@hasna/workflows 0.1.3 → 0.2.0

package/dist/mcp/index.js

@@ -1,448 +1,170 @@
 #!/usr/bin/env bun
 // @bun
-var __defProp = Object.defineProperty;
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: __exportSetter.bind(all, name)
-    });
-};
-var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-var __require = import.meta.require;
 
-// src/lanes/types.ts
-import { statSync } from "fs";
-function binaryOnPath(binary) {
-  const pathEntries = (process.env.PATH ?? "").split(":").filter(Boolean);
-  for (const entry of pathEntries) {
-    try {
-      const stat = statSync(`${entry}/${binary}`);
-      if (stat.isFile())
-        return true;
-    } catch {}
-  }
-  return false;
-}
-function withTimeout(promise, timeoutMs, what) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => {
-      reject(new Error(`${what} exceeded the ${timeoutMs}ms budget`));
-    }, timeoutMs);
-    promise.then((value) => {
-      clearTimeout(timer);
-      resolve(value);
-    }, (err) => {
-      clearTimeout(timer);
-      reject(err);
-    });
-  });
-}
-function spawnCli(cmd, opts) {
-  const started = Date.now();
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-  let proc;
-  try {
-    proc = Bun.spawnSync({
-      cmd,
-      cwd: opts.cwd,
-      env: { ...process.env, ...opts.env ?? {} },
-      stdout: "pipe",
-      stderr: "pipe",
-      timeout: timeoutMs
-    });
-  } catch (err) {
-    const message = String(err instanceof Error ? err.message : err);
-    if (message.includes("ENOENT") || /not found/i.test(message)) {
-      throw new LaneDependencyMissingError(`lane binary ${JSON.stringify(opts.binaryName)} not found on PATH; install it or provide ${opts.packageHint}`);
-    }
-    return { ok: false, exitCode: 1, output: "", durationMs: Date.now() - started, error: message };
-  }
-  const durationMs = Date.now() - started;
-  const stdout = proc.stdout ? new TextDecoder().decode(proc.stdout) : "";
-  const stderr = proc.stderr ? new TextDecoder().decode(proc.stderr) : "";
-  const output = stderr ? `${stdout}
-${stderr}`.trim() : stdout.trim();
-  const exitCode = proc.exitCode ?? 1;
-  return { ok: exitCode === 0, exitCode, output, durationMs };
-}
-var LANE_KINDS2, LaneDependencyMissingError, LaneAdapterShapeError, DEFAULT_LANE_TIMEOUT_MS = 120000;
-var init_types = __esm(() => {
-  LANE_KINDS2 = ["claude", "codex", "cursor", "grok"];
-  LaneDependencyMissingError = class LaneDependencyMissingError extends Error {
-    constructor(message) {
-      super(message);
-      this.name = "LaneDependencyMissingError";
-    }
-  };
-  LaneAdapterShapeError = class LaneAdapterShapeError extends Error {
-    constructor(message) {
-      super(message);
-      this.name = "LaneAdapterShapeError";
-    }
-  };
-});
+// src/mcp/index.ts
+import { createInterface } from "readline";
 
-// src/lanes/claude.ts
-function createClaudeAdapter(deps = {}) {
-  return {
-    kind: "claude",
-    async probe() {
-      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
-      try {
-        await loader();
-        return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "sdk" };
-      } catch {
-        if (binaryOnPath(deps.cliPath ?? "claude")) {
-          return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "cli" };
-        }
-        return {
-          kind: "claude",
-          sdk: "@anthropic-ai/claude-agent-sdk",
-          wired: false,
-          reason: "neither @anthropic-ai/claude-agent-sdk nor the claude CLI is available on this machine"
-        };
-      }
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "claude lane requires a prompt" };
-      }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
-      let sdk;
-      try {
-        sdk = await loader();
-      } catch (err) {
-        return runClaudeCli(job, deps.cliPath ?? "claude", started, timeoutMs);
-      }
-      const query = sdk.query;
-      if (typeof query !== "function") {
-        throw new LaneAdapterShapeError("@anthropic-ai/claude-agent-sdk exports no query() function");
-      }
-      const prompt = job.prompt;
-      try {
-        const { output, isError } = await withTimeout((async () => {
-          const generator = await query({
-            prompt,
-            options: { model: job.model, maxTurns: 32, abortSignal: undefined }
-          });
-          let output2 = "";
-          let isError2 = false;
-          for await (const message of generator) {
-            if (message.type === "assistant") {
-              const content = message.message?.content;
-              if (Array.isArray(content)) {
-                for (const block of content) {
-                  if (block && typeof block === "object" && "text" in block && typeof block.text === "string") {
-                    output2 += block.text;
-                  }
-                }
-              }
-            }
-            if (message.type === "error")
-              isError2 = true;
-          }
-          return { output: output2, isError: isError2 };
-        })(), timeoutMs, `claude lane (${job.prompt.slice(0, 60)})`);
-        const durationMs = Date.now() - started;
-        return { ok: !isError, exitCode: isError ? 1 : 0, output: output.trim(), durationMs };
-      } catch (err) {
-        const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
-      }
-    }
-  };
-}
-function runClaudeCli(job, cliPath, started, timeoutMs) {
-  try {
-    const result = spawnCli([cliPath, "-p", job.prompt], {
-      binaryName: cliPath,
-      packageHint: "@anthropic-ai/claude-agent-sdk or the claude CLI",
-      timeoutMs,
-      env: job.env,
-      cwd: job.cwd
-    });
-    return { ...result, durationMs: Date.now() - started };
-  } catch (err) {
-    if (err instanceof LaneDependencyMissingError) {
-      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
-    }
-    throw err;
-  }
+// src/tool-definitions.ts
+function textResult(payload) {
+  return { content: [{ type: "text", text: JSON.stringify(payload) }], isError: false };
 }
-var init_claude = __esm(() => {
-  init_types();
-});
-
-// src/lanes/codex.ts
-function createCodexAdapter(deps = {}) {
-  return {
-    kind: "codex",
-    async probe() {
-      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
-      try {
-        await loader();
-        return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "sdk" };
-      } catch {
-        if (binaryOnPath(deps.cliPath ?? "codex")) {
-          return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "cli" };
-        }
-        return {
-          kind: "codex",
-          sdk: "@openai/codex-sdk",
-          wired: false,
-          reason: "neither @openai/codex-sdk nor the codex CLI is available on this machine"
-        };
-      }
+function workflowsTools(_service) {
+  const tools = [
+    {
+      name: "workflows_version",
+      description: "Report the installed @hasna/workflows version.",
+      inputSchema: { type: "object", properties: {} }
     },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codex lane requires a prompt" };
-      }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
-      let sdk;
-      try {
-        sdk = await loader();
-      } catch {
-        return runCodexCli(job, deps.cliPath ?? "codex", started, timeoutMs);
-      }
-      const CodexClass = sdk.Codex;
-      if (typeof CodexClass !== "function") {
-        throw new LaneAdapterShapeError("@openai/codex-sdk exports no Codex class");
+    {
+      name: "workflows_health",
+      description: "Report the workflows service health (service, version, pid, uptime).",
+      inputSchema: { type: "object", properties: {} }
+    },
+    {
+      name: "workflows_ready",
+      description: "Report the hosted workflows service readiness.",
+      inputSchema: { type: "object", properties: {} }
+    },
+    {
+      name: "workflows_validate",
+      description: "Validate a workflow graph (JSON object with name, version, nodes).",
+      inputSchema: {
+        type: "object",
+        properties: { graph: { type: "object", description: "the workflow graph" } },
+        required: ["graph"]
       }
-      try {
-        const client = await withTimeout(Promise.resolve(new CodexClass({
-          config: { model: job.model },
-          env: job.env
-        })), timeoutMs, `codex lane (${job.prompt.slice(0, 60)})`);
-        const thread = client.startThread?.();
-        if (!thread || typeof thread.run !== "function") {
-          throw new LaneAdapterShapeError("@openai/codex-sdk Codex.startThread() returned no run()");
-        }
-        const turn = await withTimeout(thread.run(job.prompt), timeoutMs, `codex lane (${job.prompt.slice(0, 60)})`);
-        const output = turn?.finalResponse ?? "";
-        const durationMs = Date.now() - started;
-        return { ok: true, exitCode: 0, output, durationMs };
-      } catch (err) {
-        const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
+    },
+    {
+      name: "workflows_run",
+      description: "Run a workflow graph to a terminal state (bounded cycles; command steps execute; lane steps need the lane substrate).",
+      inputSchema: {
+        type: "object",
+        properties: {
+          graph: { type: "object", description: "the workflow graph" },
+          context: { type: "object", description: "optional run context" },
+          idempotencyKey: { type: "string", description: "stable request key" },
+          maxCycles: { type: "integer", minimum: 1, maximum: 2000 }
+        },
+        required: ["graph", "idempotencyKey"]
       }
-    }
-  };
-}
-function runCodexCli(job, cliPath, started, timeoutMs) {
-  try {
-    const result = spawnCli([cliPath, "exec", "--", job.prompt], {
-      binaryName: cliPath,
-      packageHint: "@openai/codex-sdk or the codex CLI",
-      timeoutMs,
-      env: job.env,
-      cwd: job.cwd
-    });
-    return { ...result, durationMs: Date.now() - started };
-  } catch (err) {
-    if (err instanceof LaneDependencyMissingError) {
-      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
-    }
-    throw err;
-  }
-}
-var init_codex = __esm(() => {
-  init_types();
-});
-
-// src/lanes/cursor.ts
-function createCursorAdapter(deps = {}) {
-  return {
-    kind: "cursor",
-    async probe() {
-      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
-      try {
-        await loader();
-        return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "sdk (local mode)" };
-      } catch {
-        if (binaryOnPath(deps.cliPath ?? "cursor-agent")) {
-          return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "cli" };
+    },
+    {
+      name: "workflows_runs_list",
+      description: "List recent runs from the configured hosted service.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          status: { type: "string", description: "optional status filter" },
+          limit: { type: "number", description: "max rows (default 100)" }
         }
-        return {
-          kind: "cursor",
-          sdk: "@cursor/sdk",
-          wired: false,
-          reason: "neither @cursor/sdk nor the cursor-agent CLI is available on this machine"
-        };
       }
     },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "cursor lane requires a prompt" };
-      }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
-      let sdk;
-      try {
-        sdk = await loader();
-      } catch {
-        return runCursorCli(job, deps.cliPath ?? "cursor-agent", started, timeoutMs);
-      }
-      try {
-        const run = await withTimeout(runLocalAgent(sdk, job), timeoutMs, `cursor lane (${job.prompt.slice(0, 60)})`);
-        const durationMs = Date.now() - started;
-        const status = run?.status ?? "finished";
-        const ok = status === "finished";
-        return { ok, exitCode: ok ? 0 : 1, output: run?.result ?? "", durationMs };
-      } catch (err) {
-        const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
-      }
+    {
+      name: "workflows_lanes_list",
+      description: "List the four lane adapters with their wired-vs-not-ready-with-reason registry shape.",
+      inputSchema: { type: "object", properties: {} }
     }
-  };
-}
-async function runLocalAgent(sdk, job) {
-  const AgentClass = sdk.Agent;
-  const CursorClass = sdk.Cursor;
-  if (typeof AgentClass !== "function" && typeof CursorClass !== "function") {
-    throw new LaneAdapterShapeError("@cursor/sdk exports no Agent/Cursor class");
-  }
-  const agent = typeof AgentClass === "function" ? new AgentClass : undefined;
-  if (!agent || typeof agent.send !== "function") {
-    throw new LaneAdapterShapeError("@cursor/sdk Agent has no send()");
-  }
-  const run = await agent.send(job.prompt, { model: job.model });
-  if (!run || typeof run !== "object") {
-    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned no Run");
-  }
-  return run;
+  ];
+  return tools.map((tool) => ({ ...tool, inputSchema: { ...tool.inputSchema, properties: {
+    ...tool.inputSchema.properties,
+    agent: { type: "string", description: "calling agent identity" }
+  } } }));
 }
-function runCursorCli(job, cliPath, started, timeoutMs) {
-  try {
-    const result = spawnCli([cliPath, "run", job.prompt], {
-      binaryName: cliPath,
-      packageHint: "@cursor/sdk (local mode) or the cursor-agent CLI",
-      timeoutMs,
-      env: job.env,
-      cwd: job.cwd
-    });
-    return { ...result, durationMs: Date.now() - started };
-  } catch (err) {
-    if (err instanceof LaneDependencyMissingError) {
-      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+// package.json
+var package_default = {
+  name: "@hasna/workflows",
+  version: "0.2.0",
+  description: "Universal graph workflow app \u2014 graph language (start/step/decision/while/end), three-table store, session WAL, daemon with claims/leases, four lane adapters (claude/codex/cursor/grok), and a full CLI on four surfaces",
+  type: "module",
+  main: "./dist/index.js",
+  types: "./types/index.d.ts",
+  bin: {
+    workflows: "dist/cli/index.js",
+    "workflows-mcp": "dist/mcp/index.js",
+    "workflows-serve": "dist/serve/index.js"
+  },
+  exports: {
+    ".": {
+      types: "./types/index.d.ts",
+      import: "./dist/index.js"
+    },
+    "./sdk": {
+      types: "./types/sdk.d.ts",
+      import: "./dist/sdk.js"
+    },
+    "./cli": {
+      types: "./types/cli/index.d.ts",
+      import: "./dist/cli/index.js"
     }
-    throw err;
+  },
+  files: [
+    "dist",
+    "types",
+    "README.md",
+    "LICENSE",
+    "hasna.contract.json"
+  ],
+  scripts: {
+    build: "bun run check:sdk && bun run build:runtime && bun run build:types",
+    "generate:sdk": "bun scripts/generate-sdk.ts --write",
+    "check:sdk": "bun scripts/generate-sdk.ts",
+    "test:artifacts": "bun scripts/artifact-acceptance.ts",
+    "build:runtime": "bun build src/cli/index.ts --outdir dist/cli --target bun && bun build src/mcp/index.ts --outdir dist/mcp --target bun && bun build src/serve/index.ts src/serve/admin.ts --outdir dist/serve --target bun --packages external && bun build src/index.ts src/service.ts src/handlers.ts src/agent-tools.ts src/types.ts --root src --outdir dist --target bun --packages external && bun build src/sdk.ts --outdir dist --target node",
+    "build:types": "tsc -p tsconfig.build.json --emitDeclarationOnly --outDir types",
+    "artifact-scan": "bun scripts/contracts-cli.mjs artifact-scan dist",
+    "contract:check": "bun scripts/contracts-cli.mjs repo-conformance .",
+    typecheck: "tsc --noEmit",
+    test: "bun test",
+    "test:pg": 'WORKFLOWS_TEST_DATABASE_URL="${WORKFLOWS_TEST_DATABASE_URL:?point it at a fresh test Postgres database}" WORKFLOWS_REQUIRE_POSTGRES=1 bun test src/db/postgres-store.test.ts src/db/postgres-http.test.ts src/db/postgres-fencing.test.ts',
+    prepack: "bun run build && bun run artifact-scan",
+    prepublishOnly: "bun run test && bun run build"
+  },
+  keywords: [
+    "workflows",
+    "graph",
+    "automation",
+    "cli",
+    "typescript",
+    "bun",
+    "hasna"
+  ],
+  publishConfig: {
+    registry: "https://registry.npmjs.org",
+    access: "public"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/hasna/apps.git",
+    directory: "apps/workflows"
+  },
+  homepage: "https://github.com/hasna/apps/tree/main/apps/workflows",
+  bugs: {
+    url: "https://github.com/hasna/apps/issues"
+  },
+  engines: {
+    bun: ">=1.0.0"
+  },
+  author: "Hasna",
+  license: "Apache-2.0",
+  dependencies: {
+    "@anthropic-ai/claude-agent-sdk": "0.3.234",
+    "@cursor/sdk": "^1.0.28",
+    "@openai/codex-sdk": "0.147.0",
+    commander: "^13.1.0",
+    "@hasna/contracts": "1.3.3",
+    pg: "^8.16.3"
+  },
+  devDependencies: {
+    "@types/bun": "1.3.14",
+    "@types/pg": "^8.15.6",
+    typescript: "^5.7.3"
   }
-}
-var init_cursor = __esm(() => {
-  init_types();
-});
+};
 
-// src/lanes/grok.ts
-function createGrokAdapter(deps = {}) {
-  return {
-    kind: "grok",
-    async probe() {
-      const cliPath = deps.cliPath ?? "grok";
-      if (binaryOnPath(cliPath)) {
-        return { kind: "grok", sdk: "no npm SDK (measured 2026-08-25)", wired: true, via: "cli" };
-      }
-      return {
-        kind: "grok",
-        sdk: "no npm SDK (measured 2026-08-25)",
-        wired: false,
-        reason: `no xAI Grok SDK exists on npm (measured 2026-08-25) and the grok CLI is not on PATH`
-      };
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "grok lane requires a prompt" };
-      }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const cliPath = deps.cliPath ?? "grok";
-      try {
-        const result = spawnCli([cliPath, job.prompt], {
-          binaryName: cliPath,
-          packageHint: "the grok CLI (no xAI Grok SDK exists on npm \u2014 measured 2026-08-25)",
-          timeoutMs,
-          env: job.env,
-          cwd: job.cwd
-        });
-        return { ...result, durationMs: Date.now() - started };
-      } catch (err) {
-        if (err instanceof LaneDependencyMissingError) {
-          return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
-        }
-        throw err;
-      }
-    }
-  };
+// src/version.ts
+function packageVersion() {
+  return package_default.version;
 }
-var init_grok = __esm(() => {
-  init_types();
-});
-
-// src/lanes/index.ts
-var exports_lanes = {};
-__export(exports_lanes, {
-  runLaneJob: () => runLaneJob,
-  resolveLane: () => resolveLane,
-  probeLane: () => probeLane,
-  laneInventory: () => laneInventory,
-  createGrokAdapter: () => createGrokAdapter,
-  createCursorAdapter: () => createCursorAdapter,
-  createCodexAdapter: () => createCodexAdapter,
-  createClaudeAdapter: () => createClaudeAdapter,
-  binaryOnPath: () => binaryOnPath,
-  LaneDependencyMissingError: () => LaneDependencyMissingError,
-  LaneAdapterShapeError: () => LaneAdapterShapeError,
-  LANE_KINDS: () => LANE_KINDS2
-});
-function resolveLane(kind) {
-  const adapter = adapters.get(kind);
-  if (!adapter)
-    throw new Error(`unknown lane ${kind} (expected one of ${LANE_KINDS2.join(", ")})`);
-  return adapter;
-}
-async function runLaneJob(job) {
-  return resolveLane(job.lane).run(job);
-}
-async function probeLane(kind) {
-  return resolveLane(kind).probe();
-}
-async function laneInventory() {
-  return Promise.all(LANE_KINDS2.map((kind) => probeLane(kind)));
-}
-var adapters;
-var init_lanes = __esm(() => {
-  init_claude();
-  init_codex();
-  init_cursor();
-  init_grok();
-  init_types();
-  init_types();
-  init_claude();
-  init_codex();
-  init_cursor();
-  init_grok();
-  adapters = new Map([
-    ["claude", createClaudeAdapter()],
-    ["codex", createCodexAdapter()],
-    ["cursor", createCursorAdapter()],
-    ["grok", createGrokAdapter()]
-  ]);
-});
-
-// src/mcp/index.ts
-import { createInterface } from "readline";
 
 // src/expr.ts
 class ExprSyntaxError extends Error {
@@ -451,13 +173,6 @@ class ExprSyntaxError extends Error {
     this.name = "ExprSyntaxError";
   }
 }
-
-class ExprEvalError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ExprEvalError";
-  }
-}
 var COMPARISON_OPS = new Set(["==", "!=", "<", "<=", ">", ">="]);
 function tokenize(input) {
   const tokens = [];
@@ -627,89 +342,6 @@ class Parser {
 function parseExpr(input) {
   return new Parser(tokenize(input)).parse();
 }
-function resolvePath(segments, context) {
-  let current = context;
-  for (const segment of segments) {
-    if (current === null || typeof current !== "object")
-      return;
-    const record = current;
-    if (!(segment in record))
-      return;
-    current = record[segment];
-  }
-  if (typeof current === "number" || typeof current === "string" || typeof current === "boolean") {
-    return current;
-  }
-  return;
-}
-function evalNode(node, context) {
-  switch (node.kind) {
-    case "literal":
-      return node.value;
-    case "path":
-      return resolvePath(node.segments, context);
-    case "comparison": {
-      const left = evalNode(node.left, context);
-      const right = evalNode(node.right, context);
-      if (left === undefined || right === undefined) {
-        if (node.op === "==")
-          return left === undefined && right === undefined;
-        if (node.op === "!=")
-          return left !== right;
-        throw new ExprEvalError("cannot order-compare an unknown path");
-      }
-      if (typeof left !== typeof right) {
-        throw new ExprEvalError(`cannot compare ${JSON.stringify(left)} (${typeof left}) with ${JSON.stringify(right)} (${typeof right})`);
-      }
-      switch (node.op) {
-        case "==":
-          return left === right;
-        case "!=":
-          return left !== right;
-        case "<":
-          return left < right;
-        case "<=":
-          return left <= right;
-        case ">":
-          return left > right;
-        case ">=":
-          return left >= right;
-        default:
-          throw new ExprEvalError(`unknown operator ${node.op}`);
-      }
-    }
-    case "and": {
-      const left = evalNode(node.left, context);
-      const right = evalNode(node.right, context);
-      if (typeof left !== "boolean" || typeof right !== "boolean") {
-        throw new ExprEvalError("and requires boolean operands");
-      }
-      return left && right;
-    }
-    case "or": {
-      const left = evalNode(node.left, context);
-      const right = evalNode(node.right, context);
-      if (typeof left !== "boolean" || typeof right !== "boolean") {
-        throw new ExprEvalError("or requires boolean operands");
-      }
-      return left || right;
-    }
-    case "not": {
-      const operand = evalNode(node.operand, context);
-      if (typeof operand !== "boolean")
-        throw new ExprEvalError("not requires a boolean operand");
-      return !operand;
-    }
-  }
-}
-function evaluateExpr(input, context) {
-  const ast = parseExpr(input);
-  const value = evalNode(ast, context);
-  if (typeof value !== "boolean") {
-    throw new ExprEvalError(`condition must evaluate to a boolean, got ${typeof value}`);
-  }
-  return value;
-}
 
 // src/graph.ts
 var GRAPH_NODE_TYPES = ["start", "step", "decision", "while", "end"];
@@ -811,16 +443,49 @@ function findCycles(graph) {
 }
 function validateGraph(graph) {
   const issues = [];
+  if (graph === null || typeof graph !== "object" || Array.isArray(graph)) {
+    return { ok: false, issues: [{ path: "graph", message: "graph must be an object" }] };
+  }
   if (typeof graph.name !== "string" || graph.name.trim() === "") {
     issue(issues, "name", "graph requires a non-empty name");
   }
   if (typeof graph.version !== "string" || graph.version.trim() === "") {
     issue(issues, "version", "graph requires a version string");
   }
+  if (graph.memoWatch !== undefined) {
+    if (!Array.isArray(graph.memoWatch) || graph.memoWatch.length === 0) {
+      issue(issues, "memoWatch", "memoWatch must be a non-empty array of file paths or globs");
+    } else {
+      for (const entry of graph.memoWatch) {
+        if (typeof entry !== "string" || entry.trim() === "") {
+          issue(issues, "memoWatch", "each memoWatch entry must be a non-empty path or glob string");
+          break;
+        }
+      }
+    }
+  }
   if (!Array.isArray(graph.nodes) || graph.nodes.length === 0) {
     issue(issues, "nodes", "graph requires at least one node");
     return { ok: false, issues };
   }
+  for (let index = 0;index < graph.nodes.length; index++) {
+    const node = graph.nodes[index];
+    if (node === null || typeof node !== "object" || Array.isArray(node)) {
+      issue(issues, `nodes.${index}`, "node must be an object");
+      continue;
+    }
+    if (!GRAPH_NODE_TYPES.includes(node.type))
+      issue(issues, `nodes.${index}.type`, "type must be start, step, decision, while, or end");
+    for (const key of ["next", "then", "else", "prompt", "command"]) {
+      const value = node[key];
+      if (value !== undefined && (typeof value !== "string" || value.trim() === ""))
+        issue(issues, `nodes.${index}.${key}`, `${key} must be a non-empty string`);
+    }
+    if (node.type === "while" && (!Array.isArray(node.body) || node.body.some((id) => typeof id !== "string")))
+      issue(issues, `nodes.${index}.body`, "body must be an array of node ids");
+  }
+  if (issues.length)
+    return { ok: false, issues };
   const starts = graph.nodes.filter((n) => n.type === "start");
   if (starts.length === 0)
     issue(issues, "nodes", "graph requires exactly one start node (found none)");
@@ -882,6 +547,8 @@ function nodeEdges(node) {
       return node.next ? [{ kind: "next", target: node.next }] : [];
     case "end":
       return [];
+    default:
+      return [];
   }
 }
 function validateNode(graph, node, issues) {
@@ -975,1219 +642,1602 @@ function validateNode(graph, node, issues) {
   }
 }
 
-// src/daemon.ts
-import { createHash as createHash2 } from "crypto";
-
-// src/secrets.ts
-class SecretsGateError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "SecretsGateError";
-  }
-}
-var p = (...parts) => parts.join("");
-var VALUE_PATTERNS = [
-  { detector: "anthropic_api_key", re: new RegExp(p("sk-", "ant-") + "[A-Za-z0-9_-]{10,}") },
-  { detector: "openai_api_key", re: new RegExp(p("sk-", "proj-") + "[A-Za-z0-9_-]{10,}") },
-  { detector: "npm_token", re: /npm_[A-Za-z0-9]{20,}/ },
-  { detector: "github_token", re: /gh[pousr]_[A-Za-z0-9]{20,}/ },
-  { detector: "aws_access_key", re: /AKIA[0-9A-Z]{16}/ },
-  { detector: "google_api_key", re: /AIza[0-9A-Za-z_-]{20,}/ },
-  { detector: "xai_api_key", re: new RegExp(p("xai-") + "[A-Za-z0-9]{20,}") },
-  { detector: "codex_token", re: new RegExp(p("ctx7", "sk-") + "[A-Za-z0-9]{10,}") },
-  { detector: "private_key_block", re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/ },
-  { detector: "bearer_token", re: /Bearer [A-Za-z0-9._~+/=-]{20,}/ }
-];
-var CREDENTIAL_KEY_RE = /^(token|api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|secret[_-]?key|refresh[_-]?token|session[_-]?token|bot[_-]?token)$/i;
-function scanString(value, path, findings) {
-  for (const { detector, re } of VALUE_PATTERNS) {
-    if (re.test(value)) {
-      findings.push({ path, detector });
-      return;
-    }
-  }
+// ../../workflows-release-artifact-1/app/node_modules/@hasna/contracts/dist/client/transport.js
+import { isIP } from "net";
+import { spawnSync } from "child_process";
+import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync2 } from "fs";
+import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";
+import { hostname as osHostname } from "os";
+import { isAbsolute, join as join2 } from "path";
+import { createRequire } from "module";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { closeSync, fstatSync, lstatSync, openSync, readFileSync, realpathSync, statSync } from "fs";
+import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
+import { basename, dirname, join, relative, sep } from "path";
+import { fileURLToPath, pathToFileURL } from "url";
+function envToken(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function clientTransportEnvKeys(name) {
+  const envSegment = envToken(name);
+  return {
+    apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
+    apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
+  };
 }
-function isTrivial(value) {
-  const v = value.trim();
-  if (v.length === 0)
-    return true;
-  const upper = v.toUpperCase();
-  if (upper.startsWith("REPLACE") || upper.startsWith("CHANGE") || upper.startsWith("YOUR_") || upper.startsWith("EXAMPLE") || upper.startsWith("PLACEHOLDER"))
-    return true;
-  if (v.length < 8)
-    return true;
-  return false;
-}
-function scanForSecrets(value, path = "$") {
-  const findings = [];
-  if (value === null || value === undefined)
-    return findings;
-  if (typeof value === "string") {
-    scanString(value, path, findings);
-    return findings;
-  }
-  if (Array.isArray(value)) {
-    value.forEach((item, index) => {
-      findings.push(...scanForSecrets(item, `${path}[${index}]`));
-    });
-    return findings;
+function credentialOverrideEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
+}
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE";
+function credentialPointerEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_REF`;
+}
+function e(e2, n, r) {
+  throw new Error(r ? `No known conditions for "${n}" specifier in "${e2}" package` : `Missing "${n}" specifier in "${e2}" package`);
+}
+function n(n2, i, o, f) {
+  let s, u, l = r(n2, o), c = function(e2) {
+    let n3 = new Set(["default", ...e2.conditions || []]);
+    return e2.unsafe || n3.add(e2.require ? "require" : "import"), e2.unsafe || n3.add(e2.browser ? "browser" : "node"), n3;
+  }(f || {}), a = i[l];
+  if (a === undefined) {
+    let e2, n3, r, t;
+    for (t in i)
+      n3 && t.length < n3.length || (t[t.length - 1] === "/" && l.startsWith(t) ? (u = l.substring(t.length), n3 = t) : t.length > 1 && (r = t.indexOf("*", 1), ~r && (e2 = RegExp("^" + t.substring(0, r) + "(.*)" + t.substring(1 + r) + "$").exec(l), e2 && e2[1] && (u = e2[1], n3 = t))));
+    a = i[n3];
+  }
+  return a || e(n2, l), s = t(a, c), s || e(n2, l, 1), u && function(e2, n3) {
+    let r, t = 0, i2 = e2.length, o2 = /[*]/g, f2 = /[/]$/;
+    for (;t < i2; t++)
+      e2[t] = o2.test(r = e2[t]) ? r.replace(o2, n3) : f2.test(r) ? r + n3 : r;
+  }(s, u), s;
+}
+function r(e2, n2, r2) {
+  if (e2 === n2 || n2 === ".")
+    return ".";
+  let t = e2 + "/", i = t.length, o = n2.slice(0, i) === t, f = o ? n2.slice(i) : n2;
+  return f[0] === "#" ? f : o || !r2 ? f.slice(0, 2) === "./" ? f : "./" + f : f;
+}
+function t(e2, n2, r2) {
+  if (e2) {
+    if (typeof e2 == "string")
+      return r2 && r2.add(e2), [e2];
+    let i, o;
+    if (Array.isArray(e2)) {
+      for (o = r2 || new Set, i = 0;i < e2.length; i++)
+        t(e2[i], n2, o);
+      if (!r2 && o.size)
+        return [...o];
+    } else
+      for (i in e2)
+        if (n2.has(i))
+          return t(e2[i], n2, r2);
+  }
+}
+function o(e2, r2, t2) {
+  let i, o2 = e2.exports;
+  if (o2) {
+    if (typeof o2 == "string")
+      o2 = { ".": o2 };
+    else
+      for (i in o2) {
+        i[0] !== "." && (o2 = { ".": o2 });
+        break;
+      }
+    return n(e2.name, o2, r2 || ".", t2);
   }
-  if (typeof value === "object") {
-    const record = value;
-    for (const [key, child] of Object.entries(record)) {
-      if (CREDENTIAL_KEY_RE.test(key) && typeof child === "string" && !isTrivial(child)) {
-        findings.push({ path: `${path}.${key}`, detector: "credential_key_field" });
-      } else {
-        findings.push(...scanForSecrets(child, `${path}.${key}`));
+}
+var PACKAGE = "@hasna/secrets";
+var MAX_PACKAGE_BYTES = 1024 * 1024;
+function entryPoint(directory) {
+  const root = realpathSync(directory);
+  const fd = openSync(join(root, "package.json"), O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+  let pkg;
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.size > MAX_PACKAGE_BYTES)
+      throw new Error("Invalid Secrets package metadata");
+    pkg = JSON.parse(readFileSync(fd, "utf8"));
+  } finally {
+    closeSync(fd);
+  }
+  if (!pkg || typeof pkg !== "object" || !("name" in pkg) || pkg.name !== PACKAGE) {
+    throw new Error("Invalid Secrets package identity");
+  }
+  const target = o(pkg, ".")?.[0];
+  if (typeof target !== "string" || !target.startsWith("./"))
+    throw new Error("Missing Secrets import export");
+  const parts = target.slice(2).split("/");
+  if (/[\\%?#\0]/.test(target) || parts.some((part) => !part || part === "." || part === ".." || part === "node_modules")) {
+    throw new Error("Invalid Secrets import export");
+  }
+  const file = realpathSync(join(root, ...parts));
+  const within = relative(root, file);
+  if (!within || within === ".." || within.startsWith(`..${sep}`) || !statSync(file).isFile()) {
+    throw new Error("Secrets import export escapes its package or is not a file");
+  }
+  return pathToFileURL(file).href;
+}
+function resolveInstalledSecrets(parentUrl) {
+  let directory = dirname(fileURLToPath(parentUrl));
+  for (;; ) {
+    if (basename(directory) !== "node_modules") {
+      const candidate = join(directory, "node_modules", PACKAGE);
+      let absent = false;
+      try {
+        lstatSync(candidate);
+      } catch (error) {
+        if (error.code !== "ENOENT")
+          throw error;
+        absent = true;
       }
+      if (!absent)
+        return entryPoint(candidate);
     }
+    const parent = dirname(directory);
+    if (parent === directory)
+      throw new Error("Secrets SDK is not installed for this consumer");
+    directory = parent;
   }
-  return findings;
 }
-function assertNoSecrets(value, what) {
-  const findings = scanForSecrets(value);
-  if (findings.length === 0)
-    return;
-  const detail = findings.map((f) => `${f.path} (${f.detector})`).join(", ");
-  throw new SecretsGateError(`secrets write-gate refused to persist ${what}: credential-shaped value at ${detail}`);
+
+class CredentialResolutionError extends Error {
+  appName;
+  attempted;
+  constructor(appName, message, attempted) {
+    super(message);
+    this.name = "CredentialResolutionError";
+    this.appName = appName;
+    this.attempted = attempted;
+  }
 }
 
-// src/session.ts
-import { createHash } from "crypto";
-var DEFAULT_MAX_ATTEMPTS = 3;
-function repairTornRuns(store, wal, opts = {}) {
-  const maxAttempts = opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
-  const replay = wal.replay();
-  const liveClaims = replay.liveClaims(opts.now);
-  const report = { interrupted: 0, requeued: 0, failed: 0 };
-  const running = store.listRuns({ status: "running", limit: 1000 });
-  for (const run of running) {
-    if (liveClaims.has(run.id))
+class CredentialFileUnsafeError extends Error {
+  path;
+  constructor(path, reason) {
+    super(`Refusing unsafe credential/config file ${path}: ${reason}.`);
+    this.name = "CredentialFileUnsafeError";
+    this.path = path;
+  }
+}
+var HASNA_HOME_ENV_KEY = "HASNA_HOME";
+var HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME";
+var KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION";
+var HASNA_HOME_DIR = ".hasna";
+var CONFIG_SUBDIR = "config";
+var CREDENTIALS_FILE = "credentials";
+var KEYCHAIN_SECURITY_BIN = "/usr/bin/security";
+var KEYCHAIN_SERVICE_PREFIX = "hasna.credentials";
+var KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44;
+var KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4;
+var MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
+var SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+var SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+var ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
+var VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
+function homeDir(env) {
+  const home = env.HOME?.trim();
+  return home ? home : null;
+}
+function absoluteOverride(env, key) {
+  const value = env[key]?.trim();
+  return value && isAbsolute(value) ? value : null;
+}
+function hasnaHomeDir(env) {
+  const override = absoluteOverride(env, HASNA_HOME_ENV_KEY);
+  if (override)
+    return override;
+  const home = homeDir(env);
+  return home ? join2(home, HASNA_HOME_DIR) : null;
+}
+function appConfigDir(name, env) {
+  const configRoot = absoluteOverride(env, HASNA_CONFIG_HOME_ENV_KEY);
+  if (configRoot)
+    return join2(configRoot, name);
+  const root = hasnaHomeDir(env);
+  return root ? join2(root, name, CONFIG_SUBDIR) : null;
+}
+function credentialDiskSourceList(name, env, profile = null) {
+  if (!SAFE_APP_SLUG.test(name))
+    return [];
+  const directory = appConfigDir(name, env);
+  if (!directory)
+    return [];
+  const file = profile ? `${CREDENTIALS_FILE}-${profile}` : CREDENTIALS_FILE;
+  return [{ path: join2(directory, file), tier: "disk" }];
+}
+function credentialDiskSources(name, env) {
+  return credentialDiskSourceList(name, env, null).map((s) => s.path);
+}
+function profileDiskSources(name, env, profile) {
+  return credentialDiskSourceList(name, env, profile).map((s) => s.path);
+}
+function parseEnvFile(text) {
+  const values = new Map;
+  const unusable = new Set;
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#"))
       continue;
-    report.interrupted++;
-    const nodes = store.listRunNodes(run.id);
-    if (run.attempts < maxAttempts) {
-      store.bumpAttempts(run.id);
-      store.setRunStatus(run.id, "interrupted", {
-        error: `torn run interrupted after claim loss (attempt ${run.attempts + 1}/${maxAttempts})`
-      });
-      for (const node of nodes) {
-        if (node.status === "running") {
-          store.setRunNodeStatus(node.id, "pending", { error: undefined });
-        }
-      }
-      report.requeued++;
-    } else {
-      store.setRunStatus(run.id, "failed", {
-        error: `torn run failed after ${maxAttempts} interrupted attempts`
-      });
-      for (const node of nodes) {
-        if (node.status === "running") {
-          store.setRunNodeStatus(node.id, "failed", { error: "run interrupted beyond retry budget" });
-        }
+    const withoutExport = line.startsWith("export ") ? line.slice("export ".length).trim() : line;
+    const equals = withoutExport.indexOf("=");
+    if (equals <= 0)
+      continue;
+    const key = withoutExport.slice(0, equals).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+      continue;
+    let value = withoutExport.slice(equals + 1).trim();
+    const quote = value[0];
+    if (quote === '"' || quote === "'") {
+      if (value.length < 2 || !value.endsWith(quote)) {
+        unusable.add(key);
+        continue;
       }
-      report.failed++;
+      value = value.slice(1, -1);
     }
+    if (value.trim().length === 0) {
+      unusable.add(key);
+      continue;
+    }
+    if (values.has(key) && values.get(key) !== value)
+      unusable.add(key);
+    values.set(key, value);
   }
-  return report;
+  return { values, unusable };
 }
-function inputHash(payload) {
-  return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
+function configFileModeAllowed(mode) {
+  const permissions = mode & 4095;
+  return permissions === 256 || permissions === 384;
 }
-function memoKey(graphName, nodeId, input) {
-  return `${graphName}:${nodeId}:${inputHash(input)}`;
+function configFileReadsCoherent(before, after) {
+  return before.dev === after.dev && before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs;
+}
+function readAppConfigFile(path) {
+  const unsafe = (reason) => {
+    throw new CredentialFileUnsafeError(path, reason);
+  };
+  let fd = -1;
+  try {
+    fd = openSync2(path, O_RDONLY2 | O_NOFOLLOW2 | O_NONBLOCK2);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR")
+      return null;
+    if (code === "ELOOP")
+      unsafe("the path is a symlink");
+    unsafe(`the path could not be opened (${code ?? "unknown error"})`);
+  }
+  try {
+    const before = fstatSync2(fd);
+    if (!before.isFile())
+      unsafe("the path is not a regular file");
+    if (!configFileModeAllowed(before.mode)) {
+      unsafe(`permission mode ${(before.mode & 4095).toString(8).padStart(4, "0")} is not owner-only 0400 or 0600`);
+    }
+    const uid = process.getuid?.() ?? process.geteuid?.();
+    if (uid !== undefined && before.uid !== uid)
+      unsafe("the file is not owned by the current user");
+    if (before.size > MAX_CREDENTIAL_FILE_BYTES)
+      unsafe("the file exceeds the size limit");
+    const bytes = readFileSync2(fd);
+    const after = fstatSync2(fd);
+    if (!configFileReadsCoherent(before, after)) {
+      unsafe("the file changed while being read");
+    }
+    return parseEnvFile(bytes.toString("utf8"));
+  } finally {
+    if (fd !== -1)
+      closeSync2(fd);
+  }
+}
+function readCredentialFile(path, apiKeyKeys, pointerKey) {
+  const parsed = readAppConfigFile(path);
+  if (!parsed)
+    return null;
+  for (const key of [...apiKeyKeys, pointerKey]) {
+    if (parsed.unusable.has(key)) {
+      throw new CredentialFileUnsafeError(path, `${key} is declared but blank or malformed`);
+    }
+  }
+  const values = apiKeyKeys.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+  const pointer = parsed.values.get(pointerKey)?.trim();
+  if (pointer !== undefined) {
+    if (!VAULT_POINTER_SHAPE.test(pointer))
+      throw new CredentialFileUnsafeError(path, `${pointerKey} must name a vault item`);
+    if (values.length)
+      throw new CredentialFileUnsafeError(path, "a credential file cannot select both a literal key and a vault reference");
+    return { apiKey: "", pointerVaultKey: pointer };
+  }
+  if (new Set(values).size > 1) {
+    throw new CredentialFileUnsafeError(path, "credential aliases disagree");
+  }
+  return values[0] === undefined ? null : { apiKey: values[0] };
+}
+var CREDENTIAL_SHAPED_KEY = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)(?:_|$)/;
+function appConfigDiskValue(name, env, keys, profile = null) {
+  if (profile !== null && !SAFE_PROFILE.test(profile)) {
+    throw new CredentialResolutionError(name, "The selected configuration profile is invalid.", ["profile"]);
+  }
+  const wanted = keys.filter((key) => !CREDENTIAL_SHAPED_KEY.test(key));
+  if (wanted.length === 0)
+    return null;
+  for (const path of profileDiskSources(name, env, profile)) {
+    const parsed = readAppConfigFile(path);
+    if (!parsed)
+      continue;
+    if (wanted.some((key) => parsed.unusable.has(key))) {
+      return { key: wanted.find((key) => parsed.unusable.has(key)), value: "", path, unusable: true };
+    }
+    const values = wanted.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+    if (new Set(values).size > 1)
+      throw new CredentialFileUnsafeError(path, "configuration aliases disagree");
+    for (const key of wanted) {
+      if (parsed.unusable.has(key))
+        return { key, value: "", path, unusable: true };
+      const value = parsed.values.get(key)?.trim();
+      if (value)
+        return { key, value, path };
+    }
+  }
+  return null;
 }
-function tryMemoHit(store, graphName, nodeId, input) {
-  const key = memoKey(graphName, nodeId, input);
-  const memo = store.memoGet(key);
-  if (!memo)
+function assertUsableCredential(appName, source, value) {
+  if (VAULT_POINTER_SHAPE.test(value)) {
+    throw new CredentialResolutionError(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
+  }
+  if (!ILLEGAL_IN_HEADER_VALUE.test(value))
     return;
-  store.memoHit(key);
-  return memo;
+  throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
+}
+var INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+var CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
+var CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE = "caller-supplied CredentialProvider";
+function sealCredential(fields) {
+  const { apiKey } = fields;
+  const visible = {
+    tier: fields.tier,
+    source: fields.source,
+    deliberate: fields.deliberate,
+    diskCandidates: Object.freeze([...fields.diskCandidates]),
+    warning: fields.warning
+  };
+  const sealed = { ...visible };
+  Object.defineProperty(sealed, "apiKey", {
+    value: apiKey,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  if (fields.pointerVaultKey !== undefined) {
+    Object.defineProperty(sealed, "pointerVaultKey", {
+      value: fields.pointerVaultKey,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
+  Object.defineProperty(sealed, INSPECT_CUSTOM, {
+    value: () => ({ ...visible, apiKey: "[redacted]" }),
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  Object.defineProperty(sealed, CREDENTIAL_SEAL, {
+    value: true,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  return Object.freeze(sealed);
+}
+function isSealedCredential(credential) {
+  return credential[CREDENTIAL_SEAL] === true;
+}
+function explicitCredential(appName, apiKey) {
+  const source = "explicit apiKey option";
+  assertUsableCredential(appName, source, apiKey);
+  return sealCredential({
+    apiKey,
+    tier: "argument",
+    source,
+    deliberate: true,
+    diskCandidates: [],
+    warning: null
+  });
 }
-function recordMemo(store, graphName, nodeId, input, output) {
-  const key = memoKey(graphName, nodeId, input);
-  store.memoPut(key, graphName, nodeId, inputHash(input), JSON.stringify(output));
+function validateAndSealResolvedCredential(appName, credential) {
+  const apiKey = credential.apiKey;
+  assertUsableCredential(appName, CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE, apiKey);
+  if (!isSealedCredential(credential)) {
+    return sealCredential({
+      apiKey,
+      tier: "argument",
+      source: CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE,
+      deliberate: true,
+      diskCandidates: [],
+      warning: null
+    });
+  }
+  return sealCredential({
+    apiKey,
+    tier: credential.tier,
+    source: credential.source,
+    deliberate: credential.deliberate,
+    diskCandidates: credential.diskCandidates,
+    warning: credential.warning,
+    ...credential.pointerVaultKey !== undefined ? { pointerVaultKey: credential.pointerVaultKey } : {}
+  });
 }
-function findRunByIdempotencyKey(store, key) {
-  const runs = store.listRuns({ limit: 1000 });
-  for (const run of runs) {
-    try {
-      const context = JSON.parse(run.contextJson);
-      if (context?.__wf?.idempotencyKey === key)
-        return run;
-    } catch {}
+function firstEnvValue(env, keys) {
+  for (const key of keys) {
+    if (!Object.prototype.hasOwnProperty.call(env, key))
+      continue;
+    const value = env[key]?.trim();
+    if (value)
+      return { key, value };
   }
-  return;
+  return null;
 }
-
-// src/daemon.ts
-init_types();
-var DEFAULT_LEASE_TTL_MS = 120000;
-var DEFAULT_MAX_ATTEMPTS2 = 3;
-var DEFAULT_MAX_DISPATCH = 4;
-var DEFAULT_MAX_STEPS = 25;
-var DEFAULT_TIMEOUT_MS = 120000;
-function nowIso() {
-  return new Date().toISOString();
-}
-function stripRunState(context) {
-  const { __wf: _wf, steps: _steps, ...user } = context;
-  return user;
-}
-function runCommand(job) {
-  if (!job.command) {
-    return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "no command" };
-  }
-  const started = Date.now();
-  const timeoutMs = job.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const proc = Bun.spawnSync({
-    cmd: ["/bin/sh", "-c", job.command],
-    cwd: job.cwd,
-    env: { ...process.env, ...job.env ?? {} },
-    stdout: "pipe",
-    stderr: "pipe",
-    timeout: timeoutMs
+var AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+function isAmbientEnvironment(env) {
+  return env === process.env || env[AMBIENT_ENVIRONMENT] === true;
+}
+function defaultKeychainRunner(argv) {
+  const result = spawnSync(KEYCHAIN_SECURITY_BIN, [...argv], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: KEYCHAIN_SPAWN_TIMEOUT_MS
   });
-  const durationMs = Date.now() - started;
-  const stdout = proc.stdout ? new TextDecoder().decode(proc.stdout) : "";
-  const stderr = proc.stderr ? new TextDecoder().decode(proc.stderr) : "";
-  const output = stderr ? `${stdout}
-${stderr}`.trim() : stdout.trim();
-  const exitCode = proc.exitCode ?? (proc.signalCode ? 1 : 1);
-  return { ok: exitCode === 0, exitCode, output, durationMs };
+  return {
+    status: result.status,
+    stdout: result.stdout ?? "",
+    stderr: result.error ? result.error.message : result.stderr ?? ""
+  };
 }
-
-class WorkflowsDaemon {
-  store;
-  wal;
-  worker;
-  leaseTtlMs;
-  maxAttempts;
-  maxDispatchPerCycle;
-  maxStepsPerCycle;
-  time;
-  laneRunner;
-  env;
-  leases = new Map;
-  fencingCounter = new Map;
-  graphCache = new Map;
-  isolatedRunId = null;
-  constructor(store, wal, options = {}) {
-    this.store = store;
-    this.wal = wal;
-    this.worker = options.worker ?? "local";
-    this.leaseTtlMs = options.leaseTtlMs ?? DEFAULT_LEASE_TTL_MS;
-    this.maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS2;
-    this.maxDispatchPerCycle = options.maxDispatchPerCycle ?? DEFAULT_MAX_DISPATCH;
-    this.maxStepsPerCycle = options.maxStepsPerCycle ?? DEFAULT_MAX_STEPS;
-    this.time = options.time ?? Date.now;
-    this.env = options.env ?? {};
-    this.laneRunner = options.laneRunner ?? defaultLaneRunner;
-    this.isolatedRunId = options.isolatedRunId ?? null;
-    this.replayRegisteredGraphs();
-  }
-  isolateRun(runId) {
-    this.isolatedRunId = runId;
-  }
-  replayRegisteredGraphs() {
-    const entries = this.wal.replay().entries;
-    for (const entry of entries) {
-      const op = entry.op;
-      if (op.op === "graph_registered") {
-        this.graphCache.set(op.name, op.graph);
-      }
+function keychainTierEnabled(env, options) {
+  if ((options.platform ?? process.platform) !== "darwin")
+    return false;
+  if (options.enabled !== undefined)
+    return options.enabled;
+  return options.run !== undefined || isAmbientEnvironment(env);
+}
+function keychainAccount(env, options) {
+  const station = env[KEYCHAIN_STATION_ENV_KEY]?.trim();
+  if (station)
+    return station;
+  const host = (options.hostname ?? osHostname)().split(".")[0]?.trim() ?? "";
+  if (host)
+    return host;
+  const user = env.USER?.trim();
+  return user || null;
+}
+function keychainFailureHint(text) {
+  const line = text.split(/\r?\n/).find((entry) => entry.trim().length > 0)?.trim() ?? "";
+  const clean = line.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, 200);
+  return clean ? `: ${clean}` : "";
+}
+function readKeychainItem(name, env, kind, options) {
+  if (!SAFE_APP_SLUG.test(name) || !keychainTierEnabled(env, options))
+    return null;
+  const account = keychainAccount(env, options);
+  if (!account)
+    return null;
+  const service = `${KEYCHAIN_SERVICE_PREFIX}.${name}.${kind}`;
+  const source = `keychain:${service}@${account}`;
+  const run = options.run ?? defaultKeychainRunner;
+  let result;
+  try {
+    result = run(["find-generic-password", "-a", account, "-s", service, "-w"]);
+  } catch (error) {
+    const reason = keychainFailureHint(error instanceof Error ? error.message : String(error));
+    throw new CredentialResolutionError(name, `The Keychain lookup for ${source} could not run${reason}. A Keychain failure is never resolved ` + `around: fix the keychain, or delete the item to fall through to the credential on disk.`, [source]);
+  }
+  if (result.status === KEYCHAIN_ITEM_NOT_FOUND_STATUS)
+    return null;
+  if (result.status !== 0) {
+    throw new CredentialResolutionError(name, `The Keychain lookup for ${source} failed (security exited ` + `${result.status ?? "without a status"}${keychainFailureHint(result.stderr)}). A Keychain item that ` + `exists but cannot be read is never resolved around: unlock the keychain, run from a session that ` + `may use it, or delete the item to fall through to the credential on disk.`, [source]);
+  }
+  const value = result.stdout.trim();
+  if (!value) {
+    throw new CredentialResolutionError(name, `${source} exists but holds an empty value; a declared item never falls through to another ` + `identity. Store a value in it or delete the item.`, [source]);
+  }
+  return { value, source };
+}
+function keychainConfigValue(name, env, options = {}) {
+  return readKeychainItem(name, env, "api-url", options);
+}
+function snapshotClientEnvironment(name, env) {
+  const keys = clientTransportEnvKeys(name);
+  const ambient = isAmbientEnvironment(env);
+  const snapshot = Object.create(null);
+  for (const key of [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey(name),
+    credentialPointerEnvKey(name),
+    CREDENTIAL_PROFILE_ENV_KEY,
+    "HOME",
+    HASNA_HOME_ENV_KEY,
+    HASNA_CONFIG_HOME_ENV_KEY,
+    KEYCHAIN_STATION_ENV_KEY,
+    "USER"
+  ]) {
+    const descriptor = Object.getOwnPropertyDescriptor(env, key);
+    if (!descriptor)
+      continue;
+    if (!("value" in descriptor)) {
+      throw new CredentialResolutionError(name, `${key} is accessor-backed; client configuration requires own data properties.`, [key]);
     }
-  }
-  liveLeases() {
-    const now = this.time();
-    for (const [runId, lease] of this.leases) {
-      if (lease.expiresAtMs <= now)
-        this.leases.delete(runId);
+    if (descriptor.value !== undefined && typeof descriptor.value !== "string") {
+      throw new CredentialResolutionError(name, `${key} must be a string data property.`, [key]);
     }
-    return this.leases;
+    snapshot[key] = descriptor.value;
   }
-  claim(runId) {
-    const now = this.time();
-    const existing = this.leases.get(runId);
-    if (existing && existing.worker !== this.worker && existing.expiresAtMs > now) {
-      return null;
+  if (ambient) {
+    Object.defineProperty(snapshot, AMBIENT_ENVIRONMENT, {
+      value: true,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
+  return Object.freeze(snapshot);
+}
+function resolveCredential(name, env, options = {}) {
+  env = snapshotClientEnvironment(name, env);
+  const { apiKeyKeys } = clientTransportEnvKeys(name);
+  const diskPaths = credentialDiskSources(name, env);
+  if (options.apiKey !== undefined) {
+    const explicitKey = options.apiKey.trim();
+    if (!explicitKey) {
+      throw new CredentialResolutionError(name, "The explicit apiKey argument is blank; an explicit credential never falls through to another identity.", ["explicit apiKey argument"]);
+    }
+    assertUsableCredential(name, "the explicit apiKey argument", explicitKey);
+    return sealCredential({
+      apiKey: explicitKey,
+      tier: "argument",
+      source: "explicit apiKey argument",
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const overrideKeyName = credentialOverrideEnvKey(name);
+  const overrideRaw = Object.prototype.hasOwnProperty.call(env, overrideKeyName) ? env[overrideKeyName] : undefined;
+  if (overrideRaw !== undefined) {
+    const override = overrideRaw.trim();
+    if (!override) {
+      throw new CredentialResolutionError(name, `${overrideKeyName} is set but empty. It is a deliberate override, so it is not resolved around: ` + `either give it a real key or unset it to fall back to the credential on disk.`, [overrideKeyName]);
+    }
+    assertUsableCredential(name, overrideKeyName, override);
+    return sealCredential({
+      apiKey: override,
+      tier: "override",
+      source: overrideKeyName,
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const pointerKeyName = credentialPointerEnvKey(name);
+  const pointerRaw = Object.prototype.hasOwnProperty.call(env, pointerKeyName) ? env[pointerKeyName] : undefined;
+  if (pointerRaw !== undefined) {
+    const pointer = pointerRaw.trim();
+    if (!pointer) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} is set but empty. It is a deliberate vault pointer, so it is not resolved around: ` + `either give it a vault item key or unset it to fall back to the credential on disk.`, [pointerKeyName]);
+    }
+    if (!VAULT_POINTER_SHAPE.test(pointer)) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} must name a vault ITEM KEY (a path-shaped reference like ` + `'namespace/app/live/api_key'), not a credential value. A pointer that carries a literal is refused.`, [pointerKeyName]);
+    }
+    return sealCredential({
+      apiKey: "",
+      pointerVaultKey: pointer,
+      tier: "pointer",
+      source: pointerKeyName,
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  if (options.profile !== undefined && !options.profile.trim()) {
+    throw new CredentialResolutionError(name, "The explicit profile argument is blank; an explicit identity selection never falls through.", ["explicit profile argument"]);
+  }
+  const profileRaw = Object.prototype.hasOwnProperty.call(env, CREDENTIAL_PROFILE_ENV_KEY) ? env[CREDENTIAL_PROFILE_ENV_KEY] : undefined;
+  if (profileRaw !== undefined && !profileRaw.trim()) {
+    throw new CredentialResolutionError(name, `${CREDENTIAL_PROFILE_ENV_KEY} is set but blank.`, [CREDENTIAL_PROFILE_ENV_KEY]);
+  }
+  const profile = options.profile?.trim() || profileRaw?.trim();
+  if (profile) {
+    const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
+    if (!SAFE_PROFILE.test(profile)) {
+      throw new CredentialResolutionError(name, `Profile name from ${profileSource} is not usable in a path. ` + `Use letters, digits, dot, dash, or underscore.`, [profileSource]);
+    }
+    const paths = profileDiskSources(name, env, profile);
+    for (const path of paths) {
+      const value = readCredentialFile(path, apiKeyKeys, pointerKeyName);
+      if (value) {
+        if (!value.pointerVaultKey)
+          assertUsableCredential(name, path, value.apiKey);
+        return sealCredential({
+          ...value,
+          tier: value.pointerVaultKey ? "pointer" : "profile",
+          source: path,
+          deliberate: true,
+          diskCandidates: paths,
+          warning: null
+        });
+      }
     }
-    const liveClaims = this.wal.replay().liveClaims(now);
-    const foreign = liveClaims.get(runId);
-    if (foreign && foreign.worker !== this.worker && foreign.expiresAtMs > now) {
-      return null;
+    throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} or ${pointerKeyName} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
+  }
+  const definedEnvEntries = apiKeyKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, value: String(env[key]).trim() }));
+  const blankEnv = definedEnvEntries.find((entry) => entry.value.length === 0);
+  if (blankEnv) {
+    throw new CredentialResolutionError(name, `${blankEnv.key} is set but blank; a declared credential never falls through to another alias or identity.`, [blankEnv.key]);
+  }
+  if (definedEnvEntries.length > 1 && new Set(definedEnvEntries.map((entry) => entry.value)).size > 1) {
+    throw new CredentialResolutionError(name, `${definedEnvEntries.map((entry) => entry.key).join(" and ")} disagree; credential aliases must be identical or only one may be set.`, definedEnvEntries.map((entry) => entry.key));
+  }
+  const envHit = firstEnvValue(env, apiKeyKeys);
+  const keychainHit = readKeychainItem(name, env, "api-key", options.keychain ?? {});
+  if (keychainHit) {
+    assertUsableCredential(name, keychainHit.source, keychainHit.value);
+    const warning = envHit && envHit.value !== keychainHit.value ? `Credential sources disagree for '${name}': ${keychainHit.source} and ${envHit.key} hold ` + `different keys. ${keychainHit.source} wins, because the Keychain is re-read on every call while ` + `an environment variable is a snapshot. Reconcile them \u2014 a rotation that updated only one leaves ` + `the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential({
+      apiKey: keychainHit.value,
+      tier: "keychain",
+      source: keychainHit.source,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  const diskSourceList = credentialDiskSourceList(name, env, null);
+  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys, pointerKeyName) })).filter((hit) => hit.value !== null);
+  if (diskHits.length > 0) {
+    const winner = diskHits[0];
+    if (winner.value.pointerVaultKey) {
+      return sealCredential({
+        ...winner.value,
+        tier: "pointer",
+        source: winner.src.path,
+        deliberate: false,
+        diskCandidates: diskPaths,
+        warning: null
+      });
     }
-    const fencing = (this.fencingCounter.get(runId) ?? 0) + 1;
-    this.fencingCounter.set(runId, fencing);
-    const lease = { runId, worker: this.worker, expiresAtMs: now + this.leaseTtlMs, fencing };
-    this.leases.set(runId, lease);
-    this.wal.append({
-      op: "claim_acquired",
-      runId,
-      worker: this.worker,
-      expiresAt: new Date(lease.expiresAtMs).toISOString(),
-      fencing,
-      at: nowIso()
+    assertUsableCredential(name, winner.src.path, winner.value.apiKey);
+    const divergentSources = [
+      ...diskHits.slice(1).filter((hit) => hit.value.apiKey !== winner.value.apiKey || hit.value.pointerVaultKey !== winner.value.pointerVaultKey).map((hit) => hit.src.path),
+      ...envHit && envHit.value !== winner.value.apiKey ? [envHit.key] : []
+    ];
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential({
+      apiKey: winner.value.apiKey,
+      tier: winner.src.tier,
+      source: winner.src.path,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning
     });
-    return lease;
-  }
-  heartbeat(runId, fencing) {
-    const lease = this.leases.get(runId);
-    if (!lease || lease.fencing !== fencing)
-      return false;
-    lease.expiresAtMs = this.time() + this.leaseTtlMs;
-    return true;
-  }
-  release(runId, fencing) {
-    const lease = this.leases.get(runId);
-    if (!lease || lease.fencing !== fencing)
-      return false;
-    this.leases.delete(runId);
-    this.wal.append({ op: "claim_released", runId, fencing, at: nowIso() });
-    return true;
-  }
-  async reap() {
-    const report = { expired: 0, interrupted: 0, requeued: 0, failed: 0, dispatched: 0, advanced: 0, completed: 0 };
-    const now = this.time();
-    for (const [runId, lease] of this.leases) {
-      if (lease.expiresAtMs <= now) {
-        this.leases.delete(runId);
-        report.expired++;
+  }
+  if (envHit) {
+    assertUsableCredential(name, envHit.key, envHit.value);
+    return sealCredential({
+      apiKey: envHit.value,
+      tier: "env",
+      source: envHit.key,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  return null;
+}
+var requireSecretsSdk = createRequire(import.meta.url);
+async function completePointerCredential(name, pointerResolution, env = process.env) {
+  const secretsEnv = snapshotClientEnvironment("secrets", env);
+  const vaultKey = pointerResolution.pointerVaultKey;
+  const pointerEnvKey = pointerResolution.source;
+  if (!vaultKey) {
+    throw new CredentialResolutionError(name, `Pointer resolution from ${pointerEnvKey} carries no vault item key; this is a defect in the resolver.`, [pointerEnvKey]);
+  }
+  if (name === "secrets") {
+    throw new CredentialResolutionError(name, "The Secrets bootstrap credential cannot reference the same hosted vault; configure an independent bootstrap provider.", [pointerEnvKey]);
+  }
+  let secretsSdk;
+  try {
+    const sdkUrl = resolveInstalledSecrets(import.meta.url);
+    secretsSdk = requireSecretsSdk(fileURLToPath2(sdkUrl));
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets SDK (@hasna/secrets) is not installed ` + `in this process. A vault pointer is TERMINAL: install @hasna/secrets to resolve it, or unset ${pointerEnvKey}.`, [pointerEnvKey]);
+  }
+  let client;
+  try {
+    const bootstrap = resolveCredential("secrets", secretsEnv);
+    if (!bootstrap || bootstrap.tier === "pointer") {
+      throw new CredentialResolutionError("secrets", "The Secrets vault requires an independent, non-reference bootstrap credential.", bootstrap ? [bootstrap.source] : []);
+    }
+    client = secretsSdk.createSecretsClientFromEnv(secretsEnv);
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets client could not be configured from this ` + `environment (the secrets service URL and key env are missing or invalid). A vault pointer is TERMINAL and ` + `never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  let secret;
+  try {
+    secret = await client.getSecret({ key: vaultKey });
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the vault could not be reached or the item is ` + `unavailable. A vault pointer is TERMINAL and never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  const value = secret.value;
+  if (!value) {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} resolved vault item '${vaultKey}', but it holds no value. A vault pointer is TERMINAL.`, [pointerEnvKey]);
+  }
+  assertUsableCredential(name, `${pointerEnvKey} -> vault:${vaultKey}`, value);
+  return sealCredential({
+    apiKey: value,
+    tier: "pointer",
+    source: `${pointerEnvKey} -> vault:${vaultKey}`,
+    deliberate: pointerResolution.deliberate,
+    diskCandidates: pointerResolution.diskCandidates,
+    warning: null
+  });
+}
+var DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com";
+var DEFAULT_AUTHORITY_SOURCE = "default";
+function defaultFleetGatewayBaseUrl(name) {
+  return `${DEFAULT_FLEET_GATEWAY_ORIGIN}/${validateAppSlug(name)}`;
+}
+var ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
+var DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+function isValidDnsDomain(value) {
+  if (value.length === 0 || value.length > 253 || ASCII_CONTROL_PATTERN.test(value) || /[^\x00-\x7f]/.test(value)) {
+    return false;
+  }
+  return value.split(".").every((label) => label.length <= 63 && !label.startsWith("xn--") && DNS_LABEL_PATTERN.test(label));
+}
+function validateAppSlug(name) {
+  if (name.length > 63 || !DNS_LABEL_PATTERN.test(name)) {
+    throw new Error("App name must be one lowercase DNS label.");
+  }
+  return name;
+}
+function rawAuthority(value) {
+  const match = /^[a-z][a-z0-9+.-]*:\/\//i.exec(value);
+  if (!match)
+    throw new Error("API URL must be absolute.");
+  const afterScheme = value.slice(match[0].length);
+  const boundary = afterScheme.search(/[/?#]/);
+  const authority = boundary === -1 ? afterScheme : afterScheme.slice(0, boundary);
+  if (!authority)
+    throw new Error("API URL must include a hostname.");
+  return authority;
+}
+function assertCanonicalPort(port) {
+  if (!/^[0-9]+$/.test(port) || port.length > 1 && port.startsWith("0")) {
+    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
+  }
+  const numericPort = Number(port);
+  if (!Number.isSafeInteger(numericPort) || numericPort < 1 || numericPort > 65535) {
+    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
+  }
+}
+function canonicalAuthorityHostname(authority) {
+  let rawHostname;
+  if (authority.startsWith("[")) {
+    const closingBracket = authority.indexOf("]");
+    if (closingBracket === -1) {
+      throw new Error("API URL authority must contain a canonical hostname.");
+    }
+    rawHostname = authority.slice(0, closingBracket + 1);
+    const portSuffix = authority.slice(closingBracket + 1);
+    if (portSuffix) {
+      if (!portSuffix.startsWith(":")) {
+        throw new Error("API URL authority must contain a canonical hostname and port.");
       }
+      assertCanonicalPort(portSuffix.slice(1));
     }
-    if (this.isolatedRunId === null) {
-      const repair = repairTornRuns(this.store, this.wal, { maxAttempts: this.maxAttempts, now });
-      report.interrupted += repair.interrupted;
-      report.requeued += repair.requeued;
-      report.failed += repair.failed;
+    if (isIP(rawHostname.slice(1, -1)) !== 6) {
+      throw new Error("API URL authority must contain a canonical IPv6 literal.");
     }
-    const pending = this.store.listRuns({ status: "pending", limit: this.maxDispatchPerCycle }).concat(this.store.listRuns({ status: "interrupted", limit: this.maxDispatchPerCycle })).sort((a, b) => a.createdAt === b.createdAt ? a.id < b.id ? 1 : -1 : a.createdAt < b.createdAt ? 1 : -1).slice(0, this.maxDispatchPerCycle);
-    for (const run of pending) {
-      if (this.isolatedRunId !== null && run.id !== this.isolatedRunId)
-        continue;
-      const lease = this.claim(run.id);
-      if (!lease)
-        continue;
-      this.store.setRunStatus(run.id, "running");
-      this.wal.append({ op: "run_started", runId: run.id, at: nowIso() });
-      report.dispatched++;
-    }
-    const running = this.store.listRuns({ status: "running", limit: this.maxStepsPerCycle });
-    let steps = 0;
-    for (const run of running) {
-      if (this.isolatedRunId !== null && run.id !== this.isolatedRunId)
-        continue;
-      if (steps >= this.maxStepsPerCycle)
-        break;
-      const outcome = await this.advanceRun(run.id);
-      steps++;
-      if (outcome.kind === "completed")
-        report.completed++;
-      if (outcome.kind === "failed")
-        report.failed++;
-      if (outcome.kind === "advanced")
-        report.advanced++;
-    }
-    return report;
-  }
-  startRun(graph, context) {
-    const validation = validateGraph(graph);
-    if (!validation.ok) {
-      throw new Error(`graph validation failed: ${validation.issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`);
-    }
-    assertNoSecrets(context, "run context");
-    assertNoSecrets(graph, "graph definition");
-    const existing = this.graphCache.get(graph.name);
-    const serialized = JSON.stringify(graph);
-    if (!existing || JSON.stringify(existing) !== serialized) {
-      this.graphCache.set(graph.name, graph);
-      this.wal.append({ op: "graph_registered", name: graph.name, version: graph.version, graph, at: nowIso() });
+  } else {
+    const firstColon = authority.indexOf(":");
+    const lastColon = authority.lastIndexOf(":");
+    if (firstColon !== lastColon) {
+      throw new Error("IPv6 API URL authorities must use brackets.");
+    }
+    if (lastColon !== -1) {
+      const port = authority.slice(lastColon + 1);
+      assertCanonicalPort(port);
+      rawHostname = authority.slice(0, lastColon);
     } else {
-      this.graphCache.set(graph.name, existing);
-    }
-    return this.store.createRun({ graphName: graph.name, graphVersion: graph.version, context: context ?? {} });
-  }
-  async advanceRun(runId) {
-    const run = this.store.getRun(runId);
-    if (!run || run.status !== "running")
-      return { kind: "noop" };
-    const lease = this.leases.get(runId);
-    if (!lease || lease.expiresAtMs <= this.time())
-      return { kind: "blocked" };
-    const graph = this.loadGraph(run.graphName);
-    if (!graph) {
-      this.failRun(run, `graph ${run.graphName} not found in daemon graph cache`);
-      return { kind: "failed", error: "graph not found" };
-    }
-    const context = JSON.parse(run.contextJson);
-    const rawWf = context.__wf ?? {};
-    const wf = {
-      ...rawWf,
-      cursor: typeof rawWf.cursor === "string" ? rawWf.cursor : undefined,
-      loops: rawWf.loops ?? {},
-      completedLoops: rawWf.completedLoops ?? {}
-    };
-    try {
-      const cursor = wf.cursor;
-      const node = cursor === undefined ? graph.nodes.find((n) => n.type === "start") : findNode(graph, cursor);
-      if (!node) {
-        this.failRun(run, `cursor ${cursor ?? "<start>"} resolves to no node`);
-        return { kind: "failed", error: "no node at cursor" };
-      }
-      switch (node.type) {
-        case "start": {
-          wf.cursor = node.next;
-          this.persistContext(run, context, wf);
-          return { kind: "advanced", nodeId: node.id };
-        }
-        case "step": {
-          return await this.executeStep(run, graph, context, wf, node);
-        }
-        case "decision": {
-          const value = evaluateExpr(node.condition, this.conditionScope(context));
-          const next = value ? node.then : node.else;
-          if (!next) {
-            this.failRun(run, `decision ${node.id} evaluated ${value} but no ${value ? "then" : "else"} edge`);
-            return { kind: "failed", error: "missing decision edge" };
-          }
-          wf.cursor = next;
-          this.persistContext(run, context, wf);
-          return { kind: "advanced", nodeId: node.id };
-        }
-        case "while": {
-          return this.executeWhile(run, graph, context, wf, node);
-        }
-        case "end": {
-          this.completeRun(run, context);
-          return { kind: "completed" };
-        }
-      }
-    } catch (err) {
-      if (err instanceof ExprEvalError || err instanceof ExprSyntaxError) {
-        this.failRun(run, `condition error at ${wf.cursor ?? "<start>"}: ${err.message}`);
-        return { kind: "failed", error: err.message };
-      }
-      throw err;
-    }
-  }
-  loadGraph(name) {
-    return this.graphCache.get(name);
-  }
-  conditionScope(context) {
-    return { ...context, steps: context.steps ?? {} };
-  }
-  persistContext(run, context, wf) {
-    context.__wf = wf;
-    this.store.setRunContext(run.id, context);
-  }
-  async executeStep(run, graph, context, wf, node) {
-    const nodeId = node.id;
-    const existing = this.store.listRunNodes(run.id).find((n) => n.nodeId === nodeId);
-    const nodeRow = existing ?? this.store.createRunNode({ runId: run.id, nodeId, lane: node.lane ?? "claude" });
-    if (node.memo) {
-      const memoInput = { command: node.command, prompt: node.prompt, context: stripRunState(context) };
-      const hit = tryMemoHit(this.store, run.graphName, nodeId, memoInput);
-      if (hit) {
-        const cached = JSON.parse(hit.outputJson);
-        this.store.setRunNodeStatus(nodeRow.id, "completed", { exitCode: Number(cached.exitCode ?? 0), output: { ...cached, memoHit: true } });
-        this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "completed", at: nowIso() });
-        this.recordStepResult(context, nodeId, { ...cached, memoHit: true });
-        return this.afterNode(run, context, wf, node.next);
-      }
+      rawHostname = authority;
     }
-    if (nodeRow.status !== "running") {
-      this.store.setRunNodeStatus(nodeRow.id, "running");
-      this.wal.append({ op: "node_started", runId: run.id, nodeId, at: nowIso() });
+    const ipVersion = isIP(rawHostname);
+    const numericAddressParts = rawHostname.split(".");
+    const looksLikeNonCanonicalIpv4 = numericAddressParts.every((part) => /^(?:0x[0-9a-f]+|[0-9]+)$/i.test(part));
+    if (ipVersion !== 4 && looksLikeNonCanonicalIpv4 || ipVersion !== 4 && !isValidDnsDomain(rawHostname.toLowerCase())) {
+      throw new Error("API URL authority must contain a canonical ASCII hostname.");
     }
-    const job = {
-      lane: node.lane ?? "claude",
-      prompt: node.prompt,
-      command: node.command,
-      timeoutMs: node.timeoutMs,
-      env: this.env
-    };
-    let result;
+  }
+  return rawHostname.toLowerCase();
+}
+function isDeliberateLoopbackHttpAuthority(authority) {
+  return /^(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]+)?$/i.test(authority);
+}
+function toV1BaseUrl(apiUrl) {
+  if (ASCII_CONTROL_PATTERN.test(apiUrl)) {
+    throw new Error("API URL must not contain ASCII control characters.");
+  }
+  const input = apiUrl.trim();
+  const authority = rawAuthority(input);
+  if (authority.includes("@") || authority.includes("\\") || authority.includes("%") || /[^\x00-\x7f]/.test(authority)) {
+    throw new Error("API URL authority must be canonical ASCII without credentials.");
+  }
+  const canonicalHostname = canonicalAuthorityHostname(authority);
+  const url = new URL(input);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("API URL must use http or https.");
+  }
+  if (url.username || url.password) {
+    throw new Error("API URL must not include credentials.");
+  }
+  if (!url.hostname || url.hostname.endsWith(".")) {
+    throw new Error("API URL must include a canonical hostname.");
+  }
+  if (url.hostname.toLowerCase() !== canonicalHostname) {
+    throw new Error("API URL authority must not rely on parser hostname normalization.");
+  }
+  if (url.hostname.split(".").some((label) => label.toLowerCase().startsWith("xn--"))) {
+    throw new Error("API URL must not use IDN or punycode hostnames.");
+  }
+  if (url.protocol === "http:" && !isDeliberateLoopbackHttpAuthority(authority)) {
+    throw new Error("API URL may use http only for an exact loopback authority.");
+  }
+  if (url.search || url.hash) {
+    throw new Error("API URL must not include a query string or fragment.");
+  }
+  let path = url.pathname.replace(/\/+$/, "");
+  if (path.endsWith("/v1"))
+    path = path.slice(0, -"/v1".length);
+  url.pathname = `${path}/v1`;
+  return url.toString().replace(/\/+$/, "");
+}
+class ClientTransportConfigurationError extends Error {
+  appName;
+  sources;
+  constructor(appName, message, sources = []) {
+    super(message);
+    this.name = "ClientTransportConfigurationError";
+    this.appName = appName;
+    this.sources = Object.freeze([...sources]);
+  }
+}
+
+class ClientCredentialMissingError extends ClientTransportConfigurationError {
+  authorityConfigured;
+  constructor(name, message, sources, authorityConfigured) {
+    super(name, message, sources);
+    this.authorityConfigured = authorityConfigured;
+    this.name = "ClientCredentialMissingError";
+  }
+}
+function resolveClientAuthoritySnapshot(name, env = process.env, options = {}) {
+  env = snapshotClientEnvironment(name, env);
+  const keys = clientTransportEnvKeys(name);
+  const definedUrlEntries = keys.apiUrlKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, raw: String(env[key]) }));
+  const blankUrl = definedUrlEntries.find((entry) => entry.raw.trim().length === 0);
+  if (blankUrl) {
+    throw new ClientTransportConfigurationError(name, `${blankUrl.key} is set but blank; public clients require an explicit HTTPS API URL and never select local storage.`, [blankUrl.key]);
+  }
+  const controlledUrl = definedUrlEntries.find((entry) => ASCII_CONTROL_PATTERN.test(entry.raw));
+  if (controlledUrl) {
+    throw new ClientTransportConfigurationError(name, `${controlledUrl.key} contains ASCII control characters.`, [controlledUrl.key]);
+  }
+  const usableUrlEntries = definedUrlEntries.map((entry) => ({ key: entry.key, value: entry.raw.trim() }));
+  const normalizedAuthority = (entry) => {
     try {
-      result = await this.laneRunner(job);
-    } catch (err) {
-      result = { ok: false, exitCode: 1, output: "", durationMs: 0, error: String(err instanceof Error ? err.message : err) };
-    }
-    const output = { ok: result.ok, exitCode: result.exitCode, output: result.output, durationMs: result.durationMs };
-    if (!result.ok) {
-      const shouldRetry = nodeRow.attempts < (node.maxRetries ?? 0);
-      this.store.bumpAttemptsNode(nodeRow.id);
-      if (shouldRetry) {
-        this.store.setRunNodeStatus(nodeRow.id, "pending", { error: result.error ?? `exit ${result.exitCode}` });
-        return { kind: "advanced", nodeId };
-      }
-      const error = result.error ?? `step ${nodeId} failed with exit ${result.exitCode}`;
-      this.store.setRunNodeStatus(nodeRow.id, "failed", { exitCode: result.exitCode, error });
-      this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "failed", at: nowIso() });
-      this.failRun(run, error);
-      return { kind: "failed", error };
+      return toV1BaseUrl(entry.value);
+    } catch {
+      throw new ClientTransportConfigurationError(name, `Invalid API URL from ${entry.key}; use an absolute HTTPS URL or exact loopback HTTP authority without credentials, query or fragment.`, [entry.key]);
     }
+  };
+  if (usableUrlEntries.length > 1 && new Set(usableUrlEntries.map(normalizedAuthority)).size > 1) {
+    throw new ClientTransportConfigurationError(name, `${usableUrlEntries.map((entry) => entry.key).join(" and ")} disagree; client authority aliases must select the same versioned API authority or only one may be set.`, usableUrlEntries.map((entry) => entry.key));
+  }
+  const envUrlHit = usableUrlEntries[0] ?? null;
+  const keychainUrlHit = keychainConfigValue(name, env, options.credentials?.keychain);
+  const profile = options.bindUnpairedCredentialsToFleet ? options.credentials?.profile?.trim() || env.HASNA_PROFILE?.trim() || null : null;
+  const diskConfigUrlHit = appConfigDiskValue(name, env, keys.apiUrlKeys, profile);
+  if (diskConfigUrlHit?.unusable) {
+    throw new ClientTransportConfigurationError(name, `${diskConfigUrlHit.key} in ${diskConfigUrlHit.path} is declared but blank or malformed; public clients require a valid HTTPS service authority.`, [diskConfigUrlHit.path]);
+  }
+  const urlCandidates = [
+    ...envUrlHit ? [envUrlHit] : [],
+    ...keychainUrlHit ? [{ key: keychainUrlHit.source, value: keychainUrlHit.value }] : [],
+    ...diskConfigUrlHit ? [{ key: diskConfigUrlHit.path, value: diskConfigUrlHit.value.trim() }] : []
+  ];
+  const configuredUrl = urlCandidates[0] ?? null;
+  const normalizedUrls = urlCandidates.map(normalizedAuthority);
+  const divergentUrls = urlCandidates.filter((_, index) => normalizedUrls[index] !== normalizedUrls[0]);
+  if (configuredUrl && divergentUrls.length > 0) {
+    throw new ClientTransportConfigurationError(name, `${configuredUrl.key} and ${divergentUrls.map((candidate) => candidate.key).join(" and ")} select different service authorities; refusing to send a credential written for one authority to the other.`, urlCandidates.map((candidate) => candidate.key));
+  }
+  if (configuredUrl && options.bindUnpairedCredentialsToFleet) {
     try {
-      assertNoSecrets(output, `node ${nodeId} output`);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this.store.setRunNodeStatus(nodeRow.id, "failed", { error: message });
-      this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "failed", at: nowIso() });
-      this.failRun(run, message);
-      return { kind: "failed", error: message };
-    }
-    this.store.setRunNodeStatus(nodeRow.id, "completed", { exitCode: result.exitCode, output });
-    this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "completed", at: nowIso() });
-    if (node.memo) {
-      recordMemo(this.store, run.graphName, nodeId, { command: node.command, prompt: node.prompt, context: stripRunState(context) }, output);
-      this.wal.append({ op: "memo_set", key: `${run.graphName}:${nodeId}:${createHash2("sha256").update(JSON.stringify({ command: node.command, prompt: node.prompt, context: stripRunState(context) })).digest("hex")}`, at: nowIso() });
-    }
-    this.recordStepResult(context, nodeId, output);
-    return this.afterNode(run, context, wf, node.next);
-  }
-  afterNode(run, context, wf, next) {
-    if (next) {
-      wf.cursor = next;
-      this.persistContext(run, context, wf);
-      return { kind: "advanced", nodeId: wf.cursor };
-    }
-    const cursor = wf.cursor;
-    const graph = this.loadGraph(run.graphName);
-    const whileNode = graph.nodes.find((n) => n.type === "while" && n.body.includes(cursor ?? ""));
-    if (whileNode) {
-      const index = whileNode.body.indexOf(cursor ?? "");
-      if (index >= 0 && index < whileNode.body.length - 1) {
-        wf.cursor = whileNode.body[index + 1];
-        this.persistContext(run, context, wf);
-        return { kind: "advanced", nodeId: wf.cursor };
-      }
-      wf.loops[whileNode.id] = (wf.loops[whileNode.id] ?? 0) + 1;
-      wf.cursor = whileNode.id;
-      this.persistContext(run, context, wf);
-      return { kind: "advanced", nodeId: whileNode.id };
-    }
-    this.completeRun(run, context);
-    return { kind: "completed" };
-  }
-  executeWhile(run, graph, context, wf, node) {
-    const iteration = wf.loops[node.id] ?? 0;
-    if (iteration >= node.maxIterations) {
-      const error = `while node ${node.id} exceeded maxIterations (${node.maxIterations})`;
-      this.failRun(run, error);
-      return { kind: "failed", error };
-    }
-    const scope = { ...this.conditionScope(context), i: iteration };
-    const keepGoing = evaluateExpr(node.condition, scope);
-    if (!keepGoing) {
-      wf.completedLoops[node.id] = iteration;
-      delete wf.loops[node.id];
-      wf.cursor = node.next;
-      this.persistContext(run, context, wf);
-      return { kind: "advanced", nodeId: node.id };
-    }
-    wf.cursor = node.body[0];
-    this.persistContext(run, context, wf);
-    return { kind: "advanced", nodeId: node.id };
-  }
-  recordStepResult(context, nodeId, output) {
-    const steps = context.steps ?? {};
-    steps[nodeId] = output;
-    context.steps = steps;
-  }
-  completeRun(run, context) {
-    const result = {
-      steps: context.steps ?? {},
-      iterations: context.__wf?.completedLoops ?? {}
-    };
+      toV1BaseUrl(configuredUrl.value);
+    } catch (error) {
+      throw new ClientTransportConfigurationError(name, `Invalid API URL from ${configuredUrl.key}: ${error instanceof Error ? error.message : String(error)}`, [configuredUrl.key]);
+    }
+  }
+  return { keys, configuredUrl, envUrlHit, keychainUrlHit, diskConfigUrlHit };
+}
+function resolveClientTransportSnapshot(name, env = process.env, options = {}) {
+  env = snapshotClientEnvironment(name, env);
+  const { keys, configuredUrl, envUrlHit, keychainUrlHit, diskConfigUrlHit } = resolveClientAuthoritySnapshot(name, env, options);
+  const warnings = [];
+  if (configuredUrl && !envUrlHit) {
+    warnings.push(`No ${keys.apiUrlKeys[0]} in the environment; the server URL in ${configuredUrl.key} was used, so this client connects to the server. ` + `Keep that entry aligned with the intended service authority.`);
+  }
+  const credential = resolveCredential(name, env, options.credentials);
+  if (!credential) {
+    const diskHint = credentialDiskSourcesForMessage(name, env);
+    const lead = configuredUrl ? `${configuredUrl.key} selects the HTTP server for '${name}', but no API key could be resolved` : `${keys.apiUrlKeys[0]} is not set and no API key could be resolved for '${name}'; a credential is required before the default fleet gateway authority applies`;
+    warnings.push(`${lead}; refusing to create an unauthenticated client \u2014 public clients never fall back to SQLite or another local store. ` + `Looked in the Keychain (macOS only), then for a credential file at ${diskHint}, then for ${keys.apiKeyKeys[0]} in the environment.`);
+    const sources = [configuredUrl?.key ?? keys.apiUrlKeys[0]];
+    if (options.bindUnpairedCredentialsToFleet)
+      throw new ClientCredentialMissingError(name, warnings.join(" "), sources, configuredUrl !== null);
+    throw new ClientTransportConfigurationError(name, warnings.join(" "), sources);
+  }
+  if (credential.warning)
+    warnings.push(credential.warning);
+  let urlHit;
+  if (configuredUrl) {
+    urlHit = configuredUrl;
+  } else {
     try {
-      assertNoSecrets(result, "run result");
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this.failRun(run, message);
-      return;
+      urlHit = { key: DEFAULT_AUTHORITY_SOURCE, value: defaultFleetGatewayBaseUrl(name) };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new ClientTransportConfigurationError(name, `No ${keys.apiUrlKeys[0]} is configured and the default fleet gateway authority cannot be composed for '${name}': ${message}`, [keys.apiUrlKeys[0]]);
     }
-    this.store.setRunStatus(run.id, "completed", { result, finishedAt: nowIso(), error: null });
-    this.wal.append({ op: "run_finished", runId: run.id, status: "completed", at: nowIso() });
-    const lease = this.leases.get(run.id);
-    if (lease)
-      this.release(run.id, lease.fencing);
-  }
-  failRun(run, error) {
-    this.store.setRunStatus(run.id, "failed", { error, finishedAt: nowIso() });
-    this.wal.append({ op: "run_finished", runId: run.id, status: "failed", at: nowIso() });
-    const lease = this.leases.get(run.id);
-    if (lease)
-      this.release(run.id, lease.fencing);
-  }
-}
-var defaultLaneRunner = async (job) => {
-  if (job.command)
-    return runCommand(job);
-  const { runLaneJob: runLaneJob2 } = await Promise.resolve().then(() => (init_lanes(), exports_lanes));
-  return runLaneJob2(job);
-};
-async function runGraphToCompletion(store, wal, graph, context, options = {}) {
-  const daemon = new WorkflowsDaemon(store, wal, {
-    worker: "local",
-    laneRunner: options.laneRunner,
-    time: options.time,
-    env: options.env,
-    isolatedRunId: options.isolatedRunId
-  });
-  const run = daemon.startRun(graph, context);
-  daemon.isolateRun(run.id);
-  const maxCycles = options.maxCycles ?? 500;
-  for (let cycle = 0;cycle < maxCycles; cycle++) {
-    const report = await daemon.reap();
-    const current = store.getRun(run.id);
-    if (current.status !== "running")
-      return current;
-    if (report.advanced === 0 && report.dispatched === 0) {
-      return store.getRun(run.id);
+  }
+  const apiUrlSource = urlHit.key;
+  let baseUrl;
+  try {
+    baseUrl = toV1BaseUrl(urlHit.value);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new ClientTransportConfigurationError(name, `Invalid API URL from ${apiUrlSource}: ${message}`, [apiUrlSource]);
+  }
+  if (options.bindUnpairedCredentialsToFleet && baseUrl !== toV1BaseUrl(defaultFleetGatewayBaseUrl(name))) {
+    const pairedDisk = diskConfigUrlHit?.path === credential.source && (credential.tier === "disk" || credential.tier === "profile" || credential.tier === "pointer");
+    const pairedKeychain = credential.tier === "keychain" && keychainUrlHit?.source === credential.source.replace(".api-key@", ".api-url@");
+    const deliberatePair = envUrlHit !== null && (credential.tier === "argument" || credential.tier === "override");
+    if (!pairedDisk && !pairedKeychain && !deliberatePair) {
+      throw new ClientTransportConfigurationError(name, "An unpaired legacy credential is bound to the fleet gateway. Configure a stored authority/credential pair or an explicit API key override for the intended authority; no credential was sent.");
     }
   }
-  return store.getRun(run.id);
-}
-
-// src/agent-tools.ts
-init_lanes();
-
-// src/store.ts
-import { Database } from "bun:sqlite";
-import { mkdirSync } from "fs";
-import { join } from "path";
-import { randomUUID } from "crypto";
-function nowIso2() {
-  return new Date().toISOString();
-}
-function openStore(dataDir) {
-  mkdirSync(dataDir, { recursive: true });
-  const db = new Database(join(dataDir, "workflows.db"));
-  db.exec("PRAGMA journal_mode = WAL");
-  db.exec("PRAGMA foreign_keys = ON");
-  db.exec(`
-    CREATE TABLE IF NOT EXISTS runs (
-      id            TEXT PRIMARY KEY,
-      graph_name    TEXT NOT NULL,
-      graph_version TEXT NOT NULL,
-      status        TEXT NOT NULL,
-      attempts      INTEGER NOT NULL DEFAULT 0,
-      context_json  TEXT NOT NULL,
-      result_json   TEXT,
-      error         TEXT,
-      started_at    TEXT,
-      finished_at   TEXT,
-      created_at    TEXT NOT NULL,
-      updated_at    TEXT NOT NULL
-    );
-    CREATE TABLE IF NOT EXISTS run_nodes (
-      id          TEXT PRIMARY KEY,
-      run_id      TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
-      node_id     TEXT NOT NULL,
-      status      TEXT NOT NULL,
-      attempts    INTEGER NOT NULL DEFAULT 0,
-      lane        TEXT,
-      exit_code   INTEGER,
-      output_json TEXT,
-      error       TEXT,
-      started_at  TEXT,
-      finished_at TEXT
-    );
-    CREATE TABLE IF NOT EXISTS memos (
-      key         TEXT PRIMARY KEY,
-      graph_name  TEXT NOT NULL,
-      node_id     TEXT NOT NULL,
-      input_hash  TEXT NOT NULL,
-      output_json TEXT NOT NULL,
-      hit_count   INTEGER NOT NULL DEFAULT 0,
-      created_at  TEXT NOT NULL
-    );
-    CREATE INDEX IF NOT EXISTS idx_runs_status ON runs(status);
-    CREATE INDEX IF NOT EXISTS idx_runs_created ON runs(created_at);
-    CREATE INDEX IF NOT EXISTS idx_run_nodes_run ON run_nodes(run_id);
-  `);
-  const rowToRun = (r) => ({
-    id: String(r.id),
-    graphName: String(r.graph_name),
-    graphVersion: String(r.graph_version),
-    status: r.status,
-    attempts: Number(r.attempts),
-    contextJson: String(r.context_json),
-    resultJson: r.result_json === null ? null : String(r.result_json),
-    error: r.error === null ? null : String(r.error),
-    startedAt: r.started_at === null ? null : String(r.started_at),
-    finishedAt: r.finished_at === null ? null : String(r.finished_at),
-    createdAt: String(r.created_at),
-    updatedAt: String(r.updated_at)
-  });
-  const rowToNode = (r) => ({
-    id: String(r.id),
-    runId: String(r.run_id),
-    nodeId: String(r.node_id),
-    status: r.status,
-    attempts: Number(r.attempts),
-    lane: r.lane === null ? null : String(r.lane),
-    exitCode: r.exit_code === null ? null : Number(r.exit_code),
-    outputJson: r.output_json === null ? null : String(r.output_json),
-    error: r.error === null ? null : String(r.error),
-    startedAt: r.started_at === null ? null : String(r.started_at),
-    finishedAt: r.finished_at === null ? null : String(r.finished_at)
-  });
-  const rowToMemo = (r) => ({
-    key: String(r.key),
-    graphName: String(r.graph_name),
-    nodeId: String(r.node_id),
-    inputHash: String(r.input_hash),
-    outputJson: String(r.output_json),
-    hitCount: Number(r.hit_count),
-    createdAt: String(r.created_at)
-  });
   return {
-    close() {
-      db.close();
-    },
-    listTables() {
-      const rows = db.query("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'").all();
-      return rows.map((r) => r.name);
-    },
-    createRun(input) {
-      const id = randomUUID();
-      const now = nowIso2();
-      db.query(`INSERT INTO runs (id, graph_name, graph_version, status, attempts, context_json, created_at, updated_at)
-         VALUES (?, ?, ?, 'pending', 0, ?, ?, ?)`).run(id, input.graphName, input.graphVersion, JSON.stringify(input.context ?? {}), now, now);
-      return this.getRun(id);
-    },
-    getRun(id) {
-      const row = db.query(`SELECT * FROM runs WHERE id = ?`).get(id);
-      return row ? rowToRun(row) : undefined;
-    },
-    listRuns(opts = {}) {
-      const limit = Math.min(opts.limit ?? 100, 1000);
-      if (opts.status) {
-        const rows2 = db.query(`SELECT * FROM runs WHERE status = ? ORDER BY created_at DESC, id DESC LIMIT ?`).all(opts.status, limit);
-        return rows2.map((r) => rowToRun(r));
-      }
-      const rows = db.query(`SELECT * FROM runs ORDER BY created_at DESC, id DESC LIMIT ?`).all(limit);
-      return rows.map((r) => rowToRun(r));
-    },
-    setRunStatus(id, status, patch = {}) {
-      const now = nowIso2();
-      const existing = this.getRun(id);
-      const resultJson = patch.result !== undefined ? JSON.stringify(patch.result) : existing?.resultJson ?? null;
-      const error = patch.error !== undefined ? patch.error : existing?.error ?? null;
-      const startedAt = patch.startedAt !== undefined ? patch.startedAt : status === "running" && existing?.startedAt === null ? now : existing?.startedAt ?? null;
-      const terminal = status === "completed" || status === "failed" || status === "cancelled" || status === "interrupted";
-      const finishedAt = patch.finishedAt !== undefined ? patch.finishedAt : terminal && existing?.finishedAt === null ? now : existing?.finishedAt ?? null;
-      db.query(`UPDATE runs SET status = ?, result_json = ?, error = ?, started_at = ?, finished_at = ?, updated_at = ? WHERE id = ?`).run(status, resultJson, error, startedAt, finishedAt, now, id);
-    },
-    bumpAttempts(id) {
-      db.query(`UPDATE runs SET attempts = attempts + 1, updated_at = ? WHERE id = ?`).run(nowIso2(), id);
-    },
-    setRunContext(id, context) {
-      db.query(`UPDATE runs SET context_json = ?, updated_at = ? WHERE id = ?`).run(JSON.stringify(context), nowIso2(), id);
-    },
-    createRunNode(input) {
-      const id = randomUUID();
-      db.query(`INSERT INTO run_nodes (id, run_id, node_id, status, attempts, lane)
-         VALUES (?, ?, ?, 'pending', 0, ?)`).run(id, input.runId, input.nodeId, input.lane ?? null);
-      return this.getRunNode(id);
-    },
-    getRunNode(id) {
-      const row = db.query(`SELECT * FROM run_nodes WHERE id = ?`).get(id);
-      return row ? rowToNode(row) : undefined;
-    },
-    listRunNodes(runId) {
-      const rows = db.query(`SELECT * FROM run_nodes WHERE run_id = ? ORDER BY rowid ASC`).all(runId);
-      return rows.map((r) => rowToNode(r));
-    },
-    setRunNodeStatus(id, status, patch = {}) {
-      const now = nowIso2();
-      const existing = this.getRunNode(id);
-      if (!existing)
-        return;
-      const exitCode = patch.exitCode !== undefined ? patch.exitCode : existing.exitCode;
-      const outputJson = patch.output !== undefined ? JSON.stringify(patch.output) : existing.outputJson;
-      const error = patch.error !== undefined ? patch.error : existing.error;
-      const startedAt = patch.startedAt !== undefined ? patch.startedAt : status === "running" && existing.startedAt === null ? now : existing.startedAt;
-      const terminal = status === "completed" || status === "failed" || status === "skipped";
-      const finishedAt = patch.finishedAt !== undefined ? patch.finishedAt : terminal && existing.finishedAt === null ? now : existing.finishedAt;
-      db.query(`UPDATE run_nodes SET status = ?, exit_code = ?, output_json = ?, error = ?, started_at = ?, finished_at = ? WHERE id = ?`).run(status, exitCode, outputJson, error, startedAt, finishedAt, id);
-    },
-    bumpAttemptsNode(id) {
-      db.query(`UPDATE run_nodes SET attempts = attempts + 1 WHERE id = ?`).run(id);
-    },
-    memoPut(key, graphName, nodeId, inputHash2, outputJson) {
-      db.query(`INSERT INTO memos (key, graph_name, node_id, input_hash, output_json, hit_count, created_at)
-         VALUES (?, ?, ?, ?, ?, 0, ?)
-         ON CONFLICT(key) DO UPDATE SET output_json = excluded.output_json`).run(key, graphName, nodeId, inputHash2, outputJson, nowIso2());
+    resolution: {
+      transport: "http",
+      transportSource: urlHit.key,
+      baseUrl,
+      apiUrlSource,
+      apiKeyPresent: true,
+      apiKeySource: credential.source,
+      apiKeyTier: credential.tier,
+      misconfigured: false,
+      warning: warnings.length > 0 ? warnings.join(" ") : null
     },
-    memoGet(key) {
-      const row = db.query(`SELECT * FROM memos WHERE key = ?`).get(key);
-      return row ? rowToMemo(row) : undefined;
-    },
-    memoHit(key) {
-      db.query(`UPDATE memos SET hit_count = hit_count + 1 WHERE key = ?`).run(key);
-    },
-    memoList() {
-      const rows = db.query(`SELECT * FROM memos ORDER BY created_at DESC LIMIT 1000`).all();
-      return rows.map((r) => rowToMemo(r));
-    },
-    memoClear() {
-      db.exec(`DELETE FROM memos`);
-    }
+    credential
   };
 }
-
-// src/wal.ts
-import { createHash as createHash3 } from "crypto";
-import { appendFileSync, existsSync, mkdirSync as mkdirSync2, readFileSync, renameSync, truncateSync, writeFileSync } from "fs";
-import { join as join2 } from "path";
-var WAL_FILE_NAME = "session.wal";
-var SESSIONS_DIR_NAME = "sessions";
-var MAX_WAL_BYTES = 256 * 1024 * 1024;
-function checksumOf(op) {
-  if (op === undefined || op === null)
-    return "";
-  return createHash3("sha256").update(JSON.stringify(op)).digest("hex");
+function credentialDiskSourcesForMessage(name, env) {
+  const paths = credentialDiskSources(name, env);
+  return paths.length > 0 ? paths.join(" or ") : "<no HOME or HASNA_HOME set in this environment, so no credential file was consulted>";
 }
 
-class SessionWAL {
-  filePath;
-  constructor(filePath) {
-    this.filePath = filePath;
-  }
-  static open(dataDir) {
-    mkdirSync2(join2(dataDir, SESSIONS_DIR_NAME), { recursive: true });
-    const canonical = join2(dataDir, SESSIONS_DIR_NAME, WAL_FILE_NAME);
-    const legacy = join2(dataDir, WAL_FILE_NAME);
-    if (existsSync(legacy) && !existsSync(canonical)) {
-      try {
-        renameSync(legacy, canonical);
-      } catch {
-        return new SessionWAL(legacy);
+class HasnaHttpError extends Error {
+  status;
+  method;
+  path;
+  credentialSource;
+  credentialTier;
+  constructor(method, path, status, body, credential) {
+    const guidance = credential ? `. ${credential.guidance}` : "";
+    super(`Hasna cloud request failed: ${method} ${path} -> ${status}${guidance}`);
+    this.name = "HasnaHttpError";
+    this.status = status;
+    this.method = method;
+    this.path = path;
+    Object.defineProperty(this, "body", {
+      value: body,
+      enumerable: status !== 401 && status !== 403,
+      writable: false,
+      configurable: false
+    });
+    this.credentialSource = credential?.source ?? null;
+    this.credentialTier = credential?.tier ?? null;
+  }
+}
+function currentCredential(name, apiKey) {
+  if (typeof apiKey === "function") {
+    return validateAndSealResolvedCredential(name, apiKey());
+  }
+  return explicitCredential(name, apiKey);
+}
+async function resolveRequestCredential(name, apiKey, env = process.env) {
+  const resolved = currentCredential(name, apiKey);
+  if (resolved.tier === "pointer") {
+    return completePointerCredential(name, resolved, env);
+  }
+  return resolved;
+}
+function authFailureGuidance(credential) {
+  const origin = `The API key for this request came from ${credential.source}`;
+  if (credential.deliberate) {
+    const remedy = credential.source === CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE ? `Fix that provider so it returns the current key, or replace it with resolveCredential() ` + `so diagnostics can name the original source.` : `Rotate that key, or unset the override to use the credential on disk.`;
+    return `${origin} \u2014 a credential you selected deliberately. It was NOT substituted with any other key: ` + `falling back here would authenticate as a different principal than the one you named, which is ` + `exactly the failure an override exists to prevent. ${remedy}`;
+  }
+  if (credential.tier === "env") {
+    const target = credential.diskCandidates[0];
+    const remedy = target ? `Store the CURRENT key in the Keychain or write it to ${target} \u2014 both are re-read on every call, so ` + `rotations take effect immediately and in every shell. Do not simply unset ${credential.source}: ` + `nothing was found in the Keychain or on disk, so that would leave this client with no credential at all.` : `This environment has no HOME or HASNA_HOME, so no credential file could be consulted; the disk tier is ` + `unavailable here and there is nothing to fall back to. Set HOME, or supply the key explicitly.`;
+    return `${origin}, a variable in this process's environment. If a wrapper injected it for this one process, the ` + `wrapper re-reads its store on every invocation and the stored key itself is being rejected \u2014 rotate it. ` + `If this SHELL exported it, the export is a snapshot taken when the shell started: a STALE SHELL that ` + `exported the key before it was rotated keeps sending the old one until it exits. ${remedy}`;
+  }
+  if (credential.tier === "keychain") {
+    return `${origin}, which was re-read from the Keychain on this very call \u2014 so a stale shell is NOT the cause ` + `here. The stored item is genuinely being rejected: update it with the current key, or re-run the fleet ` + `key distribution so this machine gets the current key.`;
+  }
+  return `${origin}, which was re-read from disk on this very call \u2014 so a stale shell is NOT the cause here. ` + `The stored credential is genuinely being rejected: rotate it, or re-run the fleet key distribution ` + `so this machine gets the current key.`;
+}
+var DEFAULT_RETRY_STATUSES = [408, 425, 429, 500, 502, 503, 504];
+var IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+var AUTHORITY_OVERRIDE_HEADERS = new Set([
+  "host",
+  ":authority",
+  "forwarded",
+  "x-forwarded-host",
+  "x-original-host"
+]);
+function assertNoAuthorityOverrideHeaders(headers, source) {
+  if (!headers)
+    return;
+  const forbidden = Object.keys(headers).find((name) => AUTHORITY_OVERRIDE_HEADERS.has(name.trim().toLowerCase()));
+  if (forbidden) {
+    throw new Error(`Authenticated ${source} headers must not set authority header '${forbidden}'.`);
+  }
+}
+function appendQuery(path, query) {
+  if (!query)
+    return path;
+  const params = query instanceof URLSearchParams ? query : new URLSearchParams;
+  if (!(query instanceof URLSearchParams)) {
+    for (const [key, value] of Object.entries(query)) {
+      if (value === null || value === undefined)
+        continue;
+      if (Array.isArray(value)) {
+        for (const v of value)
+          params.append(key, String(v));
+      } else {
+        params.append(key, String(value));
       }
     }
-    return new SessionWAL(canonical);
-  }
-  static openAt(filePath) {
-    return new SessionWAL(filePath);
-  }
-  append(op) {
-    const at = op.at ?? new Date().toISOString();
-    const full = { ...op, at };
-    const nextSeq = this.nextSeq();
-    const entry = { seq: nextSeq, at, checksum: checksumOf(full), op: full };
-    appendFileSync(this.filePath, JSON.stringify(entry) + `
-`, "utf8");
-    return entry;
-  }
-  nextSeq() {
-    const replay = this.replay();
-    return replay.entries.length + 1;
-  }
-  replay() {
-    const entries = [];
-    let torn = false;
-    let repaired = false;
-    let content;
+  }
+  const qs = params.toString();
+  if (!qs)
+    return path;
+  return `${path}${path.includes("?") ? "&" : "?"}${qs}`;
+}
+var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function createHasnaHttpTransportInternal(options, requestBindingProvider) {
+  const fetchImpl = options.fetchImpl ?? ((input, init) => fetch(input, init));
+  const base = toV1BaseUrl(options.baseUrl);
+  const timeoutMs = options.timeoutMs ?? 30000;
+  const sleep = options.sleepImpl ?? defaultSleep;
+  const defaultRetry = options.retry;
+  function resolveRetry(callRetry) {
+    const chosen = callRetry !== undefined ? callRetry : defaultRetry;
+    if (chosen === false)
+      return null;
+    const r2 = chosen ?? {};
+    return {
+      retries: r2.retries ?? 2,
+      baseDelayMs: r2.baseDelayMs ?? 200,
+      maxDelayMs: r2.maxDelayMs ?? 2000,
+      retryStatuses: r2.retryStatuses ?? [...DEFAULT_RETRY_STATUSES]
+    };
+  }
+  async function once(method, rel, body, opts, bind) {
+    const materializeHeaders = (input) => Object.fromEntries(Object.entries(input ?? {}).map(([key, value]) => [key, String(value)]));
+    const transportHeaders = materializeHeaders(options.headers);
+    const requestHeaders = materializeHeaders(opts.headers);
+    assertNoAuthorityOverrideHeaders(transportHeaders, "transport");
+    assertNoAuthorityOverrideHeaders(requestHeaders, "request");
+    const headers = {
+      Accept: "application/json",
+      ...transportHeaders,
+      ...requestHeaders
+    };
+    const idempotencyKey = opts.idempotencyKey;
+    if (idempotencyKey)
+      headers["Idempotency-Key"] = String(idempotencyKey);
+    const init = {
+      method,
+      headers,
+      redirect: "manual"
+    };
+    if (body !== undefined) {
+      headers["Content-Type"] = "application/json";
+      init.body = JSON.stringify(body);
+    }
+    const controller = new AbortController;
+    const onAbort = () => controller.abort();
+    const callerSignal = opts.signal;
+    if (callerSignal) {
+      if (callerSignal.aborted)
+        controller.abort();
+      else
+        callerSignal.addEventListener("abort", onAbort, { once: true });
+    }
+    const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? timeoutMs);
+    init.signal = controller.signal;
+    let response;
+    let credential;
     try {
-      content = readFileSync(this.filePath, "utf8");
-    } catch {
-      return { entries, torn, repaired, liveClaims: () => new Map };
-    }
-    if (content.length > MAX_WAL_BYTES) {
-      throw new Error(`session WAL exceeds ${MAX_WAL_BYTES} bytes; refusing to replay a truncated journal`);
-    }
-    if (content === "") {
-      return { entries, torn, repaired, liveClaims: () => new Map };
-    }
-    const lines = content.split(`
-`);
-    let badOffset = null;
-    let expectedSeq = 1;
-    for (let i = 0;i < lines.length; i++) {
-      const line = lines[i];
-      if (line === "")
-        continue;
-      if (badOffset !== null)
-        break;
-      const lineOffset = cumulativeOffset(lines, i);
-      let entry;
+      const binding = bind();
+      credential = binding.credential;
+      init.headers = {
+        "x-api-key": credential.apiKey,
+        Authorization: `Bearer ${credential.apiKey}`,
+        ...headers
+      };
       try {
-        entry = JSON.parse(line);
-      } catch {
-        badOffset = lineOffset;
-        break;
-      }
-      if (typeof entry?.seq !== "number" || entry.seq !== expectedSeq || entry.checksum !== checksumOf(entry.op)) {
-        badOffset = lineOffset;
-        break;
+        response = await fetchImpl(`${binding.baseUrl}${rel}`, init);
+      } catch (error) {
+        const err = error instanceof Error ? error : new Error(String(error));
+        if (callerSignal?.aborted)
+          return { ok: false, retryable: false, error: err };
+        return { ok: false, retryable: true, error: err };
       }
-      entries.push(entry);
-      expectedSeq++;
+    } finally {
+      clearTimeout(timer);
+      if (callerSignal)
+        callerSignal.removeEventListener("abort", onAbort);
     }
-    if (badOffset !== null) {
-      torn = true;
+    const authenticationFailure = response.status === 401 || response.status === 403;
+    let parsed = undefined;
+    if (authenticationFailure) {
       try {
-        truncateSync(this.filePath, badOffset);
-        repaired = true;
+        await response.body?.cancel();
       } catch {}
+    } else {
+      const text = await response.text();
+      if (text.length > 0) {
+        try {
+          parsed = JSON.parse(text);
+        } catch {
+          parsed = text;
+        }
+      }
     }
-    return {
-      entries,
-      torn,
-      repaired,
-      liveClaims: (nowMs) => reconstructLiveClaims(entries, nowMs)
-    };
-  }
-  close() {}
-}
-function cumulativeOffset(lines, index) {
-  let offset = 0;
-  for (let i = 0;i < index; i++) {
-    offset += Buffer.byteLength(lines[i]) + 1;
-  }
-  return offset;
-}
-function reconstructLiveClaims(entries, nowMs = Date.now()) {
-  const claims = new Map;
-  for (const entry of entries) {
-    const op = entry.op;
-    if (op.op === "claim_acquired") {
-      claims.set(op.runId, { worker: op.worker, fencing: op.fencing, expiresAtMs: Date.parse(op.expiresAt) });
-    } else if (op.op === "claim_released") {
-      const existing = claims.get(op.runId);
-      if (existing && existing.fencing === op.fencing) {
-        claims.delete(op.runId);
+    if (!response.ok) {
+      if (response.status >= 300 && response.status < 400) {
+        return {
+          ok: false,
+          retryable: false,
+          error: new HasnaHttpError(method, rel, response.status, parsed)
+        };
+      }
+      if (authenticationFailure) {
+        return {
+          ok: false,
+          retryable: false,
+          error: new HasnaHttpError(method, rel, response.status, undefined, {
+            source: credential.source,
+            tier: credential.tier,
+            guidance: authFailureGuidance(credential)
+          })
+        };
       }
+      const retry = resolveRetry(opts.retry);
+      const retryable = retry ? retry.retryStatuses.includes(response.status) : false;
+      return { ok: false, retryable, error: new HasnaHttpError(method, rel, response.status, parsed) };
+    }
+    return { ok: true, value: parsed };
+  }
+  async function request(method, path, body, opts = {}) {
+    const upper = method.toUpperCase();
+    const rel = appendQuery(path.startsWith("/") ? path : `/${path}`, opts.query);
+    const retry = resolveRetry(opts.retry);
+    const methodRetryable = IDEMPOTENT_METHODS.has(upper) || Boolean(opts.idempotencyKey);
+    const maxAttempts = retry && methodRetryable ? retry.retries + 1 : 1;
+    let finalize;
+    if (requestBindingProvider) {
+      const prepared = requestBindingProvider();
+      finalize = typeof prepared === "function" ? prepared : await prepared;
+    } else {
+      const credential = await resolveRequestCredential(options.name, options.apiKey);
+      finalize = () => ({ baseUrl: base, credential });
+    }
+    let binding;
+    const bind = () => binding ??= finalize();
+    let last = null;
+    for (let attempt = 1;attempt <= maxAttempts; attempt++) {
+      const result = await once(upper, rel, body, opts, bind);
+      if (result.ok)
+        return result.value;
+      last = result;
+      const canRetry = retry !== null && methodRetryable && result.retryable && attempt < maxAttempts;
+      if (!canRetry)
+        break;
+      const backoff = Math.min(retry.maxDelayMs, retry.baseDelayMs * 2 ** (attempt - 1));
+      const jitter = Math.floor(Math.random() * (backoff / 2 + 1));
+      await sleep(backoff + jitter);
     }
+    throw last.error;
   }
-  for (const [runId, claim] of claims) {
-    if (claim.expiresAtMs <= nowMs)
-      claims.delete(runId);
-  }
-  return claims;
-}
-
-// src/agent-tools.ts
-function textResult(payload) {
-  return { content: [{ type: "text", text: JSON.stringify(payload) }], isError: false };
+  return {
+    baseUrl: base,
+    request,
+    get: (path, opts) => request("GET", path, undefined, opts),
+    post: (path, body, opts) => request("POST", path, body, opts),
+    put: (path, body, opts) => request("PUT", path, body, opts),
+    patch: (path, body, opts) => request("PATCH", path, body, opts),
+    del: (path, body, opts) => request("DELETE", path, body, opts)
+  };
 }
-function workflowsTools(_service) {
-  return [
-    {
-      name: "workflows_version",
-      description: "Report the installed @hasna/workflows version.",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "workflows_health",
-      description: "Report the workflows service health (service, version, pid, uptime).",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "workflows_ready",
-      description: "Report the workflows service readiness (version check).",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "workflows_validate",
-      description: "Validate a workflow graph (JSON object with name, version, nodes).",
-      inputSchema: {
-        type: "object",
-        properties: { graph: { type: "object", description: "the workflow graph" } },
-        required: ["graph"]
-      }
-    },
-    {
-      name: "workflows_run",
-      description: "Run a workflow graph to a terminal state (bounded cycles; command steps execute; lane steps need the lane substrate).",
-      inputSchema: {
-        type: "object",
-        properties: {
-          graph: { type: "object", description: "the workflow graph" },
-          context: { type: "object", description: "optional run context" }
-        },
-        required: ["graph"]
-      }
-    },
-    {
-      name: "workflows_runs_list",
-      description: "List recent runs from the local store.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          status: { type: "string", description: "optional status filter" },
-          limit: { type: "number", description: "max rows (default 100)" }
-        }
-      }
-    },
-    {
-      name: "workflows_lanes_list",
-      description: "List the four lane adapters with their wired-vs-not-ready-with-reason registry shape.",
-      inputSchema: { type: "object", properties: {} }
+function createClientTransport(name, env = process.env, overrides) {
+  const credentialOptions = overrides?.credentials;
+  const snapshotOptions = {
+    ...credentialOptions ? { credentials: credentialOptions } : {},
+    ...overrides?.bindUnpairedCredentialsToFleet === undefined ? {} : { bindUnpairedCredentialsToFleet: overrides.bindUnpairedCredentialsToFleet }
+  };
+  const resolution = resolveClientTransportSnapshot(name, env, snapshotOptions).resolution;
+  const sameBinding = (left, right) => left.resolution.baseUrl === right.resolution.baseUrl && left.credential.apiKey === right.credential.apiKey && left.credential.pointerVaultKey === right.credential.pointerVaultKey && left.credential.source === right.credential.source && left.credential.tier === right.credential.tier;
+  const unstableConfiguration = () => new ClientTransportConfigurationError(name, "The configured service authority or credential changed while a request was being prepared; no authenticated request was sent.");
+  const assertPinnedAuthority = (snapshot) => {
+    if (snapshot.resolution.baseUrl !== resolution.baseUrl) {
+      throw new ClientTransportConfigurationError(name, "The configured service authority changed; rebuild the client before sending credentials.");
     }
-  ];
+  };
+  const requestBindingProvider = () => {
+    const first = resolveClientTransportSnapshot(name, env, snapshotOptions);
+    assertPinnedAuthority(first);
+    const finalize = (reviewed2, completed) => () => {
+      const final = resolveClientTransportSnapshot(name, env, snapshotOptions);
+      if (!sameBinding(reviewed2, final))
+        throw unstableConfiguration();
+      assertPinnedAuthority(final);
+      return {
+        baseUrl: final.resolution.baseUrl,
+        credential: completed ?? currentCredential(name, () => final.credential)
+      };
+    };
+    if (first.credential.tier !== "pointer")
+      return finalize(first);
+    const reviewed = resolveClientTransportSnapshot(name, env, snapshotOptions);
+    if (!sameBinding(first, reviewed))
+      throw unstableConfiguration();
+    assertPinnedAuthority(reviewed);
+    return resolveRequestCredential(name, () => reviewed.credential, env).then((credential) => finalize(reviewed, credential));
+  };
+  return {
+    transport: "http",
+    client: createHasnaHttpTransportInternal({
+      name,
+      baseUrl: resolution.baseUrl,
+      apiKey: () => {
+        throw new Error("The authenticated request binding provider was not invoked.");
+      },
+      ...overrides?.fetchImpl ? { fetchImpl: overrides.fetchImpl } : {},
+      ...overrides?.headers ? { headers: overrides.headers } : {},
+      ...overrides?.timeoutMs ? { timeoutMs: overrides.timeoutMs } : {},
+      ...overrides?.retry !== undefined ? { retry: overrides.retry } : {},
+      ...overrides?.sleepImpl ? { sleepImpl: overrides.sleepImpl } : {}
+    }, requestBindingProvider),
+    resolution
+  };
 }
-async function callWorkflowTool(service, name, args) {
+
+// src/client-error.ts
+class WorkflowInputError extends Error {
+}
+var guidance = {
+  invalid_graph: "graph must match the workflow graph schema; use workflows validate <file>",
+  graph_required: "body.graph must be a workflow graph object",
+  invalid_context: "context must be a JSON object",
+  reserved_context: "context.__wf and context.steps are reserved",
+  invalid_max_cycles: "maxCycles must be an integer from 1 to 2000",
+  invalid_idempotency_key: "idempotencyKey must contain 1 to 128 ASCII letters, digits, or _.:-",
+  invalid_query: "limit must be 1 to 1000 and status must be a supported run status",
+  invalid_run_id: "run id must contain 1 to 128 ASCII letters, digits, underscores or hyphens",
+  invalid_lane: "lane must be claude, codex, cursor or grok",
+  run_not_found: "run id does not exist",
+  idempotency_conflict: "idempotencyKey is already bound to a different request",
+  invalid_run_status: "run status does not permit this action",
+  run_status_conflict: "run changed before this action",
+  execution_active: "previous execution must finish or be reconciled before resume",
+  graph_unavailable: "legacy run requires its original graph from the server operator",
+  invalid_schema: "PostgreSQL workflow schema requires explicit initialization or a reviewed migration",
+  storage_unavailable: "PostgreSQL workflow storage is unavailable"
+};
+function workflowErrorMessage(error) {
+  if (error instanceof WorkflowInputError)
+    return error.message;
+  if (error instanceof ClientCredentialMissingError)
+    return "Workflows credential is missing; configure it through this station's supported credential resolver";
+  if (error instanceof ClientTransportConfigurationError)
+    return "Workflows API URL or credential binding was refused; use an absolute HTTPS URL and its paired credential (exact loopback HTTP is supported)";
+  if (error instanceof HasnaHttpError) {
+    const code = error.body && typeof error.body === "object" ? error.body.error : undefined;
+    const known = typeof code === "string" && Object.hasOwn(guidance, code) ? `: ${guidance[code]}` : "";
+    return `Workflows API returned HTTP ${error.status}${known}`;
+  }
+  return "Workflows request failed; verify the API connection and configured credential";
+}
+
+// src/client-tools.ts
+async function callClientTool(client, name, args) {
   switch (name) {
     case "workflows_version":
-      return textResult({ service: service.name, version: service.version });
+      return textResult({ service: "workflows", version: packageVersion() });
+    case "workflows_validate":
+      return textResult(validateGraph(args.graph));
     case "workflows_health":
-      return textResult(service.health());
+      return textResult(await client().health());
     case "workflows_ready":
-      return textResult(service.ready());
-    case "workflows_validate": {
-      const graph = args.graph;
-      const result = validateGraph(graph);
-      return textResult(result);
-    }
+      return textResult(await client().ready());
     case "workflows_run": {
-      const graph = args.graph;
-      const store = openStore(service.config.dataDir);
-      const wal = SessionWAL.open(service.config.dataDir);
-      try {
-        const final = await runGraphToCompletion(store, wal, graph, args.context ?? {});
-        return textResult({
-          runId: final.id,
-          status: final.status,
-          error: final.error ?? null,
-          result: final.resultJson ? JSON.parse(final.resultJson) : null
-        });
-      } finally {
-        store.close();
-      }
-    }
-    case "workflows_runs_list": {
-      const store = openStore(service.config.dataDir);
-      try {
-        const status = typeof args.status === "string" ? args.status : undefined;
-        const limit = typeof args.limit === "number" ? args.limit : 100;
-        return textResult(store.listRuns({ status, limit }));
-      } finally {
-        store.close();
-      }
-    }
+      if (typeof args.idempotencyKey !== "string" || !/^[A-Za-z0-9_.:-]{1,128}$/.test(args.idempotencyKey))
+        throw new WorkflowInputError("workflows_run requires a stable idempotencyKey with 1 to 128 ASCII identity characters");
+      return textResult(await client().triggerRun(args.graph, args.context ?? {}, {
+        idempotencyKey: args.idempotencyKey,
+        maxCycles: args.maxCycles
+      }));
+    }
+    case "workflows_runs_list":
+      return textResult(await client().listRuns({ status: args.status, limit: args.limit }));
     case "workflows_lanes_list":
-      return textResult(await laneInventory());
+      return textResult(await client().lanes());
     default:
-      throw new Error(`Unknown tool: ${name}`);
+      throw new Error("unknown_workflows_tool");
   }
 }
-// package.json
-var package_default = {
-  name: "@hasna/workflows",
-  version: "0.1.3",
-  description: "Universal graph workflow app \u2014 graph language (start/step/decision/while/end), three-table store, session WAL, daemon with claims/leases, four lane adapters (claude/codex/cursor/grok), and a full CLI on four surfaces",
-  type: "module",
-  main: "./dist/index.js",
-  types: "./types/index.d.ts",
-  bin: {
-    workflows: "dist/cli/index.js",
-    "workflows-mcp": "dist/mcp/index.js",
-    "workflows-serve": "dist/serve/index.js"
-  },
-  exports: {
-    ".": {
-      types: "./types/index.d.ts",
-      import: "./dist/index.js"
-    },
-    "./sdk": {
-      types: "./types/index.d.ts",
-      import: "./dist/index.js"
-    },
-    "./cli": {
-      types: "./types/cli/index.d.ts",
-      import: "./dist/cli/index.js"
-    }
-  },
-  files: [
-    "dist",
-    "types",
-    "README.md",
-    "LICENSE",
-    "hasna.contract.json"
-  ],
-  scripts: {
-    build: "bun run build:runtime && bun run build:types",
-    "build:runtime": "rm -rf dist && bun build src/cli/index.ts --outdir dist/cli --target bun --packages external && bun build src/mcp/index.ts --outdir dist/mcp --target bun --packages external && bun build src/serve/index.ts --outdir dist/serve --target bun --packages external && bun build src/index.ts src/service.ts src/handlers.ts src/agent-tools.ts src/types.ts --root src --outdir dist --target bun --packages external",
-    "build:types": "rm -rf types && tsc -p tsconfig.build.json --emitDeclarationOnly --outDir types",
-    "artifact-scan": "bun scripts/contracts-cli.mjs artifact-scan dist",
-    "contract:check": "bun scripts/contracts-cli.mjs repo-conformance .",
-    typecheck: "tsc --noEmit",
-    test: "bun test",
-    "test:pg": 'WORKFLOWS_TEST_DATABASE_URL="${WORKFLOWS_TEST_DATABASE_URL:?point it at a throwaway Postgres; the live-PG gate must not pass without one}" WORKFLOWS_REQUIRE_POSTGRES=1 bun test src/db/pg-live.test.ts',
-    prepack: "bun run build && bun run artifact-scan",
-    prepublishOnly: "bun run test && bun run build"
-  },
-  keywords: [
-    "workflows",
-    "graph",
-    "automation",
-    "cli",
-    "typescript",
-    "bun",
-    "hasna"
-  ],
-  publishConfig: {
-    registry: "https://registry.npmjs.org",
-    access: "public"
-  },
-  repository: {
-    type: "git",
-    url: "git+https://github.com/hasna/apps.git"
-  },
-  homepage: "https://github.com/hasna/apps/tree/main/apps/workflows",
-  bugs: {
-    url: "https://github.com/hasna/apps/issues"
-  },
-  engines: {
-    bun: ">=1.0.0"
-  },
-  author: "Hasna",
-  license: "Apache-2.0",
-  dependencies: {
-    "@anthropic-ai/claude-agent-sdk": "0.3.234",
-    "@cursor/sdk": "^1.0.28",
-    "@hasna/paths": "0.1.0",
-    "@openai/codex-sdk": "0.147.0",
-    commander: "^13.1.0"
-  },
-  devDependencies: {
-    "@hasna/contracts": "0.14.1",
-    "@types/bun": "latest",
-    "@types/pg": "^8.15.6",
-    pg: "^8.16.3",
-    typescript: "^5.7.3"
-  }
-};
 
-// src/paths.ts
-import { existsSync as existsSync2 } from "fs";
-import { homedir } from "os";
-import { join as join3 } from "path";
-import { dataDir } from "@hasna/paths";
-var APP = "workflows";
-var STORE_DB_FILE = "workflows.db";
-function getHomeDir(env = process.env) {
-  return env["HOME"] || env["USERPROFILE"] || homedir();
-}
-function getLegacyDataDir(env = process.env) {
-  return join3(getHomeDir(env), ".hasna", APP);
-}
-function getResolverDataDir(env = process.env) {
-  return dataDir({ app: APP, home: getHomeDir(env), env });
-}
-function adoptResolverDataDir(resolved, env = process.env) {
-  const dataOverride = env.HASNA_DATA_HOME;
-  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
-    return true;
-  return existsSync2(join3(resolved, STORE_DB_FILE));
-}
-function getEffectiveDataDir(env = process.env) {
-  const resolved = getResolverDataDir(env);
-  return adoptResolverDataDir(resolved, env) ? resolved : getLegacyDataDir(env);
+// src/sdk/generated-api.ts
+class WorkflowsApi {
+  async inspectDaemon() {
+    return this.apiRequest("GET", `/daemon/status`, {
+      body: undefined,
+      query: undefined
+    });
+  }
+  async getHealth() {
+    return this.apiRequest("GET", `/health`, {
+      body: undefined,
+      query: undefined
+    });
+  }
+  async listLanes() {
+    return this.apiRequest("GET", `/lanes`, {
+      body: undefined,
+      query: undefined
+    });
+  }
+  async probeLane(lane) {
+    return this.apiRequest("GET", `/lanes/${encodeURIComponent(String(lane))}`, {
+      body: undefined,
+      query: undefined
+    });
+  }
+  async listServerMachines() {
+    return this.apiRequest("GET", `/machines/list`, {
+      body: undefined,
+      query: undefined
+    });
+  }
+  async inspectServerMachine() {
+    return this.apiRequest("GET", `/machines/status`, {
+      body: undefined,
+      query: undefined
+    });
+  }
+  async listMemoRecords() {
+    return this.apiRequest("GET", `/memos/list`, {
+      body: undefined,
+      query: undefined
+    });
+  }
+  async getReadiness() {
+    return this.apiRequest("GET", `/ready`, {
+      body: undefined,
+      query: undefined
+    });
+  }
+  async listRunRecords(query) {
+    return this.apiRequest("GET", `/runs`, {
+      body: undefined,
+      query
+    });
+  }
+  async getRunRecord(id) {
+    return this.apiRequest("GET", `/runs/${encodeURIComponent(String(id))}`, {
+      body: undefined,
+      query: undefined
+    });
+  }
+  async cancelWorkflow(id) {
+    return this.apiRequest("POST", `/runs/${encodeURIComponent(String(id))}/cancel`, {
+      body: undefined,
+      query: undefined
+    });
+  }
+  async getRunEvents(id) {
+    return this.apiRequest("GET", `/runs/${encodeURIComponent(String(id))}/events`, {
+      body: undefined,
+      query: undefined
+    });
+  }
+  async getRunNodes(id) {
+    return this.apiRequest("GET", `/runs/${encodeURIComponent(String(id))}/nodes`, {
+      body: undefined,
+      query: undefined
+    });
+  }
+  async resumeWorkflow(id) {
+    return this.apiRequest("POST", `/runs/${encodeURIComponent(String(id))}/resume`, {
+      body: undefined,
+      query: undefined
+    });
+  }
+  async listSessionEvents() {
+    return this.apiRequest("GET", `/sessions/list`, {
+      body: undefined,
+      query: undefined
+    });
+  }
+  async inspectSession() {
+    return this.apiRequest("GET", `/sessions/pull`, {
+      body: undefined,
+      query: undefined
+    });
+  }
+  async triggerWorkflow(body) {
+    return this.apiRequest("POST", `/trigger`, {
+      body,
+      query: undefined
+    });
+  }
+  async validateWorkflow(body) {
+    return this.apiRequest("POST", `/validate`, {
+      body,
+      query: undefined
+    });
+  }
+  async getVersion() {
+    return this.apiRequest("GET", `/version`, {
+      body: undefined,
+      query: undefined
+    });
+  }
 }
 
-// src/service.ts
-var DEFAULT_PORT = 8790;
-var DEFAULT_HOST = "127.0.0.1";
-function packageVersion() {
-  return package_default.version;
-}
-function envString(names) {
-  for (const name of names) {
-    const value = process.env[name];
-    if (value !== undefined && value !== "")
-      return value;
+// src/identity.ts
+import { createHash } from "crypto";
+import { hostname } from "os";
+function name(value) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/.test(value) || /^(owner|andrei-hasna)$/i.test(value)) {
+    throw new WorkflowInputError("agent must be a non-owner identity with 1 to 128 identity characters");
   }
-  return;
-}
-function envInt(names, fallback) {
-  const value = envString(names);
-  if (value === undefined)
-    return fallback;
-  const parsed = Number(value);
-  return Number.isFinite(parsed) ? parsed : fallback;
+  return value;
 }
-function resolveWorkflowsConfig(overrides = {}) {
-  return {
-    port: overrides.port ?? envInt(["HASNA_WORKFLOWS_PORT", "WORKFLOWS_PORT"], DEFAULT_PORT),
-    host: overrides.host ?? envString(["HASNA_WORKFLOWS_HOST", "WORKFLOWS_HOST"]) ?? DEFAULT_HOST,
-    dataDir: overrides.dataDir ?? envString(["HASNA_WORKFLOWS_DATA_DIR", "WORKFLOWS_DATA_DIR"]) ?? getEffectiveDataDir(),
-    apiUrl: overrides.apiUrl ?? envString(["WORKFLOWS_API_URL"]),
-    apiKey: overrides.apiKey ?? envString(["WORKFLOWS_API_KEY"])
-  };
+function station(env) {
+  const value = (env.HASNA_STATION ?? hostname()).split(".")[0].toLowerCase();
+  return value.replace(/[^a-z0-9-]/g, "-").slice(0, 63) || "unknown";
+}
+function workflowAgent(env = process.env, explicit) {
+  if (explicit !== undefined)
+    return { name: name(explicit), source: "argument" };
+  if (env.HASNA_WORKFLOWS_AGENT !== undefined)
+    return { name: name(env.HASNA_WORKFLOWS_AGENT), source: "HASNA_WORKFLOWS_AGENT" };
+  for (const [harness, key] of [["claude", "CLAUDE_CODE_SESSION_ID"], ["codex", "CODEX_THREAD_ID"]]) {
+    if (env[key] !== undefined)
+      return {
+        name: `${harness}-${createHash("sha256").update(JSON.stringify([env[key], null])).digest("hex").slice(0, 32)}`,
+        source: key
+      };
+  }
+  return { name: `cli@${station(env)}`, source: "station" };
+}
+function workflowMcpAgent(env, harness, explicit, meta) {
+  if (explicit !== undefined) {
+    if (typeof explicit !== "string")
+      throw new WorkflowInputError("agent must be a string");
+    return { name: name(explicit), source: "argument" };
+  }
+  if (env.HASNA_WORKFLOWS_AGENT !== undefined)
+    return workflowAgent(env);
+  const label = harness.toLowerCase().replace(/[^a-z0-9_-]/g, "-").slice(0, 32) || "mcp";
+  const id = meta && typeof meta === "object" ? meta["claudecode/agentId"] : undefined;
+  if (typeof id === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(id))
+    return { name: `${label}:${id}@${station(env)}`, source: "mcp-meta" };
+  const native = workflowAgent(env);
+  if (native.source !== "station")
+    return native;
+  return { name: `${label}@${station(env)}`, source: "mcp-client" };
 }
 
-class WorkflowsService {
+// src/client.ts
+class WorkflowsClient extends WorkflowsApi {
   name = "workflows";
-  version;
-  config;
-  startedAt = Date.now();
-  constructor(config = {}) {
-    this.config = resolveWorkflowsConfig(config);
-    this.version = packageVersion();
+  resolution;
+  http;
+  constructor(options = {}) {
+    super();
+    const env = { ...options.env ?? process.env };
+    if (options.apiUrl !== undefined) {
+      env.HASNA_WORKFLOWS_API_URL = options.apiUrl;
+      delete env.WORKFLOWS_API_URL;
+    }
+    const { client, resolution } = createClientTransport("workflows", env, {
+      credentials: { keychain: { enabled: options.env === undefined }, ...options.apiKey === undefined ? {} : { apiKey: options.apiKey } },
+      bindUnpairedCredentialsToFleet: true,
+      fetchImpl: options.fetchImpl,
+      timeoutMs: options.timeoutMs ?? 120000,
+      retry: false,
+      headers: { "user-agent": `hasna-workflows-sdk/${packageVersion()}`, "x-hasna-agent": workflowAgent(env, options.agent).name }
+    });
+    this.http = client;
+    this.resolution = resolution;
+  }
+  request(method, path, body) {
+    return this.http.request(method, path, body);
+  }
+  apiRequest(method, path, opts) {
+    const query = new URLSearchParams;
+    for (const [key, value] of Object.entries(opts.query ?? {}))
+      if (value !== undefined && value !== null)
+        query.set(key, String(value));
+    return this.request(method, `${path}${query.size ? `?${query}` : ""}`, opts.body);
   }
   health() {
-    return {
-      ok: true,
-      service: this.name,
-      version: this.version,
-      pid: process.pid,
-      uptimeMs: Date.now() - this.startedAt
-    };
+    return this.getHealth();
   }
   ready() {
-    return {
-      ok: true,
-      service: this.name,
-      version: this.version,
-      checks: { version: "ok" }
-    };
+    return this.getReadiness();
   }
-  async triggerRun(graph, context = {}, opts = {}) {
-    const store = openStore(this.config.dataDir);
-    const wal = SessionWAL.open(this.config.dataDir);
-    try {
-      if (opts.idempotencyKey) {
-        const existing = findRunByIdempotencyKey(store, opts.idempotencyKey);
-        if (existing) {
-          return {
-            runId: existing.id,
-            status: existing.status,
-            error: existing.error ?? null,
-            result: existing.resultJson ? JSON.parse(existing.resultJson) : null,
-            reused: true
-          };
-        }
-      }
-      const contextWithKey = opts.idempotencyKey ? {
-        ...context,
-        __wf: {
-          cursor: undefined,
-          loops: {},
-          completedLoops: {},
-          ...context?.__wf ?? {},
-          idempotencyKey: opts.idempotencyKey
-        }
-      } : context;
-      const maxCycles = Math.min(Math.max(opts.maxCycles ?? 500, 1), 2000);
-      const final = await runGraphToCompletion(store, wal, graph, contextWithKey, { maxCycles });
-      return {
-        runId: final.id,
-        status: final.status,
-        error: final.error ?? null,
-        result: final.resultJson ? JSON.parse(final.resultJson) : null,
-        reused: false
-      };
-    } finally {
-      store.close();
-    }
+  version() {
+    return this.getVersion();
+  }
+  validate(graph) {
+    return this.validateWorkflow({ graph });
+  }
+  triggerRun(graph, context = {}, opts = {}) {
+    return this.triggerWorkflow({ graph, context, ...opts });
+  }
+  listRuns(options = {}) {
+    return this.listRunRecords(options);
+  }
+  getRun(id) {
+    return this.getRunRecord(id);
+  }
+  listNodes(id) {
+    return this.getRunNodes(id);
+  }
+  events(id) {
+    return this.getRunEvents(id);
+  }
+  cancelRun(id) {
+    return this.cancelWorkflow(id);
+  }
+  resumeRun(id) {
+    return this.resumeWorkflow(id);
+  }
+  lanes() {
+    return this.listLanes();
   }
 }
-function createWorkflowsService(config = {}) {
-  return new WorkflowsService(config);
+function createWorkflowsClient(options = {}) {
+  return new WorkflowsClient(options);
 }
 
 // src/mcp/index.ts
@@ -2209,34 +2259,60 @@ if (argv.includes("--help") || argv.includes("-h")) {
   console.log(HELP_TEXT);
   process.exit(0);
 }
+if (argv.some((argument) => argument !== "--stdio")) {
+  console.error("unknown workflows-mcp argument; use --help");
+  process.exit(2);
+}
 function respond(id, result) {
-  if (id === null || id === undefined)
+  if (id === undefined)
     return;
   process.stdout.write(JSON.stringify({ jsonrpc: "2.0", id, result }) + `
 `);
 }
 function respondError(id, code, message) {
-  if (id === null || id === undefined)
+  if (id === undefined)
     return;
   process.stdout.write(JSON.stringify({ jsonrpc: "2.0", id, error: { code, message } }) + `
 `);
 }
-var service = createWorkflowsService();
+var harness = "mcp";
+var protocols = ["2025-06-18", "2025-03-26", "2024-11-05"];
 var rl = createInterface({ input: process.stdin, crlfDelay: Infinity });
 rl.on("line", (line) => {
   const trimmed = line.trim();
   if (trimmed === "")
     return;
-  let msg;
+  if (Buffer.byteLength(trimmed) > 1048576) {
+    respondError(null, -32600, "Frame exceeds 1 MiB");
+    return;
+  }
+  let candidate;
   try {
-    msg = JSON.parse(trimmed);
+    candidate = JSON.parse(trimmed);
   } catch {
+    respondError(null, -32700, "Parse error");
+    return;
+  }
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+    respondError(null, -32600, "Invalid request");
+    return;
+  }
+  const msg = candidate;
+  if (msg.jsonrpc !== "2.0" || typeof msg.method !== "string" || msg.id !== undefined && msg.id !== null && typeof msg.id !== "number" && typeof msg.id !== "string") {
+    respondError(null, -32600, "Invalid request");
     return;
   }
-  const method = msg.method ?? "";
+  if (msg.params !== undefined && (!msg.params || typeof msg.params !== "object" || Array.isArray(msg.params))) {
+    respondError(msg.id, -32602, "params must be an object");
+    return;
+  }
+  const method = msg.method;
   if (method === "initialize") {
-    respond(msg.id ?? null, {
-      protocolVersion: "2024-11-05",
+    const info = msg.params?.clientInfo;
+    if (info && typeof info === "object" && typeof info.name === "string")
+      harness = info.name;
+    respond(msg.id, {
+      protocolVersion: protocols.includes(msg.params?.protocolVersion) ? msg.params.protocolVersion : protocols[0],
       capabilities: { tools: {} },
       serverInfo: { name: "workflows-mcp", version: packageVersion() }
     });
@@ -2245,28 +2321,33 @@ rl.on("line", (line) => {
   if (method.startsWith("notifications/"))
     return;
   if (method === "ping") {
-    respond(msg.id ?? null, {});
+    respond(msg.id, {});
     return;
   }
   if (method === "tools/list") {
-    respond(msg.id ?? null, { tools: workflowsTools(service) });
+    respond(msg.id, { tools: workflowsTools() });
     return;
   }
   if (method === "tools/call") {
     const params = msg.params ?? {};
-    const name = typeof params.name === "string" ? params.name : "";
+    const name2 = typeof params.name === "string" ? params.name : "";
     const args = params.arguments ?? {};
+    if (!name2 || !args || typeof args !== "object" || Array.isArray(args)) {
+      respondError(msg.id, -32602, "name must be a tool name and arguments must be an object");
+      return;
+    }
     (async () => {
       try {
-        respond(msg.id ?? null, await callWorkflowTool(service, name, args));
+        const agent = workflowMcpAgent(process.env, harness, args.agent, params._meta);
+        respond(msg.id, await callClientTool(() => createWorkflowsClient({ agent: agent.name }), name2, args));
       } catch (err) {
-        respond(msg.id ?? null, {
-          content: [{ type: "text", text: String(err instanceof Error ? err.message : err) }],
+        respond(msg.id, {
+          content: [{ type: "text", text: workflowErrorMessage(err) }],
           isError: true
         });
       }
     })();
     return;
   }
-  respondError(msg.id ?? null, -32601, `Method not found: ${method}`);
+  respondError(msg.id, -32601, "Method not found");
 });