation;
+}
 export interface ProviderAdapter {
     provider: AgentProvider;
     capabilities: ProviderCapabilities;
     validate(target: AgentTarget, label?: string): void;
     buildInvocation(target: AgentTarget): AgentInvocation;
+    prepareInvocation(target: AgentTarget): PreparedAgentInvocation;
 }
-export declare const UNSAFE_CODEWITH_EXEC_EXTRA_ARGS: Set<string>;
+export declare function effectiveAgentSandbox(target: AgentTarget): AgentSandbox | "provider-default";
+export declare function agentSessionContract(target: AgentTarget, cwd?: string | undefined): AgentSessionContract | undefined;
+export declare function workflowStepAgentSessionContract(step: WorkflowStep): AgentSessionContract | undefined;
+export declare function agentSessionContractPrompt(target: AgentTarget, cwd?: string | undefined): string | undefined;
 export declare const PROVIDER_ADAPTERS: Record<AgentProvider, ProviderAdapter>;
 export declare const AGENT_PROVIDERS: AgentProvider[];
 export declare function providerAdapter(provider: AgentProvider): ProviderAdapter;
+/** Validate an untrusted or persisted agent target without relying on TypeScript-only shape guarantees. */
+export declare function validateAgentTarget(target: unknown, label?: string): asserts target is AgentTarget;
 export interface SpawnCaptureOptions {
     cwd?: string;
     env?: NodeJS.ProcessEnv;

package/dist/lib/auth/route-policy.d.ts

@@ -0,0 +1,14 @@
+export type TenantRole = "admin" | "operator" | "member" | "readonly" | "service" | "worker";
+export type TokenKind = "api_key" | "service" | "machine";
+export interface RoutePolicy {
+    operationId: string;
+    method: string;
+    pathTemplate: string;
+    path: RegExp;
+    scopes: readonly string[];
+    roles: readonly TenantRole[];
+    tokenKinds: readonly TokenKind[];
+    risk: "read" | "write" | "destructive" | "runner";
+}
+export declare const ROUTE_POLICIES: readonly RoutePolicy[];
+export declare function routePolicy(method: string, path: string): RoutePolicy | undefined;

package/dist/lib/auth/tenant-auth.d.ts

@@ -0,0 +1,38 @@
+import { type ApiKeyClaims } from "@hasna/contracts/auth";
+import type { TypedQueryClient } from "../../generated/storage-kit/query.js";
+import type { RoutePolicy, TenantRole, TokenKind } from "./route-policy.js";
+export interface TenantAuthContext {
+    tenantId: string;
+    principalId: string;
+    requestId: string;
+    kid: string;
+    agent: string | null;
+    scopes: string[];
+    roles: TenantRole[];
+    tokenKind: TokenKind;
+    claims: ApiKeyClaims;
+}
+export type TenantAuthDecision = {
+    ok: true;
+    status: 200;
+    principal: TenantAuthContext;
+} | {
+    ok: false;
+    status: 401 | 403 | 503;
+    reason: string;
+    message: string;
+    requestId: string;
+};
+export declare class TenantApiAuthenticator {
+    private readonly client;
+    private readonly signingSecret;
+    private readonly now;
+    constructor(client: TypedQueryClient, signingSecret: string | Buffer, now?: () => number);
+    authenticate(headers: Headers, context: {
+        method: string;
+        path: string;
+        policy: RoutePolicy;
+    }): Promise<TenantAuthDecision>;
+    private deny;
+    private audit;
+}

package/dist/lib/cloud/mode.d.ts

@@ -1,16 +1,10 @@
-export type StorageMode = "local" | "cloud";
-/** Deprecated mode aliases that all normalize to `cloud`. */
-export declare const DEPRECATED_STORAGE_MODE_ALIASES: readonly ["remote", "hybrid", "self_hosted"];
+export type StorageMode = "local" | "self_hosted" | "cloud";
 export type Env = Record<string, string | undefined>;
 export interface StorageModeNormalization {
     mode: StorageMode;
-    /** The deprecated alias that was normalized to `cloud`, if any. */
-    deprecatedAlias: string | null;
 }
 /**
- * Normalize a raw storage-mode string to the `local | cloud` runtime enum.
- * Accepts deprecated aliases (`remote`, `hybrid`, `self_hosted`) and maps them
- * to `cloud`. Throws on any other value.
+ * Normalize a raw storage-mode string to the canonical deployment vocabulary.
  */
 export declare function normalizeStorageMode(value: string): StorageModeNormalization;
 /** Upper-snake env token for an app name, e.g. `todos` -> `TODOS`. */

package/dist/lib/cloud/storage.d.ts

@@ -76,7 +76,6 @@ export type ResolveStorageClientResult = {
  * `name`; when it resolves to `cloud-http` (mode=cloud/self_hosted + API_URL +
  * API_KEY), returns a ready {@link HasnaStorageClient}. Otherwise returns
  * `{ transport: 'local', client: null }` so the app uses its local store.
- * Throws if cloud was requested but is misconfigured (so callers never silently
- * read the wrong dataset).
+ * Incomplete remote configuration throws so callers never read the wrong dataset.
  */
 export declare function resolveStorageClient(name: string, env?: Env, overrides?: Parameters<typeof createClientTransport>[2]): ResolveStorageClientResult;

package/dist/lib/cloud/transport.d.ts

@@ -1,7 +1,5 @@
 import { type Env } from "./mode.js";
 import type { StorageMode } from "./mode.js";
-/** Default cloud host template. `<app>` is the app slug. */
-export declare function defaultCloudBaseUrl(name: string): string;
 export interface ClientTransportEnvKeys {
     /** Mode keys, in precedence order. */
     modeKeys: string[];
@@ -18,10 +16,8 @@ export type ClientTransportKind = "local" | "cloud-http";
 export interface ClientTransportResolution {
     /** Where the client should read/write from. */
     transport: ClientTransportKind;
-    /** Resolved storage mode (`local` | `cloud`). */
+    /** Resolved canonical deployment mode. */
     mode: StorageMode;
-    /** Deprecated mode alias that was normalized (e.g. `self_hosted`), if any. */
-    deprecatedAlias: string | null;
     /** Env key the mode was read from, or `"default"`. */
     modeSource: string;
     /** `<origin>/v1` base for the cloud API when transport is cloud-http, else null. */
@@ -32,20 +28,11 @@ export interface ClientTransportResolution {
     apiKeyPresent: boolean;
     /** Env key the API key came from, or null. */
     apiKeySource: string | null;
-    /**
-     * True when the operator asked for cloud but the config is incomplete (no API
-     * key), so we fell back to local. Callers SHOULD treat this as an error rather
-     * than silently reading local data.
-     */
-    misconfigured: boolean;
-    /** Human-readable warning, or null. Never contains secret values. */
-    warning: string | null;
 }
 /**
  * Resolve how a client should reach an app's data given the environment.
  *
- * Precedence for the mode: the first present of `HASNA_<NAME>_STORAGE_MODE`,
- * `HASNA_<NAME>_MODE`, `<NAME>_STORAGE_MODE`, `<NAME>_MODE`, else `local`.
+ * The only mode key is `HASNA_<NAME>_STORAGE_MODE`; unset means `local`.
  */
 export declare function resolveClientTransport(name: string, env?: Env): ClientTransportResolution;
 /** Thrown when a cloud HTTP request returns a non-2xx status. */
@@ -132,9 +119,8 @@ export declare function createHasnaHttpTransport(options: HasnaHttpTransportOpti
 /**
  * Convenience: resolve transport from env and, when cloud-http, build the HTTP
  * client in one call. Returns `{ transport: 'local', resolution }` for local, or
- * `{ transport: 'cloud-http', client, resolution }` for cloud. Throws if the
- * config is `misconfigured` (cloud requested but unusable) so callers can't drift
- * onto local data by accident.
+ * `{ transport: 'cloud-http', client, resolution }` for self_hosted/cloud.
+ * Incomplete remote configuration throws before a client is built.
  */
 export declare function createClientTransport(name: string, env?: Env, overrides?: Partial<Pick<HasnaHttpTransportOptions, "fetchImpl" | "headers" | "timeoutMs" | "retry" | "sleepImpl">>): {
     transport: "local";

package/dist/lib/errors.d.ts

@@ -13,9 +13,51 @@ export declare class LoopNotFoundError extends CodedError {
 export declare class LoopArchivedError extends CodedError {
     constructor(idOrName: string);
 }
+export declare class LoopAdvancementConflictError extends CodedError {
+    constructor(loopId: string, runId: string);
+}
+export type RunFinalizationConflictReason = "stale_claim" | "run_not_running";
+export declare class RunFinalizationConflictError extends CodedError {
+    readonly reason: RunFinalizationConflictReason;
+    constructor(reason: RunFinalizationConflictReason, runId: string);
+}
 export declare class AmbiguousNameError extends CodedError {
     constructor(name: string);
 }
+export type AgentExtraArgsValidationReason = "not_array" | "invalid_array" | "invalid_item" | "option_not_allowed";
+/**
+ * Deliberately public, bounded validation metadata. API boundaries may expose
+ * this object, but must never expose the accompanying Error.message.
+ */
+export interface PublicValidationDetails {
+    code: "agent_extra_args_invalid";
+    reason: AgentExtraArgsValidationReason;
+    path: string;
+    index?: number;
+    option?: string;
+}
+export declare function publicValidationDetails(value: unknown): Readonly<PublicValidationDetails> | undefined;
 export declare class ValidationError extends CodedError {
-    constructor(message: string);
+    readonly publicDetails?: Readonly<PublicValidationDetails>;
+    constructor(message: string, publicDetails?: PublicValidationDetails);
+}
+/** Safely capture and re-project even forged/subclass validation errors. */
+export declare function validationErrorPublicDetails(error: ValidationError): Readonly<PublicValidationDetails> | undefined;
+export declare class DuplicateWorkflowEventError extends CodedError {
+    constructor(workflowRunId: string, eventType: string, stepId?: string);
+}
+export declare class LegacyWorkflowRunProvenanceError extends CodedError {
+    constructor(workflowRunId: string);
+}
+export declare class WorkflowRunDefinitionConflictError extends CodedError {
+    constructor(workflowRunId: string);
+}
+export declare class WorkflowRunHasLiveStepsError extends CodedError {
+    constructor();
+}
+export declare class WorkflowRunStepOwnershipUnverifiableError extends CodedError {
+    constructor();
+}
+export declare class WorkflowRunNotRunningError extends CodedError {
+    constructor();
 }

package/dist/lib/format.d.ts

@@ -1,4 +1,4 @@
-import type { ExecutorResult, Goal, GoalRun, Loop, LoopRun, RunReceipt, WorkflowEvent, WorkflowInvocation, WorkflowRun, WorkflowSpec, WorkflowStepRun, WorkflowWorkItem } from "../types.js";
+import type { ExecutorResult, Goal, GoalRun, Loop, LoopRun, RunReceipt, PublicWorkflowEvent, StoredWorkflowEvent, WorkflowInvocation, WorkflowRun, WorkflowSpec, WorkflowStepRun, WorkflowWorkItem } from "../types.js";
 export declare function redact(value: string | undefined, visible?: number): string | undefined;
 export declare function textOutputBlocks(value: Pick<LoopRun | WorkflowStepRun, "stdout" | "stderr">, opts?: {
     indent?: string;
@@ -14,6 +14,6 @@ export declare function publicWorkflowRun(run: WorkflowRun): Record<string, unkn
 export declare function publicWorkflowInvocation(invocation: WorkflowInvocation): Record<string, unknown>;
 export declare function publicWorkflowWorkItem(item: WorkflowWorkItem): Record<string, unknown>;
 export declare function publicWorkflowStepRun(run: WorkflowStepRun, showOutput?: boolean): Record<string, unknown>;
-export declare function publicWorkflowEvent(event: WorkflowEvent): Record<string, unknown>;
+export declare function publicWorkflowEvent(event: StoredWorkflowEvent | PublicWorkflowEvent): Record<string, unknown>;
 export declare function publicGoal(goal: Goal): Record<string, unknown>;
 export declare function publicGoalRun(run: GoalRun): Record<string, unknown>;

package/dist/lib/goal/runner.d.ts

@@ -1,3 +1,36 @@
-import type { Store } from "../store.js";
-import type { GoalExecutorResult, GoalSpec, RunGoalOptions } from "./types.js";
-export declare function runGoal(store: Store, input: GoalSpec, opts?: RunGoalOptions): Promise<GoalExecutorResult>;
+import type { CreateGoalInput, CreateGoalPlanNodeInput, RecordGoalEventInput } from "../store.js";
+import type { Goal, GoalExecutorResult, GoalPlanNode, GoalRun, GoalSpec, GoalStatus, RunGoalOptions } from "./types.js";
+type MaybePromise<T> = T | Promise<T>;
+export interface GoalRunnerStore {
+    findGoalByContext(context: {
+        loopRunId?: string;
+        workflowRunId?: string;
+        workflowStepId?: string;
+        sourceType?: string;
+        sourceId?: string;
+    }): MaybePromise<Goal | undefined>;
+    createGoal(input: CreateGoalInput, opts?: {
+        daemonLeaseId?: string;
+        now?: Date;
+    }): MaybePromise<Goal>;
+    requireGoal(id: string): MaybePromise<Goal>;
+    createGoalPlanNodes(goalId: string, nodes: CreateGoalPlanNodeInput[], opts?: {
+        daemonLeaseId?: string;
+        now?: Date;
+    }): MaybePromise<GoalPlanNode[]>;
+    listGoalPlanNodes(goalIdOrPlanId: string): MaybePromise<GoalPlanNode[]>;
+    updateGoalStatus(goalId: string, status: GoalStatus, opts?: {
+        daemonLeaseId?: string;
+        now?: Date;
+    }): MaybePromise<Goal>;
+    updateGoalPlanNode(goalId: string, key: string, patch: Partial<Pick<GoalPlanNode, "status" | "tokensUsed" | "timeUsedSeconds" | "ready">>, opts?: {
+        daemonLeaseId?: string;
+        now?: Date;
+    }): MaybePromise<GoalPlanNode>;
+    recordGoalEvent(input: RecordGoalEventInput, opts?: {
+        daemonLeaseId?: string;
+        now?: Date;
+    }): MaybePromise<GoalRun>;
+}
+export declare function runGoal(store: GoalRunnerStore, input: GoalSpec, opts?: RunGoalOptions): Promise<GoalExecutorResult>;
+export {};

package/dist/lib/health.d.ts

@@ -2,7 +2,7 @@ import type { Loop, LoopRun, LoopStatus } from "../types.js";
 import type { DaemonStatus } from "../daemon/control.js";
 import type { DoctorCheck, DoctorReport } from "./doctor.js";
 import type { Store } from "./store.js";
-export type RunFailureClassification = "rate_limit" | "auth" | "provider_unavailable" | "model_not_found" | "context_length" | "schema_response_format" | "node_init" | "preflight" | "route_functional" | "timeout" | "sigsegv" | "restart_interrupted" | "skipped_previous_active" | "circuit_breaker" | "unknown";
+export type RunFailureClassification = "rate_limit" | "auth" | "provider_capacity" | "provider_unavailable" | "model_not_found" | "context_length" | "schema_response_format" | "node_init" | "preflight" | "route_functional" | "timeout" | "sigsegv" | "restart_interrupted" | "skipped_previous_active" | "circuit_breaker" | "unknown";
 export interface RunFailureSignal {
     classification: RunFailureClassification;
     fingerprint: string;

package/dist/lib/labels.d.ts

@@ -0,0 +1,4 @@
+export declare const LOOP_LABEL_MAX_COUNT = 32;
+export declare function normalizeLoopLabels(value: string | string[] | undefined, label?: string): string[];
+export declare function mergeLoopLabels(current: string[] | undefined, added: string | string[]): string[];
+export declare function removeLoopLabels(current: string[] | undefined, removed: string | string[]): string[];

package/dist/lib/loop-status.d.ts

@@ -0,0 +1,4 @@
+import type { LoopStatus } from "../types.js";
+export declare const LOOP_STATUSES: readonly ["active", "paused", "stopped", "expired"];
+export declare function isLoopStatus(value: unknown): value is LoopStatus;
+export declare function assertLoopStatus(value: unknown): asserts value is LoopStatus;

package/dist/lib/migration.d.ts

@@ -81,26 +81,13 @@ export interface ApplyLoopsMigrationResult {
 export interface SelfHostedPlanOptions {
     operation: "self-hosted-push" | "self-hosted-pull" | "self-hosted-migrate";
     apiUrl?: string;
-    apiToken?: string;
+    apiKey?: string;
+    timeoutMs?: number;
     fetchImpl?: typeof fetch;
     env?: NodeJS.ProcessEnv;
     includeRuns?: boolean;
     replace?: boolean;
 }
-export interface RunnerRegistrationOptions {
-    apiUrl?: string;
-    apiToken?: string;
-    runnerId: string;
-    machineId?: string;
-    labels?: Record<string, string>;
-    capabilities?: Record<string, unknown>;
-    fetchImpl?: typeof fetch;
-    env?: NodeJS.ProcessEnv;
-}
-export interface RunnerRegistrationResult {
-    ok: boolean;
-    runner: Record<string, unknown>;
-}
 export declare function migrationHash(value: unknown): string;
 export declare function exportLoopsMigrationBundle(store: Store, opts?: ExportLoopsMigrationOptions): LoopsMigrationBundle;
 export declare function validateLoopsMigrationBundle(value: unknown): LoopsMigrationBundle;
@@ -109,7 +96,8 @@ export declare function applyImportMigrationBundle(store: Store, bundle: LoopsMi
 export declare function buildSelfHostedMigrationPlan(store: Store, opts: SelfHostedPlanOptions): Promise<LoopsMigrationPlan>;
 export interface SelfHostedPushOptions {
     apiUrl?: string;
-    apiToken?: string;
+    apiKey?: string;
+    timeoutMs?: number;
     includeRuns?: boolean;
     replace?: boolean;
     fetchImpl?: typeof fetch;
@@ -210,6 +198,5 @@ export interface SelfHostedPushManifest {
  * endpoint upserts by id, so re-running never duplicates rows.
  */
 export declare function applySelfHostedPush(store: Store, opts: SelfHostedPushOptions): Promise<SelfHostedPushResult>;
-export declare function registerSelfHostedRunner(opts: RunnerRegistrationOptions): Promise<RunnerRegistrationResult>;
 export declare function publicMigrationBundle(bundle: LoopsMigrationBundle): Record<string, unknown>;
 export declare function selfHostedControlPlaneSummary(env?: NodeJS.ProcessEnv): Record<string, unknown>;

package/dist/lib/mode.d.ts

@@ -11,11 +11,8 @@ export interface LoopModeResolution {
 }
 export interface LoopControlPlaneConfig {
     apiUrl?: string;
-    cloudApiUrl?: string;
     databaseUrlPresent: boolean;
-    apiAuthTokenPresent: boolean;
-    cloudAuthTokenPresent: boolean;
-    authTokenPresent: boolean;
+    apiKeyPresent: boolean;
 }
 export interface LoopDeploymentStatus {
     packageVersion: string;
@@ -32,7 +29,7 @@ export interface LoopDeploymentStatus {
         configured: boolean;
         apiUrl?: string;
         databaseUrlPresent: boolean;
-        authTokenPresent: boolean;
+        apiKeyPresent: boolean;
     };
     runner: {
         required: boolean;

package/dist/lib/mode.js

@@ -2,7 +2,7 @@
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.28",
+  version: "0.4.29",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -81,11 +81,14 @@ var package_default = {
     "build:bin": "bun build src/cli/index.ts --compile --outfile dist/loops",
     typecheck: "tsc --noEmit",
     test: "bun test",
+    "check:branding": "bun test scripts/check-branding.test.mjs && bun run scripts/check-branding.mjs",
     "test:boundary": "bun run scripts/no-private-cloud-boundary.mjs",
+    "check:contracts": "bun run scripts/check-storage-kit.mjs && bun run scripts/check-contract-conformance.mjs",
+    "check:supply-chain": "bun audit && bun audit --production && bun run check:contracts && bun run check:branding && bun pm pack --dry-run --ignore-scripts && bun run test:boundary && bun run scripts/check-packed-boundary.mjs",
     prepare: "test -d dist || bun run build",
     "dev:cli": "bun run src/cli/index.ts",
     "dev:daemon": "bun run src/daemon/index.ts",
-    prepublishOnly: "bun run build && bun run typecheck && bun test && bun run test:boundary"
+    prepublishOnly: "bun run build && bun run typecheck && bun test && bun run test:boundary && bun run check:supply-chain"
   },
   keywords: [
     "loops",
@@ -112,7 +115,8 @@ var package_default = {
     bun: ">=1.0.0"
   },
   dependencies: {
-    "@hasna/contracts": "^0.5.1",
+    "@aws-sdk/client-secrets-manager": "^3.1083.0",
+    "@hasna/contracts": "0.5.2",
     "@hasna/events": "^0.1.9",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@openrouter/ai-sdk-provider": "2.9.1",
@@ -144,13 +148,10 @@ function packageVersion() {
 
 // src/lib/mode.ts
 var LOOP_DEPLOYMENT_MODES = ["local", "self_hosted", "cloud"];
-var MODE_ENV_KEYS = ["LOOPS_MODE", "HASNA_LOOPS_MODE"];
-var API_URL_ENV_KEYS = ["LOOPS_API_URL", "HASNA_LOOPS_API_URL"];
-var CLOUD_API_URL_ENV_KEYS = ["LOOPS_CLOUD_API_URL", "HASNA_LOOPS_CLOUD_API_URL"];
-var DATABASE_URL_ENV_KEYS = ["LOOPS_DATABASE_URL", "HASNA_LOOPS_DATABASE_URL"];
-var API_TOKEN_ENV_KEYS = ["LOOPS_API_TOKEN", "HASNA_LOOPS_API_TOKEN"];
-var CLOUD_TOKEN_ENV_KEYS = ["LOOPS_CLOUD_TOKEN", "HASNA_LOOPS_CLOUD_TOKEN"];
-var TOKEN_ENV_KEYS = [...API_TOKEN_ENV_KEYS, ...CLOUD_TOKEN_ENV_KEYS];
+var MODE_ENV_KEYS = ["HASNA_LOOPS_STORAGE_MODE"];
+var API_URL_ENV_KEYS = ["HASNA_LOOPS_API_URL"];
+var DATABASE_URL_ENV_KEYS = ["HASNA_LOOPS_DATABASE_URL"];
+var API_KEY_ENV_KEYS = ["HASNA_LOOPS_API_KEY"];
 function envValue(env, keys) {
   for (const key of keys) {
     const value = env[key]?.trim();
@@ -160,14 +161,14 @@ function envValue(env, keys) {
   return;
 }
 function normalizeLoopDeploymentMode(value) {
-  const normalized = value.trim().toLowerCase().replace(/-/g, "_");
+  const normalized = value.trim();
   if (normalized === "local")
     return "local";
-  if (normalized === "self_hosted" || normalized === "selfhosted")
+  if (normalized === "self_hosted")
     return "self_hosted";
-  if (normalized === "cloud" || normalized === "saas")
+  if (normalized === "cloud")
     return "cloud";
-  throw new Error(`unsupported OpenLoops deployment mode "${value}"; expected local, self_hosted, or cloud`);
+  throw new Error(`unsupported Loops deployment mode "${value}"; expected local, self_hosted, or cloud`);
 }
 function resolveLoopDeploymentMode(env = process.env) {
   const explicitMode = envValue(env, MODE_ENV_KEYS);
@@ -177,9 +178,6 @@ function resolveLoopDeploymentMode(env = process.env) {
       source: explicitMode.key
     };
   }
-  const cloudApiUrl = envValue(env, CLOUD_API_URL_ENV_KEYS);
-  if (cloudApiUrl)
-    return { deploymentMode: "cloud", source: cloudApiUrl.key };
   const apiUrl = envValue(env, API_URL_ENV_KEYS);
   if (apiUrl)
     return { deploymentMode: "self_hosted", source: apiUrl.key };
@@ -191,11 +189,8 @@ function resolveLoopDeploymentMode(env = process.env) {
 function loopControlPlaneConfig(env = process.env) {
   return {
     apiUrl: envValue(env, API_URL_ENV_KEYS)?.value,
-    cloudApiUrl: envValue(env, CLOUD_API_URL_ENV_KEYS)?.value,
     databaseUrlPresent: Boolean(envValue(env, DATABASE_URL_ENV_KEYS)),
-    apiAuthTokenPresent: Boolean(envValue(env, API_TOKEN_ENV_KEYS)),
-    cloudAuthTokenPresent: Boolean(envValue(env, CLOUD_TOKEN_ENV_KEYS)),
-    authTokenPresent: Boolean(envValue(env, TOKEN_ENV_KEYS))
+    apiKeyPresent: Boolean(envValue(env, API_KEY_ENV_KEYS))
   };
 }
 function sourceOfTruthForMode(mode) {
@@ -217,7 +212,7 @@ function remoteSchedulerBackendForMode(mode, config) {
   if (mode === "local")
     return "none";
   if (mode === "cloud")
-    return config.cloudApiUrl ? "hosted_control_plane_contract" : "unconfigured";
+    return config.apiUrl ? "hosted_control_plane_contract" : "unconfigured";
   if (config.databaseUrlPresent)
     return "postgres_contract";
   if (config.apiUrl)
@@ -265,26 +260,22 @@ function buildDeploymentStatus(opts = {}) {
   const active = resolveLoopDeploymentMode(env);
   const deploymentMode = opts.perspective ?? active.deploymentMode;
   const config = loopControlPlaneConfig(env);
-  const rawApiUrl = deploymentMode === "cloud" ? config.cloudApiUrl : config.apiUrl;
-  const apiUrl = displayControlPlaneUrl(rawApiUrl);
+  const apiUrl = displayControlPlaneUrl(config.apiUrl);
   const controlPlaneKind = deploymentMode === "local" ? "none" : deploymentMode;
-  const deploymentAuthTokenPresent = deploymentMode === "cloud" ? config.cloudAuthTokenPresent : deploymentMode === "self_hosted" ? config.apiAuthTokenPresent : false;
-  const controlPlaneConfigured = deploymentMode === "local" ? false : deploymentMode === "self_hosted" ? Boolean(config.apiUrl || config.databaseUrlPresent) : Boolean(config.cloudApiUrl && deploymentAuthTokenPresent);
+  const deploymentAuthTokenPresent = deploymentMode === "cloud" ? config.apiKeyPresent : deploymentMode === "self_hosted" ? config.apiKeyPresent : false;
+  const controlPlaneConfigured = deploymentMode === "local" ? false : deploymentMode === "self_hosted" ? Boolean(config.apiUrl || config.databaseUrlPresent) : Boolean(config.apiUrl && deploymentAuthTokenPresent);
   const warnings = [];
   if (deploymentMode === "self_hosted" && !controlPlaneConfigured) {
-    warnings.push("self_hosted mode needs LOOPS_API_URL or LOOPS_DATABASE_URL before it can become authoritative");
+    warnings.push("self_hosted mode needs HASNA_LOOPS_API_URL or HASNA_LOOPS_DATABASE_URL before it can become authoritative");
   }
   if (deploymentMode === "self_hosted" && config.databaseUrlPresent && !config.apiUrl) {
-    warnings.push("LOOPS_DATABASE_URL selects the self_hosted storage contract; loops-runner still needs LOOPS_API_URL to claim remote work");
+    warnings.push("HASNA_LOOPS_DATABASE_URL selects the self_hosted storage contract; loops-runner still needs HASNA_LOOPS_API_URL to claim remote work");
   }
-  if (deploymentMode === "cloud" && config.apiUrl && !config.cloudApiUrl) {
-    warnings.push("LOOPS_API_URL selects self_hosted; cloud mode uses LOOPS_CLOUD_API_URL");
+  if (deploymentMode === "cloud" && !config.apiUrl) {
+    warnings.push("cloud mode needs HASNA_LOOPS_API_URL before it can become ready");
   }
-  if (deploymentMode === "cloud" && !config.cloudApiUrl) {
-    warnings.push("cloud mode is a public contract until LOOPS_CLOUD_API_URL is configured");
-  }
-  if (deploymentMode === "cloud" && config.cloudApiUrl && !deploymentAuthTokenPresent) {
-    warnings.push("cloud mode needs LOOPS_CLOUD_TOKEN or HASNA_LOOPS_CLOUD_TOKEN before it can become ready");
+  if (deploymentMode === "cloud" && config.apiUrl && !deploymentAuthTokenPresent) {
+    warnings.push("cloud mode needs HASNA_LOOPS_API_KEY before it can become ready");
   }
   if (opts.perspective && opts.perspective !== active.deploymentMode) {
     warnings.push(`active deployment mode is ${active.deploymentMode}; this is the ${opts.perspective} perspective`);
@@ -304,7 +295,7 @@ function buildDeploymentStatus(opts = {}) {
       configured: controlPlaneConfigured,
       apiUrl,
       databaseUrlPresent: config.databaseUrlPresent,
-      authTokenPresent: deploymentAuthTokenPresent
+      apiKeyPresent: deploymentAuthTokenPresent
     },
     runner: {
       required: deploymentMode !== "local",

package/dist/lib/route/index.d.ts

@@ -1,6 +1,6 @@
 /**
  * Route engine: turns Hasna events, todos ready queues, and health/hygiene
- * findings into deduped, throttled OpenLoops workflow loops and todos tasks.
+ * findings into deduped, throttled Loops workflow loops and todos tasks.
  * Extracted from the CLI so commands stay thin and the SDK/daemon can reuse it.
  */
 export * from "./types.js";
@@ -11,7 +11,7 @@ export { GateError, normalizeLoopTargetForStorage, normalizeWorkflowForStorage,
 export { accountPoolFromOpts, normalizeAgentProvider, permissionModeFromOpts, providerAuthProfileFromOpts, providerRoutingPublic, resolveProviderRouting, roleAccountFromOpts, sandboxFromOpts, SUPPORTED_AGENT_PROVIDERS, type ProviderRoutingDecision, } from "./provider.js";
 export { checkProviderAdmission, parseCodewithAdmissionDiagnostics, providerActiveCapFromOpts, providerAdmissionPlanFromOpts, type CodewithAdmissionDiagnostics, type ProviderAdmissionDecision, type ProviderAdmissionPlan, } from "./provider-admission.js";
 export { prReviewRoutingDecision, type PrReviewRoutingDecision } from "./pr-review.js";
-export { hasThrottleLimits, normalizeRoutePath, routeThrottleDecision, routeThrottleLimitsFromOpts, type RouteThrottleDecision, type RouteThrottleLimits, } from "./throttle.js";
+export { hasThrottleLimits, normalizeRoutePath, routeThrottleDecision, routeThrottleLimitsFromInputs, routeThrottleLimitsFromOpts, type RouteThrottleDecision, type RouteThrottleLimits, } from "./throttle.js";
 export { generatedRouteSandboxPreflight, readEventEnvelopeInput, routeEventByKind, routeGenericEvent, routeTodosTaskEvent, todosTaskRouteTemplateId, } from "./route-event.js";
 export { drainTodosTaskRoutes, type DrainResult } from "./drain.js";
 export { buildHygieneRouteTasks, parseHygieneChecks, taskAutoRoute, upsertRouteTasks, type HygieneCheckKind, type HygieneRouteTask, type RouteTaskSpec, type UpsertRouteTasksOptions, } from "./route-tasks.js";

package/dist/lib/route/throttle.d.ts

@@ -26,6 +26,13 @@ export declare function routeThrottleLimitsFromOpts(opts: {
     maxActivePerProjectGroup?: string;
     maxPerProfile?: string;
 }): RouteThrottleLimits;
+export declare function routeThrottleLimitsFromInputs(opts: {
+    maxActive?: string;
+    maxActiveScope?: string;
+    maxActivePerProject?: string;
+    maxActivePerProjectGroup?: string;
+    maxPerProfile?: string;
+}, data: Record<string, unknown>, metadata: Record<string, unknown>): RouteThrottleLimits;
 export declare function hasThrottleLimits(limits: RouteThrottleLimits): boolean;
 export declare function normalizeRoutePath(value: string | undefined): string | undefined;
 export declare function routeProjectGroup(optsGroup: string | undefined, data: Record<string, unknown>, metadata: Record<string, unknown>): string | undefined;

package/dist/lib/route/types.d.ts

@@ -29,6 +29,9 @@ export interface TodosTaskRouteOptions {
     verifierIdleTimeout?: string;
     permissionMode?: string;
     sandbox?: string;
+    allowTool?: string[];
+    allowCommand?: string[];
+    safetyReason?: string;
     manualBreakGlass?: boolean;
     projectPath?: string;
     projectGroup?: string;