@hasna/workflows 0.1.4 → 0.2.1

package/dist/handlers.js

@@ -16,56 +16,3251 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
-// src/handlers.ts
-import { createHash, timingSafeEqual } from "crypto";
-function jsonResponse(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json" }
+// src/expr.ts
+function tokenize(input) {
+  const tokens = [];
+  let i = 0;
+  while (i < input.length) {
+    const ch = input[i];
+    if (ch === " " || ch === "\t" || ch === `
+` || ch === "\r") {
+      i++;
+      continue;
+    }
+    if (ch === "(") {
+      tokens.push({ kind: "lparen", value: "(" });
+      i++;
+      continue;
+    }
+    if (ch === ")") {
+      tokens.push({ kind: "rparen", value: ")" });
+      i++;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      const quote = ch;
+      let j = i + 1;
+      let out = "";
+      let closed = false;
+      while (j < input.length) {
+        if (input[j] === quote) {
+          closed = true;
+          break;
+        }
+        out += input[j];
+        j++;
+      }
+      if (!closed)
+        throw new ExprSyntaxError(`unterminated string literal at offset ${i}`);
+      tokens.push({ kind: "string", value: out });
+      i = j + 1;
+      continue;
+    }
+    const two = input.slice(i, i + 2);
+    if (COMPARISON_OPS.has(two)) {
+      tokens.push({ kind: "op", value: two });
+      i += 2;
+      continue;
+    }
+    if (ch === "<" || ch === ">" || ch === "=" || ch === "!") {
+      tokens.push({ kind: "op", value: ch });
+      i++;
+      continue;
+    }
+    if (/[0-9]/.test(ch)) {
+      let j = i;
+      while (j < input.length && /[0-9.]/.test(input[j]))
+        j++;
+      tokens.push({ kind: "number", value: input.slice(i, j) });
+      i = j;
+      continue;
+    }
+    if (/[A-Za-z_]/.test(ch)) {
+      let j = i;
+      while (j < input.length && /[A-Za-z0-9_.]/.test(input[j]))
+        j++;
+      tokens.push({ kind: "ident", value: input.slice(i, j) });
+      i = j;
+      continue;
+    }
+    throw new ExprSyntaxError(`unexpected character ${JSON.stringify(ch)} at offset ${i}`);
+  }
+  return tokens;
+}
+
+class Parser {
+  tokens;
+  pos = 0;
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  peek() {
+    return this.tokens[this.pos];
+  }
+  next() {
+    return this.tokens[this.pos++];
+  }
+  expectOp(value) {
+    const t = this.next();
+    if (!t || t.kind !== "op" || t.value !== value) {
+      throw new ExprSyntaxError(`expected ${JSON.stringify(value)}`);
+    }
+  }
+  parse() {
+    if (this.tokens.length === 0)
+      throw new ExprSyntaxError("empty expression");
+    const node = this.parseOr();
+    if (this.pos < this.tokens.length) {
+      throw new ExprSyntaxError(`unexpected trailing token ${JSON.stringify(this.peek().value)}`);
+    }
+    return node;
+  }
+  parseOr() {
+    let left = this.parseAnd();
+    while (this.peek()?.kind === "ident" && this.peek().value === "or") {
+      this.next();
+      const right = this.parseAnd();
+      left = { kind: "or", left, right };
+    }
+    return left;
+  }
+  parseAnd() {
+    let left = this.parseNot();
+    while (this.peek()?.kind === "ident" && this.peek().value === "and") {
+      this.next();
+      const right = this.parseNot();
+      left = { kind: "and", left, right };
+    }
+    return left;
+  }
+  parseNot() {
+    if (this.peek()?.kind === "ident" && this.peek().value === "not") {
+      this.next();
+      return { kind: "not", operand: this.parseNot() };
+    }
+    return this.parseComparison();
+  }
+  parseComparison() {
+    const left = this.parsePrimary();
+    const t = this.peek();
+    if (t && t.kind === "op" && COMPARISON_OPS.has(t.value)) {
+      this.next();
+      const right = this.parsePrimary();
+      return { kind: "comparison", op: t.value, left, right };
+    }
+    return left;
+  }
+  parsePrimary() {
+    const t = this.next();
+    if (!t)
+      throw new ExprSyntaxError("unexpected end of expression");
+    if (t.kind === "lparen") {
+      const inner = this.parseOr();
+      this.expectCloseParen();
+      return inner;
+    }
+    if (t.kind === "number") {
+      const value = Number(t.value);
+      if (!Number.isFinite(value))
+        throw new ExprSyntaxError(`invalid number ${JSON.stringify(t.value)}`);
+      return { kind: "literal", value };
+    }
+    if (t.kind === "string")
+      return { kind: "literal", value: t.value };
+    if (t.kind === "ident") {
+      if (t.value === "true")
+        return { kind: "literal", value: true };
+      if (t.value === "false")
+        return { kind: "literal", value: false };
+      return { kind: "path", segments: t.value.split(".") };
+    }
+    throw new ExprSyntaxError(`unexpected token ${JSON.stringify(t.value)}`);
+  }
+  expectCloseParen() {
+    const t = this.next();
+    if (!t || t.kind !== "rparen")
+      throw new ExprSyntaxError("expected )");
+  }
+}
+function parseExpr(input) {
+  return new Parser(tokenize(input)).parse();
+}
+function resolvePath(segments, context) {
+  let current = context;
+  for (const segment of segments) {
+    if (current === null || typeof current !== "object")
+      return;
+    const record = current;
+    if (!(segment in record))
+      return;
+    current = record[segment];
+  }
+  if (typeof current === "number" || typeof current === "string" || typeof current === "boolean") {
+    return current;
+  }
+  return;
+}
+function evalNode(node, context) {
+  switch (node.kind) {
+    case "literal":
+      return node.value;
+    case "path":
+      return resolvePath(node.segments, context);
+    case "comparison": {
+      const left = evalNode(node.left, context);
+      const right = evalNode(node.right, context);
+      if (left === undefined || right === undefined) {
+        if (node.op === "==")
+          return left === undefined && right === undefined;
+        if (node.op === "!=")
+          return left !== right;
+        throw new ExprEvalError("cannot order-compare an unknown path");
+      }
+      if (typeof left !== typeof right) {
+        throw new ExprEvalError(`cannot compare ${JSON.stringify(left)} (${typeof left}) with ${JSON.stringify(right)} (${typeof right})`);
+      }
+      switch (node.op) {
+        case "==":
+          return left === right;
+        case "!=":
+          return left !== right;
+        case "<":
+          return left < right;
+        case "<=":
+          return left <= right;
+        case ">":
+          return left > right;
+        case ">=":
+          return left >= right;
+        default:
+          throw new ExprEvalError(`unknown operator ${node.op}`);
+      }
+    }
+    case "and": {
+      const left = evalNode(node.left, context);
+      const right = evalNode(node.right, context);
+      if (typeof left !== "boolean" || typeof right !== "boolean") {
+        throw new ExprEvalError("and requires boolean operands");
+      }
+      return left && right;
+    }
+    case "or": {
+      const left = evalNode(node.left, context);
+      const right = evalNode(node.right, context);
+      if (typeof left !== "boolean" || typeof right !== "boolean") {
+        throw new ExprEvalError("or requires boolean operands");
+      }
+      return left || right;
+    }
+    case "not": {
+      const operand = evalNode(node.operand, context);
+      if (typeof operand !== "boolean")
+        throw new ExprEvalError("not requires a boolean operand");
+      return !operand;
+    }
+  }
+}
+function evaluateExpr(input, context) {
+  const ast = parseExpr(input);
+  const value = evalNode(ast, context);
+  if (typeof value !== "boolean") {
+    throw new ExprEvalError(`condition must evaluate to a boolean, got ${typeof value}`);
+  }
+  return value;
+}
+var ExprSyntaxError, ExprEvalError, COMPARISON_OPS;
+var init_expr = __esm(() => {
+  ExprSyntaxError = class ExprSyntaxError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "ExprSyntaxError";
+    }
+  };
+  ExprEvalError = class ExprEvalError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "ExprEvalError";
+    }
+  };
+  COMPARISON_OPS = new Set(["==", "!=", "<", "<=", ">", ">="]);
+});
+
+// src/graph.ts
+function issue(issues, path, message) {
+  issues.push({ path, message });
+}
+function findNode(graph, id) {
+  return graph.nodes.find((n) => n.id === id);
+}
+function collectEdges(graph) {
+  const edges = [];
+  for (const node of graph.nodes) {
+    switch (node.type) {
+      case "start":
+      case "step":
+        if (node.next)
+          edges.push({ from: node.id, to: node.next });
+        break;
+      case "decision":
+        if (node.then)
+          edges.push({ from: node.id, to: node.then });
+        if (node.else)
+          edges.push({ from: node.id, to: node.else });
+        break;
+      case "while":
+        if (node.next)
+          edges.push({ from: node.id, to: node.next });
+        break;
+      case "end":
+        break;
+    }
+  }
+  return edges;
+}
+function reachableNodes(graph) {
+  const start = graph.nodes.find((n) => n.type === "start");
+  if (!start)
+    return [];
+  const seen = new Set;
+  const stack = [start.id];
+  while (stack.length > 0) {
+    const id = stack.pop();
+    if (seen.has(id))
+      continue;
+    seen.add(id);
+    const node = findNode(graph, id);
+    if (!node)
+      continue;
+    if (node.type === "start" || node.type === "step") {
+      if (node.next)
+        stack.push(node.next);
+    } else if (node.type === "decision") {
+      if (node.then)
+        stack.push(node.then);
+      if (node.else)
+        stack.push(node.else);
+    } else if (node.type === "while") {
+      for (const bodyId of node.body)
+        stack.push(bodyId);
+      if (node.next)
+        stack.push(node.next);
+    }
+  }
+  return [...seen];
+}
+function findCycles(graph) {
+  const edges = collectEdges(graph);
+  const adj = new Map;
+  for (const e of edges) {
+    const list = adj.get(e.from) ?? [];
+    list.push(e.to);
+    adj.set(e.from, list);
+  }
+  const color = new Map;
+  const stack = [];
+  const cycles = [];
+  function visit(id) {
+    color.set(id, "grey");
+    stack.push(id);
+    for (const to of adj.get(id) ?? []) {
+      const c = color.get(to);
+      if (c === "grey") {
+        const idx = stack.indexOf(to);
+        cycles.push([...stack.slice(idx), to]);
+      } else if (c === undefined) {
+        visit(to);
+      }
+    }
+    stack.pop();
+    color.set(id, "black");
+  }
+  for (const node of graph.nodes) {
+    if (color.get(node.id) === undefined)
+      visit(node.id);
+  }
+  return cycles;
+}
+function validateGraph(graph) {
+  const issues = [];
+  if (graph === null || typeof graph !== "object" || Array.isArray(graph)) {
+    return { ok: false, issues: [{ path: "graph", message: "graph must be an object" }] };
+  }
+  if (typeof graph.name !== "string" || graph.name.trim() === "") {
+    issue(issues, "name", "graph requires a non-empty name");
+  }
+  if (typeof graph.version !== "string" || graph.version.trim() === "") {
+    issue(issues, "version", "graph requires a version string");
+  }
+  if (graph.memoWatch !== undefined) {
+    if (!Array.isArray(graph.memoWatch) || graph.memoWatch.length === 0) {
+      issue(issues, "memoWatch", "memoWatch must be a non-empty array of file paths or globs");
+    } else {
+      for (const entry of graph.memoWatch) {
+        if (typeof entry !== "string" || entry.trim() === "") {
+          issue(issues, "memoWatch", "each memoWatch entry must be a non-empty path or glob string");
+          break;
+        }
+      }
+    }
+  }
+  if (!Array.isArray(graph.nodes) || graph.nodes.length === 0) {
+    issue(issues, "nodes", "graph requires at least one node");
+    return { ok: false, issues };
+  }
+  for (let index = 0;index < graph.nodes.length; index++) {
+    const node = graph.nodes[index];
+    if (node === null || typeof node !== "object" || Array.isArray(node)) {
+      issue(issues, `nodes.${index}`, "node must be an object");
+      continue;
+    }
+    if (!GRAPH_NODE_TYPES.includes(node.type))
+      issue(issues, `nodes.${index}.type`, "type must be start, step, decision, while, or end");
+    for (const key of ["next", "then", "else", "prompt", "command"]) {
+      const value = node[key];
+      if (value !== undefined && (typeof value !== "string" || value.trim() === ""))
+        issue(issues, `nodes.${index}.${key}`, `${key} must be a non-empty string`);
+    }
+    if (node.type === "while" && (!Array.isArray(node.body) || node.body.some((id) => typeof id !== "string")))
+      issue(issues, `nodes.${index}.body`, "body must be an array of node ids");
+  }
+  if (issues.length)
+    return { ok: false, issues };
+  const starts = graph.nodes.filter((n) => n.type === "start");
+  if (starts.length === 0)
+    issue(issues, "nodes", "graph requires exactly one start node (found none)");
+  if (starts.length > 1)
+    issue(issues, "nodes", "graph requires exactly one start node (found multiple)");
+  const ends = graph.nodes.filter((n) => n.type === "end");
+  if (ends.length === 0)
+    issue(issues, "nodes", "graph requires at least one end node");
+  const seenIds = new Map;
+  for (const node of graph.nodes) {
+    if (typeof node.id !== "string" || !NODE_ID_RE.test(node.id)) {
+      issue(issues, "nodes", `node id ${JSON.stringify(node.id)} must match ${String(NODE_ID_RE)}`);
+      continue;
+    }
+    if (seenIds.has(node.id)) {
+      issue(issues, `nodes.${node.id}`, `duplicate node id ${node.id}`);
+      continue;
+    }
+    seenIds.set(node.id, node);
+    if (!GRAPH_NODE_TYPES.includes(node.type)) {
+      issue(issues, `nodes.${node.id}`, `unknown node type ${JSON.stringify(node.type)}`);
+      continue;
+    }
+    validateNode(graph, node, issues);
+  }
+  for (const node of graph.nodes) {
+    const edges = nodeEdges(node);
+    for (const { kind, target } of edges) {
+      if (!seenIds.has(target)) {
+        issue(issues, `nodes.${node.id}`, `${kind} edge targets nonexistent node ${target}`);
+      }
+    }
+  }
+  if (starts.length === 1) {
+    const reachable = new Set(reachableNodes(graph));
+    for (const node of graph.nodes) {
+      if (!reachable.has(node.id)) {
+        issue(issues, `nodes.${node.id}`, `node ${node.id} is unreachable from start`);
+      }
+    }
+  }
+  const cycles = findCycles(graph);
+  for (const cycle of cycles) {
+    issue(issues, "nodes", `explicit cycle detected: ${cycle.join(" -> ")} (loop only via a while node)`);
+  }
+  return { ok: issues.length === 0, issues };
+}
+function nodeEdges(node) {
+  switch (node.type) {
+    case "start":
+    case "step":
+      return node.next ? [{ kind: "next", target: node.next }] : [];
+    case "decision":
+      return [
+        ...node.then ? [{ kind: "then", target: node.then }] : [],
+        ...node.else ? [{ kind: "else", target: node.else }] : []
+      ];
+    case "while":
+      return node.next ? [{ kind: "next", target: node.next }] : [];
+    case "end":
+      return [];
+    default:
+      return [];
+  }
+}
+function validateNode(graph, node, issues) {
+  switch (node.type) {
+    case "start":
+      if (!node.next)
+        issue(issues, `nodes.${node.id}`, "start node requires a next edge");
+      break;
+    case "step": {
+      if (!node.prompt && !node.command) {
+        issue(issues, `nodes.${node.id}`, "step node requires prompt or command");
+      }
+      if (node.lane !== undefined && !LANE_KINDS.includes(node.lane)) {
+        issue(issues, `nodes.${node.id}`, `unknown lane ${JSON.stringify(node.lane)} (expected one of ${LANE_KINDS.join(", ")})`);
+      }
+      if (node.cwd !== undefined && (typeof node.cwd !== "string" || !node.cwd.trim() || node.cwd.includes("\x00"))) {
+        issue(issues, `nodes.${node.id}.cwd`, "cwd must be a non-empty path string without NUL characters on the executor");
+      }
+      if (node.codexMode !== undefined) {
+        if (!CODEX_EXECUTION_MODES.includes(node.codexMode)) {
+          issue(issues, `nodes.${node.id}.codexMode`, "codexMode must be repository or read-only");
+        } else if (node.lane !== "codex" || !node.prompt || node.command !== undefined) {
+          issue(issues, `nodes.${node.id}.codexMode`, "codexMode is supported only for a codex prompt step without command");
+        }
+      }
+      if (node.maxRetries !== undefined && (!Number.isInteger(node.maxRetries) || node.maxRetries < 0)) {
+        issue(issues, `nodes.${node.id}`, "maxRetries must be a non-negative integer");
+      }
+      if (node.timeoutMs !== undefined && (!Number.isInteger(node.timeoutMs) || node.timeoutMs < 1)) {
+        issue(issues, `nodes.${node.id}`, "timeoutMs must be a positive integer");
+      }
+      break;
+    }
+    case "decision": {
+      if (typeof node.condition !== "string" || node.condition.trim() === "") {
+        issue(issues, `nodes.${node.id}`, "decision node requires a condition expression");
+      } else {
+        try {
+          parseExpr(node.condition);
+        } catch (err) {
+          if (err instanceof ExprSyntaxError) {
+            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
+          } else {
+            throw err;
+          }
+        }
+      }
+      if (!node.then && !node.else) {
+        issue(issues, `nodes.${node.id}`, "decision node requires then and/or else edge");
+      }
+      break;
+    }
+    case "while": {
+      if (typeof node.condition !== "string" || node.condition.trim() === "") {
+        issue(issues, `nodes.${node.id}`, "while node requires a condition expression");
+      } else {
+        try {
+          parseExpr(node.condition);
+        } catch (err) {
+          if (err instanceof ExprSyntaxError) {
+            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
+          } else {
+            throw err;
+          }
+        }
+      }
+      if (node.maxIterations === undefined) {
+        issue(issues, `nodes.${node.id}`, "while node requires maxIterations (finite loop bound)");
+      } else if (!Number.isInteger(node.maxIterations) || node.maxIterations < 1) {
+        issue(issues, `nodes.${node.id}`, "maxIterations must be a positive integer");
+      }
+      if (!Array.isArray(node.body) || node.body.length === 0) {
+        issue(issues, `nodes.${node.id}`, "while node requires a non-empty body");
+      } else {
+        for (const bodyId of node.body) {
+          const bodyNode = findNode(graph, bodyId);
+          if (!bodyNode) {
+            issue(issues, `nodes.${node.id}`, `while body references nonexistent node ${bodyId}`);
+            continue;
+          }
+          if (bodyNode.type === "start" || bodyNode.type === "end" || bodyNode.type === "while") {
+            issue(issues, `nodes.${node.id}`, `while body may only contain step/decision nodes in v1 (found ${bodyNode.type})`);
+          }
+        }
+        const bodySet = new Set(node.body);
+        for (const bodyId of node.body) {
+          const bodyNode = findNode(graph, bodyId);
+          if (!bodyNode)
+            continue;
+          for (const { kind, target } of nodeEdges(bodyNode)) {
+            if (!bodySet.has(target)) {
+              issue(issues, `nodes.${node.id}`, `while body node ${bodyId} ${kind}-edge leaves the body (target ${target})`);
+            }
+          }
+        }
+      }
+      break;
+    }
+    case "end":
+      break;
+  }
+}
+var GRAPH_NODE_TYPES, LANE_KINDS, CODEX_EXECUTION_MODES, NODE_ID_RE;
+var init_graph = __esm(() => {
+  init_expr();
+  GRAPH_NODE_TYPES = ["start", "step", "decision", "while", "end"];
+  LANE_KINDS = ["claude", "codex", "cursor", "grok"];
+  CODEX_EXECUTION_MODES = ["repository", "read-only"];
+  NODE_ID_RE = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+});
+
+// src/lanes/types.ts
+import { statSync as statSync2 } from "fs";
+function binaryOnPath(binary) {
+  const pathEntries = (process.env.PATH ?? "").split(":").filter(Boolean);
+  for (const entry of pathEntries) {
+    try {
+      const stat = statSync2(`${entry}/${binary}`);
+      if (stat.isFile())
+        return true;
+    } catch {}
+  }
+  return false;
+}
+function subscriptionEnvironment(overrides = {}) {
+  const paid = /^(OPENAI_API_KEY|ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|CODEX_API_KEY|CURSOR_API_KEY)$/;
+  const sensitive = /(?:API[_-]?KEY|SECRET|PASSWORD|TOKEN|DATABASE_URL|CREDENTIAL)/i;
+  const env = {};
+  for (const [name, value] of Object.entries(process.env)) {
+    if (value !== undefined && !paid.test(name) && (!sensitive.test(name) || name === "CLAUDE_CODE_OAUTH_TOKEN"))
+      env[name] = value;
+  }
+  for (const [name, value] of Object.entries(overrides)) {
+    if (paid.test(name) || sensitive.test(name))
+      throw new Error(`lane environment field ${name} requires a supported scoped credential consumer`);
+    env[name] = value;
+  }
+  return env;
+}
+function subscriptionSdkEnvironment(overrides = {}) {
+  const safe = subscriptionEnvironment(overrides);
+  return { ...Object.fromEntries(Object.keys(process.env).map((name) => [name, undefined])), ...safe };
+}
+function withTimeout(promise, timeoutMs, what, cancel) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      cancel?.();
+      reject(new LaneTimeoutError(what, timeoutMs));
+    }, timeoutMs);
+    promise.then((value) => {
+      clearTimeout(timer);
+      resolve(value);
+    }, (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+  });
+}
+async function spawnCli(cmd, opts) {
+  const started = Date.now();
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+  let proc;
+  try {
+    proc = Bun.spawn({
+      cmd,
+      cwd: opts.cwd,
+      env: subscriptionEnvironment(opts.env),
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "pipe",
+      timeout: timeoutMs
+    });
+  } catch (err) {
+    const message = String(err instanceof Error ? err.message : err);
+    if (message.includes("ENOENT") || /not found/i.test(message)) {
+      throw new LaneDependencyMissingError(`lane binary ${JSON.stringify(opts.binaryName)} not found on PATH; install it or provide ${opts.packageHint}`);
+    }
+    return { ok: false, exitCode: 1, output: "", durationMs: Date.now() - started, error: message };
+  }
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
+  const output = opts.stdoutOnly ? stdout.trim() : stderr ? `${stdout}
+${stderr}`.trim() : stdout.trim();
+  return {
+    ok: exitCode === 0,
+    exitCode,
+    output,
+    durationMs: Date.now() - started,
+    ...opts.stdoutOnly && exitCode !== 0 && stderr.trim() ? { error: stderr.trim() } : {}
+  };
+}
+var LANE_KINDS2, LaneDependencyMissingError, LaneAdapterShapeError, DEFAULT_LANE_TIMEOUT_MS = 120000, LaneTimeoutError;
+var init_types = __esm(() => {
+  LANE_KINDS2 = ["claude", "codex", "cursor", "grok"];
+  LaneDependencyMissingError = class LaneDependencyMissingError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "LaneDependencyMissingError";
+    }
+  };
+  LaneAdapterShapeError = class LaneAdapterShapeError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "LaneAdapterShapeError";
+    }
+  };
+  LaneTimeoutError = class LaneTimeoutError extends Error {
+    constructor(what, timeoutMs) {
+      super(`${what} exceeded the ${timeoutMs}ms budget`);
+      this.name = "LaneTimeoutError";
+    }
+  };
+});
+
+// src/lanes/claude.ts
+function createClaudeAdapter(deps = {}) {
+  return {
+    kind: "claude",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
+      try {
+        await loader();
+        return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "sdk" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "claude")) {
+          return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "claude",
+          sdk: "@anthropic-ai/claude-agent-sdk",
+          wired: false,
+          reason: "neither @anthropic-ai/claude-agent-sdk nor the claude CLI is available on this machine"
+        };
+      }
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "claude lane requires a prompt" };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch (err) {
+        return runClaudeCli(job, deps.cliPath ?? "claude", started, timeoutMs);
+      }
+      const query = sdk.query;
+      if (typeof query !== "function") {
+        throw new LaneAdapterShapeError("@anthropic-ai/claude-agent-sdk exports no query() function");
+      }
+      const prompt = job.prompt;
+      const abortController = new AbortController;
+      try {
+        const { output, isError } = await withTimeout((async () => {
+          const generator = await query({
+            prompt,
+            options: { model: job.model, cwd: job.cwd, maxTurns: 32, abortController, env: subscriptionSdkEnvironment(job.env) }
+          });
+          let output2 = "";
+          let isError2 = false;
+          for await (const message of generator) {
+            if (message.type === "assistant") {
+              const content = message.message?.content;
+              if (Array.isArray(content)) {
+                for (const block of content) {
+                  if (block && typeof block === "object" && "text" in block && typeof block.text === "string") {
+                    output2 += block.text;
+                  }
+                }
+              }
+            }
+            if (message.type === "error")
+              isError2 = true;
+          }
+          return { output: output2, isError: isError2 };
+        })(), timeoutMs, "claude lane", () => abortController.abort());
+        const durationMs = Date.now() - started;
+        return { ok: !isError, exitCode: isError ? 1 : 0, output: output.trim(), durationMs };
+      } catch (err) {
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
+      }
+    }
+  };
+}
+async function runClaudeCli(job, cliPath, started, timeoutMs) {
+  try {
+    const result = await spawnCli([cliPath, "-p", job.prompt], {
+      binaryName: cliPath,
+      packageHint: "@anthropic-ai/claude-agent-sdk or the claude CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd
+    });
+    return { ...result, durationMs: Date.now() - started };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    }
+    throw err;
+  }
+}
+var init_claude = __esm(() => {
+  init_types();
+});
+
+// src/lanes/codex.ts
+function createCodexAdapter(deps = {}) {
+  return {
+    kind: "codex",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
+      try {
+        await loader();
+        return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "sdk" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "codex")) {
+          return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "codex",
+          sdk: "@openai/codex-sdk",
+          wired: false,
+          reason: "neither @openai/codex-sdk nor the codex CLI is available on this machine"
+        };
+      }
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codex lane requires a prompt" };
+      }
+      if (job.codexMode !== undefined && (!CODEX_EXECUTION_MODES.includes(job.codexMode) || job.lane !== "codex" || job.command !== undefined)) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codexMode must be repository or read-only on a codex prompt without command", retryable: false };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch {
+        return runCodexCli(job, deps.cliPath ?? "codex", started, timeoutMs);
+      }
+      const CodexClass = sdk.Codex;
+      if (typeof CodexClass !== "function") {
+        throw new LaneAdapterShapeError("@openai/codex-sdk exports no Codex class");
+      }
+      const abortController = new AbortController;
+      try {
+        const client = await withTimeout(Promise.resolve(new CodexClass({
+          config: { model: job.model },
+          env: subscriptionEnvironment(job.env)
+        })), timeoutMs, "codex lane");
+        const thread = client.startThread?.({
+          model: job.model,
+          workingDirectory: job.cwd,
+          ...job.codexMode === "read-only" ? { sandboxMode: "read-only", skipGitRepoCheck: true, approvalPolicy: "never" } : {}
+        });
+        if (!thread || typeof thread.run !== "function") {
+          throw new LaneAdapterShapeError("@openai/codex-sdk Codex.startThread() returned no run()");
+        }
+        const turn = await withTimeout(thread.run(job.prompt, { signal: abortController.signal }), timeoutMs, "codex lane", () => abortController.abort());
+        const durationMs = Date.now() - started;
+        const output = turn?.finalResponse;
+        if (typeof output !== "string" || !output.trim()) {
+          return missingResponse(durationMs);
+        }
+        return { ok: true, exitCode: 0, output, durationMs };
+      } catch (err) {
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
+      }
+    }
+  };
+}
+async function runCodexCli(job, cliPath, started, timeoutMs) {
+  try {
+    const controls = job.codexMode === "read-only" ? ["--sandbox", "read-only", "--skip-git-repo-check", "--config", 'approval_policy="never"'] : [];
+    const result = await spawnCli([cliPath, "exec", ...controls, "--", job.prompt], {
+      binaryName: cliPath,
+      packageHint: "@openai/codex-sdk or the codex CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd,
+      stdoutOnly: true
+    });
+    const durationMs = Date.now() - started;
+    return result.ok && !result.output.trim() ? missingResponse(durationMs) : { ...result, durationMs };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    }
+    throw err;
+  }
+}
+function missingResponse(durationMs) {
+  return { ok: false, exitCode: 1, output: "", durationMs, error: "Codex completed without an agent response; verify the native subscription and model route", retryable: false };
+}
+var init_codex = __esm(() => {
+  init_graph();
+  init_types();
+});
+
+// src/lanes/cursor.ts
+function createCursorAdapter(deps = {}) {
+  return {
+    kind: "cursor",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
+      try {
+        await loader();
+        return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "sdk (local mode)" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "cursor-agent")) {
+          return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "cursor",
+          sdk: "@cursor/sdk",
+          wired: false,
+          reason: "neither @cursor/sdk nor the cursor-agent CLI is available on this machine"
+        };
+      }
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "cursor lane requires a prompt" };
+      }
+      if (!deps.sdkLoader && binaryOnPath(deps.cliPath ?? "cursor-agent"))
+        return runCursorCli(job, deps.cliPath ?? "cursor-agent", Date.now(), job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS);
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch {
+        return runCursorCli(job, deps.cliPath ?? "cursor-agent", started, timeoutMs);
+      }
+      let cancel;
+      try {
+        subscriptionEnvironment(job.env);
+        if (!deps.sdkLoader && process.env.CURSOR_API_KEY)
+          throw new Error("cursor lane refuses ambient API billing; use the native subscription CLI");
+        const run2 = await withTimeout(runLocalAgent(sdk, job, (callback) => {
+          cancel = callback;
+        }), timeoutMs, "cursor lane", () => cancel?.());
+        const durationMs = Date.now() - started;
+        const status = run2.status;
+        const ok = status === "finished";
+        return { ok, exitCode: ok ? 0 : 1, output: run2.result, durationMs };
+      } catch (err) {
+        if (err instanceof LaneAdapterShapeError)
+          throw err;
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
+      }
+    }
+  };
+}
+async function runLocalAgent(sdk, job, onCancel) {
+  const AgentClass = sdk.Agent;
+  const CursorClass = sdk.Cursor;
+  if (typeof AgentClass !== "function" && typeof CursorClass !== "function") {
+    throw new LaneAdapterShapeError("@cursor/sdk exports no Agent/Cursor class");
+  }
+  const create = AgentClass.create;
+  const agent = typeof create === "function" ? await create.call(AgentClass, { local: { cwd: job.cwd, enableAgentRetries: false } }) : typeof AgentClass === "function" ? new AgentClass : undefined;
+  if (!agent || typeof agent.send !== "function") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent has no send()");
+  }
+  let run2 = await agent.send(job.prompt, { model: job.model });
+  if (run2 && typeof run2 === "object") {
+    const handle = run2;
+    if (typeof handle.cancel === "function")
+      onCancel(() => {
+        handle.cancel().catch(() => {});
+      });
+    if (typeof handle.wait === "function")
+      run2 = await handle.wait();
+  }
+  if (!run2 || typeof run2 !== "object") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned no Run");
+  }
+  const candidate = run2;
+  if (typeof candidate.status !== "string" || !["finished", "error", "cancelled"].includes(candidate.status)) {
+    throw new LaneAdapterShapeError(`@cursor/sdk Agent.send() returned a Run without a terminal status (got ${JSON.stringify(candidate.status)}; expected finished|error|cancelled)`);
+  }
+  if (typeof candidate.result !== "string") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned a Run without a string result");
+  }
+  return { status: candidate.status, result: candidate.result };
+}
+async function runCursorCli(job, cliPath, started, timeoutMs) {
+  try {
+    const result = await spawnCli([cliPath, "--print", job.prompt, ...job.model ? ["--model", job.model] : []], {
+      binaryName: cliPath,
+      packageHint: "@cursor/sdk (local mode) or the cursor-agent CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd
+    });
+    return { ...result, durationMs: Date.now() - started };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    }
+    throw err;
+  }
+}
+var init_cursor = __esm(() => {
+  init_types();
+});
+
+// src/lanes/grok.ts
+function createGrokAdapter(deps = {}) {
+  return {
+    kind: "grok",
+    async probe() {
+      const cliPath = deps.cliPath ?? "grok";
+      if (binaryOnPath(cliPath)) {
+        return { kind: "grok", sdk: "no npm SDK (measured 2026-08-25)", wired: true, via: "cli" };
+      }
+      return {
+        kind: "grok",
+        sdk: "no npm SDK (measured 2026-08-25)",
+        wired: false,
+        reason: `no xAI Grok SDK exists on npm (measured 2026-08-25) and the grok CLI is not on PATH`
+      };
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "grok lane requires a prompt" };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const cliPath = deps.cliPath ?? "grok";
+      try {
+        const result = await spawnCli([cliPath, job.prompt], {
+          binaryName: cliPath,
+          packageHint: "the grok CLI (no xAI Grok SDK exists on npm \u2014 measured 2026-08-25)",
+          timeoutMs,
+          env: job.env,
+          cwd: job.cwd
+        });
+        return { ...result, durationMs: Date.now() - started };
+      } catch (err) {
+        if (err instanceof LaneDependencyMissingError) {
+          return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+        }
+        throw err;
+      }
+    }
+  };
+}
+var init_grok = __esm(() => {
+  init_types();
+});
+
+// src/lanes/index.ts
+var exports_lanes = {};
+__export(exports_lanes, {
+  runLaneJob: () => runLaneJob,
+  resolveLane: () => resolveLane,
+  probeLane: () => probeLane,
+  laneInventory: () => laneInventory,
+  createGrokAdapter: () => createGrokAdapter,
+  createCursorAdapter: () => createCursorAdapter,
+  createCodexAdapter: () => createCodexAdapter,
+  createClaudeAdapter: () => createClaudeAdapter,
+  binaryOnPath: () => binaryOnPath,
+  LaneDependencyMissingError: () => LaneDependencyMissingError,
+  LaneAdapterShapeError: () => LaneAdapterShapeError,
+  LANE_KINDS: () => LANE_KINDS2
+});
+function resolveLane(kind) {
+  const adapter = adapters.get(kind);
+  if (!adapter)
+    throw new Error(`unknown lane ${kind} (expected one of ${LANE_KINDS2.join(", ")})`);
+  return adapter;
+}
+async function runLaneJob(job) {
+  return resolveLane(job.lane).run(job);
+}
+async function probeLane(kind) {
+  return resolveLane(kind).probe();
+}
+async function laneInventory() {
+  return Promise.all(LANE_KINDS2.map((kind) => probeLane(kind)));
+}
+var adapters;
+var init_lanes = __esm(() => {
+  init_claude();
+  init_codex();
+  init_cursor();
+  init_grok();
+  init_types();
+  init_types();
+  init_claude();
+  init_codex();
+  init_cursor();
+  init_grok();
+  adapters = new Map([
+    ["claude", createClaudeAdapter()],
+    ["codex", createCodexAdapter()],
+    ["cursor", createCursorAdapter()],
+    ["grok", createGrokAdapter()]
+  ]);
+});
+
+// src/service.ts
+import { createHash as createHash3 } from "crypto";
+// package.json
+var package_default = {
+  name: "@hasna/workflows",
+  version: "0.2.1",
+  description: "Universal graph workflow app \u2014 graph language (start/step/decision/while/end), three-table store, session WAL, daemon with claims/leases, four lane adapters (claude/codex/cursor/grok), and a full CLI on four surfaces",
+  type: "module",
+  main: "./dist/index.js",
+  types: "./types/index.d.ts",
+  bin: {
+    workflows: "dist/cli/index.js",
+    "workflows-mcp": "dist/mcp/index.js",
+    "workflows-serve": "dist/serve/index.js"
+  },
+  exports: {
+    ".": {
+      types: "./types/index.d.ts",
+      import: "./dist/index.js"
+    },
+    "./sdk": {
+      types: "./types/sdk.d.ts",
+      import: "./dist/sdk.js"
+    },
+    "./cli": {
+      types: "./types/cli/index.d.ts",
+      import: "./dist/cli/index.js"
+    }
+  },
+  files: [
+    "dist",
+    "types",
+    "README.md",
+    "LICENSE",
+    "hasna.contract.json"
+  ],
+  scripts: {
+    build: "bun run check:sdk && bun run build:runtime && bun run build:types",
+    "generate:sdk": "bun scripts/generate-sdk.ts --write",
+    "check:sdk": "bun scripts/generate-sdk.ts",
+    "test:artifacts": "bun scripts/artifact-acceptance.ts",
+    "build:runtime": "bun build src/cli/index.ts --outdir dist/cli --target bun && bun build src/mcp/index.ts --outdir dist/mcp --target bun && bun build src/serve/index.ts src/serve/admin.ts --outdir dist/serve --target bun --packages external && bun build src/index.ts src/service.ts src/handlers.ts src/agent-tools.ts src/types.ts --root src --outdir dist --target bun --packages external && bun build src/sdk.ts --outdir dist --target node",
+    "build:types": "tsc -p tsconfig.build.json --emitDeclarationOnly --outDir types",
+    "artifact-scan": "bun scripts/contracts-cli.mjs artifact-scan dist",
+    "contract:check": "bun scripts/contracts-cli.mjs repo-conformance .",
+    typecheck: "tsc --noEmit",
+    test: "bun test",
+    "test:pg": 'WORKFLOWS_TEST_DATABASE_URL="${WORKFLOWS_TEST_DATABASE_URL:?point it at a fresh test Postgres database}" WORKFLOWS_REQUIRE_POSTGRES=1 bun test src/db/postgres-store.test.ts src/db/postgres-http.test.ts src/db/postgres-fencing.test.ts',
+    prepack: "bun run build && bun run artifact-scan",
+    prepublishOnly: "bun run test && bun run build"
+  },
+  keywords: [
+    "workflows",
+    "graph",
+    "automation",
+    "cli",
+    "typescript",
+    "bun",
+    "hasna"
+  ],
+  publishConfig: {
+    registry: "https://registry.npmjs.org",
+    access: "public"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/hasna/apps.git",
+    directory: "apps/workflows"
+  },
+  homepage: "https://github.com/hasna/apps/tree/main/apps/workflows",
+  bugs: {
+    url: "https://github.com/hasna/apps/issues"
+  },
+  engines: {
+    bun: ">=1.0.0"
+  },
+  author: "Hasna",
+  license: "Apache-2.0",
+  dependencies: {
+    "@anthropic-ai/claude-agent-sdk": "0.3.234",
+    "@cursor/sdk": "^1.0.28",
+    "@hasna/contracts": "1.3.3",
+    "@openai/codex-sdk": "0.160.0",
+    commander: "^13.1.0",
+    pg: "^8.16.3"
+  },
+  devDependencies: {
+    "@types/bun": "1.3.14",
+    "@types/pg": "^8.15.6",
+    typescript: "^5.7.3"
+  }
+};
+
+// src/version.ts
+function packageVersion() {
+  return package_default.version;
+}
+
+// src/daemon.ts
+init_expr();
+init_graph();
+import { randomUUID as randomUUID2 } from "crypto";
+
+// src/secrets.ts
+class SecretsGateError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SecretsGateError";
+  }
+}
+var p = (...parts) => parts.join("");
+var VALUE_PATTERNS = [
+  { detector: "anthropic_api_key", re: new RegExp(p("sk-", "ant-") + "[A-Za-z0-9_-]{10,}") },
+  { detector: "openai_api_key", re: new RegExp(p("sk-", "proj-") + "[A-Za-z0-9_-]{10,}") },
+  { detector: "npm_token", re: /npm_[A-Za-z0-9]{20,}/ },
+  { detector: "github_token", re: /gh[pousr]_[A-Za-z0-9]{20,}/ },
+  { detector: "aws_access_key", re: /AKIA[0-9A-Z]{16}/ },
+  { detector: "google_api_key", re: /AIza[0-9A-Za-z_-]{20,}/ },
+  { detector: "xai_api_key", re: new RegExp(p("xai-") + "[A-Za-z0-9]{20,}") },
+  { detector: "codex_token", re: new RegExp(p("ctx7", "sk-") + "[A-Za-z0-9]{10,}") },
+  { detector: "private_key_block", re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/ },
+  { detector: "bearer_token", re: /Bearer [A-Za-z0-9._~+/=-]{20,}/ }
+];
+var CREDENTIAL_KEY_RE = /^(token|api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|secret[_-]?key|refresh[_-]?token|session[_-]?token|bot[_-]?token)$/i;
+function scanString(value, path, findings) {
+  for (const { detector, re } of VALUE_PATTERNS) {
+    if (re.test(value)) {
+      findings.push({ path, detector });
+      return;
+    }
+  }
+}
+function isTrivial(value) {
+  const v = value.trim();
+  if (v.length === 0)
+    return true;
+  const upper = v.toUpperCase();
+  if (upper.startsWith("REPLACE") || upper.startsWith("CHANGE") || upper.startsWith("YOUR_") || upper.startsWith("EXAMPLE") || upper.startsWith("PLACEHOLDER"))
+    return true;
+  if (v.length < 8)
+    return true;
+  return false;
+}
+function scanForSecrets(value, path = "$") {
+  const findings = [];
+  if (value === null || value === undefined)
+    return findings;
+  if (typeof value === "string") {
+    scanString(value, path, findings);
+    return findings;
+  }
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => {
+      findings.push(...scanForSecrets(item, `${path}[${index}]`));
+    });
+    return findings;
+  }
+  if (typeof value === "object") {
+    const record = value;
+    for (const [key, child] of Object.entries(record)) {
+      if (CREDENTIAL_KEY_RE.test(key) && typeof child === "string" && !isTrivial(child)) {
+        findings.push({ path: `${path}.${key}`, detector: "credential_key_field" });
+      } else {
+        findings.push(...scanForSecrets(child, `${path}.${key}`));
+      }
+    }
+  }
+  return findings;
+}
+function assertNoSecrets(value, what) {
+  const findings = scanForSecrets(value);
+  if (findings.length === 0)
+    return;
+  const detail = findings.map((f) => `${f.path} (${f.detector})`).join(", ");
+  throw new SecretsGateError(`secrets write-gate refused to persist ${what}: credential-shaped value at ${detail}`);
+}
+
+// src/session.ts
+import { createHash } from "crypto";
+import { readFileSync, statSync } from "fs";
+import { isAbsolute, join } from "path";
+var DEFAULT_MAX_ATTEMPTS = 3;
+function repairTornRuns(store, wal, opts = {}) {
+  const sequence = repairSteps(store, wal, opts);
+  let step = sequence.next();
+  while (!step.done) {
+    if (step.value instanceof Promise) {
+      return (async () => {
+        while (!step.done)
+          step = sequence.next(await step.value);
+        return step.value;
+      })();
+    }
+    step = sequence.next(step.value);
+  }
+  return step.value;
+}
+function* repairSteps(store, wal, opts) {
+  const maxAttempts = opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+  const replay = wal.replay();
+  const liveClaims = replay.liveClaims(opts.now);
+  const report = { interrupted: 0, requeued: 0, failed: 0 };
+  const running = yield store.listRuns({ status: "running", limit: 1000 });
+  for (const run of running) {
+    if (liveClaims.has(run.id))
+      continue;
+    report.interrupted++;
+    const nodes = yield store.listRunNodes(run.id);
+    if (run.attempts < maxAttempts) {
+      yield store.bumpAttempts(run.id);
+      yield store.setRunStatus(run.id, "interrupted", {
+        error: `torn run interrupted after claim loss (attempt ${run.attempts + 1}/${maxAttempts})`
+      });
+      for (const node of nodes) {
+        if (node.status === "running") {
+          yield store.setRunNodeStatus(node.id, "pending", { error: undefined });
+        }
+      }
+      report.requeued++;
+    } else {
+      yield store.setRunStatus(run.id, "failed", {
+        error: `torn run failed after ${maxAttempts} interrupted attempts`
+      });
+      for (const node of nodes) {
+        if (node.status === "running") {
+          yield store.setRunNodeStatus(node.id, "failed", { error: "run interrupted beyond retry budget" });
+        }
+      }
+      report.failed++;
+    }
+  }
+  return report;
+}
+function inputHash(payload) {
+  return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
+}
+function memoKey(graphName, nodeId, input) {
+  return `${graphName}:${nodeId}:${inputHash(input)}`;
+}
+function tryMemoHit(store, graphName, nodeId, input) {
+  const key = memoKey(graphName, nodeId, input);
+  const value = store.memoGet(key);
+  if (value instanceof Promise) {
+    return value.then(async (row) => {
+      if (row)
+        await store.memoHit(key);
+      return row;
+    });
+  }
+  if (value)
+    store.memoHit(key);
+  return value;
+}
+function memoWatchFingerprint(graph, dataDir) {
+  if (!graph.memoWatch || graph.memoWatch.length === 0)
+    return;
+  const entries = [];
+  for (const pattern of graph.memoWatch) {
+    if (hasGlobMagic(pattern)) {
+      const matches = [...new Bun.Glob(pattern).scanSync({ cwd: dataDir, onlyFiles: true })].sort();
+      for (const match of matches) {
+        const path2 = isAbsolute(match) ? match : join(dataDir, match);
+        entries.push(fingerprintFile(pattern, path2));
+      }
+      continue;
+    }
+    const path = isAbsolute(pattern) ? pattern : join(dataDir, pattern);
+    entries.push(fingerprintFile(pattern, path));
+  }
+  return entries;
+}
+function hasGlobMagic(pattern) {
+  return /[*?[\]{}]/.test(pattern);
+}
+function fingerprintFile(pattern, path) {
+  try {
+    const stat = statSync(path);
+    if (!stat.isFile()) {
+      return { pattern, path, missing: true, mtimeMs: null, size: null, sha256: null };
+    }
+    const content = readFileSync(path);
+    return {
+      pattern,
+      path,
+      missing: false,
+      mtimeMs: stat.mtimeMs,
+      size: content.byteLength,
+      sha256: createHash("sha256").update(content).digest("hex")
+    };
+  } catch {
+    return { pattern, path, missing: true, mtimeMs: null, size: null, sha256: null };
+  }
+}
+
+// src/db/postgres-store.ts
+import { randomUUID } from "crypto";
+import { Pool } from "pg";
+var run = (r) => ({
+  id: String(r.id),
+  graphName: String(r.graph_name),
+  graphVersion: String(r.graph_version),
+  status: r.status,
+  attempts: Number(r.attempts),
+  contextJson: String(r.context_json),
+  resultJson: r.result_json == null ? null : String(r.result_json),
+  error: r.error == null ? null : String(r.error),
+  startedAt: r.started_at == null ? null : String(r.started_at),
+  finishedAt: r.finished_at == null ? null : String(r.finished_at),
+  createdAt: String(r.created_at),
+  updatedAt: String(r.updated_at)
+});
+var node = (r) => ({
+  id: String(r.id),
+  runId: String(r.run_id),
+  nodeId: String(r.node_id),
+  status: r.status,
+  attempts: Number(r.attempts),
+  lane: r.lane == null ? null : String(r.lane),
+  exitCode: r.exit_code == null ? null : Number(r.exit_code),
+  outputJson: r.output_json == null ? null : String(r.output_json),
+  error: r.error == null ? null : String(r.error),
+  startedAt: r.started_at == null ? null : String(r.started_at),
+  finishedAt: r.finished_at == null ? null : String(r.finished_at)
+});
+var memo = (r) => ({
+  key: String(r.key),
+  graphName: String(r.graph_name),
+  nodeId: String(r.node_id),
+  inputHash: String(r.input_hash),
+  outputJson: String(r.output_json),
+  hitCount: Number(r.hit_count),
+  createdAt: String(r.created_at)
+});
+
+class WorkflowStorageError extends Error {
+  constructor() {
+    super("PostgreSQL workflow storage is unavailable or its schema is invalid");
+    this.name = "WorkflowStorageError";
+  }
+}
+
+class PostgresWorkflowsStore {
+  pool;
+  prefix;
+  dataDir;
+  execution;
+  constructor(options) {
+    const schema = options.schema ?? "workflows";
+    if (!/^[a-z][a-z0-9_]{0,62}$/.test(schema))
+      throw new Error("PostgreSQL schema must be a lowercase SQL identifier");
+    this.prefix = `"${schema}"`;
+    this.dataDir = options.dataDir;
+    this.pool = new Pool({
+      connectionString: options.databaseUrl,
+      max: 4,
+      connectionTimeoutMillis: 5000,
+      idleTimeoutMillis: 1e4,
+      statement_timeout: 1e4,
+      application_name: "workflows"
+    });
+  }
+  async rows(sql, values = []) {
+    try {
+      if (this.execution?.lost)
+        throw new WorkflowStorageError;
+      return (await (this.execution?.client ?? this.pool).query(sql, values)).rows;
+    } catch (error) {
+      if (error?.code === "23505")
+        throw Object.assign(new Error("workflow uniqueness conflict"), { code: "23505" });
+      throw new WorkflowStorageError;
+    }
+  }
+  async close() {
+    await this.releaseExecution();
+    await this.pool.end();
+  }
+  async acquireExecution(runId) {
+    if (this.execution)
+      return this.execution.runId === runId && !this.execution.lost;
+    const client = await this.pool.connect();
+    let lost = false;
+    client.on("error", () => {
+      lost = true;
+      if (this.execution?.client === client)
+        this.execution.lost = true;
+    });
+    try {
+      const acquired = await client.query("SELECT pg_try_advisory_lock(hashtextextended($1,0)) AS owned", [`${this.prefix}:${runId}`]);
+      if (!acquired.rows[0]?.owned) {
+        client.release();
+        return false;
+      }
+      this.execution = { runId, client, lost };
+      return !lost;
+    } catch {
+      client.release(true);
+      throw new WorkflowStorageError;
+    }
+  }
+  async releaseExecution() {
+    const owned = this.execution;
+    if (!owned)
+      return;
+    this.execution = undefined;
+    try {
+      if (!owned.lost)
+        await owned.client.query("SELECT pg_advisory_unlock(hashtextextended($1,0))", [`${this.prefix}:${owned.runId}`]);
+    } finally {
+      owned.client.release(owned.lost);
+    }
+  }
+  async transaction(action) {
+    if (this.execution?.lost)
+      throw new WorkflowStorageError;
+    const client = this.execution?.client ?? await this.pool.connect();
+    const retained = client === this.execution?.client;
+    try {
+      await client.query("BEGIN");
+      const result = await action(client);
+      await client.query("COMMIT");
+      return result;
+    } catch {
+      try {
+        await client.query("ROLLBACK");
+      } catch {}
+      throw new WorkflowStorageError;
+    } finally {
+      if (!retained)
+        client.release();
+    }
+  }
+  async listTables() {
+    return (await this.rows("SELECT table_name FROM information_schema.tables WHERE table_schema=$1 AND table_type='BASE TABLE' ORDER BY table_name", [this.prefix.slice(1, -1)])).map((row) => String(row.table_name));
+  }
+  async checkSchema() {
+    if ((await this.listTables()).join(",") !== "memos,run_nodes,runs")
+      return false;
+    await this.rows(`SELECT id,graph_name,graph_version,status,attempts,context_json,result_json,error,started_at,finished_at,created_at,updated_at FROM ${this.prefix}.runs LIMIT 0`);
+    await this.rows(`SELECT id,sequence,run_id,node_id,status,attempts,lane,exit_code,output_json,error,started_at,finished_at FROM ${this.prefix}.run_nodes LIMIT 0`);
+    await this.rows(`SELECT key,graph_name,node_id,input_hash,output_json,hit_count,created_at FROM ${this.prefix}.memos LIMIT 0`);
+    const schema = this.prefix.slice(1, -1);
+    const indices = await this.rows(`SELECT i.indisunique,i.indisvalid,i.indisready,i.indnkeyatts,i.indnatts,i.indpred IS NULL AS unfiltered,pg_get_expr(i.indexprs,i.indrelid) AS expression FROM pg_index i JOIN pg_class c ON c.oid=i.indexrelid JOIN pg_class t ON t.oid=i.indrelid JOIN pg_namespace n ON n.oid=c.relnamespace WHERE n.nspname=$1 AND c.relname='runs_idempotency' AND t.relname='runs'`, [schema]);
+    const index = indices[0];
+    if (indices.length !== 1 || !index?.indisunique || !index.indisvalid || !index.indisready || !index.unfiltered || Number(index.indnkeyatts) !== 1 || Number(index.indnatts) !== 1 || String(index.expression).replace(/[()\s]/g, "") !== "context_json::jsonb#>>'{__wf,idempotencyKey}'::text[]")
+      return false;
+    const columns = await this.rows("SELECT table_name,column_name,data_type,is_nullable,is_identity,identity_generation FROM information_schema.columns WHERE table_schema=$1", [schema]);
+    const required = {
+      runs: ["id:text", "graph_name:text", "graph_version:text", "status:text", "attempts:integer", "context_json:text", "created_at:text", "updated_at:text"],
+      run_nodes: ["id:text", "sequence:bigint", "run_id:text", "node_id:text", "status:text", "attempts:integer"],
+      memos: ["key:text", "graph_name:text", "node_id:text", "input_hash:text", "output_json:text", "hit_count:integer", "created_at:text"]
+    };
+    for (const [table, fields] of Object.entries(required))
+      for (const field of fields) {
+        const [name, type] = field.split(":");
+        const c = columns.find((row) => row.table_name === table && row.column_name === name);
+        if (!c || c.data_type !== type || c.is_nullable !== "NO")
+          return false;
+        if (name === "sequence" && (c.is_identity !== "YES" || c.identity_generation !== "ALWAYS"))
+          return false;
+      }
+    const constraints = await this.rows(`SELECT c.relname AS table_name,co.contype,pg_get_constraintdef(co.oid) AS definition FROM pg_constraint co JOIN pg_class c ON c.oid=co.conrelid JOIN pg_namespace n ON n.oid=c.relnamespace WHERE n.nspname=$1`, [schema]);
+    for (const [table, key] of [["runs", "id"], ["run_nodes", "id"], ["memos", "key"]])
+      if (!constraints.some((row) => row.table_name === table && row.contype === "p" && row.definition === `PRIMARY KEY (${key})`))
+        return false;
+    return constraints.some((row) => row.table_name === "run_nodes" && row.contype === "f" && String(row.definition).replaceAll('"', "") === `FOREIGN KEY (run_id) REFERENCES ${schema}.runs(id)`);
+  }
+  async initialize() {
+    const tables = await this.listTables();
+    if (tables.length) {
+      if (await this.checkSchema())
+        return;
+      throw new WorkflowStorageError;
+    }
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query(`CREATE SCHEMA IF NOT EXISTS ${this.prefix};
+      CREATE TABLE IF NOT EXISTS ${this.prefix}.runs (
+        id TEXT PRIMARY KEY, graph_name TEXT NOT NULL, graph_version TEXT NOT NULL, status TEXT NOT NULL,
+        attempts INTEGER NOT NULL DEFAULT 0, context_json TEXT NOT NULL, result_json TEXT, error TEXT,
+        started_at TEXT, finished_at TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS ${this.prefix}.run_nodes (
+        id TEXT PRIMARY KEY, sequence BIGINT GENERATED ALWAYS AS IDENTITY, run_id TEXT NOT NULL REFERENCES ${this.prefix}.runs(id), node_id TEXT NOT NULL,
+        status TEXT NOT NULL, attempts INTEGER NOT NULL DEFAULT 0, lane TEXT, exit_code INTEGER,
+        output_json TEXT, error TEXT, started_at TEXT, finished_at TEXT);
+      CREATE TABLE IF NOT EXISTS ${this.prefix}.memos (
+        key TEXT PRIMARY KEY, graph_name TEXT NOT NULL, node_id TEXT NOT NULL, input_hash TEXT NOT NULL,
+        output_json TEXT NOT NULL, hit_count INTEGER NOT NULL DEFAULT 0, created_at TEXT NOT NULL);
+      CREATE UNIQUE INDEX IF NOT EXISTS runs_idempotency ON ${this.prefix}.runs ((context_json::jsonb #>> '{__wf,idempotencyKey}'));
+      CREATE INDEX IF NOT EXISTS runs_status ON ${this.prefix}.runs(status);
+      CREATE INDEX IF NOT EXISTS nodes_run ON ${this.prefix}.run_nodes(run_id);`);
+      await client.query("COMMIT");
+    } catch {
+      await client.query("ROLLBACK");
+      throw new WorkflowStorageError;
+    } finally {
+      client.release();
+    }
+    if (!await this.checkSchema())
+      throw new WorkflowStorageError;
+  }
+  async createRun(input) {
+    const at = new Date().toISOString();
+    const rows = await this.rows(`INSERT INTO ${this.prefix}.runs(id,graph_name,graph_version,status,context_json,created_at,updated_at)
+      VALUES($1,$2,$3,'pending',$4,$5,$5) RETURNING *`, [randomUUID(), input.graphName, input.graphVersion, JSON.stringify(input.context ?? {}), at]);
+    return run(rows[0]);
+  }
+  async getRun(id) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.runs WHERE id=$1`, [id]);
+    return rows[0] ? run(rows[0]) : undefined;
+  }
+  async getRunByIdempotencyKey(key) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.runs WHERE context_json::jsonb #>> '{__wf,idempotencyKey}'=$1`, [key]);
+    return rows[0] ? run(rows[0]) : undefined;
+  }
+  async listRuns(options = {}) {
+    const limit = Math.max(1, Math.min(1000, options.limit ?? 100));
+    return (await this.rows(`SELECT * FROM ${this.prefix}.runs ${options.status ? "WHERE status=$2" : ""} ORDER BY created_at DESC,id DESC LIMIT $1`, options.status ? [limit, options.status] : [limit])).map(run);
+  }
+  async setRunStatus(id, status, patch = {}) {
+    const values = [id, status, new Date().toISOString()];
+    const sets = ["status=$2", "updated_at=$3"];
+    for (const [field, key] of [["result_json", "result"], ["error", "error"], ["started_at", "startedAt"], ["finished_at", "finishedAt"]]) {
+      if (Object.hasOwn(patch, key)) {
+        values.push(key === "result" ? JSON.stringify(patch.result) : patch[key]);
+        sets.push(`${field}=$${values.length}`);
+      }
+    }
+    if (status === "running" && !Object.hasOwn(patch, "startedAt"))
+      sets.push("started_at=COALESCE(started_at,$3)");
+    await this.rows(`UPDATE ${this.prefix}.runs SET ${sets.join(",")} WHERE id=$1`, values);
+  }
+  async compareRunStatus(id, expected, status, patch = {}) {
+    const values = [id, expected, status, new Date().toISOString()];
+    const sets = ["status=$3", "updated_at=$4"];
+    for (const [field, key] of [["result_json", "result"], ["error", "error"], ["started_at", "startedAt"], ["finished_at", "finishedAt"]]) {
+      if (patch && Object.hasOwn(patch, key)) {
+        values.push(key === "result" ? JSON.stringify(patch.result) : patch[key]);
+        sets.push(`${field}=$${values.length}`);
+      }
+    }
+    return (await this.rows(`UPDATE ${this.prefix}.runs SET ${sets.join(",")} WHERE id=$1 AND status=ANY($2::text[]) RETURNING id`, values)).length === 1;
+  }
+  async setRunContext(id, context) {
+    await this.rows(`UPDATE ${this.prefix}.runs SET context_json=$2,updated_at=$3 WHERE id=$1`, [id, JSON.stringify(context), new Date().toISOString()]);
+  }
+  async setRunningContext(id, context) {
+    return (await this.rows(`UPDATE ${this.prefix}.runs SET context_json=$2,updated_at=$3 WHERE id=$1 AND status='running' RETURNING id`, [id, JSON.stringify(context), new Date().toISOString()])).length === 1;
+  }
+  async blockRunResume(id) {
+    await this.rows(`UPDATE ${this.prefix}.runs SET context_json=jsonb_set(context_json::jsonb,'{__wf,resumeBlocked}',to_jsonb($2::text))::text,updated_at=$3 WHERE id=$1`, [id, "execution cancellation has not been confirmed", new Date().toISOString()]);
+  }
+  async dispatchIfRunning(id, action) {
+    const marked = await this.rows(`UPDATE ${this.prefix}.runs SET context_json=jsonb_set(context_json::jsonb,'{__wf,executionMayBeActive}','true'::jsonb)::text WHERE id=$1 AND status='running' RETURNING id`, [id]);
+    if (!marked.length)
+      return { started: false };
+    return this.transaction(async (client) => {
+      const run2 = await client.query(`SELECT status FROM ${this.prefix}.runs WHERE id=$1 FOR UPDATE`, [id]);
+      if (run2.rows[0]?.status !== "running")
+        return { started: false };
+      return { started: true, result: action() };
+    });
+  }
+  async finishDispatch(id, unconfirmed) {
+    await this.rows(`UPDATE ${this.prefix}.runs SET context_json=(CASE WHEN $2 THEN jsonb_set(context_json::jsonb #- '{__wf,executionMayBeActive}','{__wf,resumeBlocked}',to_jsonb($3::text)) ELSE context_json::jsonb #- '{__wf,executionMayBeActive}' END)::text,updated_at=$4 WHERE id=$1`, [id, unconfirmed, "execution cancellation has not been confirmed", new Date().toISOString()]);
+  }
+  async commitStep(input) {
+    return this.transaction(async (client) => {
+      const nodes = await client.query(`SELECT run_id FROM ${this.prefix}.run_nodes WHERE id=$1 FOR UPDATE`, [input.nodeRowId]);
+      if (nodes.rows[0]?.run_id !== input.runId)
+        return false;
+      const run2 = await client.query(`SELECT status FROM ${this.prefix}.runs WHERE id=$1 FOR UPDATE`, [input.runId]);
+      if (run2.rows[0]?.status !== "running")
+        return false;
+      const patch = input.patch ?? {}, values = [input.nodeRowId, input.status];
+      const sets = ["status=$2"];
+      for (const [field, key] of [["exit_code", "exitCode"], ["output_json", "output"], ["error", "error"], ["started_at", "startedAt"], ["finished_at", "finishedAt"]]) {
+        if (Object.hasOwn(patch, key)) {
+          values.push(key === "output" ? JSON.stringify(patch.output) : patch[key]);
+          sets.push(`${field}=$${values.length}`);
+        }
+      }
+      if (input.status === "running") {
+        values.push(new Date().toISOString());
+        sets.push(`started_at=COALESCE(started_at,$${values.length})`);
+      }
+      if (["completed", "failed", "skipped"].includes(input.status)) {
+        values.push(new Date().toISOString());
+        sets.push(`finished_at=$${values.length}`);
+      }
+      if (input.incrementAttempts)
+        sets.push("attempts=attempts+1");
+      await client.query(`UPDATE ${this.prefix}.run_nodes SET ${sets.join(",")} WHERE id=$1`, values);
+      if (input.context !== undefined)
+        await client.query(`UPDATE ${this.prefix}.runs SET context_json=$2,updated_at=$3 WHERE id=$1`, [input.runId, JSON.stringify(input.context), new Date().toISOString()]);
+      if (input.memo) {
+        const m = input.memo;
+        await client.query(`INSERT INTO ${this.prefix}.memos(key,graph_name,node_id,input_hash,output_json,created_at) VALUES($1,$2,$3,$4,$5,$6) ON CONFLICT(key) DO UPDATE SET output_json=EXCLUDED.output_json`, [m.key, m.graphName, m.nodeId, m.inputHash, m.outputJson, new Date().toISOString()]);
+      }
+      return true;
+    });
+  }
+  async bumpAttempts(id) {
+    await this.rows(`UPDATE ${this.prefix}.runs SET attempts=attempts+1,updated_at=$2 WHERE id=$1`, [id, new Date().toISOString()]);
+  }
+  async createRunNode(input) {
+    const rows = await this.rows(`INSERT INTO ${this.prefix}.run_nodes(id,run_id,node_id,lane,status) VALUES($1,$2,$3,$4,'pending') RETURNING *`, [randomUUID(), input.runId, input.nodeId, input.lane ?? null]);
+    return node(rows[0]);
+  }
+  async getRunNode(id) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.run_nodes WHERE id=$1`, [id]);
+    return rows[0] ? node(rows[0]) : undefined;
+  }
+  async listRunNodes(runId) {
+    return (await this.rows(`SELECT * FROM ${this.prefix}.run_nodes WHERE run_id=$1 ORDER BY sequence`, [runId])).map(node);
+  }
+  async getLatestRunNode(runId, nodeId) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.run_nodes WHERE run_id=$1 AND node_id=$2 ORDER BY sequence DESC LIMIT 1`, [runId, nodeId]);
+    return rows[0] ? node(rows[0]) : undefined;
+  }
+  async setRunNodeStatus(id, status, patch = {}) {
+    const values = [id, status];
+    const sets = ["status=$2"];
+    for (const [field, key] of [["exit_code", "exitCode"], ["output_json", "output"], ["error", "error"], ["started_at", "startedAt"], ["finished_at", "finishedAt"]]) {
+      if (Object.hasOwn(patch, key)) {
+        values.push(key === "output" ? JSON.stringify(patch.output) : patch[key]);
+        sets.push(`${field}=$${values.length}`);
+      }
+    }
+    if (status === "running" && !Object.hasOwn(patch, "startedAt")) {
+      values.push(new Date().toISOString());
+      sets.push(`started_at=COALESCE(started_at,$${values.length})`);
+    }
+    if (["completed", "failed", "skipped"].includes(status) && !Object.hasOwn(patch, "finishedAt")) {
+      values.push(new Date().toISOString());
+      sets.push(`finished_at=$${values.length}`);
+    }
+    await this.rows(`UPDATE ${this.prefix}.run_nodes SET ${sets.join(",")} WHERE id=$1`, values);
+  }
+  async bumpAttemptsNode(id) {
+    await this.rows(`UPDATE ${this.prefix}.run_nodes SET attempts=attempts+1 WHERE id=$1`, [id]);
+  }
+  async memoPut(key, graphName, nodeId, inputHash2, outputJson) {
+    await this.rows(`INSERT INTO ${this.prefix}.memos(key,graph_name,node_id,input_hash,output_json,created_at) VALUES($1,$2,$3,$4,$5,$6)
+      ON CONFLICT(key) DO UPDATE SET output_json=EXCLUDED.output_json`, [key, graphName, nodeId, inputHash2, outputJson, new Date().toISOString()]);
+  }
+  async memoGet(key) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.memos WHERE key=$1`, [key]);
+    return rows[0] ? memo(rows[0]) : undefined;
+  }
+  async memoHit(key) {
+    await this.rows(`UPDATE ${this.prefix}.memos SET hit_count=hit_count+1 WHERE key=$1`, [key]);
+  }
+  async memoList() {
+    return (await this.rows(`SELECT * FROM ${this.prefix}.memos ORDER BY created_at DESC,key LIMIT 1000`)).map(memo);
+  }
+  async memoClear() {
+    throw new Error("PostgreSQL memo removal requires the reviewed server-operator preservation procedure");
+  }
+}
+
+// src/daemon.ts
+init_types();
+init_types();
+var DEFAULT_LEASE_TTL_MS = 120000;
+var DEFAULT_MAX_ATTEMPTS2 = 3;
+var DEFAULT_MAX_DISPATCH = 4;
+var DEFAULT_MAX_STEPS = 25;
+var DEFAULT_TIMEOUT_MS = 120000;
+function nowIso() {
+  return new Date().toISOString();
+}
+function stripRunState(context) {
+  const { __wf: _wf, steps: _steps, ...user } = context;
+  return user;
+}
+async function runCommand(job) {
+  if (!job.command) {
+    return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "no command" };
+  }
+  const started = Date.now();
+  const timeoutMs = job.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const proc = Bun.spawn({
+    cmd: ["/bin/sh", "-c", job.command],
+    cwd: job.cwd,
+    env: subscriptionEnvironment(job.env),
+    stdout: "pipe",
+    stderr: "pipe",
+    timeout: timeoutMs
   });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
+  const output = stderr ? `${stdout}
+${stderr}`.trim() : stdout.trim();
+  return { ok: exitCode === 0, exitCode, output, durationMs: Date.now() - started };
 }
-function openApiDoc(service) {
-  return {
-    openapi: "3.0.3",
-    info: { title: "workflows", version: service.version },
-    paths: {
-      "/health": { get: { summary: "Service health", responses: { "200": { description: "ok" } } } },
-      "/ready": { get: { summary: "Service readiness", responses: { "200": { description: "ok" } } } },
-      "/version": { get: { summary: "Service version", responses: { "200": { description: "ok" } } } },
-      "/trigger": {
-        post: {
-          summary: "Authenticated trigger: run a workflow graph to a terminal state",
-          security: [{ bearerAuth: [] }],
-          requestBody: {
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  required: ["graph"],
-                  properties: {
-                    graph: { type: "object", description: "the workflow graph" },
-                    context: { type: "object", description: "optional run context" },
-                    idempotencyKey: { type: "string", description: "re-run with the same key returns the same run" },
-                    maxCycles: { type: "number", description: "bound on reap cycles (default 500, max 2000)" }
-                  }
-                }
-              }
-            }
-          },
-          responses: {
-            "200": { description: "run summary" },
-            "401": { description: "missing or invalid Bearer token" },
-            "503": { description: "trigger not configured (WORKFLOWS_API_KEY unset)" }
+
+class WorkflowsDaemon {
+  store;
+  wal;
+  worker;
+  leaseTtlMs;
+  maxAttempts;
+  maxDispatchPerCycle;
+  maxStepsPerCycle;
+  time;
+  laneRunner;
+  env;
+  leases = new Map;
+  fencingCounter = new Map;
+  graphCache = new Map;
+  isolatedRunId = null;
+  constructor(store, wal, options = {}) {
+    this.store = store;
+    this.wal = wal;
+    this.worker = options.worker ?? `worker-${randomUUID2()}`;
+    this.leaseTtlMs = options.leaseTtlMs ?? DEFAULT_LEASE_TTL_MS;
+    this.maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS2;
+    this.maxDispatchPerCycle = options.maxDispatchPerCycle ?? DEFAULT_MAX_DISPATCH;
+    this.maxStepsPerCycle = options.maxStepsPerCycle ?? DEFAULT_MAX_STEPS;
+    this.time = options.time ?? Date.now;
+    this.env = options.env ?? {};
+    this.laneRunner = options.laneRunner ?? defaultLaneRunner;
+    this.isolatedRunId = options.isolatedRunId ?? null;
+    this.replayRegisteredGraphs();
+  }
+  isolateRun(runId) {
+    this.isolatedRunId = runId;
+  }
+  replayRegisteredGraphs() {
+    const entries = this.wal.replay().entries;
+    for (const entry of entries) {
+      const op = entry.op;
+      if (op.op === "graph_registered") {
+        this.graphCache.set(op.name, op.graph);
+      }
+    }
+  }
+  liveLeases() {
+    const now = this.time();
+    for (const [runId, lease] of this.leases) {
+      if (lease.expiresAtMs <= now)
+        this.leases.delete(runId);
+    }
+    return this.leases;
+  }
+  claim(runId) {
+    return this.wal.exclusive(() => this.claimLocked(runId));
+  }
+  claimLocked(runId) {
+    const now = this.time();
+    const existing = this.leases.get(runId);
+    if (existing && existing.worker !== this.worker && existing.expiresAtMs > now) {
+      return null;
+    }
+    const replay = this.wal.replay();
+    const liveClaims = replay.liveClaims(now);
+    const foreign = liveClaims.get(runId);
+    if (foreign && foreign.worker !== this.worker && foreign.expiresAtMs > now) {
+      return null;
+    }
+    const lastFencing = replay.entries.reduce((max, entry) => entry.op.op === "claim_acquired" && entry.op.runId === runId ? Math.max(max, entry.op.fencing) : max, 0);
+    const fencing = Math.max(lastFencing, this.fencingCounter.get(runId) ?? 0) + 1;
+    this.fencingCounter.set(runId, fencing);
+    const lease = { runId, worker: this.worker, expiresAtMs: now + this.leaseTtlMs, fencing };
+    this.leases.set(runId, lease);
+    this.wal.append({
+      op: "claim_acquired",
+      runId,
+      worker: this.worker,
+      expiresAt: new Date(lease.expiresAtMs).toISOString(),
+      fencing,
+      at: nowIso()
+    });
+    return lease;
+  }
+  heartbeat(runId, fencing) {
+    return this.wal.exclusive(() => this.heartbeatLocked(runId, fencing));
+  }
+  heartbeatLocked(runId, fencing) {
+    const lease = this.leases.get(runId);
+    if (!lease || lease.fencing !== fencing)
+      return false;
+    const current = this.wal.replay({ repair: false }).liveClaims(this.time()).get(runId);
+    if (!current || current.worker !== lease.worker || current.fencing !== fencing)
+      return false;
+    lease.expiresAtMs = this.time() + this.leaseTtlMs;
+    this.wal.append({
+      op: "claim_acquired",
+      runId,
+      worker: lease.worker,
+      fencing,
+      expiresAt: new Date(lease.expiresAtMs).toISOString(),
+      at: nowIso()
+    });
+    return true;
+  }
+  release(runId, fencing) {
+    return this.wal.exclusive(() => this.releaseLocked(runId, fencing));
+  }
+  releaseLocked(runId, fencing) {
+    const lease = this.leases.get(runId);
+    if (!lease || lease.fencing !== fencing)
+      return false;
+    const current = this.wal.replay().liveClaims(this.time()).get(runId);
+    if (current && (current.worker !== lease.worker || current.fencing !== fencing))
+      return false;
+    this.leases.delete(runId);
+    this.wal.append({ op: "claim_released", runId, fencing, at: nowIso() });
+    return true;
+  }
+  async reap() {
+    const report = { expired: 0, interrupted: 0, requeued: 0, failed: 0, dispatched: 0, advanced: 0, completed: 0 };
+    const now = this.time();
+    for (const [runId, lease] of this.leases) {
+      if (lease.expiresAtMs <= now) {
+        this.leases.delete(runId);
+        report.expired++;
+      }
+    }
+    if (this.isolatedRunId === null) {
+      const repair = await repairTornRuns(this.store, this.wal, { maxAttempts: this.maxAttempts, now });
+      report.interrupted += repair.interrupted;
+      report.requeued += repair.requeued;
+      report.failed += repair.failed;
+    }
+    const pending = (await this.store.listRuns({ status: "pending", limit: this.maxDispatchPerCycle })).concat(await this.store.listRuns({ status: "interrupted", limit: this.maxDispatchPerCycle })).sort((a, b) => a.createdAt === b.createdAt ? a.id < b.id ? 1 : -1 : a.createdAt < b.createdAt ? 1 : -1).slice(0, this.maxDispatchPerCycle);
+    for (const run2 of pending) {
+      if (this.isolatedRunId !== null && run2.id !== this.isolatedRunId)
+        continue;
+      const lease = this.claim(run2.id);
+      if (!lease)
+        continue;
+      await this.store.setRunStatus(run2.id, "running");
+      this.wal.append({ op: "run_started", runId: run2.id, at: nowIso() });
+      report.dispatched++;
+    }
+    const running = await this.store.listRuns({ status: "running", limit: this.maxStepsPerCycle });
+    let steps = 0;
+    for (const run2 of running) {
+      if (this.isolatedRunId !== null && run2.id !== this.isolatedRunId)
+        continue;
+      if (steps >= this.maxStepsPerCycle)
+        break;
+      const outcome = await this.advanceRun(run2.id);
+      steps++;
+      if (outcome.kind === "completed")
+        report.completed++;
+      if (outcome.kind === "failed")
+        report.failed++;
+      if (outcome.kind === "advanced")
+        report.advanced++;
+    }
+    return report;
+  }
+  startRun(graph, context) {
+    const validation = validateGraph(graph);
+    if (!validation.ok) {
+      throw new Error(`graph validation failed: ${validation.issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`);
+    }
+    assertNoSecrets(context, "run context");
+    assertNoSecrets(graph, "graph definition");
+    const existing = this.graphCache.get(graph.name);
+    const serialized = JSON.stringify(graph);
+    if (!existing || JSON.stringify(existing) !== serialized) {
+      this.graphCache.set(graph.name, graph);
+      this.wal.append({ op: "graph_registered", name: graph.name, version: graph.version, graph, at: nowIso() });
+    } else {
+      this.graphCache.set(graph.name, existing);
+    }
+    const initial = context !== null && typeof context === "object" ? context : {};
+    return this.store.createRun({
+      graphName: graph.name,
+      graphVersion: graph.version,
+      context: { ...initial, __wf: { ...initial.__wf ?? {}, graph } }
+    });
+  }
+  async advanceRun(runId) {
+    const run2 = await this.store.getRun(runId);
+    if (!run2 || run2.status !== "running")
+      return { kind: "noop" };
+    const lease = this.leases.get(runId);
+    if (!lease || lease.expiresAtMs <= this.time())
+      return { kind: "blocked" };
+    const storedContext = JSON.parse(run2.contextJson);
+    const pinned = storedContext.__wf?.graph;
+    const graph = pinned ?? this.loadGraph(run2.graphName);
+    if (!graph) {
+      await this.failRun(run2, `graph ${run2.graphName} not found in daemon graph cache`);
+      return { kind: "failed", error: "graph not found" };
+    }
+    const context = storedContext;
+    const rawWf = context.__wf ?? {};
+    const wf = {
+      ...rawWf,
+      cursor: typeof rawWf.cursor === "string" ? rawWf.cursor : undefined,
+      loops: Object.assign(Object.create(null), rawWf.loops ?? {}),
+      completedLoops: Object.assign(Object.create(null), rawWf.completedLoops ?? {})
+    };
+    try {
+      if (rawWf.stepTerminal === true) {
+        context.__wf = wf;
+        await this.completeRun(run2, context);
+        return { kind: "completed" };
+      }
+      const cursor = wf.cursor;
+      const node2 = cursor === undefined ? graph.nodes.find((n) => n.type === "start") : findNode(graph, cursor);
+      if (!node2) {
+        await this.failRun(run2, `cursor ${cursor ?? "<start>"} resolves to no node`);
+        return { kind: "failed", error: "no node at cursor" };
+      }
+      switch (node2.type) {
+        case "start": {
+          wf.cursor = node2.next;
+          await this.persistContext(run2, context, wf);
+          return { kind: "advanced", nodeId: node2.id };
+        }
+        case "step": {
+          return await this.executeStep(run2, graph, context, wf, node2);
+        }
+        case "decision": {
+          const value = evaluateExpr(node2.condition, this.conditionScope(context));
+          const next = value ? node2.then : node2.else;
+          if (!next) {
+            await this.failRun(run2, `decision ${node2.id} evaluated ${value} but no ${value ? "then" : "else"} edge`);
+            return { kind: "failed", error: "missing decision edge" };
           }
+          wf.cursor = next;
+          await this.persistContext(run2, context, wf);
+          return { kind: "advanced", nodeId: node2.id };
+        }
+        case "while": {
+          return await this.executeWhile(run2, graph, context, wf, node2);
+        }
+        case "end": {
+          await this.completeRun(run2, context);
+          return { kind: "completed" };
+        }
+      }
+    } catch (err) {
+      if (err instanceof ExprEvalError || err instanceof ExprSyntaxError) {
+        await this.failRun(run2, `condition error at ${wf.cursor ?? "<start>"}: ${err.message}`);
+        return { kind: "failed", error: err.message };
+      }
+      throw err;
+    }
+  }
+  loadGraph(name) {
+    return this.graphCache.get(name);
+  }
+  conditionScope(context) {
+    return { ...context, steps: context.steps ?? {} };
+  }
+  async persistContext(run2, context, wf) {
+    context.__wf = wf;
+    await this.store.setRunningContext(run2.id, context);
+  }
+  async discardStep(run2, nodeRowId) {
+    const current = await this.store.getRun(run2.id);
+    const node2 = await this.store.getRunNode(nodeRowId);
+    if (current?.status === "cancelled" && node2 && ["pending", "running"].includes(node2.status))
+      await this.store.setRunNodeStatus(nodeRowId, "skipped", { error: "run cancelled", finishedAt: nowIso() });
+    return { kind: "noop" };
+  }
+  async executeStep(run2, graph, context, wf, node2) {
+    const nodeId = node2.id;
+    const latest = await this.store.getLatestRunNode(run2.id, nodeId);
+    const isLoopBody = graph.nodes.some((candidate) => candidate.type === "while" && candidate.body.includes(nodeId));
+    const nodeRow = latest === undefined || isLoopBody && latest.status === "completed" ? await this.store.createRunNode({ runId: run2.id, nodeId, lane: node2.lane ?? "claude" }) : latest;
+    const memoWatch = node2.memo ? memoWatchFingerprint(graph, this.store.dataDir) : undefined;
+    const memoSource = {
+      command: node2.command,
+      prompt: node2.prompt,
+      context: stripRunState(context),
+      lane: node2.lane ?? "claude",
+      cwd: node2.cwd,
+      codexMode: node2.lane === "codex" ? node2.codexMode ?? "repository" : undefined
+    };
+    const memoInput = node2.memo ? memoWatch !== undefined ? { ...memoSource, memoWatch } : memoSource : undefined;
+    if (memoInput !== undefined) {
+      const hit = await tryMemoHit(this.store, run2.graphName, nodeId, memoInput);
+      if (hit) {
+        const cached = JSON.parse(hit.outputJson);
+        this.recordStepResult(context, nodeId, { ...cached, memoHit: true });
+        const continuation2 = this.advanceAfterStep(graph, context, wf, node2.next);
+        if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "completed", patch: { exitCode: Number(cached.exitCode ?? 0), output: { ...cached, memoHit: true } }, context }))
+          return this.discardStep(run2, nodeRow.id);
+        this.wal.append({ op: "node_finished", runId: run2.id, nodeId, status: "completed", at: nowIso() });
+        if (continuation2.kind === "completed")
+          await this.completeRun(run2, context);
+        return continuation2;
+      }
+    }
+    if (nodeRow.status !== "running") {
+      if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "running" }))
+        return this.discardStep(run2, nodeRow.id);
+      this.wal.append({ op: "node_started", runId: run2.id, nodeId, at: nowIso() });
+    }
+    const job = {
+      lane: node2.lane ?? "claude",
+      prompt: node2.prompt,
+      command: node2.command,
+      cwd: node2.cwd,
+      codexMode: node2.codexMode,
+      timeoutMs: node2.timeoutMs,
+      env: this.env
+    };
+    let result;
+    const activeLease = this.leases.get(run2.id);
+    const pulse = setInterval(() => {
+      this.heartbeat(run2.id, activeLease.fencing);
+    }, Math.max(1, Math.floor(this.leaseTtlMs / 3)));
+    try {
+      const dispatched = await this.store.dispatchIfRunning(run2.id, async () => {
+        try {
+          return await this.laneRunner(job);
+        } catch (err) {
+          return { ok: false, exitCode: 1, output: "", durationMs: 0, error: String(err instanceof Error ? err.message : err) };
+        }
+      });
+      if (!dispatched.started) {
+        await this.store.finishDispatch(run2.id, false);
+        return this.discardStep(run2, nodeRow.id);
+      }
+      result = await dispatched.result;
+    } finally {
+      clearInterval(pulse);
+    }
+    const unconfirmed = result.retryable === false && /exceeded.*budget/.test(result.error ?? "");
+    await this.store.finishDispatch(run2.id, unconfirmed);
+    if (unconfirmed)
+      Object.assign(wf, { resumeBlocked: "execution cancellation has not been confirmed" });
+    const current = await this.store.getRun(run2.id);
+    const currentClaim = this.wal.replay({ repair: false }).liveClaims(this.time()).get(run2.id);
+    const lease = this.leases.get(run2.id);
+    if (!current || current.status !== "running" || !currentClaim || !lease || currentClaim.worker !== lease.worker || currentClaim.fencing !== lease.fencing) {
+      if (current?.status === "cancelled")
+        await this.store.setRunNodeStatus(nodeRow.id, "skipped", { error: "run cancelled", finishedAt: nowIso() });
+      return { kind: "noop" };
+    }
+    try {
+      assertNoSecrets({ output: result.output, error: result.error }, `node ${nodeId} execution`);
+    } catch {
+      result = { ok: false, exitCode: 1, output: "", durationMs: result.durationMs, error: "execution result refused by secrets write-gate", retryable: false };
+    }
+    const output = { ok: result.ok, exitCode: result.exitCode, output: result.output, durationMs: result.durationMs };
+    if (!result.ok) {
+      const shouldRetry = result.retryable !== false && nodeRow.attempts < (node2.maxRetries ?? 0);
+      if (shouldRetry) {
+        if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "pending", patch: { error: result.error ?? `exit ${result.exitCode}` }, incrementAttempts: true }))
+          return this.discardStep(run2, nodeRow.id);
+        return { kind: "advanced", nodeId };
+      }
+      const error = result.error ?? `step ${nodeId} failed with exit ${result.exitCode}`;
+      if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "failed", patch: { exitCode: result.exitCode, error }, incrementAttempts: true }))
+        return this.discardStep(run2, nodeRow.id);
+      this.wal.append({ op: "node_finished", runId: run2.id, nodeId, status: "failed", at: nowIso() });
+      await this.failRun(run2, error);
+      return { kind: "failed", error };
+    }
+    try {
+      assertNoSecrets(output, `node ${nodeId} output`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "failed", patch: { error: message } }))
+        return this.discardStep(run2, nodeRow.id);
+      this.wal.append({ op: "node_finished", runId: run2.id, nodeId, status: "failed", at: nowIso() });
+      await this.failRun(run2, message);
+      return { kind: "failed", error: message };
+    }
+    let memo2;
+    if (memoInput !== undefined) {
+      const memoInputAfter = node2.memo ? memoWatchFingerprint(graph, this.store.dataDir) : undefined;
+      const stable = memoWatch === undefined && memoInputAfter === undefined || memoWatch !== undefined && memoInputAfter !== undefined && JSON.stringify(memoWatch) === JSON.stringify(memoInputAfter);
+      if (stable) {
+        memo2 = { key: memoKey(run2.graphName, nodeId, memoInput), graphName: run2.graphName, nodeId, inputHash: inputHash(memoInput), outputJson: JSON.stringify(output) };
+      }
+    }
+    this.recordStepResult(context, nodeId, output);
+    const continuation = this.advanceAfterStep(graph, context, wf, node2.next);
+    if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "completed", patch: { exitCode: result.exitCode, output }, context, memo: memo2 }))
+      return this.discardStep(run2, nodeRow.id);
+    this.wal.append({ op: "node_finished", runId: run2.id, nodeId, status: "completed", at: nowIso() });
+    if (memo2)
+      this.wal.append({ op: "memo_set", key: memo2.key, at: nowIso() });
+    if (continuation.kind === "completed")
+      await this.completeRun(run2, context);
+    return continuation;
+  }
+  advanceAfterStep(graph, context, wf, next) {
+    context.__wf = wf;
+    if (next) {
+      wf.cursor = next;
+      return { kind: "advanced", nodeId: wf.cursor };
+    }
+    const cursor = wf.cursor;
+    const whileNode = graph.nodes.find((n) => n.type === "while" && n.body.includes(cursor ?? ""));
+    if (whileNode) {
+      const index = whileNode.body.indexOf(cursor ?? "");
+      if (index >= 0 && index < whileNode.body.length - 1) {
+        wf.cursor = whileNode.body[index + 1];
+        return { kind: "advanced", nodeId: wf.cursor };
+      }
+      wf.loops[whileNode.id] = (wf.loops[whileNode.id] ?? 0) + 1;
+      wf.cursor = whileNode.id;
+      return { kind: "advanced", nodeId: whileNode.id };
+    }
+    wf.stepTerminal = true;
+    return { kind: "completed" };
+  }
+  async executeWhile(run2, graph, context, wf, node2) {
+    const iteration = wf.loops[node2.id] ?? 0;
+    if (iteration >= node2.maxIterations) {
+      const error = `while node ${node2.id} exceeded maxIterations (${node2.maxIterations})`;
+      await this.failRun(run2, error);
+      return { kind: "failed", error };
+    }
+    const scope = { ...this.conditionScope(context), i: iteration };
+    const keepGoing = evaluateExpr(node2.condition, scope);
+    if (!keepGoing) {
+      wf.completedLoops[node2.id] = iteration;
+      delete wf.loops[node2.id];
+      wf.cursor = node2.next;
+      await this.persistContext(run2, context, wf);
+      return { kind: "advanced", nodeId: node2.id };
+    }
+    wf.cursor = node2.body[0];
+    await this.persistContext(run2, context, wf);
+    return { kind: "advanced", nodeId: node2.id };
+  }
+  recordStepResult(context, nodeId, output) {
+    const steps = Object.assign(Object.create(null), context.steps ?? {});
+    steps[nodeId] = output;
+    context.steps = steps;
+  }
+  async completeRun(run2, context) {
+    const result = {
+      steps: context.steps ?? {},
+      iterations: context.__wf?.completedLoops ?? {}
+    };
+    try {
+      assertNoSecrets(result, "run result");
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      await this.failRun(run2, message);
+      return;
+    }
+    if (!await this.store.compareRunStatus(run2.id, ["running"], "completed", { result, finishedAt: nowIso(), error: null }))
+      return;
+    this.wal.append({ op: "run_finished", runId: run2.id, status: "completed", at: nowIso() });
+    const lease = this.leases.get(run2.id);
+    if (lease)
+      this.release(run2.id, lease.fencing);
+  }
+  async failRun(run2, error) {
+    if (!await this.store.compareRunStatus(run2.id, ["running"], "failed", { error, finishedAt: nowIso() }))
+      return;
+    this.wal.append({ op: "run_finished", runId: run2.id, status: "failed", at: nowIso() });
+    const lease = this.leases.get(run2.id);
+    if (lease)
+      this.release(run2.id, lease.fencing);
+  }
+}
+var defaultLaneRunner = async (job) => {
+  if (job.command)
+    return runCommand(job);
+  const { runLaneJob: runLaneJob2 } = await Promise.resolve().then(() => (init_lanes(), exports_lanes));
+  return runLaneJob2(job);
+};
+async function runGraphToCompletion(store, wal, graph, context, options = {}) {
+  const daemon = new WorkflowsDaemon(store, wal, {
+    worker: `foreground-${randomUUID2()}`,
+    laneRunner: options.laneRunner,
+    time: options.time,
+    env: options.env,
+    isolatedRunId: options.isolatedRunId
+  });
+  const run2 = options.existingRunId ? await store.getRun(options.existingRunId) : await daemon.startRun(graph, context);
+  if (!run2)
+    throw new Error("run not found");
+  options.onRunCreated?.(run2);
+  daemon.isolateRun(run2.id);
+  const maxCycles = options.maxCycles ?? 500;
+  const hosted = store instanceof PostgresWorkflowsStore ? store : undefined;
+  if (hosted && !await hosted.acquireExecution(run2.id))
+    return await store.getRun(run2.id);
+  const lease = daemon.claim(run2.id);
+  if (!lease) {
+    await hosted?.releaseExecution();
+    return await store.getRun(run2.id);
+  }
+  try {
+    if (!await store.compareRunStatus(run2.id, ["pending"], "running", { startedAt: nowIso() }))
+      return await store.getRun(run2.id);
+    wal.append({ op: "run_started", runId: run2.id, at: nowIso() });
+    for (let cycle = 0;cycle < maxCycles; cycle++) {
+      daemon.heartbeat(run2.id, lease.fencing);
+      const outcome = await daemon.advanceRun(run2.id);
+      const current = await store.getRun(run2.id);
+      if (current.status !== "running" || outcome.kind === "blocked" || outcome.kind === "noop")
+        return current;
+    }
+    await store.compareRunStatus(run2.id, ["running"], "interrupted", { error: "run reached maxCycles; resume to continue" });
+    return await store.getRun(run2.id);
+  } finally {
+    daemon.release(run2.id, lease.fencing);
+    await hosted?.releaseExecution();
+  }
+}
+
+// src/paths.ts
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { join as join2 } from "path";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+var PATHS_RESOLVER_KIND_ENV = {
+  config: "HASNA_CONFIG_HOME",
+  data: "HASNA_DATA_HOME",
+  state: "HASNA_STATE_HOME",
+  cache: "HASNA_CACHE_HOME"
+};
+var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function pathsResolverAssertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
+}
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
+    return override;
+  const home = options.home ?? pathsResolverHomedir();
+  const platform = options.platform ?? process.platform;
+  if (platform === "darwin") {
+    switch (kind) {
+      case "config":
+      case "data":
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
+      case "state":
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return pathsResolverJoin(home, ".config", "hasna");
+    case "data":
+      return pathsResolverJoin(home, ".local", "share", "hasna");
+    case "state":
+      return pathsResolverJoin(home, ".local", "state", "hasna");
+    case "cache":
+      return pathsResolverJoin(home, ".cache", "hasna");
+  }
+}
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
+}
+function dataDir(options) {
+  return pathsResolverResolve("data", options);
+}
+var APP = "workflows";
+var STORE_DB_FILE = "workflows.db";
+function getHomeDir(env = process.env) {
+  return env["HOME"] || env["USERPROFILE"] || homedir();
+}
+function getLegacyDataDir(env = process.env) {
+  return join2(getHomeDir(env), ".hasna", APP);
+}
+function getResolverDataDir(env = process.env, platform = process.platform) {
+  return dataDir({ app: APP, home: getHomeDir(env), env, platform });
+}
+function adoptResolverDataDir(resolved, env = process.env) {
+  const dataOverride = env.HASNA_DATA_HOME;
+  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
+    return true;
+  return existsSync(join2(resolved, STORE_DB_FILE));
+}
+function getEffectiveDataDir(env = process.env) {
+  const resolved = getResolverDataDir(env);
+  return adoptResolverDataDir(resolved, env) ? resolved : getLegacyDataDir(env);
+}
+
+// src/store.ts
+import { Database } from "bun:sqlite";
+import { mkdirSync } from "fs";
+import { join as join3 } from "path";
+import { randomUUID as randomUUID3 } from "crypto";
+var RUN_STATUSES = ["pending", "running", "completed", "failed", "cancelled", "interrupted"];
+function nowIso2() {
+  return new Date().toISOString();
+}
+var BUSY_TIMEOUT_MS = 3000;
+var BUSY_RETRIES = 2;
+var BUSY_RETRY_SLEEP_MS = 50;
+function isBusyError(err) {
+  if (!(err instanceof Error))
+    return false;
+  const code = String(err.code ?? "");
+  return code.includes("BUSY") || /\bdatabase is locked\b/i.test(err.message);
+}
+function retryBusy(fn) {
+  let last;
+  for (let attempt = 0;attempt <= BUSY_RETRIES; attempt++) {
+    try {
+      return fn();
+    } catch (err) {
+      if (!isBusyError(err))
+        throw err;
+      last = err;
+      Bun.sleepSync(BUSY_RETRY_SLEEP_MS);
+    }
+  }
+  throw last;
+}
+function openStore(dataDir2) {
+  mkdirSync(dataDir2, { recursive: true });
+  const db = new Database(join3(dataDir2, "workflows.db"));
+  retryBusy(() => db.exec(`PRAGMA busy_timeout = ${BUSY_TIMEOUT_MS}`));
+  retryBusy(() => db.exec("PRAGMA journal_mode = WAL"));
+  retryBusy(() => db.exec("PRAGMA foreign_keys = ON"));
+  retryBusy(() => db.exec(`
+    CREATE TABLE IF NOT EXISTS runs (
+      id            TEXT PRIMARY KEY,
+      graph_name    TEXT NOT NULL,
+      graph_version TEXT NOT NULL,
+      status        TEXT NOT NULL,
+      attempts      INTEGER NOT NULL DEFAULT 0,
+      context_json  TEXT NOT NULL,
+      result_json   TEXT,
+      error         TEXT,
+      started_at    TEXT,
+      finished_at   TEXT,
+      created_at    TEXT NOT NULL,
+      updated_at    TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS run_nodes (
+      id          TEXT PRIMARY KEY,
+      run_id      TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+      node_id     TEXT NOT NULL,
+      status      TEXT NOT NULL,
+      attempts    INTEGER NOT NULL DEFAULT 0,
+      lane        TEXT,
+      exit_code   INTEGER,
+      output_json TEXT,
+      error       TEXT,
+      started_at  TEXT,
+      finished_at TEXT
+    );
+    CREATE TABLE IF NOT EXISTS memos (
+      key         TEXT PRIMARY KEY,
+      graph_name  TEXT NOT NULL,
+      node_id     TEXT NOT NULL,
+      input_hash  TEXT NOT NULL,
+      output_json TEXT NOT NULL,
+      hit_count   INTEGER NOT NULL DEFAULT 0,
+      created_at  TEXT NOT NULL
+    );
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_runs_idempotency ON runs(json_extract(context_json, '$.__wf.idempotencyKey'))
+      WHERE json_type(context_json, '$.__wf.idempotencyKey') = 'text';
+    CREATE INDEX IF NOT EXISTS idx_runs_status ON runs(status);
+    CREATE INDEX IF NOT EXISTS idx_runs_created ON runs(created_at);
+    CREATE INDEX IF NOT EXISTS idx_run_nodes_run ON run_nodes(run_id);
+  `));
+  const rowToRun = (r) => ({
+    id: String(r.id),
+    graphName: String(r.graph_name),
+    graphVersion: String(r.graph_version),
+    status: r.status,
+    attempts: Number(r.attempts),
+    contextJson: String(r.context_json),
+    resultJson: r.result_json === null ? null : String(r.result_json),
+    error: r.error === null ? null : String(r.error),
+    startedAt: r.started_at === null ? null : String(r.started_at),
+    finishedAt: r.finished_at === null ? null : String(r.finished_at),
+    createdAt: String(r.created_at),
+    updatedAt: String(r.updated_at)
+  });
+  const rowToNode = (r) => ({
+    id: String(r.id),
+    runId: String(r.run_id),
+    nodeId: String(r.node_id),
+    status: r.status,
+    attempts: Number(r.attempts),
+    lane: r.lane === null ? null : String(r.lane),
+    exitCode: r.exit_code === null ? null : Number(r.exit_code),
+    outputJson: r.output_json === null ? null : String(r.output_json),
+    error: r.error === null ? null : String(r.error),
+    startedAt: r.started_at === null ? null : String(r.started_at),
+    finishedAt: r.finished_at === null ? null : String(r.finished_at)
+  });
+  const rowToMemo = (r) => ({
+    key: String(r.key),
+    graphName: String(r.graph_name),
+    nodeId: String(r.node_id),
+    inputHash: String(r.input_hash),
+    outputJson: String(r.output_json),
+    hitCount: Number(r.hit_count),
+    createdAt: String(r.created_at)
+  });
+  return {
+    dataDir: dataDir2,
+    close() {
+      db.close();
+    },
+    listTables() {
+      const rows = retryBusy(() => db.query("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'").all());
+      return rows.map((r) => r.name);
+    },
+    createRun(input) {
+      const id = randomUUID3();
+      const now = nowIso2();
+      retryBusy(() => db.query(`INSERT INTO runs (id, graph_name, graph_version, status, attempts, context_json, created_at, updated_at)
+             VALUES (?, ?, ?, 'pending', 0, ?, ?, ?)`).run(id, input.graphName, input.graphVersion, JSON.stringify(input.context ?? {}), now, now));
+      return this.getRun(id);
+    },
+    getRun(id) {
+      const row = retryBusy(() => db.query(`SELECT * FROM runs WHERE id = ?`).get(id));
+      return row ? rowToRun(row) : undefined;
+    },
+    getRunByIdempotencyKey(key) {
+      const row = retryBusy(() => db.query(`SELECT * FROM runs WHERE json_valid(context_json) AND json_extract(context_json, '$.__wf.idempotencyKey') = ? ORDER BY created_at DESC LIMIT 1`).get(key));
+      return row ? rowToRun(row) : undefined;
+    },
+    listRuns(opts = {}) {
+      const limit = Math.min(opts.limit ?? 100, 1000);
+      if (opts.status) {
+        const status = opts.status;
+        const rows2 = retryBusy(() => db.query(`SELECT * FROM runs WHERE status = ? ORDER BY created_at DESC, id DESC LIMIT ?`).all(status, limit));
+        return rows2.map((r) => rowToRun(r));
+      }
+      const rows = retryBusy(() => db.query(`SELECT * FROM runs ORDER BY created_at DESC, id DESC LIMIT ?`).all(limit));
+      return rows.map((r) => rowToRun(r));
+    },
+    setRunStatus(id, status, patch = {}) {
+      const now = nowIso2();
+      const existing = this.getRun(id);
+      const resultJson = patch.result !== undefined ? JSON.stringify(patch.result) : existing?.resultJson ?? null;
+      const error = patch.error !== undefined ? patch.error : existing?.error ?? null;
+      const startedAt = patch.startedAt !== undefined ? patch.startedAt : status === "running" && existing?.startedAt === null ? now : existing?.startedAt ?? null;
+      const terminal = status === "completed" || status === "failed" || status === "cancelled" || status === "interrupted";
+      const finishedAt = patch.finishedAt !== undefined ? patch.finishedAt : terminal && existing?.finishedAt === null ? now : existing?.finishedAt ?? null;
+      retryBusy(() => db.query(`UPDATE runs SET status = ?, result_json = ?, error = ?, started_at = ?, finished_at = ?, updated_at = ? WHERE id = ?`).run(status, resultJson, error, startedAt, finishedAt, now, id));
+    },
+    compareRunStatus(id, expected, status, patch = {}) {
+      return retryBusy(() => db.transaction(() => {
+        const current = this.getRun(id);
+        if (!current || !expected.includes(current.status))
+          return false;
+        this.setRunStatus(id, status, patch);
+        return true;
+      }).immediate());
+    },
+    bumpAttempts(id) {
+      retryBusy(() => db.query(`UPDATE runs SET attempts = attempts + 1, updated_at = ? WHERE id = ?`).run(nowIso2(), id));
+    },
+    setRunContext(id, context) {
+      retryBusy(() => db.query(`UPDATE runs SET context_json = ?, updated_at = ? WHERE id = ?`).run(JSON.stringify(context), nowIso2(), id));
+    },
+    setRunningContext(id, context) {
+      return retryBusy(() => db.transaction(() => {
+        if (this.getRun(id)?.status !== "running")
+          return false;
+        this.setRunContext(id, context);
+        return true;
+      }).immediate());
+    },
+    blockRunResume(id) {
+      retryBusy(() => db.transaction(() => {
+        const run2 = this.getRun(id);
+        if (!run2)
+          return;
+        const context = JSON.parse(run2.contextJson);
+        context.__wf = { ...context.__wf, resumeBlocked: "execution cancellation has not been confirmed" };
+        this.setRunContext(id, context);
+      }).immediate());
+    },
+    dispatchIfRunning(id, action) {
+      return retryBusy(() => db.transaction(() => {
+        const run2 = this.getRun(id);
+        if (run2?.status !== "running")
+          return { started: false };
+        const context = JSON.parse(run2.contextJson);
+        context.__wf = { ...context.__wf, executionMayBeActive: true };
+        this.setRunContext(id, context);
+        return { started: true, result: action() };
+      }).immediate());
+    },
+    finishDispatch(id, unconfirmed) {
+      retryBusy(() => db.transaction(() => {
+        const run2 = this.getRun(id);
+        if (!run2)
+          return;
+        const context = JSON.parse(run2.contextJson);
+        delete context.__wf?.executionMayBeActive;
+        if (unconfirmed)
+          context.__wf = { ...context.__wf, resumeBlocked: "execution cancellation has not been confirmed" };
+        this.setRunContext(id, context);
+      }).immediate());
+    },
+    commitStep(input) {
+      return retryBusy(() => db.transaction(() => {
+        if (this.getRun(input.runId)?.status !== "running")
+          return false;
+        const node2 = this.getRunNode(input.nodeRowId);
+        if (!node2 || node2.runId !== input.runId)
+          return false;
+        this.setRunNodeStatus(input.nodeRowId, input.status, input.patch);
+        if (input.incrementAttempts)
+          this.bumpAttemptsNode(input.nodeRowId);
+        if (input.context !== undefined)
+          this.setRunContext(input.runId, input.context);
+        if (input.memo)
+          this.memoPut(input.memo.key, input.memo.graphName, input.memo.nodeId, input.memo.inputHash, input.memo.outputJson);
+        return true;
+      }).immediate());
+    },
+    createRunNode(input) {
+      const id = randomUUID3();
+      retryBusy(() => db.query(`INSERT INTO run_nodes (id, run_id, node_id, status, attempts, lane)
+             VALUES (?, ?, ?, 'pending', 0, ?)`).run(id, input.runId, input.nodeId, input.lane ?? null));
+      return this.getRunNode(id);
+    },
+    getRunNode(id) {
+      const row = retryBusy(() => db.query(`SELECT * FROM run_nodes WHERE id = ?`).get(id));
+      return row ? rowToNode(row) : undefined;
+    },
+    listRunNodes(runId) {
+      const rows = retryBusy(() => db.query(`SELECT * FROM run_nodes WHERE run_id = ? ORDER BY rowid ASC`).all(runId));
+      return rows.map((r) => rowToNode(r));
+    },
+    getLatestRunNode(runId, nodeId) {
+      const row = retryBusy(() => db.query(`SELECT * FROM run_nodes WHERE run_id = ? AND node_id = ? ORDER BY rowid DESC LIMIT 1`).get(runId, nodeId));
+      return row ? rowToNode(row) : undefined;
+    },
+    setRunNodeStatus(id, status, patch = {}) {
+      const now = nowIso2();
+      const existing = this.getRunNode(id);
+      if (!existing)
+        return;
+      const exitCode = patch.exitCode !== undefined ? patch.exitCode : existing.exitCode;
+      const outputJson = patch.output !== undefined ? JSON.stringify(patch.output) : existing.outputJson;
+      const error = patch.error !== undefined ? patch.error : existing.error;
+      const startedAt = patch.startedAt !== undefined ? patch.startedAt : status === "running" && existing.startedAt === null ? now : existing.startedAt;
+      const terminal = status === "completed" || status === "failed" || status === "skipped";
+      const finishedAt = patch.finishedAt !== undefined ? patch.finishedAt : terminal && existing.finishedAt === null ? now : existing.finishedAt;
+      retryBusy(() => db.query(`UPDATE run_nodes SET status = ?, exit_code = ?, output_json = ?, error = ?, started_at = ?, finished_at = ? WHERE id = ?`).run(status, exitCode, outputJson, error, startedAt, finishedAt, id));
+    },
+    bumpAttemptsNode(id) {
+      retryBusy(() => db.query(`UPDATE run_nodes SET attempts = attempts + 1 WHERE id = ?`).run(id));
+    },
+    memoPut(key, graphName, nodeId, inputHash2, outputJson) {
+      retryBusy(() => db.query(`INSERT INTO memos (key, graph_name, node_id, input_hash, output_json, hit_count, created_at)
+             VALUES (?, ?, ?, ?, ?, 0, ?)
+             ON CONFLICT(key) DO UPDATE SET output_json = excluded.output_json`).run(key, graphName, nodeId, inputHash2, outputJson, nowIso2()));
+    },
+    memoGet(key) {
+      const row = retryBusy(() => db.query(`SELECT * FROM memos WHERE key = ?`).get(key));
+      return row ? rowToMemo(row) : undefined;
+    },
+    memoHit(key) {
+      retryBusy(() => db.query(`UPDATE memos SET hit_count = hit_count + 1 WHERE key = ?`).run(key));
+    },
+    memoList() {
+      const rows = retryBusy(() => db.query(`SELECT * FROM memos ORDER BY created_at DESC LIMIT 1000`).all());
+      return rows.map((r) => rowToMemo(r));
+    },
+    memoClear() {
+      retryBusy(() => db.exec(`DELETE FROM memos`));
+    }
+  };
+}
+
+// src/wal.ts
+import { Database as Database2 } from "bun:sqlite";
+import { createHash as createHash2 } from "crypto";
+import { appendFileSync, copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, truncateSync, writeFileSync, constants } from "fs";
+import { basename, dirname, join as join4 } from "path";
+var WAL_FILE_NAME = "session.wal";
+var SESSIONS_DIR_NAME = "sessions";
+var MAX_WAL_BYTES = 256 * 1024 * 1024;
+function checksumOf(op) {
+  if (op === undefined || op === null)
+    return "";
+  return createHash2("sha256").update(JSON.stringify(op)).digest("hex");
+}
+
+class SessionWAL {
+  filePath;
+  journalLocked = false;
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  static open(dataDir2) {
+    mkdirSync2(join4(dataDir2, SESSIONS_DIR_NAME), { recursive: true, mode: 448 });
+    const canonical = join4(dataDir2, SESSIONS_DIR_NAME, WAL_FILE_NAME);
+    const legacy = join4(dataDir2, WAL_FILE_NAME);
+    if (existsSync2(legacy) && !existsSync2(canonical)) {
+      try {
+        preserveOriginal(legacy);
+        renameSync(legacy, canonical);
+      } catch {
+        return new SessionWAL(legacy);
+      }
+    }
+    return new SessionWAL(canonical);
+  }
+  static openAt(filePath) {
+    return new SessionWAL(filePath);
+  }
+  append(op) {
+    return this.withJournalLock(() => this.appendLocked(op));
+  }
+  withJournalLock(operation) {
+    if (this.journalLocked)
+      return operation();
+    const parent = dirname(this.filePath);
+    const dataDir2 = basename(parent) === SESSIONS_DIR_NAME ? dirname(parent) : parent;
+    mkdirSync2(dataDir2, { recursive: true, mode: 448 });
+    const mutex = new Database2(join4(dataDir2, "workflows.db"));
+    try {
+      mutex.exec("PRAGMA busy_timeout = 5000");
+      mutex.exec("BEGIN IMMEDIATE");
+      this.journalLocked = true;
+      try {
+        const result = operation();
+        mutex.exec("COMMIT");
+        return result;
+      } catch (error) {
+        mutex.exec("ROLLBACK");
+        throw error;
+      } finally {
+        this.journalLocked = false;
+      }
+    } finally {
+      mutex.close();
+    }
+  }
+  exclusive(operation) {
+    return this.withJournalLock(operation);
+  }
+  appendLocked(op) {
+    const at = op.at ?? new Date().toISOString();
+    const full = { ...op, at };
+    const nextSeq = this.nextSeq();
+    const entry = { seq: nextSeq, at, checksum: checksumOf(full), op: full };
+    appendFileSync(this.filePath, JSON.stringify(entry) + `
+`, { encoding: "utf8", mode: 384 });
+    return entry;
+  }
+  nextSeq() {
+    const replay = this.replay();
+    return replay.entries.length + 1;
+  }
+  replay(options = {}) {
+    return this.withJournalLock(() => this.replayLocked(options));
+  }
+  replayLocked(options) {
+    const entries = [];
+    let torn = false;
+    let repaired = false;
+    let content;
+    try {
+      content = readFileSync2(this.filePath, "utf8");
+    } catch {
+      return { entries, torn, repaired, liveClaims: () => new Map };
+    }
+    if (content.length > MAX_WAL_BYTES) {
+      throw new Error(`session WAL exceeds ${MAX_WAL_BYTES} bytes; refusing to replay a truncated journal`);
+    }
+    if (content === "") {
+      return { entries, torn, repaired, liveClaims: () => new Map };
+    }
+    const lines = content.split(`
+`);
+    let badOffset = null;
+    let expectedSeq = 1;
+    for (let i = 0;i < lines.length; i++) {
+      const line = lines[i];
+      if (line === "")
+        continue;
+      if (badOffset !== null)
+        break;
+      const lineOffset = cumulativeOffset(lines, i);
+      let entry;
+      try {
+        entry = JSON.parse(line);
+      } catch {
+        badOffset = lineOffset;
+        break;
+      }
+      if (typeof entry?.seq !== "number" || entry.seq !== expectedSeq || entry.checksum !== checksumOf(entry.op)) {
+        badOffset = lineOffset;
+        break;
+      }
+      entries.push(entry);
+      expectedSeq++;
+    }
+    if (badOffset !== null) {
+      torn = true;
+      try {
+        if (options.repair === false)
+          return { entries, torn, repaired, liveClaims: (nowMs) => reconstructLiveClaims(entries, nowMs) };
+        preserveOriginal(this.filePath);
+        truncateSync(this.filePath, badOffset);
+        repaired = true;
+      } catch {}
+    }
+    return {
+      entries,
+      torn,
+      repaired,
+      liveClaims: (nowMs) => reconstructLiveClaims(entries, nowMs)
+    };
+  }
+  close() {}
+}
+function cumulativeOffset(lines, index) {
+  let offset = 0;
+  for (let i = 0;i < index; i++) {
+    offset += Buffer.byteLength(lines[i]) + 1;
+  }
+  return offset;
+}
+function reconstructLiveClaims(entries, nowMs = Date.now()) {
+  const claims = new Map;
+  for (const entry of entries) {
+    const op = entry.op;
+    if (op.op === "claim_acquired") {
+      claims.set(op.runId, { worker: op.worker, fencing: op.fencing, expiresAtMs: Date.parse(op.expiresAt) });
+    } else if (op.op === "claim_released") {
+      const existing = claims.get(op.runId);
+      if (existing && existing.fencing === op.fencing) {
+        claims.delete(op.runId);
+      }
+    }
+  }
+  for (const [runId, claim] of claims) {
+    if (claim.expiresAtMs <= nowMs)
+      claims.delete(runId);
+  }
+  return claims;
+}
+function preserveOriginal(filePath) {
+  const original = readFileSync2(filePath);
+  const digest = createHash2("sha256").update(original).digest("hex");
+  const backup = `${filePath}.preserved-${digest}`;
+  if (!existsSync2(backup))
+    copyFileSync(filePath, backup, constants.COPYFILE_EXCL);
+  if (!readFileSync2(backup).equals(original))
+    throw new Error("session WAL preservation readback failed; source retained");
+  return backup;
+}
+
+// src/service.ts
+import { hostname } from "os";
+import { resolveDatabaseUrl } from "@hasna/contracts";
+var DEFAULT_PORT = 8790;
+var DEFAULT_HOST = "127.0.0.1";
+function envString(names) {
+  for (const name of names) {
+    const value = process.env[name];
+    if (value !== undefined && value !== "")
+      return value;
+  }
+  return;
+}
+function envInt(names, fallback) {
+  const value = envString(names);
+  if (value === undefined)
+    return fallback;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : fallback;
+}
+function resolveWorkflowsConfig(overrides = {}) {
+  const originAuth = overrides.originAuth ?? process.env.HASNA_WORKFLOWS_ORIGIN_AUTH;
+  if (originAuth !== undefined && !/^[A-Za-z0-9_-]{32,256}$/.test(originAuth))
+    throw new Error("HASNA_WORKFLOWS_ORIGIN_AUTH must be a valid gateway origin identity");
+  return {
+    port: overrides.port ?? envInt(["HASNA_WORKFLOWS_PORT", "WORKFLOWS_PORT"], DEFAULT_PORT),
+    host: overrides.host ?? envString(["HASNA_WORKFLOWS_HOST", "WORKFLOWS_HOST"]) ?? DEFAULT_HOST,
+    dataDir: overrides.dataDir ?? envString(["HASNA_WORKFLOWS_DATA_DIR", "WORKFLOWS_DATA_DIR"]) ?? getEffectiveDataDir(),
+    apiUrl: overrides.apiUrl ?? envString(["HASNA_WORKFLOWS_API_URL", "WORKFLOWS_API_URL"]),
+    apiKey: overrides.apiKey ?? envString(["HASNA_WORKFLOWS_API_KEY", "WORKFLOWS_API_KEY"]),
+    originAuth,
+    storageBackend: overrides.storageBackend ?? "postgresql",
+    databaseUrl: overrides.databaseUrl ?? envString(["HASNA_WORKFLOWS_DATABASE_URL", "WORKFLOWS_DATABASE_URL"]),
+    databaseSchema: overrides.databaseSchema ?? envString(["HASNA_WORKFLOWS_DATABASE_SCHEMA", "WORKFLOWS_DATABASE_SCHEMA"])
+  };
+}
+
+class WorkflowsService {
+  execution;
+  name = "workflows";
+  version;
+  config;
+  startedAt = Date.now();
+  databaseEnv;
+  constructor(config = {}, execution = {}) {
+    this.execution = execution;
+    this.config = resolveWorkflowsConfig(config);
+    this.databaseEnv = config.databaseUrl !== undefined ? { HASNA_WORKFLOWS_DATABASE_URL: config.databaseUrl } : {
+      HASNA_WORKFLOWS_DATABASE_URL: process.env.HASNA_WORKFLOWS_DATABASE_URL,
+      WORKFLOWS_DATABASE_URL: process.env.WORKFLOWS_DATABASE_URL
+    };
+    this.version = packageVersion();
+  }
+  health() {
+    return {
+      ok: true,
+      status: "ok",
+      backend: this.config.storageBackend,
+      service: this.name,
+      version: this.version,
+      pid: process.pid,
+      uptimeMs: Date.now() - this.startedAt
+    };
+  }
+  async ready() {
+    const checks = { version: "ok", auth: this.config.apiKey ? "ok" : "missing", storage: "not-checked" };
+    if (this.config.apiKey) {
+      try {
+        checks.storage = await this.withStore(async (store) => (store instanceof PostgresWorkflowsStore ? await store.checkSchema() : (await store.listTables()).sort().join(",") === "memos,run_nodes,runs") ? "ok" : "invalid-schema");
+      } catch (error) {
+        checks.storage = error instanceof WorkflowRequestError && error.code === "invalid_schema" ? "invalid-schema" : "unavailable";
+      }
+    }
+    return { ok: checks.auth === "ok" && checks.storage === "ok", service: this.name, version: this.version, checks };
+  }
+  async openEngineStore(verifySchema = true) {
+    if (this.config.storageBackend === "sqlite")
+      return openStore(this.config.dataDir);
+    if (this.config.storageBackend !== "postgresql")
+      throw new WorkflowRequestError("invalid_storage_backend", "storage backend must be postgresql or explicit embedded sqlite", 503);
+    let databaseUrl;
+    try {
+      databaseUrl = resolveDatabaseUrl("workflows", this.databaseEnv);
+    } catch (error) {
+      throw new WorkflowRequestError("invalid_database_configuration", error instanceof Error ? error.message : "HASNA_WORKFLOWS_DATABASE_URL must configure PostgreSQL", 503);
+    }
+    let store;
+    try {
+      store = new PostgresWorkflowsStore({ databaseUrl, dataDir: this.config.dataDir, schema: this.config.databaseSchema });
+    } catch {
+      throw new WorkflowRequestError("invalid_database_schema", "HASNA_WORKFLOWS_DATABASE_SCHEMA must be a lowercase SQL identifier", 503);
+    }
+    try {
+      if (verifySchema && !await store.checkSchema())
+        throw new WorkflowRequestError("invalid_schema", "PostgreSQL workflow schema requires explicit initialization or a reviewed migration", 503);
+      return store;
+    } catch (error) {
+      await store.close();
+      throw error;
+    }
+  }
+  async withStore(operation) {
+    const store = await this.openEngineStore();
+    try {
+      return await operation(store);
+    } finally {
+      await store.close();
+    }
+  }
+  async initializeStorage() {
+    const store = await this.openEngineStore(false);
+    try {
+      if (!(store instanceof PostgresWorkflowsStore))
+        throw new WorkflowRequestError("invalid_storage_backend", "init-db requires PostgreSQL", 503);
+      await store.initialize();
+    } finally {
+      await store.close();
+    }
+  }
+  listRuns(options = {}) {
+    return this.withStore((store) => store.listRuns(options));
+  }
+  getRun(id) {
+    return this.withStore((store) => store.getRun(id));
+  }
+  listNodes(id) {
+    return this.withStore((store) => store.listRunNodes(id));
+  }
+  events(id) {
+    return SessionWAL.open(this.config.dataDir).replay({ repair: false }).entries.filter((entry) => ("runId" in entry.op) && entry.op.runId === id);
+  }
+  cancelRun(id) {
+    return this.withStore(async (store) => {
+      const run2 = await store.getRun(id);
+      if (!run2)
+        return;
+      if (["completed", "failed", "cancelled"].includes(run2.status))
+        throw new WorkflowRequestError("invalid_run_status", "cancellation requires a pending, running, or interrupted run", 409);
+      if (!await store.compareRunStatus(id, ["pending", "running", "interrupted"], "cancelled", { finishedAt: new Date().toISOString() }))
+        throw new WorkflowRequestError("run_status_conflict", "run changed before cancellation", 409);
+      return store.getRun(id);
+    });
+  }
+  async resumeRun(id) {
+    const store = await this.openEngineStore();
+    const wal = SessionWAL.open(this.config.dataDir);
+    try {
+      const run2 = await store.getRun(id);
+      if (!run2)
+        throw new WorkflowRequestError("run_not_found", "run id does not exist", 404);
+      if (!["failed", "cancelled", "interrupted"].includes(run2.status))
+        throw new WorkflowRequestError("invalid_run_status", "resume requires a failed, cancelled, or interrupted run", 409);
+      const context = JSON.parse(run2.contextJson);
+      if (context.__wf?.resumeBlocked || context.__wf?.executionMayBeActive || wal.replay({ repair: false }).liveClaims().has(id))
+        throw new WorkflowRequestError("execution_active", "previous execution must finish before resume", 409);
+      if (store instanceof PostgresWorkflowsStore && !await store.acquireExecution(id))
+        throw new WorkflowRequestError("execution_active", "another executor still owns this run", 409);
+      const graph = context.__wf?.graph;
+      if (!graph)
+        throw new WorkflowRequestError("graph_unavailable", "legacy run needs its original graph registered by the server operator", 409);
+      if (!await store.compareRunStatus(id, ["failed", "cancelled", "interrupted"], "pending", { error: null }))
+        throw new WorkflowRequestError("run_status_conflict", "run changed before resume", 409);
+      for (const node2 of await store.listRunNodes(id)) {
+        if (node2.status !== "completed")
+          await store.setRunNodeStatus(node2.id, "pending", { error: null });
+      }
+      const final = await runGraphToCompletion(store, wal, graph, context, { ...this.execution, existingRunId: id });
+      return runSummary(final, false);
+    } finally {
+      await store.close();
+    }
+  }
+  sessions(action) {
+    const replay = SessionWAL.open(this.config.dataDir).replay({ repair: false });
+    if (action === "list")
+      return replay.entries.slice(-100).map(({ seq, at, op }) => ({ seq, at, operation: op.op }));
+    return {
+      entries: replay.entries.length,
+      torn: replay.torn,
+      repaired: false,
+      liveClaims: [...replay.liveClaims().entries()].map(([runId, claim]) => ({ runId, worker: claim.worker, fencing: claim.fencing, expiresAt: new Date(claim.expiresAtMs).toISOString() }))
+    };
+  }
+  machines(action) {
+    const local = { name: hostname(), role: "server", version: this.version };
+    if (action === "list")
+      return [local];
+    return { ...local, health: this.health(), sessions: this.sessions("pull") };
+  }
+  daemonStatus() {
+    const replay = SessionWAL.open(this.config.dataDir).replay({ repair: false });
+    return { activeClaims: replay.liveClaims().size, mode: "bounded-trigger", continuousDaemon: false };
+  }
+  listMemos() {
+    return this.withStore(async (store) => (await store.memoList()).slice(0, 100));
+  }
+  async triggerRun(graph, context = {}, opts = {}) {
+    const store = await this.openEngineStore();
+    const wal = SessionWAL.open(this.config.dataDir);
+    try {
+      if (context === null || typeof context !== "object" || Array.isArray(context))
+        throw new WorkflowRequestError("invalid_context", "context must be an object");
+      if (Object.hasOwn(context, "__wf") || Object.hasOwn(context, "steps"))
+        throw new WorkflowRequestError("reserved_context", "context.__wf and context.steps are reserved for the workflow engine");
+      const maxCycles = opts.maxCycles ?? 500;
+      if (!Number.isSafeInteger(maxCycles) || maxCycles < 1 || maxCycles > 2000)
+        throw new WorkflowRequestError("invalid_max_cycles", "maxCycles must be an integer from 1 to 2000");
+      if (opts.idempotencyKey !== undefined && !/^[A-Za-z0-9_.:-]{1,128}$/.test(opts.idempotencyKey))
+        throw new WorkflowRequestError("invalid_idempotency_key", "idempotencyKey must contain 1 to 128 ASCII letters, digits, or _.:-");
+      const requestHash = createHash3("sha256").update(canonicalJson({ graph, context, maxCycles })).digest("hex");
+      const reuse = async () => {
+        const existing2 = opts.idempotencyKey ? await store.getRunByIdempotencyKey(opts.idempotencyKey) : undefined;
+        if (!existing2)
+          return;
+        if (JSON.parse(existing2.contextJson).__wf?.requestHash !== requestHash)
+          throw new WorkflowRequestError("idempotency_conflict", "idempotencyKey is already bound to a different request", 409);
+        return runSummary(existing2, true);
+      };
+      const existing = await reuse();
+      if (existing)
+        return existing;
+      const contextWithKey = { ...context, __wf: { requestHash, ...opts.idempotencyKey ? { idempotencyKey: opts.idempotencyKey } : {} } };
+      let final;
+      try {
+        final = await runGraphToCompletion(store, wal, graph, contextWithKey, { ...this.execution, maxCycles });
+      } catch (err) {
+        if (err instanceof Error && (/UNIQUE constraint failed/.test(err.message) || err.code === "23505")) {
+          const winner = await reuse();
+          if (winner)
+            return winner;
         }
+        throw err;
       }
+      return {
+        runId: final.id,
+        status: final.status,
+        error: final.error ?? null,
+        result: final.resultJson ? JSON.parse(final.resultJson) : null,
+        reused: false
+      };
+    } finally {
+      await store.close();
+    }
+  }
+}
+function createWorkflowsService(config = {}, execution = {}) {
+  return new WorkflowsService(config, execution);
+}
+
+class WorkflowRequestError extends Error {
+  code;
+  status;
+  constructor(code, message, status = 400) {
+    super(message);
+    this.code = code;
+    this.status = status;
+    this.name = "WorkflowRequestError";
+  }
+}
+function canonicalJson(value) {
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object")
+    return `{${Object.keys(value).sort().filter((k) => value[k] !== undefined).map((k) => `${JSON.stringify(k)}:${canonicalJson(value[k])}`).join(",")}}`;
+  return JSON.stringify(value) ?? "null";
+}
+function runSummary(run2, reused) {
+  return { runId: run2.id, status: run2.status, error: run2.error ?? null, result: run2.resultJson ? JSON.parse(run2.resultJson) : null, reused };
+}
+
+// src/handlers.ts
+import { createHash as createHash4, timingSafeEqual } from "crypto";
+
+// src/openapi.ts
+function buildOpenApi(version) {
+  const string = { type: "string" }, integer = { type: "integer" }, nullableString = { type: "string", nullable: true };
+  const ref = (name) => ({ $ref: `#/components/schemas/${name}` });
+  const object = (properties, required = Object.keys(properties)) => ({ type: "object", properties, required });
+  const response = (schema, description = "Success") => ({ description, content: { "application/json": { schema } } });
+  const id = [{ name: "id", in: "path", required: true, schema: { type: "string", pattern: "^[a-zA-Z0-9_-]{1,128}$" } }];
+  const body = (schema) => ({ required: true, description: "JSON object, at most 1 MiB", content: { "application/json": { schema } } });
+  const statuses = ["pending", "running", "completed", "failed", "interrupted", "cancelled"];
+  const operation = (operationId, summary, schema, extra = {}, publicRoute = false) => ({
+    operationId,
+    summary,
+    ...publicRoute ? {} : { security: [{ bearerAuth: [] }] },
+    ...extra,
+    responses: { "200": response(schema), ...publicRoute ? {} : {
+      "400": response(ref("ApiError"), "Invalid field or request shape"),
+      "401": response(ref("ApiError"), "Bearer credential missing or refused"),
+      "404": response(ref("ApiError"), "Run or route absent"),
+      "409": response(ref("ApiError"), "Conflicting key, run state or execution ownership"),
+      "503": response(ref("ApiError"), "Authentication or PostgreSQL storage unavailable")
+    } }
+  });
+  const doc = {
+    openapi: "3.0.3",
+    info: { title: "workflows", version },
+    servers: [{ url: "./" }],
+    paths: {
+      "/health": { get: operation("getHealth", "Service health", ref("HealthReport"), {}, true) },
+      "/ready": { get: { ...operation("getReadiness", "Authentication and actual schema readiness", ref("ReadinessReport"), {}, true), responses: { "200": response(ref("ReadinessReport")), "503": response(ref("ReadinessReport"), "Not ready") } } },
+      "/version": { get: operation("getVersion", "Package version", object({ service: string, version: string }), {}, true) },
+      "/validate": { post: operation("validateWorkflow", "Validate a workflow graph", ref("GraphValidation"), { requestBody: body(object({ graph: ref("WorkflowGraph") })) }) },
+      "/trigger": { post: operation("triggerWorkflow", "Execute a bounded workflow; identical keyed retries reuse the original run", ref("RunSummary"), { requestBody: body(object({ graph: ref("WorkflowGraph"), context: { type: "object", description: "__wf and steps are reserved", additionalProperties: true }, idempotencyKey: { type: "string", pattern: "^[A-Za-z0-9_.:-]{1,128}$" }, maxCycles: { type: "integer", minimum: 1, maximum: 2000, default: 500 } }, ["graph"])) }) },
+      "/runs": { get: operation("listRunRecords", "List recent runs", { type: "array", items: ref("RunRow") }, { parameters: [{ name: "status", in: "query", schema: { type: "string", enum: statuses } }, { name: "limit", in: "query", schema: { type: "integer", minimum: 1, maximum: 1000, default: 100 } }] }) },
+      "/runs/{id}": { get: operation("getRunRecord", "Read a durable run", ref("RunRow"), { parameters: id }) },
+      "/runs/{id}/nodes": { get: operation("getRunNodes", "Ordered node execution history", { type: "array", items: ref("RunNodeRow") }, { parameters: id }) },
+      "/runs/{id}/events": { get: operation("getRunEvents", "Preserved execution journal events", { type: "array", items: { type: "object" } }, { parameters: id }) },
+      "/runs/{id}/cancel": { post: operation("cancelWorkflow", "Cancel a pending, running or interrupted run and fence late results", ref("RunRow"), { parameters: id }) },
+      "/runs/{id}/resume": { post: operation("resumeWorkflow", "Continue a failed, cancelled or interrupted run using its pinned graph; active or unconfirmed execution refuses resume", ref("RunSummary"), { parameters: id }) },
+      "/lanes": { get: operation("listLanes", "Inspect lane substrates; this does not prove sign-in or model capacity", { type: "array", items: { type: "object" } }) },
+      "/lanes/{lane}": { get: operation("probeLane", "Inspect one lane substrate", { type: "object" }, { parameters: [{ name: "lane", in: "path", required: true, schema: { type: "string", enum: ["claude", "codex", "cursor", "grok"] } }] }) },
+      "/sessions/list": { get: operation("listSessionEvents", "Recent journal event metadata", { type: "array", items: { type: "object" } }) },
+      "/sessions/pull": { get: operation("inspectSession", "Read journal and claim state without repair", { type: "object" }) },
+      "/machines/list": { get: operation("listServerMachines", "This executor, not a fleet census", { type: "array", items: { type: "object" } }) },
+      "/machines/status": { get: operation("inspectServerMachine", "This executor's health and claims", { type: "object" }) },
+      "/daemon/status": { get: operation("inspectDaemon", "Bounded-trigger executor status", { type: "object" }) },
+      "/memos/list": { get: operation("listMemoRecords", "Recent memo results", { type: "array", items: { type: "object" } }) }
     },
     components: {
-      securitySchemes: {
-        bearerAuth: { type: "http", scheme: "bearer" }
+      securitySchemes: { bearerAuth: { type: "http", scheme: "bearer" } },
+      schemas: {
+        ApiError: object({ error: string, message: string }, ["error"]),
+        HealthReport: object({ ok: { type: "boolean" }, status: { type: "string", enum: ["ok"] }, backend: { type: "string", enum: ["postgresql", "sqlite"] }, service: string, version: string, pid: integer, uptimeMs: integer }),
+        ReadinessReport: object({ ok: { type: "boolean" }, service: string, version: string, checks: { type: "object", additionalProperties: string } }),
+        GraphValidation: object({ ok: { type: "boolean" }, issues: { type: "array", items: object({ path: string, message: string }) } }),
+        StartNode: object({ id: string, type: { type: "string", enum: ["start"] }, next: string }, ["id", "type"]),
+        StepNode: object({ id: string, type: { type: "string", enum: ["step"] }, next: string, lane: { type: "string", enum: ["claude", "codex", "cursor", "grok"] }, prompt: string, command: string, cwd: { type: "string", minLength: 1 }, codexMode: { type: "string", enum: ["repository", "read-only"], default: "repository", description: "Codex prompt steps only. Read-only permits nonrepository execution with a read-only sandbox and no approvals. Repository retains native trust, sandbox and approval defaults." }, maxRetries: { type: "integer", minimum: 0 }, memo: { type: "boolean" }, timeoutMs: { type: "integer", minimum: 1 } }, ["id", "type"]),
+        DecisionNode: object({ id: string, type: { type: "string", enum: ["decision"] }, condition: string, then: string, else: string }, ["id", "type", "condition"]),
+        WhileNode: object({ id: string, type: { type: "string", enum: ["while"] }, condition: string, body: { type: "array", items: string }, maxIterations: { type: "integer", minimum: 1 }, next: string }, ["id", "type", "condition", "body", "maxIterations"]),
+        EndNode: object({ id: string, type: { type: "string", enum: ["end"] } }),
+        GraphNode: { oneOf: ["StartNode", "StepNode", "DecisionNode", "WhileNode", "EndNode"].map(ref) },
+        WorkflowGraph: object({ name: string, version: string, nodes: { type: "array", items: ref("GraphNode") }, memoWatch: { type: "array", items: string } }, ["name", "version", "nodes"]),
+        RunSummary: object({ runId: string, status: { type: "string", enum: statuses }, error: nullableString, result: {}, reused: { type: "boolean" } }),
+        RunRow: object({ id: string, graphName: string, graphVersion: string, status: { type: "string", enum: statuses }, attempts: integer, contextJson: string, resultJson: nullableString, error: nullableString, startedAt: nullableString, finishedAt: nullableString, createdAt: string, updatedAt: string }),
+        RunNodeRow: object({ id: string, runId: string, nodeId: string, status: { type: "string", enum: ["pending", "running", "completed", "failed", "skipped"] }, attempts: integer, lane: nullableString, exitCode: { type: "integer", nullable: true }, outputJson: nullableString, error: nullableString, startedAt: nullableString, finishedAt: nullableString })
       }
     }
   };
+  return doc;
+}
+
+// src/handlers.ts
+init_graph();
+init_lanes();
+function jsonResponse(body, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" }
+  });
+}
+function openApiDoc(service) {
+  return buildOpenApi(service.version);
+}
+function authenticate(service, req) {
+  if (!service.config.apiKey)
+    return jsonResponse({ error: "auth_not_configured" }, 503);
+  if (!bearerMatches(req.headers.get("authorization") ?? "", service.config.apiKey)) {
+    return jsonResponse({ error: "unauthorized", message: "a valid Bearer token is required" }, 401);
+  }
+}
+async function readObject(req) {
+  const limit = 1048576;
+  const reader = req.body?.getReader();
+  if (!reader)
+    throw new Error("invalid_json");
+  const chunks = [];
+  let size = 0;
+  try {
+    for (;; ) {
+      const { value, done } = await reader.read();
+      if (done)
+        break;
+      size += value.byteLength;
+      if (size > limit) {
+        await reader.cancel();
+        throw new Error("body_too_large");
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const body = JSON.parse(await new Blob(chunks).text());
+  if (body === null || typeof body !== "object" || Array.isArray(body))
+    throw new Error("invalid_body");
+  return body;
 }
 function bearerMatches(authHeader, expected) {
   if (!authHeader.startsWith("Bearer "))
@@ -73,8 +3268,8 @@ function bearerMatches(authHeader, expected) {
   const supplied = authHeader.slice("Bearer ".length);
   if (supplied.length === 0)
     return false;
-  const a = createHash("sha256").update(supplied).digest();
-  const b = createHash("sha256").update(expected).digest();
+  const a = createHash4("sha256").update(supplied).digest();
+  const b = createHash4("sha256").update(expected).digest();
   return timingSafeEqual(a, b);
 }
 async function handleTrigger(service, req) {
@@ -86,50 +3281,139 @@ async function handleTrigger(service, req) {
   if (!bearerMatches(auth, expected)) {
     return jsonResponse({ error: "unauthorized", message: "a valid Bearer token is required" }, 401);
   }
-  let body;
+  let record;
   try {
-    body = await req.json();
+    record = await readObject(req);
   } catch {
-    return jsonResponse({ error: "invalid_json", message: "request body must be JSON" }, 400);
+    return jsonResponse({ error: "invalid_json", message: "request body must be a JSON object within 1 MiB" }, 400);
   }
-  const record = body;
   if (record.graph === null || typeof record.graph !== "object" || Array.isArray(record.graph)) {
     return jsonResponse({ error: "graph_required", message: "body.graph must be a workflow graph object" }, 400);
   }
   const context = record.context ?? {};
-  if (typeof context !== "object" || Array.isArray(context)) {
+  if (context === null || typeof context !== "object" || Array.isArray(context)) {
     return jsonResponse({ error: "invalid_context", message: "body.context must be an object" }, 400);
   }
+  if (record.maxCycles !== undefined && (typeof record.maxCycles !== "number" || !Number.isSafeInteger(record.maxCycles) || record.maxCycles < 1 || record.maxCycles > 2000)) {
+    return jsonResponse({ error: "invalid_max_cycles", message: "maxCycles must be an integer from 1 to 2000" }, 400);
+  }
+  if (record.idempotencyKey !== undefined && (typeof record.idempotencyKey !== "string" || !/^[A-Za-z0-9_.:-]{1,128}$/.test(record.idempotencyKey))) {
+    return jsonResponse({ error: "invalid_idempotency_key", message: "idempotencyKey must contain 1 to 128 ASCII letters, digits, or _.:-" }, 400);
+  }
+  const validation = validateGraph(record.graph);
+  if (!validation.ok)
+    return jsonResponse({ error: "invalid_graph", issues: validation.issues }, 400);
   const maxCycles = typeof record.maxCycles === "number" ? record.maxCycles : undefined;
   const idempotencyKey = typeof record.idempotencyKey === "string" ? record.idempotencyKey : undefined;
   try {
     const summary = await service.triggerRun(record.graph, context, { maxCycles, idempotencyKey });
     return jsonResponse(summary);
   } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return jsonResponse({ error: "trigger_failed", message }, 400);
+    if (err instanceof WorkflowStorageError)
+      return jsonResponse({ error: "storage_unavailable", message: err.message }, 503);
+    if (err instanceof WorkflowRequestError)
+      return jsonResponse({ error: err.code, message: err.message }, err.status);
+    return jsonResponse({ error: "trigger_failed", message: "workflow execution was refused" }, 400);
   }
 }
 function createRequestHandler(service) {
-  return (req) => {
+  return async (req) => {
     const url = new URL(req.url);
-    switch (url.pathname) {
+    if (service.config.originAuth !== undefined && !["/health", "/ready"].includes(url.pathname)) {
+      if (!bearerMatches(`Bearer ${req.headers.get("x-hasna-origin-auth") ?? ""}`, service.config.originAuth)) {
+        return jsonResponse({ error: "WORKFLOWS_ORIGIN_DENIED" }, 403);
+      }
+    }
+    const path = url.pathname.replace(/^\/v1(?=\/|$)/, "") || "/";
+    const method = req.method;
+    const allowed = path === "/trigger" || path === "/validate" || /^\/runs\/[^/]+\/(cancel|resume)$/.test(path) ? "POST" : "GET";
+    if (method !== allowed)
+      return new Response(JSON.stringify({ error: "method_not_allowed" }), { status: 405, headers: { "content-type": "application/json", allow: allowed } });
+    switch (path) {
       case "/health":
         return jsonResponse(service.health());
-      case "/ready":
-        return jsonResponse(service.ready());
+      case "/ready": {
+        const ready = await service.ready();
+        return jsonResponse(ready, ready.ok ? 200 : 503);
+      }
       case "/version":
         return jsonResponse({ service: service.name, version: service.version });
       case "/trigger":
         return handleTrigger(service, req);
       case "/openapi.json":
         return jsonResponse(openApiDoc(service));
-      default:
-        return jsonResponse({ error: "not_found", path: url.pathname }, 404);
+    }
+    if (path !== "/validate" && path !== "/runs" && path !== "/lanes" && !/^\/lanes\/[^/]+$/.test(path) && !/^\/runs\/[^/]+(?:\/(nodes|events|cancel|resume))?$/.test(path) && !/^\/(sessions|machines|daemon|memos)\/(list|pull|status)$/.test(path)) {
+      return jsonResponse({ error: "not_found" }, 404);
+    }
+    const refused = authenticate(service, req);
+    if (refused)
+      return refused;
+    try {
+      if (path === "/validate") {
+        const body = await readObject(req);
+        return jsonResponse(validateGraph(body.graph));
+      }
+      if (path === "/runs") {
+        const limit = Number(url.searchParams.get("limit") ?? 100);
+        const status = url.searchParams.get("status") ?? undefined;
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000 || status !== undefined && !RUN_STATUSES.includes(status))
+          return jsonResponse({ error: "invalid_query" }, 400);
+        return jsonResponse(await service.listRuns({ limit, status }));
+      }
+      if (path === "/lanes")
+        return jsonResponse(await laneInventory());
+      if (path.startsWith("/lanes/")) {
+        const lane = path.slice("/lanes/".length);
+        if (!LANE_KINDS2.includes(lane))
+          return jsonResponse({ error: "invalid_lane" }, 400);
+        return jsonResponse(await probeLane(lane));
+      }
+      if (path === "/sessions/list")
+        return jsonResponse(service.sessions("list"));
+      if (path === "/sessions/pull")
+        return jsonResponse(service.sessions("pull"));
+      if (path === "/machines/list")
+        return jsonResponse(service.machines("list"));
+      if (path === "/machines/status")
+        return jsonResponse(service.machines("status"));
+      if (path === "/daemon/status")
+        return jsonResponse(service.daemonStatus());
+      if (path === "/memos/list")
+        return jsonResponse(await service.listMemos());
+      const match = /^\/runs\/([^/]+)(?:\/(nodes|events|cancel|resume))?$/.exec(path);
+      if (match) {
+        const id = decodeURIComponent(match[1]);
+        if (!/^[a-zA-Z0-9_-]{1,128}$/.test(id))
+          return jsonResponse({ error: "invalid_run_id" }, 400);
+        const run2 = await service.getRun(id);
+        if (!run2)
+          return jsonResponse({ error: "run_not_found" }, 404);
+        switch (match[2]) {
+          case "nodes":
+            return jsonResponse(await service.listNodes(id));
+          case "events":
+            return jsonResponse(service.events(id));
+          case "cancel":
+            return jsonResponse(await service.cancelRun(id));
+          case "resume":
+            return jsonResponse(await service.resumeRun(id));
+          default:
+            return jsonResponse(run2);
+        }
+      }
+      return jsonResponse({ error: "not_found" }, 404);
+    } catch (err) {
+      if (err instanceof WorkflowStorageError)
+        return jsonResponse({ error: "storage_unavailable", message: err.message }, 503);
+      if (err instanceof WorkflowRequestError)
+        return jsonResponse({ error: err.code, message: err.message }, err.status);
+      return jsonResponse({ error: "invalid_request", message: "request was refused" }, 400);
     }
   };
 }
 export {
+  openApiDoc,
   jsonResponse,
   createRequestHandler
 };