@hasna/workflows 0.1.0 → 0.1.2

package/dist/index.js

@@ -1,11 +1,452 @@
 // @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = import.meta.require;
+
+// src/lanes/types.ts
+import { statSync } from "fs";
+function binaryOnPath(binary) {
+  const pathEntries = (process.env.PATH ?? "").split(":").filter(Boolean);
+  for (const entry of pathEntries) {
+    try {
+      const stat = statSync(`${entry}/${binary}`);
+      if (stat.isFile())
+        return true;
+    } catch {}
+  }
+  return false;
+}
+function withTimeout(promise, timeoutMs, what) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      reject(new Error(`${what} exceeded the ${timeoutMs}ms budget`));
+    }, timeoutMs);
+    promise.then((value) => {
+      clearTimeout(timer);
+      resolve(value);
+    }, (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+  });
+}
+function spawnCli(cmd, opts) {
+  const started = Date.now();
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+  let proc;
+  try {
+    proc = Bun.spawnSync({
+      cmd,
+      cwd: opts.cwd,
+      env: { ...process.env, ...opts.env ?? {} },
+      stdout: "pipe",
+      stderr: "pipe",
+      timeout: timeoutMs
+    });
+  } catch (err) {
+    const message = String(err instanceof Error ? err.message : err);
+    if (message.includes("ENOENT") || /not found/i.test(message)) {
+      throw new LaneDependencyMissingError(`lane binary ${JSON.stringify(opts.binaryName)} not found on PATH; install it or provide ${opts.packageHint}`);
+    }
+    return { ok: false, exitCode: 1, output: "", durationMs: Date.now() - started, error: message };
+  }
+  const durationMs = Date.now() - started;
+  const stdout = proc.stdout ? new TextDecoder().decode(proc.stdout) : "";
+  const stderr = proc.stderr ? new TextDecoder().decode(proc.stderr) : "";
+  const output = stderr ? `${stdout}
+${stderr}`.trim() : stdout.trim();
+  const exitCode = proc.exitCode ?? 1;
+  return { ok: exitCode === 0, exitCode, output, durationMs };
+}
+var LANE_KINDS2, LaneDependencyMissingError, LaneAdapterShapeError, DEFAULT_LANE_TIMEOUT_MS = 120000;
+var init_types = __esm(() => {
+  LANE_KINDS2 = ["claude", "codex", "cursor", "grok"];
+  LaneDependencyMissingError = class LaneDependencyMissingError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "LaneDependencyMissingError";
+    }
+  };
+  LaneAdapterShapeError = class LaneAdapterShapeError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "LaneAdapterShapeError";
+    }
+  };
+});
+
+// src/lanes/claude.ts
+function createClaudeAdapter(deps = {}) {
+  return {
+    kind: "claude",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
+      try {
+        await loader();
+        return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "sdk" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "claude")) {
+          return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "claude",
+          sdk: "@anthropic-ai/claude-agent-sdk",
+          wired: false,
+          reason: "neither @anthropic-ai/claude-agent-sdk nor the claude CLI is available on this machine"
+        };
+      }
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "claude lane requires a prompt" };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch (err) {
+        return runClaudeCli(job, deps.cliPath ?? "claude", started, timeoutMs);
+      }
+      const query = sdk.query;
+      if (typeof query !== "function") {
+        throw new LaneAdapterShapeError("@anthropic-ai/claude-agent-sdk exports no query() function");
+      }
+      const prompt = job.prompt;
+      try {
+        const { output, isError } = await withTimeout((async () => {
+          const generator = await query({
+            prompt,
+            options: { model: job.model, maxTurns: 32, abortSignal: undefined }
+          });
+          let output2 = "";
+          let isError2 = false;
+          for await (const message of generator) {
+            if (message.type === "assistant") {
+              const content = message.message?.content;
+              if (Array.isArray(content)) {
+                for (const block of content) {
+                  if (block && typeof block === "object" && "text" in block && typeof block.text === "string") {
+                    output2 += block.text;
+                  }
+                }
+              }
+            }
+            if (message.type === "error")
+              isError2 = true;
+          }
+          return { output: output2, isError: isError2 };
+        })(), timeoutMs, `claude lane (${job.prompt.slice(0, 60)})`);
+        const durationMs = Date.now() - started;
+        return { ok: !isError, exitCode: isError ? 1 : 0, output: output.trim(), durationMs };
+      } catch (err) {
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
+      }
+    }
+  };
+}
+function runClaudeCli(job, cliPath, started, timeoutMs) {
+  try {
+    const result = spawnCli([cliPath, "-p", job.prompt], {
+      binaryName: cliPath,
+      packageHint: "@anthropic-ai/claude-agent-sdk or the claude CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd
+    });
+    return { ...result, durationMs: Date.now() - started };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    }
+    throw err;
+  }
+}
+var init_claude = __esm(() => {
+  init_types();
+});
+
+// src/lanes/codex.ts
+function createCodexAdapter(deps = {}) {
+  return {
+    kind: "codex",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
+      try {
+        await loader();
+        return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "sdk" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "codex")) {
+          return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "codex",
+          sdk: "@openai/codex-sdk",
+          wired: false,
+          reason: "neither @openai/codex-sdk nor the codex CLI is available on this machine"
+        };
+      }
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codex lane requires a prompt" };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch {
+        return runCodexCli(job, deps.cliPath ?? "codex", started, timeoutMs);
+      }
+      const CodexClass = sdk.Codex;
+      if (typeof CodexClass !== "function") {
+        throw new LaneAdapterShapeError("@openai/codex-sdk exports no Codex class");
+      }
+      try {
+        const client = await withTimeout(Promise.resolve(new CodexClass({
+          config: { model: job.model },
+          env: job.env
+        })), timeoutMs, `codex lane (${job.prompt.slice(0, 60)})`);
+        const thread = client.startThread?.();
+        if (!thread || typeof thread.run !== "function") {
+          throw new LaneAdapterShapeError("@openai/codex-sdk Codex.startThread() returned no run()");
+        }
+        const turn = await withTimeout(thread.run(job.prompt), timeoutMs, `codex lane (${job.prompt.slice(0, 60)})`);
+        const output = turn?.finalResponse ?? "";
+        const durationMs = Date.now() - started;
+        return { ok: true, exitCode: 0, output, durationMs };
+      } catch (err) {
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
+      }
+    }
+  };
+}
+function runCodexCli(job, cliPath, started, timeoutMs) {
+  try {
+    const result = spawnCli([cliPath, "exec", "--", job.prompt], {
+      binaryName: cliPath,
+      packageHint: "@openai/codex-sdk or the codex CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd
+    });
+    return { ...result, durationMs: Date.now() - started };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    }
+    throw err;
+  }
+}
+var init_codex = __esm(() => {
+  init_types();
+});
+
+// src/lanes/cursor.ts
+function createCursorAdapter(deps = {}) {
+  return {
+    kind: "cursor",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
+      try {
+        await loader();
+        return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "sdk (local mode)" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "cursor-agent")) {
+          return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "cursor",
+          sdk: "@cursor/sdk",
+          wired: false,
+          reason: "neither @cursor/sdk nor the cursor-agent CLI is available on this machine"
+        };
+      }
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "cursor lane requires a prompt" };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch {
+        return runCursorCli(job, deps.cliPath ?? "cursor-agent", started, timeoutMs);
+      }
+      try {
+        const run = await withTimeout(runLocalAgent(sdk, job), timeoutMs, `cursor lane (${job.prompt.slice(0, 60)})`);
+        const durationMs = Date.now() - started;
+        const status = run?.status ?? "finished";
+        const ok = status === "finished";
+        return { ok, exitCode: ok ? 0 : 1, output: run?.result ?? "", durationMs };
+      } catch (err) {
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
+      }
+    }
+  };
+}
+async function runLocalAgent(sdk, job) {
+  const AgentClass = sdk.Agent;
+  const CursorClass = sdk.Cursor;
+  if (typeof AgentClass !== "function" && typeof CursorClass !== "function") {
+    throw new LaneAdapterShapeError("@cursor/sdk exports no Agent/Cursor class");
+  }
+  const agent = typeof AgentClass === "function" ? new AgentClass : undefined;
+  if (!agent || typeof agent.send !== "function") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent has no send()");
+  }
+  const run = await agent.send(job.prompt, { model: job.model });
+  if (!run || typeof run !== "object") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned no Run");
+  }
+  return run;
+}
+function runCursorCli(job, cliPath, started, timeoutMs) {
+  try {
+    const result = spawnCli([cliPath, "run", job.prompt], {
+      binaryName: cliPath,
+      packageHint: "@cursor/sdk (local mode) or the cursor-agent CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd
+    });
+    return { ...result, durationMs: Date.now() - started };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    }
+    throw err;
+  }
+}
+var init_cursor = __esm(() => {
+  init_types();
+});
+
+// src/lanes/grok.ts
+function createGrokAdapter(deps = {}) {
+  return {
+    kind: "grok",
+    async probe() {
+      const cliPath = deps.cliPath ?? "grok";
+      if (binaryOnPath(cliPath)) {
+        return { kind: "grok", sdk: "no npm SDK (measured 2026-08-25)", wired: true, via: "cli" };
+      }
+      return {
+        kind: "grok",
+        sdk: "no npm SDK (measured 2026-08-25)",
+        wired: false,
+        reason: `no xAI Grok SDK exists on npm (measured 2026-08-25) and the grok CLI is not on PATH`
+      };
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "grok lane requires a prompt" };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const cliPath = deps.cliPath ?? "grok";
+      try {
+        const result = spawnCli([cliPath, job.prompt], {
+          binaryName: cliPath,
+          packageHint: "the grok CLI (no xAI Grok SDK exists on npm \u2014 measured 2026-08-25)",
+          timeoutMs,
+          env: job.env,
+          cwd: job.cwd
+        });
+        return { ...result, durationMs: Date.now() - started };
+      } catch (err) {
+        if (err instanceof LaneDependencyMissingError) {
+          return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+        }
+        throw err;
+      }
+    }
+  };
+}
+var init_grok = __esm(() => {
+  init_types();
+});
+
+// src/lanes/index.ts
+var exports_lanes = {};
+__export(exports_lanes, {
+  runLaneJob: () => runLaneJob,
+  resolveLane: () => resolveLane,
+  probeLane: () => probeLane,
+  laneInventory: () => laneInventory,
+  createGrokAdapter: () => createGrokAdapter,
+  createCursorAdapter: () => createCursorAdapter,
+  createCodexAdapter: () => createCodexAdapter,
+  createClaudeAdapter: () => createClaudeAdapter,
+  binaryOnPath: () => binaryOnPath,
+  LaneDependencyMissingError: () => LaneDependencyMissingError,
+  LaneAdapterShapeError: () => LaneAdapterShapeError,
+  LANE_KINDS: () => LANE_KINDS2
+});
+function resolveLane(kind) {
+  const adapter = adapters.get(kind);
+  if (!adapter)
+    throw new Error(`unknown lane ${kind} (expected one of ${LANE_KINDS2.join(", ")})`);
+  return adapter;
+}
+async function runLaneJob(job) {
+  return resolveLane(job.lane).run(job);
+}
+async function probeLane(kind) {
+  return resolveLane(kind).probe();
+}
+async function laneInventory() {
+  return Promise.all(LANE_KINDS2.map((kind) => probeLane(kind)));
+}
+var adapters;
+var init_lanes = __esm(() => {
+  init_claude();
+  init_codex();
+  init_cursor();
+  init_grok();
+  init_types();
+  init_types();
+  init_claude();
+  init_codex();
+  init_cursor();
+  init_grok();
+  adapters = new Map([
+    ["claude", createClaudeAdapter()],
+    ["codex", createCodexAdapter()],
+    ["cursor", createCursorAdapter()],
+    ["grok", createGrokAdapter()]
+  ]);
+});
+
 // src/service.ts
-import { join } from "path";
+import { join as join3 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/workflows",
-  version: "0.1.0",
-  description: "Universal graph workflow app \u2014 scaffold with version/health/readiness on all four surfaces; graph language, store, session WAL, daemon, and lane adapters are roadmap",
+  version: "0.1.2",
+  description: "Universal graph workflow app \u2014 graph language (start/step/decision/while/end), three-table store, session WAL, daemon with claims/leases, four lane adapters (claude/codex/cursor/grok), and a full CLI on four surfaces",
   type: "module",
   main: "./dist/index.js",
   types: "./types/index.d.ts",
@@ -69,16 +510,18 @@ var package_default = {
     url: "https://github.com/hasna/apps/issues"
   },
   engines: {
-    bun: ">=1.0.0",
-    node: ">=20.0.0"
+    bun: ">=1.0.0"
   },
   author: "Hasna",
   license: "Apache-2.0",
   dependencies: {
+    "@anthropic-ai/claude-agent-sdk": "^0.3.234",
+    "@cursor/sdk": "^1.0.28",
+    "@openai/codex-sdk": "^0.147.0",
     commander: "^13.1.0"
   },
   devDependencies: {
-    "@hasna/contracts": "0.14.0",
+    "@hasna/contracts": "0.14.1",
     "@types/bun": "latest",
     "@types/pg": "^8.15.6",
     pg: "^8.16.3",
@@ -86,6 +529,1428 @@ var package_default = {
   }
 };
 
+// src/daemon.ts
+import { createHash as createHash2 } from "crypto";
+
+// src/expr.ts
+class ExprSyntaxError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ExprSyntaxError";
+  }
+}
+
+class ExprEvalError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ExprEvalError";
+  }
+}
+var COMPARISON_OPS = new Set(["==", "!=", "<", "<=", ">", ">="]);
+function tokenize(input) {
+  const tokens = [];
+  let i = 0;
+  while (i < input.length) {
+    const ch = input[i];
+    if (ch === " " || ch === "\t" || ch === `
+` || ch === "\r") {
+      i++;
+      continue;
+    }
+    if (ch === "(") {
+      tokens.push({ kind: "lparen", value: "(" });
+      i++;
+      continue;
+    }
+    if (ch === ")") {
+      tokens.push({ kind: "rparen", value: ")" });
+      i++;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      const quote = ch;
+      let j = i + 1;
+      let out = "";
+      let closed = false;
+      while (j < input.length) {
+        if (input[j] === quote) {
+          closed = true;
+          break;
+        }
+        out += input[j];
+        j++;
+      }
+      if (!closed)
+        throw new ExprSyntaxError(`unterminated string literal at offset ${i}`);
+      tokens.push({ kind: "string", value: out });
+      i = j + 1;
+      continue;
+    }
+    const two = input.slice(i, i + 2);
+    if (COMPARISON_OPS.has(two)) {
+      tokens.push({ kind: "op", value: two });
+      i += 2;
+      continue;
+    }
+    if (ch === "<" || ch === ">" || ch === "=" || ch === "!") {
+      tokens.push({ kind: "op", value: ch });
+      i++;
+      continue;
+    }
+    if (/[0-9]/.test(ch)) {
+      let j = i;
+      while (j < input.length && /[0-9.]/.test(input[j]))
+        j++;
+      tokens.push({ kind: "number", value: input.slice(i, j) });
+      i = j;
+      continue;
+    }
+    if (/[A-Za-z_]/.test(ch)) {
+      let j = i;
+      while (j < input.length && /[A-Za-z0-9_.]/.test(input[j]))
+        j++;
+      tokens.push({ kind: "ident", value: input.slice(i, j) });
+      i = j;
+      continue;
+    }
+    throw new ExprSyntaxError(`unexpected character ${JSON.stringify(ch)} at offset ${i}`);
+  }
+  return tokens;
+}
+
+class Parser {
+  tokens;
+  pos = 0;
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  peek() {
+    return this.tokens[this.pos];
+  }
+  next() {
+    return this.tokens[this.pos++];
+  }
+  expectOp(value) {
+    const t = this.next();
+    if (!t || t.kind !== "op" || t.value !== value) {
+      throw new ExprSyntaxError(`expected ${JSON.stringify(value)}`);
+    }
+  }
+  parse() {
+    if (this.tokens.length === 0)
+      throw new ExprSyntaxError("empty expression");
+    const node = this.parseOr();
+    if (this.pos < this.tokens.length) {
+      throw new ExprSyntaxError(`unexpected trailing token ${JSON.stringify(this.peek().value)}`);
+    }
+    return node;
+  }
+  parseOr() {
+    let left = this.parseAnd();
+    while (this.peek()?.kind === "ident" && this.peek().value === "or") {
+      this.next();
+      const right = this.parseAnd();
+      left = { kind: "or", left, right };
+    }
+    return left;
+  }
+  parseAnd() {
+    let left = this.parseNot();
+    while (this.peek()?.kind === "ident" && this.peek().value === "and") {
+      this.next();
+      const right = this.parseNot();
+      left = { kind: "and", left, right };
+    }
+    return left;
+  }
+  parseNot() {
+    if (this.peek()?.kind === "ident" && this.peek().value === "not") {
+      this.next();
+      return { kind: "not", operand: this.parseNot() };
+    }
+    return this.parseComparison();
+  }
+  parseComparison() {
+    const left = this.parsePrimary();
+    const t = this.peek();
+    if (t && t.kind === "op" && COMPARISON_OPS.has(t.value)) {
+      this.next();
+      const right = this.parsePrimary();
+      return { kind: "comparison", op: t.value, left, right };
+    }
+    return left;
+  }
+  parsePrimary() {
+    const t = this.next();
+    if (!t)
+      throw new ExprSyntaxError("unexpected end of expression");
+    if (t.kind === "lparen") {
+      const inner = this.parseOr();
+      this.expectCloseParen();
+      return inner;
+    }
+    if (t.kind === "number") {
+      const value = Number(t.value);
+      if (!Number.isFinite(value))
+        throw new ExprSyntaxError(`invalid number ${JSON.stringify(t.value)}`);
+      return { kind: "literal", value };
+    }
+    if (t.kind === "string")
+      return { kind: "literal", value: t.value };
+    if (t.kind === "ident") {
+      if (t.value === "true")
+        return { kind: "literal", value: true };
+      if (t.value === "false")
+        return { kind: "literal", value: false };
+      return { kind: "path", segments: t.value.split(".") };
+    }
+    throw new ExprSyntaxError(`unexpected token ${JSON.stringify(t.value)}`);
+  }
+  expectCloseParen() {
+    const t = this.next();
+    if (!t || t.kind !== "rparen")
+      throw new ExprSyntaxError("expected )");
+  }
+}
+function parseExpr(input) {
+  return new Parser(tokenize(input)).parse();
+}
+function resolvePath(segments, context) {
+  let current = context;
+  for (const segment of segments) {
+    if (current === null || typeof current !== "object")
+      return;
+    const record = current;
+    if (!(segment in record))
+      return;
+    current = record[segment];
+  }
+  if (typeof current === "number" || typeof current === "string" || typeof current === "boolean") {
+    return current;
+  }
+  return;
+}
+function evalNode(node, context) {
+  switch (node.kind) {
+    case "literal":
+      return node.value;
+    case "path":
+      return resolvePath(node.segments, context);
+    case "comparison": {
+      const left = evalNode(node.left, context);
+      const right = evalNode(node.right, context);
+      if (left === undefined || right === undefined) {
+        if (node.op === "==")
+          return left === undefined && right === undefined;
+        if (node.op === "!=")
+          return left !== right;
+        throw new ExprEvalError("cannot order-compare an unknown path");
+      }
+      if (typeof left !== typeof right) {
+        throw new ExprEvalError(`cannot compare ${JSON.stringify(left)} (${typeof left}) with ${JSON.stringify(right)} (${typeof right})`);
+      }
+      switch (node.op) {
+        case "==":
+          return left === right;
+        case "!=":
+          return left !== right;
+        case "<":
+          return left < right;
+        case "<=":
+          return left <= right;
+        case ">":
+          return left > right;
+        case ">=":
+          return left >= right;
+        default:
+          throw new ExprEvalError(`unknown operator ${node.op}`);
+      }
+    }
+    case "and": {
+      const left = evalNode(node.left, context);
+      const right = evalNode(node.right, context);
+      if (typeof left !== "boolean" || typeof right !== "boolean") {
+        throw new ExprEvalError("and requires boolean operands");
+      }
+      return left && right;
+    }
+    case "or": {
+      const left = evalNode(node.left, context);
+      const right = evalNode(node.right, context);
+      if (typeof left !== "boolean" || typeof right !== "boolean") {
+        throw new ExprEvalError("or requires boolean operands");
+      }
+      return left || right;
+    }
+    case "not": {
+      const operand = evalNode(node.operand, context);
+      if (typeof operand !== "boolean")
+        throw new ExprEvalError("not requires a boolean operand");
+      return !operand;
+    }
+  }
+}
+function evaluateExpr(input, context) {
+  const ast = parseExpr(input);
+  const value = evalNode(ast, context);
+  if (typeof value !== "boolean") {
+    throw new ExprEvalError(`condition must evaluate to a boolean, got ${typeof value}`);
+  }
+  return value;
+}
+
+// src/graph.ts
+var GRAPH_NODE_TYPES = ["start", "step", "decision", "while", "end"];
+var LANE_KINDS = ["claude", "codex", "cursor", "grok"];
+var NODE_ID_RE = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+function issue(issues, path, message) {
+  issues.push({ path, message });
+}
+function findNode(graph, id) {
+  return graph.nodes.find((n) => n.id === id);
+}
+function collectEdges(graph) {
+  const edges = [];
+  for (const node of graph.nodes) {
+    switch (node.type) {
+      case "start":
+      case "step":
+        if (node.next)
+          edges.push({ from: node.id, to: node.next });
+        break;
+      case "decision":
+        if (node.then)
+          edges.push({ from: node.id, to: node.then });
+        if (node.else)
+          edges.push({ from: node.id, to: node.else });
+        break;
+      case "while":
+        if (node.next)
+          edges.push({ from: node.id, to: node.next });
+        break;
+      case "end":
+        break;
+    }
+  }
+  return edges;
+}
+function reachableNodes(graph) {
+  const start = graph.nodes.find((n) => n.type === "start");
+  if (!start)
+    return [];
+  const seen = new Set;
+  const stack = [start.id];
+  while (stack.length > 0) {
+    const id = stack.pop();
+    if (seen.has(id))
+      continue;
+    seen.add(id);
+    const node = findNode(graph, id);
+    if (!node)
+      continue;
+    if (node.type === "start" || node.type === "step") {
+      if (node.next)
+        stack.push(node.next);
+    } else if (node.type === "decision") {
+      if (node.then)
+        stack.push(node.then);
+      if (node.else)
+        stack.push(node.else);
+    } else if (node.type === "while") {
+      for (const bodyId of node.body)
+        stack.push(bodyId);
+      if (node.next)
+        stack.push(node.next);
+    }
+  }
+  return [...seen];
+}
+function findCycles(graph) {
+  const edges = collectEdges(graph);
+  const adj = new Map;
+  for (const e of edges) {
+    const list = adj.get(e.from) ?? [];
+    list.push(e.to);
+    adj.set(e.from, list);
+  }
+  const color = new Map;
+  const stack = [];
+  const cycles = [];
+  function visit(id) {
+    color.set(id, "grey");
+    stack.push(id);
+    for (const to of adj.get(id) ?? []) {
+      const c = color.get(to);
+      if (c === "grey") {
+        const idx = stack.indexOf(to);
+        cycles.push([...stack.slice(idx), to]);
+      } else if (c === undefined) {
+        visit(to);
+      }
+    }
+    stack.pop();
+    color.set(id, "black");
+  }
+  for (const node of graph.nodes) {
+    if (color.get(node.id) === undefined)
+      visit(node.id);
+  }
+  return cycles;
+}
+function validateGraph(graph) {
+  const issues = [];
+  if (typeof graph.name !== "string" || graph.name.trim() === "") {
+    issue(issues, "name", "graph requires a non-empty name");
+  }
+  if (typeof graph.version !== "string" || graph.version.trim() === "") {
+    issue(issues, "version", "graph requires a version string");
+  }
+  if (!Array.isArray(graph.nodes) || graph.nodes.length === 0) {
+    issue(issues, "nodes", "graph requires at least one node");
+    return { ok: false, issues };
+  }
+  const starts = graph.nodes.filter((n) => n.type === "start");
+  if (starts.length === 0)
+    issue(issues, "nodes", "graph requires exactly one start node (found none)");
+  if (starts.length > 1)
+    issue(issues, "nodes", "graph requires exactly one start node (found multiple)");
+  const ends = graph.nodes.filter((n) => n.type === "end");
+  if (ends.length === 0)
+    issue(issues, "nodes", "graph requires at least one end node");
+  const seenIds = new Map;
+  for (const node of graph.nodes) {
+    if (typeof node.id !== "string" || !NODE_ID_RE.test(node.id)) {
+      issue(issues, "nodes", `node id ${JSON.stringify(node.id)} must match ${String(NODE_ID_RE)}`);
+      continue;
+    }
+    if (seenIds.has(node.id)) {
+      issue(issues, `nodes.${node.id}`, `duplicate node id ${node.id}`);
+      continue;
+    }
+    seenIds.set(node.id, node);
+    if (!GRAPH_NODE_TYPES.includes(node.type)) {
+      issue(issues, `nodes.${node.id}`, `unknown node type ${JSON.stringify(node.type)}`);
+      continue;
+    }
+    validateNode(graph, node, issues);
+  }
+  for (const node of graph.nodes) {
+    const edges = nodeEdges(node);
+    for (const { kind, target } of edges) {
+      if (!seenIds.has(target)) {
+        issue(issues, `nodes.${node.id}`, `${kind} edge targets nonexistent node ${target}`);
+      }
+    }
+  }
+  if (starts.length === 1) {
+    const reachable = new Set(reachableNodes(graph));
+    for (const node of graph.nodes) {
+      if (!reachable.has(node.id)) {
+        issue(issues, `nodes.${node.id}`, `node ${node.id} is unreachable from start`);
+      }
+    }
+  }
+  const cycles = findCycles(graph);
+  for (const cycle of cycles) {
+    issue(issues, "nodes", `explicit cycle detected: ${cycle.join(" -> ")} (loop only via a while node)`);
+  }
+  return { ok: issues.length === 0, issues };
+}
+function nodeEdges(node) {
+  switch (node.type) {
+    case "start":
+    case "step":
+      return node.next ? [{ kind: "next", target: node.next }] : [];
+    case "decision":
+      return [
+        ...node.then ? [{ kind: "then", target: node.then }] : [],
+        ...node.else ? [{ kind: "else", target: node.else }] : []
+      ];
+    case "while":
+      return node.next ? [{ kind: "next", target: node.next }] : [];
+    case "end":
+      return [];
+  }
+}
+function validateNode(graph, node, issues) {
+  switch (node.type) {
+    case "start":
+      if (!node.next)
+        issue(issues, `nodes.${node.id}`, "start node requires a next edge");
+      break;
+    case "step": {
+      if (!node.prompt && !node.command) {
+        issue(issues, `nodes.${node.id}`, "step node requires prompt or command");
+      }
+      if (node.lane !== undefined && !LANE_KINDS.includes(node.lane)) {
+        issue(issues, `nodes.${node.id}`, `unknown lane ${JSON.stringify(node.lane)} (expected one of ${LANE_KINDS.join(", ")})`);
+      }
+      if (node.maxRetries !== undefined && (!Number.isInteger(node.maxRetries) || node.maxRetries < 0)) {
+        issue(issues, `nodes.${node.id}`, "maxRetries must be a non-negative integer");
+      }
+      if (node.timeoutMs !== undefined && (!Number.isInteger(node.timeoutMs) || node.timeoutMs < 1)) {
+        issue(issues, `nodes.${node.id}`, "timeoutMs must be a positive integer");
+      }
+      break;
+    }
+    case "decision": {
+      if (typeof node.condition !== "string" || node.condition.trim() === "") {
+        issue(issues, `nodes.${node.id}`, "decision node requires a condition expression");
+      } else {
+        try {
+          parseExpr(node.condition);
+        } catch (err) {
+          if (err instanceof ExprSyntaxError) {
+            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
+          } else {
+            throw err;
+          }
+        }
+      }
+      if (!node.then && !node.else) {
+        issue(issues, `nodes.${node.id}`, "decision node requires then and/or else edge");
+      }
+      break;
+    }
+    case "while": {
+      if (typeof node.condition !== "string" || node.condition.trim() === "") {
+        issue(issues, `nodes.${node.id}`, "while node requires a condition expression");
+      } else {
+        try {
+          parseExpr(node.condition);
+        } catch (err) {
+          if (err instanceof ExprSyntaxError) {
+            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
+          } else {
+            throw err;
+          }
+        }
+      }
+      if (node.maxIterations === undefined) {
+        issue(issues, `nodes.${node.id}`, "while node requires maxIterations (finite loop bound)");
+      } else if (!Number.isInteger(node.maxIterations) || node.maxIterations < 1) {
+        issue(issues, `nodes.${node.id}`, "maxIterations must be a positive integer");
+      }
+      if (!Array.isArray(node.body) || node.body.length === 0) {
+        issue(issues, `nodes.${node.id}`, "while node requires a non-empty body");
+      } else {
+        for (const bodyId of node.body) {
+          const bodyNode = findNode(graph, bodyId);
+          if (!bodyNode) {
+            issue(issues, `nodes.${node.id}`, `while body references nonexistent node ${bodyId}`);
+            continue;
+          }
+          if (bodyNode.type === "start" || bodyNode.type === "end" || bodyNode.type === "while") {
+            issue(issues, `nodes.${node.id}`, `while body may only contain step/decision nodes in v1 (found ${bodyNode.type})`);
+          }
+        }
+        const bodySet = new Set(node.body);
+        for (const bodyId of node.body) {
+          const bodyNode = findNode(graph, bodyId);
+          if (!bodyNode)
+            continue;
+          for (const { kind, target } of nodeEdges(bodyNode)) {
+            if (!bodySet.has(target)) {
+              issue(issues, `nodes.${node.id}`, `while body node ${bodyId} ${kind}-edge leaves the body (target ${target})`);
+            }
+          }
+        }
+      }
+      break;
+    }
+    case "end":
+      break;
+  }
+}
+
+// src/secrets.ts
+class SecretsGateError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SecretsGateError";
+  }
+}
+var p = (...parts) => parts.join("");
+var VALUE_PATTERNS = [
+  { detector: "anthropic_api_key", re: new RegExp(p("sk-", "ant-") + "[A-Za-z0-9_-]{10,}") },
+  { detector: "openai_api_key", re: new RegExp(p("sk-", "proj-") + "[A-Za-z0-9_-]{10,}") },
+  { detector: "npm_token", re: /npm_[A-Za-z0-9]{20,}/ },
+  { detector: "github_token", re: /gh[pousr]_[A-Za-z0-9]{20,}/ },
+  { detector: "aws_access_key", re: /AKIA[0-9A-Z]{16}/ },
+  { detector: "google_api_key", re: /AIza[0-9A-Za-z_-]{20,}/ },
+  { detector: "xai_api_key", re: new RegExp(p("xai-") + "[A-Za-z0-9]{20,}") },
+  { detector: "codex_token", re: new RegExp(p("ctx7", "sk-") + "[A-Za-z0-9]{10,}") },
+  { detector: "private_key_block", re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/ },
+  { detector: "bearer_token", re: /Bearer [A-Za-z0-9._~+/=-]{20,}/ }
+];
+var CREDENTIAL_KEY_RE = /^(token|api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|secret[_-]?key|refresh[_-]?token|session[_-]?token|bot[_-]?token)$/i;
+function scanString(value, path, findings) {
+  for (const { detector, re } of VALUE_PATTERNS) {
+    if (re.test(value)) {
+      findings.push({ path, detector });
+      return;
+    }
+  }
+}
+function isTrivial(value) {
+  const v = value.trim();
+  if (v.length === 0)
+    return true;
+  const upper = v.toUpperCase();
+  if (upper.startsWith("REPLACE") || upper.startsWith("CHANGE") || upper.startsWith("YOUR_") || upper.startsWith("EXAMPLE") || upper.startsWith("PLACEHOLDER"))
+    return true;
+  if (v.length < 8)
+    return true;
+  return false;
+}
+function scanForSecrets(value, path = "$") {
+  const findings = [];
+  if (value === null || value === undefined)
+    return findings;
+  if (typeof value === "string") {
+    scanString(value, path, findings);
+    return findings;
+  }
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => {
+      findings.push(...scanForSecrets(item, `${path}[${index}]`));
+    });
+    return findings;
+  }
+  if (typeof value === "object") {
+    const record = value;
+    for (const [key, child] of Object.entries(record)) {
+      if (CREDENTIAL_KEY_RE.test(key) && typeof child === "string" && !isTrivial(child)) {
+        findings.push({ path: `${path}.${key}`, detector: "credential_key_field" });
+      } else {
+        findings.push(...scanForSecrets(child, `${path}.${key}`));
+      }
+    }
+  }
+  return findings;
+}
+function assertNoSecrets(value, what) {
+  const findings = scanForSecrets(value);
+  if (findings.length === 0)
+    return;
+  const detail = findings.map((f) => `${f.path} (${f.detector})`).join(", ");
+  throw new SecretsGateError(`secrets write-gate refused to persist ${what}: credential-shaped value at ${detail}`);
+}
+
+// src/session.ts
+import { createHash } from "crypto";
+var DEFAULT_MAX_ATTEMPTS = 3;
+function repairTornRuns(store, wal, opts = {}) {
+  const maxAttempts = opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+  const replay = wal.replay();
+  const liveClaims = replay.liveClaims(opts.now);
+  const report = { interrupted: 0, requeued: 0, failed: 0 };
+  const running = store.listRuns({ status: "running", limit: 1000 });
+  for (const run of running) {
+    if (liveClaims.has(run.id))
+      continue;
+    report.interrupted++;
+    const nodes = store.listRunNodes(run.id);
+    if (run.attempts < maxAttempts) {
+      store.bumpAttempts(run.id);
+      store.setRunStatus(run.id, "interrupted", {
+        error: `torn run interrupted after claim loss (attempt ${run.attempts + 1}/${maxAttempts})`
+      });
+      for (const node of nodes) {
+        if (node.status === "running") {
+          store.setRunNodeStatus(node.id, "pending", { error: undefined });
+        }
+      }
+      report.requeued++;
+    } else {
+      store.setRunStatus(run.id, "failed", {
+        error: `torn run failed after ${maxAttempts} interrupted attempts`
+      });
+      for (const node of nodes) {
+        if (node.status === "running") {
+          store.setRunNodeStatus(node.id, "failed", { error: "run interrupted beyond retry budget" });
+        }
+      }
+      report.failed++;
+    }
+  }
+  return report;
+}
+function inputHash(payload) {
+  return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
+}
+function memoKey(graphName, nodeId, input) {
+  return `${graphName}:${nodeId}:${inputHash(input)}`;
+}
+function tryMemoHit(store, graphName, nodeId, input) {
+  const key = memoKey(graphName, nodeId, input);
+  const memo = store.memoGet(key);
+  if (!memo)
+    return;
+  store.memoHit(key);
+  return memo;
+}
+function recordMemo(store, graphName, nodeId, input, output) {
+  const key = memoKey(graphName, nodeId, input);
+  store.memoPut(key, graphName, nodeId, inputHash(input), JSON.stringify(output));
+}
+function findRunByIdempotencyKey(store, key) {
+  const runs = store.listRuns({ limit: 1000 });
+  for (const run of runs) {
+    try {
+      const context = JSON.parse(run.contextJson);
+      if (context?.__wf?.idempotencyKey === key)
+        return run;
+    } catch {}
+  }
+  return;
+}
+
+// src/daemon.ts
+init_types();
+var DEFAULT_LEASE_TTL_MS = 120000;
+var DEFAULT_MAX_ATTEMPTS2 = 3;
+var DEFAULT_MAX_DISPATCH = 4;
+var DEFAULT_MAX_STEPS = 25;
+var DEFAULT_TIMEOUT_MS = 120000;
+function nowIso() {
+  return new Date().toISOString();
+}
+function stripRunState(context) {
+  const { __wf: _wf, steps: _steps, ...user } = context;
+  return user;
+}
+function runCommand(job) {
+  if (!job.command) {
+    return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "no command" };
+  }
+  const started = Date.now();
+  const timeoutMs = job.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const proc = Bun.spawnSync({
+    cmd: ["/bin/sh", "-c", job.command],
+    cwd: job.cwd,
+    env: { ...process.env, ...job.env ?? {} },
+    stdout: "pipe",
+    stderr: "pipe",
+    timeout: timeoutMs
+  });
+  const durationMs = Date.now() - started;
+  const stdout = proc.stdout ? new TextDecoder().decode(proc.stdout) : "";
+  const stderr = proc.stderr ? new TextDecoder().decode(proc.stderr) : "";
+  const output = stderr ? `${stdout}
+${stderr}`.trim() : stdout.trim();
+  const exitCode = proc.exitCode ?? (proc.signalCode ? 1 : 1);
+  return { ok: exitCode === 0, exitCode, output, durationMs };
+}
+
+class WorkflowsDaemon {
+  store;
+  wal;
+  worker;
+  leaseTtlMs;
+  maxAttempts;
+  maxDispatchPerCycle;
+  maxStepsPerCycle;
+  time;
+  laneRunner;
+  env;
+  leases = new Map;
+  fencingCounter = new Map;
+  graphCache = new Map;
+  isolatedRunId = null;
+  constructor(store, wal, options = {}) {
+    this.store = store;
+    this.wal = wal;
+    this.worker = options.worker ?? "local";
+    this.leaseTtlMs = options.leaseTtlMs ?? DEFAULT_LEASE_TTL_MS;
+    this.maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS2;
+    this.maxDispatchPerCycle = options.maxDispatchPerCycle ?? DEFAULT_MAX_DISPATCH;
+    this.maxStepsPerCycle = options.maxStepsPerCycle ?? DEFAULT_MAX_STEPS;
+    this.time = options.time ?? Date.now;
+    this.env = options.env ?? {};
+    this.laneRunner = options.laneRunner ?? defaultLaneRunner;
+    this.isolatedRunId = options.isolatedRunId ?? null;
+    this.replayRegisteredGraphs();
+  }
+  isolateRun(runId) {
+    this.isolatedRunId = runId;
+  }
+  replayRegisteredGraphs() {
+    const entries = this.wal.replay().entries;
+    for (const entry of entries) {
+      const op = entry.op;
+      if (op.op === "graph_registered") {
+        this.graphCache.set(op.name, op.graph);
+      }
+    }
+  }
+  liveLeases() {
+    const now = this.time();
+    for (const [runId, lease] of this.leases) {
+      if (lease.expiresAtMs <= now)
+        this.leases.delete(runId);
+    }
+    return this.leases;
+  }
+  claim(runId) {
+    const now = this.time();
+    const existing = this.leases.get(runId);
+    if (existing && existing.worker !== this.worker && existing.expiresAtMs > now) {
+      return null;
+    }
+    const liveClaims = this.wal.replay().liveClaims(now);
+    const foreign = liveClaims.get(runId);
+    if (foreign && foreign.worker !== this.worker && foreign.expiresAtMs > now) {
+      return null;
+    }
+    const fencing = (this.fencingCounter.get(runId) ?? 0) + 1;
+    this.fencingCounter.set(runId, fencing);
+    const lease = { runId, worker: this.worker, expiresAtMs: now + this.leaseTtlMs, fencing };
+    this.leases.set(runId, lease);
+    this.wal.append({
+      op: "claim_acquired",
+      runId,
+      worker: this.worker,
+      expiresAt: new Date(lease.expiresAtMs).toISOString(),
+      fencing,
+      at: nowIso()
+    });
+    return lease;
+  }
+  heartbeat(runId, fencing) {
+    const lease = this.leases.get(runId);
+    if (!lease || lease.fencing !== fencing)
+      return false;
+    lease.expiresAtMs = this.time() + this.leaseTtlMs;
+    return true;
+  }
+  release(runId, fencing) {
+    const lease = this.leases.get(runId);
+    if (!lease || lease.fencing !== fencing)
+      return false;
+    this.leases.delete(runId);
+    this.wal.append({ op: "claim_released", runId, fencing, at: nowIso() });
+    return true;
+  }
+  async reap() {
+    const report = { expired: 0, interrupted: 0, requeued: 0, failed: 0, dispatched: 0, advanced: 0, completed: 0 };
+    const now = this.time();
+    for (const [runId, lease] of this.leases) {
+      if (lease.expiresAtMs <= now) {
+        this.leases.delete(runId);
+        report.expired++;
+      }
+    }
+    if (this.isolatedRunId === null) {
+      const repair = repairTornRuns(this.store, this.wal, { maxAttempts: this.maxAttempts, now });
+      report.interrupted += repair.interrupted;
+      report.requeued += repair.requeued;
+      report.failed += repair.failed;
+    }
+    const pending = this.store.listRuns({ status: "pending", limit: this.maxDispatchPerCycle }).concat(this.store.listRuns({ status: "interrupted", limit: this.maxDispatchPerCycle })).sort((a, b) => a.createdAt === b.createdAt ? a.id < b.id ? 1 : -1 : a.createdAt < b.createdAt ? 1 : -1).slice(0, this.maxDispatchPerCycle);
+    for (const run of pending) {
+      if (this.isolatedRunId !== null && run.id !== this.isolatedRunId)
+        continue;
+      const lease = this.claim(run.id);
+      if (!lease)
+        continue;
+      this.store.setRunStatus(run.id, "running");
+      this.wal.append({ op: "run_started", runId: run.id, at: nowIso() });
+      report.dispatched++;
+    }
+    const running = this.store.listRuns({ status: "running", limit: this.maxStepsPerCycle });
+    let steps = 0;
+    for (const run of running) {
+      if (this.isolatedRunId !== null && run.id !== this.isolatedRunId)
+        continue;
+      if (steps >= this.maxStepsPerCycle)
+        break;
+      const outcome = await this.advanceRun(run.id);
+      steps++;
+      if (outcome.kind === "completed")
+        report.completed++;
+      if (outcome.kind === "failed")
+        report.failed++;
+      if (outcome.kind === "advanced")
+        report.advanced++;
+    }
+    return report;
+  }
+  startRun(graph, context) {
+    const validation = validateGraph(graph);
+    if (!validation.ok) {
+      throw new Error(`graph validation failed: ${validation.issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`);
+    }
+    assertNoSecrets(context, "run context");
+    assertNoSecrets(graph, "graph definition");
+    const existing = this.graphCache.get(graph.name);
+    const serialized = JSON.stringify(graph);
+    if (!existing || JSON.stringify(existing) !== serialized) {
+      this.graphCache.set(graph.name, graph);
+      this.wal.append({ op: "graph_registered", name: graph.name, version: graph.version, graph, at: nowIso() });
+    } else {
+      this.graphCache.set(graph.name, existing);
+    }
+    return this.store.createRun({ graphName: graph.name, graphVersion: graph.version, context: context ?? {} });
+  }
+  async advanceRun(runId) {
+    const run = this.store.getRun(runId);
+    if (!run || run.status !== "running")
+      return { kind: "noop" };
+    const lease = this.leases.get(runId);
+    if (!lease || lease.expiresAtMs <= this.time())
+      return { kind: "blocked" };
+    const graph = this.loadGraph(run.graphName);
+    if (!graph) {
+      this.failRun(run, `graph ${run.graphName} not found in daemon graph cache`);
+      return { kind: "failed", error: "graph not found" };
+    }
+    const context = JSON.parse(run.contextJson);
+    const rawWf = context.__wf ?? {};
+    const wf = {
+      ...rawWf,
+      cursor: typeof rawWf.cursor === "string" ? rawWf.cursor : undefined,
+      loops: rawWf.loops ?? {},
+      completedLoops: rawWf.completedLoops ?? {}
+    };
+    try {
+      const cursor = wf.cursor;
+      const node = cursor === undefined ? graph.nodes.find((n) => n.type === "start") : findNode(graph, cursor);
+      if (!node) {
+        this.failRun(run, `cursor ${cursor ?? "<start>"} resolves to no node`);
+        return { kind: "failed", error: "no node at cursor" };
+      }
+      switch (node.type) {
+        case "start": {
+          wf.cursor = node.next;
+          this.persistContext(run, context, wf);
+          return { kind: "advanced", nodeId: node.id };
+        }
+        case "step": {
+          return await this.executeStep(run, graph, context, wf, node);
+        }
+        case "decision": {
+          const value = evaluateExpr(node.condition, this.conditionScope(context));
+          const next = value ? node.then : node.else;
+          if (!next) {
+            this.failRun(run, `decision ${node.id} evaluated ${value} but no ${value ? "then" : "else"} edge`);
+            return { kind: "failed", error: "missing decision edge" };
+          }
+          wf.cursor = next;
+          this.persistContext(run, context, wf);
+          return { kind: "advanced", nodeId: node.id };
+        }
+        case "while": {
+          return this.executeWhile(run, graph, context, wf, node);
+        }
+        case "end": {
+          this.completeRun(run, context);
+          return { kind: "completed" };
+        }
+      }
+    } catch (err) {
+      if (err instanceof ExprEvalError || err instanceof ExprSyntaxError) {
+        this.failRun(run, `condition error at ${wf.cursor ?? "<start>"}: ${err.message}`);
+        return { kind: "failed", error: err.message };
+      }
+      throw err;
+    }
+  }
+  loadGraph(name) {
+    return this.graphCache.get(name);
+  }
+  conditionScope(context) {
+    return { ...context, steps: context.steps ?? {} };
+  }
+  persistContext(run, context, wf) {
+    context.__wf = wf;
+    this.store.setRunContext(run.id, context);
+  }
+  async executeStep(run, graph, context, wf, node) {
+    const nodeId = node.id;
+    const existing = this.store.listRunNodes(run.id).find((n) => n.nodeId === nodeId);
+    const nodeRow = existing ?? this.store.createRunNode({ runId: run.id, nodeId, lane: node.lane ?? "claude" });
+    if (node.memo) {
+      const memoInput = { command: node.command, prompt: node.prompt, context: stripRunState(context) };
+      const hit = tryMemoHit(this.store, run.graphName, nodeId, memoInput);
+      if (hit) {
+        const cached = JSON.parse(hit.outputJson);
+        this.store.setRunNodeStatus(nodeRow.id, "completed", { exitCode: Number(cached.exitCode ?? 0), output: { ...cached, memoHit: true } });
+        this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "completed", at: nowIso() });
+        this.recordStepResult(context, nodeId, { ...cached, memoHit: true });
+        return this.afterNode(run, context, wf, node.next);
+      }
+    }
+    if (nodeRow.status !== "running") {
+      this.store.setRunNodeStatus(nodeRow.id, "running");
+      this.wal.append({ op: "node_started", runId: run.id, nodeId, at: nowIso() });
+    }
+    const job = {
+      lane: node.lane ?? "claude",
+      prompt: node.prompt,
+      command: node.command,
+      timeoutMs: node.timeoutMs,
+      env: this.env
+    };
+    let result;
+    try {
+      result = await this.laneRunner(job);
+    } catch (err) {
+      result = { ok: false, exitCode: 1, output: "", durationMs: 0, error: String(err instanceof Error ? err.message : err) };
+    }
+    const output = { ok: result.ok, exitCode: result.exitCode, output: result.output, durationMs: result.durationMs };
+    if (!result.ok) {
+      const retriesLeft = (node.maxRetries ?? 0) + 1 - nodeRow.attempts;
+      if (retriesLeft > 0) {
+        this.store.bumpAttemptsNode(nodeRow.id);
+        this.store.setRunNodeStatus(nodeRow.id, "pending", { error: result.error ?? `exit ${result.exitCode}` });
+        return { kind: "advanced", nodeId };
+      }
+      const error = result.error ?? `step ${nodeId} failed with exit ${result.exitCode}`;
+      this.store.setRunNodeStatus(nodeRow.id, "failed", { exitCode: result.exitCode, error });
+      this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "failed", at: nowIso() });
+      this.failRun(run, error);
+      return { kind: "failed", error };
+    }
+    try {
+      assertNoSecrets(output, `node ${nodeId} output`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.store.setRunNodeStatus(nodeRow.id, "failed", { error: message });
+      this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "failed", at: nowIso() });
+      this.failRun(run, message);
+      return { kind: "failed", error: message };
+    }
+    this.store.setRunNodeStatus(nodeRow.id, "completed", { exitCode: result.exitCode, output });
+    this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "completed", at: nowIso() });
+    if (node.memo) {
+      recordMemo(this.store, run.graphName, nodeId, { command: node.command, prompt: node.prompt, context: stripRunState(context) }, output);
+      this.wal.append({ op: "memo_set", key: `${run.graphName}:${nodeId}:${createHash2("sha256").update(JSON.stringify({ command: node.command, prompt: node.prompt, context: stripRunState(context) })).digest("hex")}`, at: nowIso() });
+    }
+    this.recordStepResult(context, nodeId, output);
+    return this.afterNode(run, context, wf, node.next);
+  }
+  afterNode(run, context, wf, next) {
+    if (next) {
+      wf.cursor = next;
+      this.persistContext(run, context, wf);
+      return { kind: "advanced", nodeId: wf.cursor };
+    }
+    const cursor = wf.cursor;
+    const graph = this.loadGraph(run.graphName);
+    const whileNode = graph.nodes.find((n) => n.type === "while" && n.body.includes(cursor ?? ""));
+    if (whileNode) {
+      const index = whileNode.body.indexOf(cursor ?? "");
+      if (index >= 0 && index < whileNode.body.length - 1) {
+        wf.cursor = whileNode.body[index + 1];
+        this.persistContext(run, context, wf);
+        return { kind: "advanced", nodeId: wf.cursor };
+      }
+      wf.loops[whileNode.id] = (wf.loops[whileNode.id] ?? 0) + 1;
+      wf.cursor = whileNode.id;
+      this.persistContext(run, context, wf);
+      return { kind: "advanced", nodeId: whileNode.id };
+    }
+    this.completeRun(run, context);
+    return { kind: "completed" };
+  }
+  executeWhile(run, graph, context, wf, node) {
+    const iteration = wf.loops[node.id] ?? 0;
+    if (iteration >= node.maxIterations) {
+      const error = `while node ${node.id} exceeded maxIterations (${node.maxIterations})`;
+      this.failRun(run, error);
+      return { kind: "failed", error };
+    }
+    const scope = { ...this.conditionScope(context), i: iteration };
+    const keepGoing = evaluateExpr(node.condition, scope);
+    if (!keepGoing) {
+      wf.completedLoops[node.id] = iteration;
+      delete wf.loops[node.id];
+      wf.cursor = node.next;
+      this.persistContext(run, context, wf);
+      return { kind: "advanced", nodeId: node.id };
+    }
+    wf.cursor = node.body[0];
+    this.persistContext(run, context, wf);
+    return { kind: "advanced", nodeId: node.id };
+  }
+  recordStepResult(context, nodeId, output) {
+    const steps = context.steps ?? {};
+    steps[nodeId] = output;
+    context.steps = steps;
+  }
+  completeRun(run, context) {
+    const result = {
+      steps: context.steps ?? {},
+      iterations: context.__wf?.completedLoops ?? {}
+    };
+    try {
+      assertNoSecrets(result, "run result");
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.failRun(run, message);
+      return;
+    }
+    this.store.setRunStatus(run.id, "completed", { result, finishedAt: nowIso(), error: null });
+    this.wal.append({ op: "run_finished", runId: run.id, status: "completed", at: nowIso() });
+    const lease = this.leases.get(run.id);
+    if (lease)
+      this.release(run.id, lease.fencing);
+  }
+  failRun(run, error) {
+    this.store.setRunStatus(run.id, "failed", { error, finishedAt: nowIso() });
+    this.wal.append({ op: "run_finished", runId: run.id, status: "failed", at: nowIso() });
+    const lease = this.leases.get(run.id);
+    if (lease)
+      this.release(run.id, lease.fencing);
+  }
+}
+var defaultLaneRunner = async (job) => {
+  if (job.command)
+    return runCommand(job);
+  const { runLaneJob: runLaneJob2 } = await Promise.resolve().then(() => (init_lanes(), exports_lanes));
+  return runLaneJob2(job);
+};
+async function runGraphToCompletion(store, wal, graph, context, options = {}) {
+  const daemon = new WorkflowsDaemon(store, wal, {
+    worker: "local",
+    laneRunner: options.laneRunner,
+    time: options.time,
+    env: options.env,
+    isolatedRunId: options.isolatedRunId
+  });
+  const run = daemon.startRun(graph, context);
+  daemon.isolateRun(run.id);
+  const maxCycles = options.maxCycles ?? 500;
+  for (let cycle = 0;cycle < maxCycles; cycle++) {
+    const report = await daemon.reap();
+    const current = store.getRun(run.id);
+    if (current.status !== "running")
+      return current;
+    if (report.advanced === 0 && report.dispatched === 0) {
+      return store.getRun(run.id);
+    }
+  }
+  return store.getRun(run.id);
+}
+
+// src/store.ts
+import { Database } from "bun:sqlite";
+import { mkdirSync } from "fs";
+import { join } from "path";
+import { randomUUID } from "crypto";
+function nowIso2() {
+  return new Date().toISOString();
+}
+function openStore(dataDir) {
+  mkdirSync(dataDir, { recursive: true });
+  const db = new Database(join(dataDir, "workflows.db"));
+  db.exec("PRAGMA journal_mode = WAL");
+  db.exec("PRAGMA foreign_keys = ON");
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS runs (
+      id            TEXT PRIMARY KEY,
+      graph_name    TEXT NOT NULL,
+      graph_version TEXT NOT NULL,
+      status        TEXT NOT NULL,
+      attempts      INTEGER NOT NULL DEFAULT 0,
+      context_json  TEXT NOT NULL,
+      result_json   TEXT,
+      error         TEXT,
+      started_at    TEXT,
+      finished_at   TEXT,
+      created_at    TEXT NOT NULL,
+      updated_at    TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS run_nodes (
+      id          TEXT PRIMARY KEY,
+      run_id      TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+      node_id     TEXT NOT NULL,
+      status      TEXT NOT NULL,
+      attempts    INTEGER NOT NULL DEFAULT 0,
+      lane        TEXT,
+      exit_code   INTEGER,
+      output_json TEXT,
+      error       TEXT,
+      started_at  TEXT,
+      finished_at TEXT
+    );
+    CREATE TABLE IF NOT EXISTS memos (
+      key         TEXT PRIMARY KEY,
+      graph_name  TEXT NOT NULL,
+      node_id     TEXT NOT NULL,
+      input_hash  TEXT NOT NULL,
+      output_json TEXT NOT NULL,
+      hit_count   INTEGER NOT NULL DEFAULT 0,
+      created_at  TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_runs_status ON runs(status);
+    CREATE INDEX IF NOT EXISTS idx_runs_created ON runs(created_at);
+    CREATE INDEX IF NOT EXISTS idx_run_nodes_run ON run_nodes(run_id);
+  `);
+  const rowToRun = (r) => ({
+    id: String(r.id),
+    graphName: String(r.graph_name),
+    graphVersion: String(r.graph_version),
+    status: r.status,
+    attempts: Number(r.attempts),
+    contextJson: String(r.context_json),
+    resultJson: r.result_json === null ? null : String(r.result_json),
+    error: r.error === null ? null : String(r.error),
+    startedAt: r.started_at === null ? null : String(r.started_at),
+    finishedAt: r.finished_at === null ? null : String(r.finished_at),
+    createdAt: String(r.created_at),
+    updatedAt: String(r.updated_at)
+  });
+  const rowToNode = (r) => ({
+    id: String(r.id),
+    runId: String(r.run_id),
+    nodeId: String(r.node_id),
+    status: r.status,
+    attempts: Number(r.attempts),
+    lane: r.lane === null ? null : String(r.lane),
+    exitCode: r.exit_code === null ? null : Number(r.exit_code),
+    outputJson: r.output_json === null ? null : String(r.output_json),
+    error: r.error === null ? null : String(r.error),
+    startedAt: r.started_at === null ? null : String(r.started_at),
+    finishedAt: r.finished_at === null ? null : String(r.finished_at)
+  });
+  const rowToMemo = (r) => ({
+    key: String(r.key),
+    graphName: String(r.graph_name),
+    nodeId: String(r.node_id),
+    inputHash: String(r.input_hash),
+    outputJson: String(r.output_json),
+    hitCount: Number(r.hit_count),
+    createdAt: String(r.created_at)
+  });
+  return {
+    close() {
+      db.close();
+    },
+    listTables() {
+      const rows = db.query("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'").all();
+      return rows.map((r) => r.name);
+    },
+    createRun(input) {
+      const id = randomUUID();
+      const now = nowIso2();
+      db.query(`INSERT INTO runs (id, graph_name, graph_version, status, attempts, context_json, created_at, updated_at)
+         VALUES (?, ?, ?, 'pending', 0, ?, ?, ?)`).run(id, input.graphName, input.graphVersion, JSON.stringify(input.context ?? {}), now, now);
+      return this.getRun(id);
+    },
+    getRun(id) {
+      const row = db.query(`SELECT * FROM runs WHERE id = ?`).get(id);
+      return row ? rowToRun(row) : undefined;
+    },
+    listRuns(opts = {}) {
+      const limit = Math.min(opts.limit ?? 100, 1000);
+      if (opts.status) {
+        const rows2 = db.query(`SELECT * FROM runs WHERE status = ? ORDER BY created_at DESC, id DESC LIMIT ?`).all(opts.status, limit);
+        return rows2.map((r) => rowToRun(r));
+      }
+      const rows = db.query(`SELECT * FROM runs ORDER BY created_at DESC, id DESC LIMIT ?`).all(limit);
+      return rows.map((r) => rowToRun(r));
+    },
+    setRunStatus(id, status, patch = {}) {
+      const now = nowIso2();
+      const existing = this.getRun(id);
+      const resultJson = patch.result !== undefined ? JSON.stringify(patch.result) : existing?.resultJson ?? null;
+      const error = patch.error !== undefined ? patch.error : existing?.error ?? null;
+      const startedAt = patch.startedAt !== undefined ? patch.startedAt : status === "running" && existing?.startedAt === null ? now : existing?.startedAt ?? null;
+      const terminal = status === "completed" || status === "failed" || status === "cancelled" || status === "interrupted";
+      const finishedAt = patch.finishedAt !== undefined ? patch.finishedAt : terminal && existing?.finishedAt === null ? now : existing?.finishedAt ?? null;
+      db.query(`UPDATE runs SET status = ?, result_json = ?, error = ?, started_at = ?, finished_at = ?, updated_at = ? WHERE id = ?`).run(status, resultJson, error, startedAt, finishedAt, now, id);
+    },
+    bumpAttempts(id) {
+      db.query(`UPDATE runs SET attempts = attempts + 1, updated_at = ? WHERE id = ?`).run(nowIso2(), id);
+    },
+    setRunContext(id, context) {
+      db.query(`UPDATE runs SET context_json = ?, updated_at = ? WHERE id = ?`).run(JSON.stringify(context), nowIso2(), id);
+    },
+    createRunNode(input) {
+      const id = randomUUID();
+      db.query(`INSERT INTO run_nodes (id, run_id, node_id, status, attempts, lane)
+         VALUES (?, ?, ?, 'pending', 0, ?)`).run(id, input.runId, input.nodeId, input.lane ?? null);
+      return this.getRunNode(id);
+    },
+    getRunNode(id) {
+      const row = db.query(`SELECT * FROM run_nodes WHERE id = ?`).get(id);
+      return row ? rowToNode(row) : undefined;
+    },
+    listRunNodes(runId) {
+      const rows = db.query(`SELECT * FROM run_nodes WHERE run_id = ? ORDER BY rowid ASC`).all(runId);
+      return rows.map((r) => rowToNode(r));
+    },
+    setRunNodeStatus(id, status, patch = {}) {
+      const now = nowIso2();
+      const existing = this.getRunNode(id);
+      if (!existing)
+        return;
+      const exitCode = patch.exitCode !== undefined ? patch.exitCode : existing.exitCode;
+      const outputJson = patch.output !== undefined ? JSON.stringify(patch.output) : existing.outputJson;
+      const error = patch.error !== undefined ? patch.error : existing.error;
+      const startedAt = patch.startedAt !== undefined ? patch.startedAt : status === "running" && existing.startedAt === null ? now : existing.startedAt;
+      const terminal = status === "completed" || status === "failed" || status === "skipped";
+      const finishedAt = patch.finishedAt !== undefined ? patch.finishedAt : terminal && existing.finishedAt === null ? now : existing.finishedAt;
+      db.query(`UPDATE run_nodes SET status = ?, exit_code = ?, output_json = ?, error = ?, started_at = ?, finished_at = ? WHERE id = ?`).run(status, exitCode, outputJson, error, startedAt, finishedAt, id);
+    },
+    bumpAttemptsNode(id) {
+      db.query(`UPDATE run_nodes SET attempts = attempts + 1 WHERE id = ?`).run(id);
+    },
+    memoPut(key, graphName, nodeId, inputHash2, outputJson) {
+      db.query(`INSERT INTO memos (key, graph_name, node_id, input_hash, output_json, hit_count, created_at)
+         VALUES (?, ?, ?, ?, ?, 0, ?)
+         ON CONFLICT(key) DO UPDATE SET output_json = excluded.output_json`).run(key, graphName, nodeId, inputHash2, outputJson, nowIso2());
+    },
+    memoGet(key) {
+      const row = db.query(`SELECT * FROM memos WHERE key = ?`).get(key);
+      return row ? rowToMemo(row) : undefined;
+    },
+    memoHit(key) {
+      db.query(`UPDATE memos SET hit_count = hit_count + 1 WHERE key = ?`).run(key);
+    },
+    memoList() {
+      const rows = db.query(`SELECT * FROM memos ORDER BY created_at DESC LIMIT 1000`).all();
+      return rows.map((r) => rowToMemo(r));
+    },
+    memoClear() {
+      db.exec(`DELETE FROM memos`);
+    }
+  };
+}
+
+// src/wal.ts
+import { createHash as createHash3 } from "crypto";
+import { appendFileSync, existsSync, mkdirSync as mkdirSync2, readFileSync, renameSync, truncateSync, writeFileSync } from "fs";
+import { join as join2 } from "path";
+var WAL_FILE_NAME = "session.wal";
+var SESSIONS_DIR_NAME = "sessions";
+var MAX_WAL_BYTES = 256 * 1024 * 1024;
+function checksumOf(op) {
+  if (op === undefined || op === null)
+    return "";
+  return createHash3("sha256").update(JSON.stringify(op)).digest("hex");
+}
+
+class SessionWAL {
+  filePath;
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  static open(dataDir) {
+    mkdirSync2(join2(dataDir, SESSIONS_DIR_NAME), { recursive: true });
+    const canonical = join2(dataDir, SESSIONS_DIR_NAME, WAL_FILE_NAME);
+    const legacy = join2(dataDir, WAL_FILE_NAME);
+    if (existsSync(legacy) && !existsSync(canonical)) {
+      try {
+        renameSync(legacy, canonical);
+      } catch {
+        return new SessionWAL(legacy);
+      }
+    }
+    return new SessionWAL(canonical);
+  }
+  static openAt(filePath) {
+    return new SessionWAL(filePath);
+  }
+  append(op) {
+    const at = op.at ?? new Date().toISOString();
+    const full = { ...op, at };
+    const nextSeq = this.nextSeq();
+    const entry = { seq: nextSeq, at, checksum: checksumOf(full), op: full };
+    appendFileSync(this.filePath, JSON.stringify(entry) + `
+`, "utf8");
+    return entry;
+  }
+  nextSeq() {
+    const replay = this.replay();
+    return replay.entries.length + 1;
+  }
+  replay() {
+    const entries = [];
+    let torn = false;
+    let repaired = false;
+    let content;
+    try {
+      content = readFileSync(this.filePath, "utf8");
+    } catch {
+      return { entries, torn, repaired, liveClaims: () => new Map };
+    }
+    if (content.length > MAX_WAL_BYTES) {
+      throw new Error(`session WAL exceeds ${MAX_WAL_BYTES} bytes; refusing to replay a truncated journal`);
+    }
+    if (content === "") {
+      return { entries, torn, repaired, liveClaims: () => new Map };
+    }
+    const lines = content.split(`
+`);
+    let badOffset = null;
+    let expectedSeq = 1;
+    for (let i = 0;i < lines.length; i++) {
+      const line = lines[i];
+      if (line === "")
+        continue;
+      if (badOffset !== null)
+        break;
+      const lineOffset = cumulativeOffset(lines, i);
+      let entry;
+      try {
+        entry = JSON.parse(line);
+      } catch {
+        badOffset = lineOffset;
+        break;
+      }
+      if (typeof entry?.seq !== "number" || entry.seq !== expectedSeq || entry.checksum !== checksumOf(entry.op)) {
+        badOffset = lineOffset;
+        break;
+      }
+      entries.push(entry);
+      expectedSeq++;
+    }
+    if (badOffset !== null) {
+      torn = true;
+      try {
+        truncateSync(this.filePath, badOffset);
+        repaired = true;
+      } catch {}
+    }
+    return {
+      entries,
+      torn,
+      repaired,
+      liveClaims: (nowMs) => reconstructLiveClaims(entries, nowMs)
+    };
+  }
+  close() {}
+}
+function cumulativeOffset(lines, index) {
+  let offset = 0;
+  for (let i = 0;i < index; i++) {
+    offset += Buffer.byteLength(lines[i]) + 1;
+  }
+  return offset;
+}
+function reconstructLiveClaims(entries, nowMs = Date.now()) {
+  const claims = new Map;
+  for (const entry of entries) {
+    const op = entry.op;
+    if (op.op === "claim_acquired") {
+      claims.set(op.runId, { worker: op.worker, fencing: op.fencing, expiresAtMs: Date.parse(op.expiresAt) });
+    } else if (op.op === "claim_released") {
+      const existing = claims.get(op.runId);
+      if (existing && existing.fencing === op.fencing) {
+        claims.delete(op.runId);
+      }
+    }
+  }
+  for (const [runId, claim] of claims) {
+    if (claim.expiresAtMs <= nowMs)
+      claims.delete(runId);
+  }
+  return claims;
+}
+
 // src/service.ts
 var DEFAULT_PORT = 8790;
 var DEFAULT_HOST = "127.0.0.1";
@@ -112,7 +1977,7 @@ function resolveWorkflowsConfig(overrides = {}) {
   return {
     port: overrides.port ?? envInt(["HASNA_WORKFLOWS_PORT", "WORKFLOWS_PORT"], DEFAULT_PORT),
     host: overrides.host ?? envString(["HASNA_WORKFLOWS_HOST", "WORKFLOWS_HOST"]) ?? DEFAULT_HOST,
-    dataDir: overrides.dataDir ?? envString(["HASNA_WORKFLOWS_DATA_DIR", "WORKFLOWS_DATA_DIR"]) ?? join(home, ".hasna", "workflows"),
+    dataDir: overrides.dataDir ?? envString(["HASNA_WORKFLOWS_DATA_DIR", "WORKFLOWS_DATA_DIR"]) ?? join3(home, ".hasna", "workflows"),
     apiUrl: overrides.apiUrl ?? envString(["WORKFLOWS_API_URL"]),
     apiKey: overrides.apiKey ?? envString(["WORKFLOWS_API_KEY"])
   };
@@ -144,12 +2009,52 @@ class WorkflowsService {
       checks: { version: "ok" }
     };
   }
+  async triggerRun(graph, context = {}, opts = {}) {
+    const store = openStore(this.config.dataDir);
+    const wal = SessionWAL.open(this.config.dataDir);
+    try {
+      if (opts.idempotencyKey) {
+        const existing = findRunByIdempotencyKey(store, opts.idempotencyKey);
+        if (existing) {
+          return {
+            runId: existing.id,
+            status: existing.status,
+            error: existing.error ?? null,
+            result: existing.resultJson ? JSON.parse(existing.resultJson) : null,
+            reused: true
+          };
+        }
+      }
+      const contextWithKey = opts.idempotencyKey ? {
+        ...context,
+        __wf: {
+          cursor: undefined,
+          loops: {},
+          completedLoops: {},
+          ...context?.__wf ?? {},
+          idempotencyKey: opts.idempotencyKey
+        }
+      } : context;
+      const maxCycles = Math.min(Math.max(opts.maxCycles ?? 500, 1), 2000);
+      const final = await runGraphToCompletion(store, wal, graph, contextWithKey, { maxCycles });
+      return {
+        runId: final.id,
+        status: final.status,
+        error: final.error ?? null,
+        result: final.resultJson ? JSON.parse(final.resultJson) : null,
+        reused: false
+      };
+    } finally {
+      store.close();
+    }
+  }
 }
 function createWorkflowsService(config = {}) {
   return new WorkflowsService(config);
 }
 
 // src/handlers.ts
+import { createHash as createHash4, timingSafeEqual } from "crypto";
 function jsonResponse(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
@@ -163,10 +2068,85 @@ function openApiDoc(service) {
     paths: {
       "/health": { get: { summary: "Service health", responses: { "200": { description: "ok" } } } },
       "/ready": { get: { summary: "Service readiness", responses: { "200": { description: "ok" } } } },
-      "/version": { get: { summary: "Service version", responses: { "200": { description: "ok" } } } }
+      "/version": { get: { summary: "Service version", responses: { "200": { description: "ok" } } } },
+      "/trigger": {
+        post: {
+          summary: "Authenticated trigger: run a workflow graph to a terminal state",
+          security: [{ bearerAuth: [] }],
+          requestBody: {
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  required: ["graph"],
+                  properties: {
+                    graph: { type: "object", description: "the workflow graph" },
+                    context: { type: "object", description: "optional run context" },
+                    idempotencyKey: { type: "string", description: "re-run with the same key returns the same run" },
+                    maxCycles: { type: "number", description: "bound on reap cycles (default 500, max 2000)" }
+                  }
+                }
+              }
+            }
+          },
+          responses: {
+            "200": { description: "run summary" },
+            "401": { description: "missing or invalid Bearer token" },
+            "503": { description: "trigger not configured (WORKFLOWS_API_KEY unset)" }
+          }
+        }
+      }
+    },
+    components: {
+      securitySchemes: {
+        bearerAuth: { type: "http", scheme: "bearer" }
+      }
     }
   };
 }
+function bearerMatches(authHeader, expected) {
+  if (!authHeader.startsWith("Bearer "))
+    return false;
+  const supplied = authHeader.slice("Bearer ".length);
+  if (supplied.length === 0)
+    return false;
+  const a = createHash4("sha256").update(supplied).digest();
+  const b = createHash4("sha256").update(expected).digest();
+  return timingSafeEqual(a, b);
+}
+async function handleTrigger(service, req) {
+  const expected = service.config.apiKey;
+  if (!expected) {
+    return jsonResponse({ error: "trigger_not_configured", message: "WORKFLOWS_API_KEY is not configured \u2014 set it to enable the authenticated trigger" }, 503);
+  }
+  const auth = req.headers.get("authorization") ?? "";
+  if (!bearerMatches(auth, expected)) {
+    return jsonResponse({ error: "unauthorized", message: "a valid Bearer token is required" }, 401);
+  }
+  let body;
+  try {
+    body = await req.json();
+  } catch {
+    return jsonResponse({ error: "invalid_json", message: "request body must be JSON" }, 400);
+  }
+  const record = body;
+  if (record.graph === null || typeof record.graph !== "object" || Array.isArray(record.graph)) {
+    return jsonResponse({ error: "graph_required", message: "body.graph must be a workflow graph object" }, 400);
+  }
+  const context = record.context ?? {};
+  if (typeof context !== "object" || Array.isArray(context)) {
+    return jsonResponse({ error: "invalid_context", message: "body.context must be an object" }, 400);
+  }
+  const maxCycles = typeof record.maxCycles === "number" ? record.maxCycles : undefined;
+  const idempotencyKey = typeof record.idempotencyKey === "string" ? record.idempotencyKey : undefined;
+  try {
+    const summary = await service.triggerRun(record.graph, context, { maxCycles, idempotencyKey });
+    return jsonResponse(summary);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return jsonResponse({ error: "trigger_failed", message }, 400);
+  }
+}
 function createRequestHandler(service) {
   return (req) => {
     const url = new URL(req.url);
@@ -177,6 +2157,8 @@ function createRequestHandler(service) {
         return jsonResponse(service.ready());
       case "/version":
         return jsonResponse({ service: service.name, version: service.version });
+      case "/trigger":
+        return handleTrigger(service, req);
       case "/openapi.json":
         return jsonResponse(openApiDoc(service));
       default:
@@ -186,6 +2168,7 @@ function createRequestHandler(service) {
 }
 
 // src/agent-tools.ts
+init_lanes();
 function textResult(payload) {
   return { content: [{ type: "text", text: JSON.stringify(payload) }], isError: false };
 }
@@ -205,10 +2188,47 @@ function workflowsTools(_service) {
       name: "workflows_ready",
       description: "Report the workflows service readiness (version check).",
       inputSchema: { type: "object", properties: {} }
+    },
+    {
+      name: "workflows_validate",
+      description: "Validate a workflow graph (JSON object with name, version, nodes).",
+      inputSchema: {
+        type: "object",
+        properties: { graph: { type: "object", description: "the workflow graph" } },
+        required: ["graph"]
+      }
+    },
+    {
+      name: "workflows_run",
+      description: "Run a workflow graph to a terminal state (bounded cycles; command steps execute; lane steps need the lane substrate).",
+      inputSchema: {
+        type: "object",
+        properties: {
+          graph: { type: "object", description: "the workflow graph" },
+          context: { type: "object", description: "optional run context" }
+        },
+        required: ["graph"]
+      }
+    },
+    {
+      name: "workflows_runs_list",
+      description: "List recent runs from the local store.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          status: { type: "string", description: "optional status filter" },
+          limit: { type: "number", description: "max rows (default 100)" }
+        }
+      }
+    },
+    {
+      name: "workflows_lanes_list",
+      description: "List the four lane adapters with their wired-vs-not-ready-with-reason registry shape.",
+      inputSchema: { type: "object", properties: {} }
     }
   ];
 }
-function callWorkflowTool(service, name, _args) {
+async function callWorkflowTool(service, name, args) {
   switch (name) {
     case "workflows_version":
       return textResult({ service: service.name, version: service.version });
@@ -216,6 +2236,39 @@ function callWorkflowTool(service, name, _args) {
       return textResult(service.health());
     case "workflows_ready":
       return textResult(service.ready());
+    case "workflows_validate": {
+      const graph = args.graph;
+      const result = validateGraph(graph);
+      return textResult(result);
+    }
+    case "workflows_run": {
+      const graph = args.graph;
+      const store = openStore(service.config.dataDir);
+      const wal = SessionWAL.open(service.config.dataDir);
+      try {
+        const final = await runGraphToCompletion(store, wal, graph, args.context ?? {});
+        return textResult({
+          runId: final.id,
+          status: final.status,
+          error: final.error ?? null,
+          result: final.resultJson ? JSON.parse(final.resultJson) : null
+        });
+      } finally {
+        store.close();
+      }
+    }
+    case "workflows_runs_list": {
+      const store = openStore(service.config.dataDir);
+      try {
+        const status = typeof args.status === "string" ? args.status : undefined;
+        const limit = typeof args.limit === "number" ? args.limit : 100;
+        return textResult(store.listRuns({ status, limit }));
+      } finally {
+        store.close();
+      }
+    }
+    case "workflows_lanes_list":
+      return textResult(await laneInventory());
     default:
       throw new Error(`Unknown tool: ${name}`);
   }