@hasna/loops 0.4.3 → 0.4.5

package/dist/sdk/index.js

@@ -1523,7 +1523,7 @@ class Store {
     }
     const applied = new Set(this.db.query("SELECT id FROM schema_migrations").all().map((row) => row.id));
     for (const migration of this.migrations()) {
-      if (!migration.baseline && !migration.reapply && applied.has(migration.id))
+      if (!migration.baseline && applied.has(migration.id))
         continue;
       migration.apply();
       if (!applied.has(migration.id)) {
@@ -1576,7 +1576,6 @@ class Store {
       },
       {
         id: "0007_run_claim_tokens",
-        reapply: true,
         apply: () => {
           this.addColumnIfMissing("loop_runs", "claim_token", "TEXT");
           this.db.exec("CREATE INDEX IF NOT EXISTS idx_runs_claim_token ON loop_runs(claim_token) WHERE claim_token IS NOT NULL");
@@ -3841,6 +3840,190 @@ class Store {
     const row = status ? this.db.query("SELECT COUNT(*) AS count FROM loop_runs WHERE status = ?").get(status) : this.db.query("SELECT COUNT(*) AS count FROM loop_runs").get();
     return row?.count ?? 0;
   }
+  exportMigrationRows(opts = {}) {
+    const includeRuns = opts.includeRuns ?? true;
+    const workflows = this.db.query("SELECT * FROM workflow_specs ORDER BY created_at ASC, id ASC").all().map(rowToWorkflow);
+    const loops = this.db.query("SELECT * FROM loops ORDER BY created_at ASC, id ASC").all().map(rowToLoop);
+    const runs = includeRuns ? this.db.query("SELECT * FROM loop_runs ORDER BY created_at ASC, id ASC").all().map(rowToRun) : [];
+    return { schemaVersion: SCHEMA_USER_VERSION, workflows, loops, runs, checks: this.migrationChecks() };
+  }
+  countTable(table) {
+    const row = this.db.query(`SELECT COUNT(*) AS count FROM ${table}`).get();
+    return row?.count ?? 0;
+  }
+  migrationChecks() {
+    const now = nowIso();
+    return {
+      unsupportedCounts: {
+        workflowInvocations: this.countTable("workflow_invocations"),
+        workflowWorkItems: this.countTable("workflow_work_items"),
+        workflowRuns: this.countTable("workflow_runs"),
+        workflowStepRuns: this.countTable("workflow_step_runs"),
+        workflowEvents: this.countTable("workflow_events"),
+        goals: this.countTable("goals"),
+        goalPlanNodes: this.countTable("goal_plan_nodes"),
+        goalRuns: this.countTable("goal_runs")
+      },
+      volatileCounts: {
+        daemonLeases: this.countTable("daemon_lease"),
+        activeDaemonLeases: this.db.query("SELECT COUNT(*) AS count FROM daemon_lease WHERE expires_at > ?").get(now)?.count ?? 0,
+        runningLoopRuns: this.db.query("SELECT COUNT(*) AS count FROM loop_runs WHERE status = 'running'").get()?.count ?? 0,
+        runningWorkflowRuns: this.db.query("SELECT COUNT(*) AS count FROM workflow_runs WHERE status = 'running'").get()?.count ?? 0,
+        runningWorkflowStepRuns: this.db.query("SELECT COUNT(*) AS count FROM workflow_step_runs WHERE status = 'running'").get()?.count ?? 0,
+        leasedWorkflowWorkItems: this.db.query("SELECT COUNT(*) AS count FROM workflow_work_items WHERE lease_expires_at IS NOT NULL OR status IN ('admitted', 'running')").get()?.count ?? 0
+      }
+    };
+  }
+  upsertMigrationWorkflow(workflow, opts = {}) {
+    const existing = this.getWorkflow(workflow.id);
+    if (existing && !opts.replace)
+      return existing;
+    this.db.query(`INSERT INTO workflow_specs (id, name, description, version, status, goal_json, steps_json, created_at, updated_at)
+         VALUES ($id, $name, $description, $version, $status, $goal, $steps, $created, $updated)
+         ON CONFLICT(id) DO UPDATE SET
+           name=$name,
+           description=$description,
+           version=$version,
+           status=$status,
+           goal_json=$goal,
+           steps_json=$steps,
+           created_at=$created,
+           updated_at=$updated`).run({
+      $id: workflow.id,
+      $name: workflow.name,
+      $description: workflow.description ?? null,
+      $version: workflow.version,
+      $status: workflow.status,
+      $goal: workflow.goal ? JSON.stringify(workflow.goal) : null,
+      $steps: JSON.stringify(workflow.steps),
+      $created: workflow.createdAt,
+      $updated: workflow.updatedAt
+    });
+    const imported = this.getWorkflow(workflow.id);
+    if (!imported)
+      throw new Error(`workflow not found after migration import: ${workflow.id}`);
+    return imported;
+  }
+  upsertMigrationLoop(loop, opts = {}) {
+    const existing = this.getLoop(loop.id);
+    if (existing && !opts.replace)
+      return existing;
+    this.assertNoNestedWorkflowGoal(loop.target, loop.goal);
+    this.db.query(`INSERT INTO loops (id, name, description, status, archived_at, archived_from_status, schedule_json, target_json,
+          goal_json, machine_json, next_run_at, retry_scheduled_for, catch_up, catch_up_limit, overlap, max_attempts,
+          retry_delay_ms, lease_ms, expires_at, created_at, updated_at)
+         VALUES ($id, $name, $description, $status, $archivedAt, $archivedFromStatus, $schedule, $target,
+          $goal, $machine, $nextRun, $retrySlot, $catchUp, $catchUpLimit, $overlap, $maxAttempts,
+          $retryDelay, $leaseMs, $expiresAt, $created, $updated)
+         ON CONFLICT(id) DO UPDATE SET
+           name=$name,
+           description=$description,
+           status=$status,
+           archived_at=$archivedAt,
+           archived_from_status=$archivedFromStatus,
+           schedule_json=$schedule,
+           target_json=$target,
+           goal_json=$goal,
+           machine_json=$machine,
+           next_run_at=$nextRun,
+           retry_scheduled_for=$retrySlot,
+           catch_up=$catchUp,
+           catch_up_limit=$catchUpLimit,
+           overlap=$overlap,
+           max_attempts=$maxAttempts,
+           retry_delay_ms=$retryDelay,
+           lease_ms=$leaseMs,
+           expires_at=$expiresAt,
+           created_at=$created,
+           updated_at=$updated`).run({
+      $id: loop.id,
+      $name: loop.name,
+      $description: loop.description ?? null,
+      $status: loop.status,
+      $archivedAt: loop.archivedAt ?? null,
+      $archivedFromStatus: loop.archivedFromStatus ?? null,
+      $schedule: JSON.stringify(loop.schedule),
+      $target: JSON.stringify(loop.target),
+      $goal: loop.goal ? JSON.stringify(loop.goal) : null,
+      $machine: loop.machine ? JSON.stringify(loop.machine) : null,
+      $nextRun: loop.nextRunAt ?? null,
+      $retrySlot: loop.retryScheduledFor ?? null,
+      $catchUp: loop.catchUp,
+      $catchUpLimit: loop.catchUpLimit,
+      $overlap: loop.overlap,
+      $maxAttempts: loop.maxAttempts,
+      $retryDelay: loop.retryDelayMs,
+      $leaseMs: loop.leaseMs,
+      $expiresAt: loop.expiresAt ?? null,
+      $created: loop.createdAt,
+      $updated: loop.updatedAt
+    });
+    const imported = this.getLoop(loop.id);
+    if (!imported)
+      throw new Error(`loop not found after migration import: ${loop.id}`);
+    return imported;
+  }
+  upsertMigrationRun(run, opts = {}) {
+    if (run.status === "running")
+      throw new ValidationError(`cannot import running run ${run.id}`);
+    const existing = this.getRun(run.id);
+    if (existing && !opts.replace)
+      return existing;
+    this.db.query(`INSERT INTO loop_runs (id, loop_id, loop_name, scheduled_for, attempt, status, started_at, finished_at,
+          claimed_by, claim_token, lease_expires_at, pid, pgid, process_started_at, exit_code, duration_ms,
+          stdout, stderr, error, goal_run_id, created_at, updated_at)
+         VALUES ($id, $loopId, $loopName, $scheduledFor, $attempt, $status, $startedAt, $finishedAt,
+          $claimedBy, NULL, $leaseExpiresAt, $pid, $pgid, $processStartedAt, $exitCode, $durationMs,
+          $stdout, $stderr, $error, $goalRunId, $created, $updated)
+         ON CONFLICT(id) DO UPDATE SET
+           loop_id=$loopId,
+           loop_name=$loopName,
+           scheduled_for=$scheduledFor,
+           attempt=$attempt,
+           status=$status,
+           started_at=$startedAt,
+           finished_at=$finishedAt,
+           claimed_by=$claimedBy,
+           claim_token=NULL,
+           lease_expires_at=$leaseExpiresAt,
+           pid=$pid,
+           pgid=$pgid,
+           process_started_at=$processStartedAt,
+           exit_code=$exitCode,
+           duration_ms=$durationMs,
+           stdout=$stdout,
+           stderr=$stderr,
+           error=$error,
+           goal_run_id=$goalRunId,
+           created_at=$created,
+           updated_at=$updated`).run({
+      $id: run.id,
+      $loopId: run.loopId,
+      $loopName: run.loopName,
+      $scheduledFor: run.scheduledFor,
+      $attempt: run.attempt,
+      $status: run.status,
+      $startedAt: run.startedAt ?? null,
+      $finishedAt: run.finishedAt ?? null,
+      $claimedBy: run.claimedBy ?? null,
+      $leaseExpiresAt: run.leaseExpiresAt ?? null,
+      $pid: run.pid ?? null,
+      $pgid: run.pgid ?? null,
+      $processStartedAt: run.processStartedAt ?? null,
+      $exitCode: run.exitCode ?? null,
+      $durationMs: run.durationMs ?? null,
+      $stdout: scrubbedOrNull(run.stdout),
+      $stderr: scrubbedOrNull(run.stderr),
+      $error: scrubbedOrNull(run.error),
+      $goalRunId: run.goalRunId ?? null,
+      $created: run.createdAt,
+      $updated: run.updatedAt
+    });
+    const imported = this.getRun(run.id);
+    if (!imported)
+      throw new Error(`run not found after migration import: ${run.id}`);
+    return imported;
+  }
   pruneHistory(opts) {
     const { maxAgeDays, keepPerLoop } = opts;
     if (maxAgeDays === undefined && keepPerLoop === undefined) {
@@ -3979,6 +4162,273 @@ class Store {
     this.db.close();
   }
 }
+// package.json
+var package_default = {
+  name: "@hasna/loops",
+  version: "0.4.5",
+  description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
+  type: "module",
+  main: "dist/index.js",
+  types: "dist/index.d.ts",
+  bin: {
+    loops: "dist/cli/index.js",
+    "loops-daemon": "dist/daemon/index.js",
+    "loops-api": "dist/api/index.js",
+    "loops-runner": "dist/runner/index.js",
+    "loops-mcp": "dist/mcp/index.js"
+  },
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      import: "./dist/index.js"
+    },
+    "./sdk": {
+      types: "./dist/sdk/index.d.ts",
+      import: "./dist/sdk/index.js"
+    },
+    "./mcp": {
+      types: "./dist/mcp/index.d.ts",
+      import: "./dist/mcp/index.js"
+    },
+    "./api": {
+      types: "./dist/api/index.d.ts",
+      import: "./dist/api/index.js"
+    },
+    "./runner": {
+      types: "./dist/runner/index.d.ts",
+      import: "./dist/runner/index.js"
+    },
+    "./mode": {
+      types: "./dist/lib/mode.d.ts",
+      import: "./dist/lib/mode.js"
+    },
+    "./storage": {
+      types: "./dist/lib/store.d.ts",
+      import: "./dist/lib/store.js"
+    },
+    "./storage/contract": {
+      types: "./dist/lib/storage/contract.d.ts",
+      import: "./dist/lib/storage/contract.js"
+    },
+    "./storage/sqlite": {
+      types: "./dist/lib/storage/sqlite.d.ts",
+      import: "./dist/lib/storage/sqlite.js"
+    },
+    "./storage/postgres": {
+      types: "./dist/lib/storage/postgres.d.ts",
+      import: "./dist/lib/storage/postgres.js"
+    },
+    "./storage/postgres-schema": {
+      types: "./dist/lib/storage/postgres-schema.d.ts",
+      import: "./dist/lib/storage/postgres-schema.js"
+    }
+  },
+  files: [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "docs",
+    "LICENSE"
+  ],
+  scripts: {
+    build: "rm -rf dist && bun build src/cli/index.ts src/daemon/index.ts src/api/index.ts src/runner/index.ts src/mcp/index.ts src/index.ts src/sdk/index.ts src/lib/store.ts src/lib/mode.ts src/lib/storage/index.ts src/lib/storage/contract.ts src/lib/storage/sqlite.ts src/lib/storage/postgres.ts src/lib/storage/postgres-schema.ts --root src --outdir dist --target bun --packages external && chmod +x dist/cli/index.js dist/daemon/index.js dist/api/index.js dist/runner/index.js dist/mcp/index.js && tsc -p tsconfig.build.json --emitDeclarationOnly --outDir dist",
+    "build:bin": "bun build src/cli/index.ts --compile --outfile dist/loops",
+    typecheck: "tsc --noEmit",
+    test: "bun test",
+    "test:boundary": "bun run scripts/no-private-cloud-boundary.mjs",
+    prepare: "test -d dist || bun run build",
+    "dev:cli": "bun run src/cli/index.ts",
+    "dev:daemon": "bun run src/daemon/index.ts",
+    prepublishOnly: "bun run build && bun run typecheck && bun test && bun run test:boundary"
+  },
+  keywords: [
+    "loops",
+    "scheduler",
+    "daemon",
+    "agents",
+    "claude",
+    "cursor",
+    "codewith",
+    "opencode",
+    "cli"
+  ],
+  repository: {
+    type: "git",
+    url: "git+https://github.com/hasna/loops.git"
+  },
+  homepage: "https://github.com/hasna/loops#readme",
+  bugs: {
+    url: "https://github.com/hasna/loops/issues"
+  },
+  author: "Hasna <andrei@hasna.com>",
+  license: "Apache-2.0",
+  engines: {
+    bun: ">=1.0.0"
+  },
+  dependencies: {
+    "@hasna/events": "^0.1.9",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@openrouter/ai-sdk-provider": "2.9.1",
+    ai: "6.0.204",
+    commander: "^13.1.0",
+    zod: "4.4.3"
+  },
+  optionalDependencies: {
+    "@hasna/machines": "0.0.49"
+  },
+  devDependencies: {
+    "@types/bun": "latest",
+    typescript: "^5.7.3"
+  },
+  publishConfig: {
+    registry: "https://registry.npmjs.org",
+    access: "public"
+  }
+};
+
+// src/lib/version.ts
+function packageVersion() {
+  if (typeof package_default.version !== "string" || package_default.version.trim() === "")
+    throw new Error("package.json version is missing");
+  return package_default.version;
+}
+
+// src/lib/mode.ts
+var LOOP_DEPLOYMENT_MODES = ["local", "self_hosted", "cloud"];
+var MODE_ENV_KEYS = ["LOOPS_MODE", "HASNA_LOOPS_MODE"];
+var API_URL_ENV_KEYS = ["LOOPS_API_URL", "HASNA_LOOPS_API_URL"];
+var CLOUD_API_URL_ENV_KEYS = ["LOOPS_CLOUD_API_URL", "HASNA_LOOPS_CLOUD_API_URL"];
+var DATABASE_URL_ENV_KEYS = ["LOOPS_DATABASE_URL", "HASNA_LOOPS_DATABASE_URL"];
+var API_TOKEN_ENV_KEYS = ["LOOPS_API_TOKEN", "HASNA_LOOPS_API_TOKEN"];
+var CLOUD_TOKEN_ENV_KEYS = ["LOOPS_CLOUD_TOKEN", "HASNA_LOOPS_CLOUD_TOKEN"];
+var TOKEN_ENV_KEYS = [...API_TOKEN_ENV_KEYS, ...CLOUD_TOKEN_ENV_KEYS];
+function envValue(env, keys) {
+  for (const key of keys) {
+    const value = env[key]?.trim();
+    if (value)
+      return { key, value };
+  }
+  return;
+}
+function normalizeLoopDeploymentMode(value) {
+  const normalized = value.trim().toLowerCase().replace(/-/g, "_");
+  if (normalized === "local")
+    return "local";
+  if (normalized === "self_hosted" || normalized === "selfhosted")
+    return "self_hosted";
+  if (normalized === "cloud" || normalized === "saas")
+    return "cloud";
+  throw new Error(`unsupported OpenLoops deployment mode "${value}"; expected local, self_hosted, or cloud`);
+}
+function resolveLoopDeploymentMode(env = process.env) {
+  const explicitMode = envValue(env, MODE_ENV_KEYS);
+  if (explicitMode) {
+    return {
+      deploymentMode: normalizeLoopDeploymentMode(explicitMode.value),
+      source: explicitMode.key
+    };
+  }
+  const cloudApiUrl = envValue(env, CLOUD_API_URL_ENV_KEYS);
+  if (cloudApiUrl)
+    return { deploymentMode: "cloud", source: cloudApiUrl.key };
+  const apiUrl = envValue(env, API_URL_ENV_KEYS);
+  if (apiUrl)
+    return { deploymentMode: "self_hosted", source: apiUrl.key };
+  const databaseUrl = envValue(env, DATABASE_URL_ENV_KEYS);
+  if (databaseUrl)
+    return { deploymentMode: "self_hosted", source: databaseUrl.key };
+  return { deploymentMode: "local", source: "default" };
+}
+function loopControlPlaneConfig(env = process.env) {
+  return {
+    apiUrl: envValue(env, API_URL_ENV_KEYS)?.value,
+    cloudApiUrl: envValue(env, CLOUD_API_URL_ENV_KEYS)?.value,
+    databaseUrlPresent: Boolean(envValue(env, DATABASE_URL_ENV_KEYS)),
+    apiAuthTokenPresent: Boolean(envValue(env, API_TOKEN_ENV_KEYS)),
+    cloudAuthTokenPresent: Boolean(envValue(env, CLOUD_TOKEN_ENV_KEYS)),
+    authTokenPresent: Boolean(envValue(env, TOKEN_ENV_KEYS))
+  };
+}
+function sourceOfTruthForMode(mode) {
+  if (mode === "local")
+    return "local_sqlite";
+  if (mode === "self_hosted")
+    return "self_hosted_control_plane";
+  return "cloud_control_plane";
+}
+function displayControlPlaneUrl(value) {
+  if (!value)
+    return;
+  try {
+    const url = new URL(value);
+    const path = url.pathname === "/" ? "" : url.pathname.replace(/\/+$/g, "");
+    return `${url.origin}${path}`;
+  } catch {
+    return "[invalid-url]";
+  }
+}
+function buildDeploymentStatus(opts = {}) {
+  const env = opts.env ?? process.env;
+  const active = resolveLoopDeploymentMode(env);
+  const deploymentMode = opts.perspective ?? active.deploymentMode;
+  const config = loopControlPlaneConfig(env);
+  const rawApiUrl = deploymentMode === "cloud" ? config.cloudApiUrl : config.apiUrl;
+  const apiUrl = displayControlPlaneUrl(rawApiUrl);
+  const controlPlaneKind = deploymentMode === "local" ? "none" : deploymentMode;
+  const deploymentAuthTokenPresent = deploymentMode === "cloud" ? config.cloudAuthTokenPresent : deploymentMode === "self_hosted" ? config.apiAuthTokenPresent : false;
+  const controlPlaneConfigured = deploymentMode === "local" ? false : deploymentMode === "self_hosted" ? Boolean(config.apiUrl || config.databaseUrlPresent) : Boolean(config.cloudApiUrl && deploymentAuthTokenPresent);
+  const warnings = [];
+  if (deploymentMode === "self_hosted" && !controlPlaneConfigured) {
+    warnings.push("self_hosted mode needs LOOPS_API_URL or LOOPS_DATABASE_URL before it can become authoritative");
+  }
+  if (deploymentMode === "cloud" && config.apiUrl && !config.cloudApiUrl) {
+    warnings.push("LOOPS_API_URL selects self_hosted; cloud mode uses LOOPS_CLOUD_API_URL");
+  }
+  if (deploymentMode === "cloud" && !config.cloudApiUrl) {
+    warnings.push("cloud mode is a public contract until LOOPS_CLOUD_API_URL is configured");
+  }
+  if (deploymentMode === "cloud" && config.cloudApiUrl && !deploymentAuthTokenPresent) {
+    warnings.push("cloud mode needs LOOPS_CLOUD_TOKEN or HASNA_LOOPS_CLOUD_TOKEN before it can become ready");
+  }
+  if (opts.perspective && opts.perspective !== active.deploymentMode) {
+    warnings.push(`active deployment mode is ${active.deploymentMode}; this is the ${opts.perspective} perspective`);
+  }
+  return {
+    packageVersion: packageVersion(),
+    deploymentMode,
+    activeDeploymentMode: active.deploymentMode,
+    active: deploymentMode === active.deploymentMode,
+    deploymentModeSource: active.source,
+    sourceOfTruth: sourceOfTruthForMode(deploymentMode),
+    localStore: {
+      role: deploymentMode === "local" ? "authoritative" : "cache_and_spool"
+    },
+    controlPlane: {
+      kind: controlPlaneKind,
+      configured: controlPlaneConfigured,
+      apiUrl,
+      databaseUrlPresent: config.databaseUrlPresent,
+      authTokenPresent: deploymentAuthTokenPresent
+    },
+    runner: {
+      required: deploymentMode !== "local",
+      role: deploymentMode === "local" ? "daemon" : "control_plane_worker"
+    },
+    warnings
+  };
+}
+function deploymentStatusLine(status) {
+  const configured = status.controlPlane.kind === "none" ? "none" : String(status.controlPlane.configured);
+  const active = status.active ? "active" : `active=${status.activeDeploymentMode}`;
+  return [
+    `deploymentMode=${status.deploymentMode}`,
+    active,
+    `source=${status.deploymentModeSource}`,
+    `truth=${status.sourceOfTruth}`,
+    `local=${status.localStore.role}`,
+    `control_plane=${configured}`
+  ].join(" ");
+}
 
 // src/lib/doctor.ts
 import { spawnSync as spawnSync5 } from "child_process";
@@ -6043,6 +6493,515 @@ function buildHealthReport(store, opts = {}) {
   };
 }
 
+// src/lib/migration.ts
+import { createHash as createHash3 } from "crypto";
+import { hostname as hostname2 } from "os";
+var LOOPS_MIGRATION_SCHEMA = "open-loops.migration/v1";
+function canonicalize(value) {
+  if (Array.isArray(value))
+    return value.map((entry) => canonicalize(entry));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, canonicalize(entry)]));
+  }
+  return value;
+}
+function migrationHash(value) {
+  return createHash3("sha256").update(JSON.stringify(canonicalize(value))).digest("hex");
+}
+function pushBlocker(rows, resource, id, reason, name) {
+  rows.push({ resource, id, name, action: "blocked", reason });
+}
+function checksToBlockers(checks, prefix, warnings = []) {
+  const rows = [];
+  for (const [name, count] of Object.entries(checks.unsupportedCounts)) {
+    if (count > 0) {
+      pushBlocker(rows, "remote", `${prefix}:unsupported:${name}`, `${prefix} ${name} has ${count} rows; this migration bundle does not preserve that table yet`);
+    }
+  }
+  for (const [name, count] of Object.entries(checks.volatileCounts)) {
+    if (name === "daemonLeases") {
+      if (count > 0)
+        warnings.push(`${prefix} daemon_lease has ${count} volatile rows; they are intentionally not exported as authority`);
+      continue;
+    }
+    if (count > 0) {
+      pushBlocker(rows, "remote", `${prefix}:volatile:${name}`, `${prefix} ${name} has ${count} rows; stop or finish active work before no-loss migration`);
+    }
+  }
+  return rows;
+}
+function sanitizeCommandEnv(value, blockers, resource, id, name) {
+  const copy = structuredClone(value);
+  const target = copy.target;
+  if (target && typeof target === "object" && !Array.isArray(target) && target.type === "command") {
+    const commandTarget = target;
+    if (commandTarget.env && Object.keys(commandTarget.env).length > 0) {
+      commandTarget.env = Object.fromEntries(Object.keys(commandTarget.env).map((key) => [key, "[redacted]"]));
+      pushBlocker(blockers, resource, id, "command target env values are redacted and cannot be imported as a no-loss row", name);
+    }
+  }
+  return copy;
+}
+function sanitizeWorkflow(workflow, blockers) {
+  const copy = structuredClone(workflow);
+  copy.steps = copy.steps.map((step) => {
+    if (step.target.type !== "command" || !step.target.env || Object.keys(step.target.env).length === 0)
+      return step;
+    pushBlocker(blockers, "workflow", workflow.id, `workflow step ${step.id} command env values are redacted and cannot be imported as a no-loss row`, workflow.name);
+    return {
+      ...step,
+      target: {
+        ...step.target,
+        env: Object.fromEntries(Object.keys(step.target.env).map((key) => [key, "[redacted]"]))
+      }
+    };
+  });
+  return copy;
+}
+function sanitizeExportRows(rows) {
+  const blockers = [];
+  const warnings = [];
+  blockers.push(...checksToBlockers(rows.checks, "source", warnings));
+  const workflows = rows.workflows.map((workflow) => sanitizeWorkflow(workflow, blockers));
+  const loops = rows.loops.map((loop) => sanitizeCommandEnv(loop, blockers, "loop", loop.id, loop.name));
+  const beforeScrub = JSON.stringify({ workflows, loops, runs: rows.runs });
+  const data = scrubSecretsDeep({ workflows, loops, runs: rows.runs });
+  if (JSON.stringify(data) !== beforeScrub) {
+    warnings.push("secret-looking strings were scrubbed from the export bundle; treat this as non-importable unless every scrub is expected");
+    pushBlocker(blockers, "remote", "secret-scrub", "secret-looking strings were scrubbed from the export bundle");
+  }
+  return { data, blockers, warnings };
+}
+function exportLoopsMigrationBundle(store, opts = {}) {
+  const rows = store.exportMigrationRows({ includeRuns: opts.includeRuns ?? true });
+  const sanitized = sanitizeExportRows(rows);
+  const bundleBody = {
+    schema: LOOPS_MIGRATION_SCHEMA,
+    packageVersion: packageVersion(),
+    exportedAt: new Date().toISOString(),
+    source: {
+      backend: "sqlite",
+      schemaVersion: rows.schemaVersion,
+      hostname: hostname2()
+    },
+    checks: rows.checks,
+    importable: sanitized.blockers.length === 0,
+    counts: {
+      workflows: sanitized.data.workflows.length,
+      loops: sanitized.data.loops.length,
+      runs: sanitized.data.runs.length
+    },
+    data: sanitized.data,
+    blockers: sanitized.blockers,
+    warnings: sanitized.warnings
+  };
+  return {
+    ...bundleBody,
+    hash: migrationHash(bundleBody)
+  };
+}
+function validateLoopsMigrationBundle(value) {
+  if (!value || typeof value !== "object")
+    throw new ValidationError("migration bundle must be a JSON object");
+  const bundle = value;
+  if (bundle.schema !== LOOPS_MIGRATION_SCHEMA)
+    throw new ValidationError(`unsupported migration bundle schema: ${String(bundle.schema)}`);
+  if (!bundle.data || !Array.isArray(bundle.data.workflows) || !Array.isArray(bundle.data.loops) || !Array.isArray(bundle.data.runs)) {
+    throw new ValidationError("migration bundle data must include workflows, loops, and runs arrays");
+  }
+  if (!bundle.checks || !bundle.counts || !bundle.source || !bundle.hash)
+    throw new ValidationError("migration bundle is missing required metadata");
+  const typed = bundle;
+  assertMigrationBundleIntegrity(typed);
+  return typed;
+}
+function assertMigrationBundleIntegrity(bundle) {
+  const { hash: _hash, ...body } = bundle;
+  const expectedHash = migrationHash(body);
+  if (bundle.hash !== expectedHash)
+    throw new ValidationError("migration bundle hash mismatch");
+}
+function rowPlanSummary(plan) {
+  const count = (action) => plan.rows.filter((row) => row.action === action).length;
+  return {
+    dryRun: plan.dryRun,
+    replace: plan.replace,
+    importable: plan.importable,
+    workflows: plan.rows.filter((row) => row.resource === "workflow").length,
+    loops: plan.rows.filter((row) => row.resource === "loop").length,
+    runs: plan.rows.filter((row) => row.resource === "run").length,
+    insert: count("insert"),
+    update: count("update"),
+    skip: count("skip"),
+    conflict: count("conflict"),
+    blocked: count("blocked")
+  };
+}
+function finalizePlan(plan) {
+  return { ...plan, summary: rowPlanSummary(plan) };
+}
+function compareResource(current, incoming, opts) {
+  const incomingHash = migrationHash(incoming);
+  if (!current)
+    return { resource: opts.resource, id: opts.id, name: opts.name, action: "insert", incomingHash };
+  const currentHash = migrationHash(current);
+  if (currentHash === incomingHash)
+    return { resource: opts.resource, id: opts.id, name: opts.name, action: "skip", incomingHash, currentHash };
+  return {
+    resource: opts.resource,
+    id: opts.id,
+    name: opts.name,
+    action: opts.replace ? "update" : "conflict",
+    reason: opts.replace ? "existing row differs and --replace was requested" : "existing row differs; rerun with --replace to update",
+    incomingHash,
+    currentHash
+  };
+}
+function buildImportMigrationPlan(store, bundle, opts = {}) {
+  assertMigrationBundleIntegrity(bundle);
+  const includeRuns = opts.includeRuns ?? true;
+  const replace = opts.replace ?? false;
+  const rows = [];
+  const warnings = [...bundle.warnings ?? []];
+  rows.push(...checksToBlockers(store.exportMigrationRows({ includeRuns: false }).checks, "destination", warnings));
+  if (!bundle.importable || bundle.blockers.length > 0) {
+    rows.push(...bundle.blockers.map((row) => ({ ...row, action: "blocked" })));
+  }
+  const workflowIds = new Set(bundle.data.workflows.map((workflow) => workflow.id));
+  const loopIds = new Set(bundle.data.loops.map((loop) => loop.id));
+  for (const workflow of bundle.data.workflows) {
+    const redactedStep = workflow.steps.find((step) => step.target.type === "command" && step.target.env && Object.values(step.target.env).includes("[redacted]"));
+    if (redactedStep) {
+      rows.push({
+        resource: "workflow",
+        id: workflow.id,
+        name: workflow.name,
+        action: "blocked",
+        reason: `workflow step ${redactedStep.id} has redacted command env values`,
+        incomingHash: migrationHash(workflow)
+      });
+      continue;
+    }
+    const activeNameCollision = store.listWorkflows({ status: "active" }).find((current) => current.name === workflow.name && current.id !== workflow.id);
+    if (workflow.status === "active" && activeNameCollision) {
+      rows.push({
+        resource: "workflow",
+        id: workflow.id,
+        name: workflow.name,
+        action: "conflict",
+        reason: `active workflow name collides with existing workflow ${activeNameCollision.id}`,
+        incomingHash: migrationHash(workflow),
+        currentHash: migrationHash(activeNameCollision)
+      });
+      continue;
+    }
+    rows.push(compareResource(store.getWorkflow(workflow.id), workflow, { replace, resource: "workflow", id: workflow.id, name: workflow.name }));
+  }
+  for (const loop of bundle.data.loops) {
+    if (loop.target.type === "command" && loop.target.env && Object.values(loop.target.env).includes("[redacted]")) {
+      rows.push({
+        resource: "loop",
+        id: loop.id,
+        name: loop.name,
+        action: "blocked",
+        reason: "loop has redacted command env values",
+        incomingHash: migrationHash(loop)
+      });
+      continue;
+    }
+    if (loop.target.type === "workflow" && !workflowIds.has(loop.target.workflowId) && !store.getWorkflow(loop.target.workflowId)) {
+      rows.push({
+        resource: "loop",
+        id: loop.id,
+        name: loop.name,
+        action: "blocked",
+        reason: `workflow target ${loop.target.workflowId} is not present in bundle or destination store`,
+        incomingHash: migrationHash(loop)
+      });
+      continue;
+    }
+    rows.push(compareResource(store.getLoop(loop.id), loop, { replace, resource: "loop", id: loop.id, name: loop.name }));
+  }
+  if (includeRuns) {
+    for (const run of bundle.data.runs) {
+      if (run.status === "running") {
+        rows.push({
+          resource: "run",
+          id: run.id,
+          name: run.loopName,
+          action: "blocked",
+          reason: "running rows carry volatile lease/process ownership and must finish before import",
+          incomingHash: migrationHash(run)
+        });
+        continue;
+      }
+      if (!loopIds.has(run.loopId) && !store.getLoop(run.loopId)) {
+        rows.push({
+          resource: "run",
+          id: run.id,
+          name: run.loopName,
+          action: "blocked",
+          reason: `loop ${run.loopId} is not present in bundle or destination store`,
+          incomingHash: migrationHash(run)
+        });
+        continue;
+      }
+      const slot = store.getRunBySlot(run.loopId, run.scheduledFor);
+      if (slot && slot.id !== run.id) {
+        rows.push({
+          resource: "run",
+          id: run.id,
+          name: run.loopName,
+          action: "conflict",
+          reason: `scheduled slot already belongs to run ${slot.id}`,
+          incomingHash: migrationHash(run),
+          currentHash: migrationHash(slot)
+        });
+        continue;
+      }
+      rows.push(compareResource(store.getRun(run.id), run, { replace, resource: "run", id: run.id, name: run.loopName }));
+    }
+  } else if (bundle.data.runs.length > 0) {
+    warnings.push("run history is present in the bundle but --no-runs was requested");
+  }
+  const plan = finalizePlan({
+    schema: LOOPS_MIGRATION_SCHEMA,
+    operation: "import",
+    dryRun: opts.dryRun ?? true,
+    replace,
+    importable: bundle.importable && rows.every((row) => row.action !== "blocked" && row.action !== "conflict"),
+    rows,
+    warnings
+  });
+  return { ...plan, importable: plan.summary.blocked === 0 && plan.summary.conflict === 0 };
+}
+function applyImportMigrationBundle(store, bundle, opts = {}) {
+  const plan = buildImportMigrationPlan(store, bundle, { ...opts, dryRun: false });
+  if (plan.summary.blocked > 0 || plan.summary.conflict > 0 || !plan.importable) {
+    throw new ValidationError(`migration import is not safe to apply: blocked=${plan.summary.blocked} conflict=${plan.summary.conflict}`);
+  }
+  const applied = { workflows: 0, loops: 0, runs: 0 };
+  let appliedPlan = plan;
+  store.writeTransaction(() => {
+    appliedPlan = buildImportMigrationPlan(store, bundle, { ...opts, dryRun: false });
+    if (appliedPlan.summary.blocked > 0 || appliedPlan.summary.conflict > 0 || !appliedPlan.importable) {
+      throw new ValidationError(`destination store changed before import apply: blocked=${appliedPlan.summary.blocked} conflict=${appliedPlan.summary.conflict}`);
+    }
+    for (const workflow of bundle.data.workflows) {
+      const row = appliedPlan.rows.find((entry) => entry.resource === "workflow" && entry.id === workflow.id);
+      if (row?.action === "insert" || row?.action === "update") {
+        store.upsertMigrationWorkflow(workflow, { replace: opts.replace });
+        applied.workflows += 1;
+      }
+    }
+    for (const loop of bundle.data.loops) {
+      const row = appliedPlan.rows.find((entry) => entry.resource === "loop" && entry.id === loop.id);
+      if (row?.action === "insert" || row?.action === "update") {
+        store.upsertMigrationLoop(loop, { replace: opts.replace });
+        applied.loops += 1;
+      }
+    }
+    if (opts.includeRuns ?? true) {
+      for (const run of bundle.data.runs) {
+        const row = appliedPlan.rows.find((entry) => entry.resource === "run" && entry.id === run.id);
+        if (row?.action === "insert" || row?.action === "update") {
+          store.upsertMigrationRun(run, { replace: opts.replace });
+          applied.runs += 1;
+        }
+      }
+    }
+  });
+  return { plan: appliedPlan, applied };
+}
+function envValue2(env, keys) {
+  for (const key of keys) {
+    const value = env[key]?.trim();
+    if (value)
+      return value;
+  }
+  return;
+}
+function resolveApiConfig(opts) {
+  const env = opts.env ?? process.env;
+  return {
+    apiUrl: opts.apiUrl ?? envValue2(env, ["LOOPS_API_URL", "HASNA_LOOPS_API_URL", "LOOPS_CLOUD_API_URL", "HASNA_LOOPS_CLOUD_API_URL"]),
+    token: opts.apiToken ?? envValue2(env, ["LOOPS_API_TOKEN", "HASNA_LOOPS_API_TOKEN", "LOOPS_CLOUD_TOKEN", "HASNA_LOOPS_CLOUD_TOKEN"])
+  };
+}
+function isLocalApiUrl(value) {
+  try {
+    return ["127.0.0.1", "localhost", "::1"].includes(new URL(value).hostname);
+  } catch {
+    return false;
+  }
+}
+function endpoint(base, path) {
+  return new URL(path.replace(/^\//, ""), base.endsWith("/") ? base : `${base}/`).toString();
+}
+async function requestJson(fetchImpl, config, path, init = {}) {
+  const response = await fetchImpl(endpoint(config.apiUrl, path), {
+    ...init,
+    headers: {
+      ...init.body ? { "content-type": "application/json" } : {},
+      ...config.token ? { authorization: `Bearer ${config.token}` } : {},
+      ...init.headers
+    }
+  });
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok)
+    throw new Error(typeof payload.error === "string" ? payload.error : `loops-api request failed: ${response.status}`);
+  return payload;
+}
+async function fetchRemotePreview(opts) {
+  const config = resolveApiConfig(opts);
+  const warnings = [];
+  if (!config.apiUrl) {
+    warnings.push("LOOPS_API_URL or HASNA_LOOPS_API_URL is required to inspect a self-hosted control plane");
+    return { loops: [], runs: [], warnings };
+  }
+  if (!isLocalApiUrl(config.apiUrl) && !config.token) {
+    warnings.push("non-local self-hosted APIs require LOOPS_API_TOKEN or HASNA_LOOPS_API_TOKEN");
+    return { loops: [], runs: [], warnings };
+  }
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const loopsPayload = await requestJson(fetchImpl, { apiUrl: config.apiUrl, token: config.token }, "/v1/loops?includeArchived=true&limit=1000");
+  const runsPayload = opts.includeRuns === false ? { runs: [] } : await requestJson(fetchImpl, { apiUrl: config.apiUrl, token: config.token }, "/v1/runs?limit=1000");
+  return {
+    loops: Array.isArray(loopsPayload.loops) ? loopsPayload.loops : [],
+    runs: Array.isArray(runsPayload.runs) ? runsPayload.runs : [],
+    warnings
+  };
+}
+async function buildSelfHostedMigrationPlan(store, opts) {
+  const bundle = exportLoopsMigrationBundle(store, { includeRuns: opts.includeRuns ?? true });
+  const remote = await fetchRemotePreview(opts);
+  const rows = [...bundle.blockers.map((row) => ({ ...row, action: "blocked" }))];
+  const warnings = [
+    ...bundle.warnings,
+    ...remote.warnings,
+    "self-hosted remote apply is preview-only until the control plane exposes id-preserving workflow/loop/run import endpoints"
+  ];
+  if (opts.operation === "self-hosted-pull") {
+    for (const entry of remote.loops) {
+      const value = entry && typeof entry === "object" ? entry : {};
+      const id = typeof value.id === "string" ? value.id : `remote-loop:${rows.length}`;
+      rows.push({
+        resource: "loop",
+        id,
+        name: typeof value.name === "string" ? value.name : undefined,
+        action: "blocked",
+        reason: "remote loop pull needs a full id-preserving export/import endpoint; /v1/loops returns public redacted rows only",
+        currentHash: migrationHash(entry)
+      });
+    }
+    for (const entry of remote.runs) {
+      const value = entry && typeof entry === "object" ? entry : {};
+      const id = typeof value.id === "string" ? value.id : `remote-run:${rows.length}`;
+      rows.push({
+        resource: "run",
+        id,
+        name: typeof value.loopName === "string" ? value.loopName : undefined,
+        action: "blocked",
+        reason: "remote run-history pull needs an id-preserving export/import endpoint; /v1/runs returns public redacted rows only",
+        currentHash: migrationHash(entry)
+      });
+    }
+    const plan2 = finalizePlan({
+      schema: LOOPS_MIGRATION_SCHEMA,
+      operation: opts.operation,
+      dryRun: true,
+      replace: false,
+      importable: false,
+      rows,
+      warnings
+    });
+    return { ...plan2, importable: false };
+  }
+  const remoteLoopsByName = new Map(remote.loops.map((entry) => entry && typeof entry === "object" ? entry : undefined).filter((entry) => typeof entry?.name === "string").map((entry) => [String(entry.name), entry]));
+  for (const workflow of bundle.data.workflows) {
+    rows.push({
+      resource: "workflow",
+      id: workflow.id,
+      name: workflow.name,
+      action: "blocked",
+      reason: "self-hosted API does not expose id-preserving workflow import/list endpoints yet",
+      incomingHash: migrationHash(workflow)
+    });
+  }
+  for (const loop of bundle.data.loops) {
+    const remoteLoop = remoteLoopsByName.get(loop.name);
+    rows.push({
+      resource: "loop",
+      id: loop.id,
+      name: loop.name,
+      action: "blocked",
+      reason: remoteLoop ? `remote loop name exists (${String(remoteLoop.id ?? "unknown id")}); exact id-preserving comparison is not available` : "normal self-hosted loop create would generate a new id; waiting for id-preserving import endpoint",
+      incomingHash: migrationHash(loop),
+      currentHash: remoteLoop ? migrationHash(remoteLoop) : undefined
+    });
+  }
+  if (opts.includeRuns ?? true) {
+    for (const run of bundle.data.runs) {
+      rows.push({
+        resource: "run",
+        id: run.id,
+        name: run.loopName,
+        action: "blocked",
+        reason: "self-hosted API does not expose run-history import endpoints; remote runners should create new run rows",
+        incomingHash: migrationHash(run)
+      });
+    }
+  }
+  const plan = finalizePlan({
+    schema: LOOPS_MIGRATION_SCHEMA,
+    operation: opts.operation,
+    dryRun: true,
+    replace: false,
+    importable: false,
+    rows,
+    warnings
+  });
+  return { ...plan, importable: false };
+}
+async function registerSelfHostedRunner(opts) {
+  const config = resolveApiConfig(opts);
+  if (!config.apiUrl)
+    throw new ValidationError("LOOPS_API_URL or --api-url is required");
+  if (!isLocalApiUrl(config.apiUrl) && !config.token)
+    throw new ValidationError("non-local self-hosted APIs require LOOPS_API_TOKEN or HASNA_LOOPS_API_TOKEN");
+  const payload = await requestJson(opts.fetchImpl ?? fetch, { apiUrl: config.apiUrl, token: config.token }, "/v1/runners/register", {
+    method: "POST",
+    body: JSON.stringify({
+      runnerId: opts.runnerId,
+      machineId: opts.machineId,
+      labels: opts.labels ?? {},
+      capabilities: opts.capabilities ?? {}
+    })
+  });
+  return {
+    ok: payload.ok === true,
+    runner: payload.runner && typeof payload.runner === "object" ? payload.runner : {}
+  };
+}
+function publicMigrationBundle(bundle) {
+  return {
+    ...bundle,
+    data: {
+      workflows: bundle.data.workflows.map(publicWorkflow),
+      loops: bundle.data.loops.map(publicLoop),
+      runs: bundle.data.runs.map((run) => publicRun(run, false, { redactError: true }))
+    }
+  };
+}
+function selfHostedControlPlaneSummary(env = process.env) {
+  const config = loopControlPlaneConfig(env);
+  return {
+    apiUrl: config.apiUrl,
+    databaseUrlPresent: config.databaseUrlPresent,
+    authTokenPresent: config.apiAuthTokenPresent
+  };
+}
+
 // src/lib/goal/metadata.ts
 function goalExecutionContext(parts) {
   return {
@@ -7414,6 +8373,18 @@ class LoopsClient {
     const result = await runLoopNow({ store: this.store, idOrName, runnerId: this.runnerId });
     return result.run;
   }
+  exportBundle(opts = {}) {
+    return exportLoopsMigrationBundle(this.store, opts);
+  }
+  planImport(bundle, opts = {}) {
+    return buildImportMigrationPlan(this.store, bundle, opts);
+  }
+  importBundle(bundle, opts = {}) {
+    return applyImportMigrationBundle(this.store, bundle, opts);
+  }
+  planSelfHostedMigration(opts = {}) {
+    return buildSelfHostedMigrationPlan(this.store, { ...opts, operation: opts.operation ?? "self-hosted-migrate" });
+  }
   close() {
     if (this.ownStore)
       this.store.close();
@@ -7462,8 +8433,16 @@ function openAutomationsRuntimeBinding(overrides = {}) {
   };
 }
 export {
+  validateLoopsMigrationBundle,
   runGoal,
+  registerSelfHostedRunner,
   openAutomationsRuntimeBinding,
+  migrationHash,
   loops,
-  LoopsClient
+  exportLoopsMigrationBundle,
+  buildSelfHostedMigrationPlan,
+  buildImportMigrationPlan,
+  applyImportMigrationBundle,
+  LoopsClient,
+  LOOPS_MIGRATION_SCHEMA
 };