@hasna/workflows 0.1.4 → 0.2.1

package/dist/index.js

@@ -16,1069 +16,1196 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
-// src/lanes/types.ts
-import { statSync as statSync2 } from "fs";
-function binaryOnPath(binary) {
-  const pathEntries = (process.env.PATH ?? "").split(":").filter(Boolean);
-  for (const entry of pathEntries) {
-    try {
-      const stat = statSync2(`${entry}/${binary}`);
-      if (stat.isFile())
-        return true;
-    } catch {}
-  }
-  return false;
-}
-function withTimeout(promise, timeoutMs, what) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => {
-      reject(new Error(`${what} exceeded the ${timeoutMs}ms budget`));
-    }, timeoutMs);
-    promise.then((value) => {
-      clearTimeout(timer);
-      resolve(value);
-    }, (err) => {
-      clearTimeout(timer);
-      reject(err);
-    });
-  });
-}
-function spawnCli(cmd, opts) {
-  const started = Date.now();
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-  let proc;
-  try {
-    proc = Bun.spawnSync({
-      cmd,
-      cwd: opts.cwd,
-      env: { ...process.env, ...opts.env ?? {} },
-      stdout: "pipe",
-      stderr: "pipe",
-      timeout: timeoutMs
-    });
-  } catch (err) {
-    const message = String(err instanceof Error ? err.message : err);
-    if (message.includes("ENOENT") || /not found/i.test(message)) {
-      throw new LaneDependencyMissingError(`lane binary ${JSON.stringify(opts.binaryName)} not found on PATH; install it or provide ${opts.packageHint}`);
+// src/expr.ts
+function tokenize(input) {
+  const tokens = [];
+  let i = 0;
+  while (i < input.length) {
+    const ch = input[i];
+    if (ch === " " || ch === "\t" || ch === `
+` || ch === "\r") {
+      i++;
+      continue;
     }
-    return { ok: false, exitCode: 1, output: "", durationMs: Date.now() - started, error: message };
-  }
-  const durationMs = Date.now() - started;
-  const stdout = proc.stdout ? new TextDecoder().decode(proc.stdout) : "";
-  const stderr = proc.stderr ? new TextDecoder().decode(proc.stderr) : "";
-  const output = stderr ? `${stdout}
-${stderr}`.trim() : stdout.trim();
-  const exitCode = proc.exitCode ?? 1;
-  return { ok: exitCode === 0, exitCode, output, durationMs };
-}
-var LANE_KINDS2, LaneDependencyMissingError, LaneAdapterShapeError, DEFAULT_LANE_TIMEOUT_MS = 120000;
-var init_types = __esm(() => {
-  LANE_KINDS2 = ["claude", "codex", "cursor", "grok"];
-  LaneDependencyMissingError = class LaneDependencyMissingError extends Error {
-    constructor(message) {
-      super(message);
-      this.name = "LaneDependencyMissingError";
+    if (ch === "(") {
+      tokens.push({ kind: "lparen", value: "(" });
+      i++;
+      continue;
     }
-  };
-  LaneAdapterShapeError = class LaneAdapterShapeError extends Error {
-    constructor(message) {
-      super(message);
-      this.name = "LaneAdapterShapeError";
+    if (ch === ")") {
+      tokens.push({ kind: "rparen", value: ")" });
+      i++;
+      continue;
     }
-  };
-});
-
-// src/lanes/claude.ts
-function createClaudeAdapter(deps = {}) {
-  return {
-    kind: "claude",
-    async probe() {
-      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
-      try {
-        await loader();
-        return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "sdk" };
-      } catch {
-        if (binaryOnPath(deps.cliPath ?? "claude")) {
-          return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "cli" };
+    if (ch === '"' || ch === "'") {
+      const quote = ch;
+      let j = i + 1;
+      let out = "";
+      let closed = false;
+      while (j < input.length) {
+        if (input[j] === quote) {
+          closed = true;
+          break;
         }
-        return {
-          kind: "claude",
-          sdk: "@anthropic-ai/claude-agent-sdk",
-          wired: false,
-          reason: "neither @anthropic-ai/claude-agent-sdk nor the claude CLI is available on this machine"
-        };
-      }
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "claude lane requires a prompt" };
-      }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
-      let sdk;
-      try {
-        sdk = await loader();
-      } catch (err) {
-        return runClaudeCli(job, deps.cliPath ?? "claude", started, timeoutMs);
-      }
-      const query = sdk.query;
-      if (typeof query !== "function") {
-        throw new LaneAdapterShapeError("@anthropic-ai/claude-agent-sdk exports no query() function");
-      }
-      const prompt = job.prompt;
-      try {
-        const { output, isError } = await withTimeout((async () => {
-          const generator = await query({
-            prompt,
-            options: { model: job.model, maxTurns: 32, abortSignal: undefined }
-          });
-          let output2 = "";
-          let isError2 = false;
-          for await (const message of generator) {
-            if (message.type === "assistant") {
-              const content = message.message?.content;
-              if (Array.isArray(content)) {
-                for (const block of content) {
-                  if (block && typeof block === "object" && "text" in block && typeof block.text === "string") {
-                    output2 += block.text;
-                  }
-                }
-              }
-            }
-            if (message.type === "error")
-              isError2 = true;
-          }
-          return { output: output2, isError: isError2 };
-        })(), timeoutMs, `claude lane (${job.prompt.slice(0, 60)})`);
-        const durationMs = Date.now() - started;
-        return { ok: !isError, exitCode: isError ? 1 : 0, output: output.trim(), durationMs };
-      } catch (err) {
-        const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
+        out += input[j];
+        j++;
       }
+      if (!closed)
+        throw new ExprSyntaxError(`unterminated string literal at offset ${i}`);
+      tokens.push({ kind: "string", value: out });
+      i = j + 1;
+      continue;
     }
-  };
-}
-function runClaudeCli(job, cliPath, started, timeoutMs) {
-  try {
-    const result = spawnCli([cliPath, "-p", job.prompt], {
-      binaryName: cliPath,
-      packageHint: "@anthropic-ai/claude-agent-sdk or the claude CLI",
-      timeoutMs,
-      env: job.env,
-      cwd: job.cwd
-    });
-    return { ...result, durationMs: Date.now() - started };
-  } catch (err) {
-    if (err instanceof LaneDependencyMissingError) {
-      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    const two = input.slice(i, i + 2);
+    if (COMPARISON_OPS.has(two)) {
+      tokens.push({ kind: "op", value: two });
+      i += 2;
+      continue;
     }
-    throw err;
-  }
-}
-var init_claude = __esm(() => {
-  init_types();
-});
-
-// src/lanes/codex.ts
-function createCodexAdapter(deps = {}) {
-  return {
-    kind: "codex",
-    async probe() {
-      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
-      try {
-        await loader();
-        return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "sdk" };
-      } catch {
-        if (binaryOnPath(deps.cliPath ?? "codex")) {
-          return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "cli" };
-        }
-        return {
-          kind: "codex",
-          sdk: "@openai/codex-sdk",
-          wired: false,
-          reason: "neither @openai/codex-sdk nor the codex CLI is available on this machine"
-        };
-      }
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codex lane requires a prompt" };
-      }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
-      let sdk;
-      try {
-        sdk = await loader();
-      } catch {
-        return runCodexCli(job, deps.cliPath ?? "codex", started, timeoutMs);
-      }
-      const CodexClass = sdk.Codex;
-      if (typeof CodexClass !== "function") {
-        throw new LaneAdapterShapeError("@openai/codex-sdk exports no Codex class");
-      }
-      try {
-        const client = await withTimeout(Promise.resolve(new CodexClass({
-          config: { model: job.model },
-          env: job.env
-        })), timeoutMs, `codex lane (${job.prompt.slice(0, 60)})`);
-        const thread = client.startThread?.();
-        if (!thread || typeof thread.run !== "function") {
-          throw new LaneAdapterShapeError("@openai/codex-sdk Codex.startThread() returned no run()");
-        }
-        const turn = await withTimeout(thread.run(job.prompt), timeoutMs, `codex lane (${job.prompt.slice(0, 60)})`);
-        const output = turn?.finalResponse ?? "";
-        const durationMs = Date.now() - started;
-        return { ok: true, exitCode: 0, output, durationMs };
-      } catch (err) {
-        const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
-      }
+    if (ch === "<" || ch === ">" || ch === "=" || ch === "!") {
+      tokens.push({ kind: "op", value: ch });
+      i++;
+      continue;
     }
-  };
-}
-function runCodexCli(job, cliPath, started, timeoutMs) {
-  try {
-    const result = spawnCli([cliPath, "exec", "--", job.prompt], {
-      binaryName: cliPath,
-      packageHint: "@openai/codex-sdk or the codex CLI",
-      timeoutMs,
-      env: job.env,
-      cwd: job.cwd
-    });
-    return { ...result, durationMs: Date.now() - started };
-  } catch (err) {
-    if (err instanceof LaneDependencyMissingError) {
-      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    if (/[0-9]/.test(ch)) {
+      let j = i;
+      while (j < input.length && /[0-9.]/.test(input[j]))
+        j++;
+      tokens.push({ kind: "number", value: input.slice(i, j) });
+      i = j;
+      continue;
     }
-    throw err;
-  }
-}
-var init_codex = __esm(() => {
-  init_types();
-});
-
-// src/lanes/cursor.ts
-function createCursorAdapter(deps = {}) {
-  return {
-    kind: "cursor",
-    async probe() {
-      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
-      try {
-        await loader();
-        return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "sdk (local mode)" };
-      } catch {
-        if (binaryOnPath(deps.cliPath ?? "cursor-agent")) {
-          return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "cli" };
-        }
-        return {
-          kind: "cursor",
-          sdk: "@cursor/sdk",
-          wired: false,
-          reason: "neither @cursor/sdk nor the cursor-agent CLI is available on this machine"
-        };
-      }
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "cursor lane requires a prompt" };
-      }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
-      let sdk;
-      try {
-        sdk = await loader();
-      } catch {
-        return runCursorCli(job, deps.cliPath ?? "cursor-agent", started, timeoutMs);
-      }
-      try {
-        const run = await withTimeout(runLocalAgent(sdk, job), timeoutMs, `cursor lane (${job.prompt.slice(0, 60)})`);
-        const durationMs = Date.now() - started;
-        const status = run.status;
-        const ok = status === "finished";
-        return { ok, exitCode: ok ? 0 : 1, output: run.result, durationMs };
-      } catch (err) {
-        if (err instanceof LaneAdapterShapeError)
-          throw err;
-        const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
-      }
+    if (/[A-Za-z_]/.test(ch)) {
+      let j = i;
+      while (j < input.length && /[A-Za-z0-9_.]/.test(input[j]))
+        j++;
+      tokens.push({ kind: "ident", value: input.slice(i, j) });
+      i = j;
+      continue;
     }
-  };
+    throw new ExprSyntaxError(`unexpected character ${JSON.stringify(ch)} at offset ${i}`);
+  }
+  return tokens;
 }
-async function runLocalAgent(sdk, job) {
-  const AgentClass = sdk.Agent;
-  const CursorClass = sdk.Cursor;
-  if (typeof AgentClass !== "function" && typeof CursorClass !== "function") {
-    throw new LaneAdapterShapeError("@cursor/sdk exports no Agent/Cursor class");
+
+class Parser {
+  tokens;
+  pos = 0;
+  constructor(tokens) {
+    this.tokens = tokens;
   }
-  const agent = typeof AgentClass === "function" ? new AgentClass : undefined;
-  if (!agent || typeof agent.send !== "function") {
-    throw new LaneAdapterShapeError("@cursor/sdk Agent has no send()");
+  peek() {
+    return this.tokens[this.pos];
   }
-  const run = await agent.send(job.prompt, { model: job.model });
-  if (!run || typeof run !== "object") {
-    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned no Run");
+  next() {
+    return this.tokens[this.pos++];
   }
-  const candidate = run;
-  if (typeof candidate.status !== "string" || !["finished", "error", "cancelled"].includes(candidate.status)) {
-    throw new LaneAdapterShapeError(`@cursor/sdk Agent.send() returned a Run without a terminal status (got ${JSON.stringify(candidate.status)}; expected finished|error|cancelled)`);
+  expectOp(value) {
+    const t = this.next();
+    if (!t || t.kind !== "op" || t.value !== value) {
+      throw new ExprSyntaxError(`expected ${JSON.stringify(value)}`);
+    }
   }
-  if (typeof candidate.result !== "string") {
-    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned a Run without a string result");
+  parse() {
+    if (this.tokens.length === 0)
+      throw new ExprSyntaxError("empty expression");
+    const node = this.parseOr();
+    if (this.pos < this.tokens.length) {
+      throw new ExprSyntaxError(`unexpected trailing token ${JSON.stringify(this.peek().value)}`);
+    }
+    return node;
   }
-  return { status: candidate.status, result: candidate.result };
-}
-function runCursorCli(job, cliPath, started, timeoutMs) {
-  try {
-    const result = spawnCli([cliPath, "run", job.prompt], {
-      binaryName: cliPath,
-      packageHint: "@cursor/sdk (local mode) or the cursor-agent CLI",
-      timeoutMs,
-      env: job.env,
-      cwd: job.cwd
-    });
-    return { ...result, durationMs: Date.now() - started };
-  } catch (err) {
-    if (err instanceof LaneDependencyMissingError) {
-      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+  parseOr() {
+    let left = this.parseAnd();
+    while (this.peek()?.kind === "ident" && this.peek().value === "or") {
+      this.next();
+      const right = this.parseAnd();
+      left = { kind: "or", left, right };
     }
-    throw err;
+    return left;
   }
-}
-var init_cursor = __esm(() => {
-  init_types();
-});
-
-// src/lanes/grok.ts
-function createGrokAdapter(deps = {}) {
-  return {
-    kind: "grok",
-    async probe() {
-      const cliPath = deps.cliPath ?? "grok";
-      if (binaryOnPath(cliPath)) {
-        return { kind: "grok", sdk: "no npm SDK (measured 2026-08-25)", wired: true, via: "cli" };
-      }
-      return {
-        kind: "grok",
-        sdk: "no npm SDK (measured 2026-08-25)",
-        wired: false,
-        reason: `no xAI Grok SDK exists on npm (measured 2026-08-25) and the grok CLI is not on PATH`
-      };
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "grok lane requires a prompt" };
-      }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const cliPath = deps.cliPath ?? "grok";
-      try {
-        const result = spawnCli([cliPath, job.prompt], {
-          binaryName: cliPath,
-          packageHint: "the grok CLI (no xAI Grok SDK exists on npm \u2014 measured 2026-08-25)",
-          timeoutMs,
-          env: job.env,
-          cwd: job.cwd
-        });
-        return { ...result, durationMs: Date.now() - started };
-      } catch (err) {
-        if (err instanceof LaneDependencyMissingError) {
-          return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
-        }
-        throw err;
-      }
+  parseAnd() {
+    let left = this.parseNot();
+    while (this.peek()?.kind === "ident" && this.peek().value === "and") {
+      this.next();
+      const right = this.parseNot();
+      left = { kind: "and", left, right };
     }
-  };
-}
-var init_grok = __esm(() => {
-  init_types();
-});
-
-// src/lanes/index.ts
-var exports_lanes = {};
-__export(exports_lanes, {
-  runLaneJob: () => runLaneJob,
-  resolveLane: () => resolveLane,
-  probeLane: () => probeLane,
-  laneInventory: () => laneInventory,
-  createGrokAdapter: () => createGrokAdapter,
-  createCursorAdapter: () => createCursorAdapter,
-  createCodexAdapter: () => createCodexAdapter,
-  createClaudeAdapter: () => createClaudeAdapter,
-  binaryOnPath: () => binaryOnPath,
-  LaneDependencyMissingError: () => LaneDependencyMissingError,
-  LaneAdapterShapeError: () => LaneAdapterShapeError,
-  LANE_KINDS: () => LANE_KINDS2
-});
-function resolveLane(kind) {
-  const adapter = adapters.get(kind);
-  if (!adapter)
-    throw new Error(`unknown lane ${kind} (expected one of ${LANE_KINDS2.join(", ")})`);
-  return adapter;
-}
-async function runLaneJob(job) {
-  return resolveLane(job.lane).run(job);
-}
-async function probeLane(kind) {
-  return resolveLane(kind).probe();
-}
-async function laneInventory() {
-  return Promise.all(LANE_KINDS2.map((kind) => probeLane(kind)));
-}
-var adapters;
-var init_lanes = __esm(() => {
-  init_claude();
-  init_codex();
-  init_cursor();
-  init_grok();
-  init_types();
-  init_types();
-  init_claude();
-  init_codex();
-  init_cursor();
-  init_grok();
-  adapters = new Map([
-    ["claude", createClaudeAdapter()],
-    ["codex", createCodexAdapter()],
-    ["cursor", createCursorAdapter()],
-    ["grok", createGrokAdapter()]
-  ]);
-});
-// package.json
-var package_default = {
-  name: "@hasna/workflows",
-  version: "0.1.4",
-  description: "Universal graph workflow app \u2014 graph language (start/step/decision/while/end), three-table store, session WAL, daemon with claims/leases, four lane adapters (claude/codex/cursor/grok), and a full CLI on four surfaces",
-  type: "module",
-  main: "./dist/index.js",
-  types: "./types/index.d.ts",
-  bin: {
-    workflows: "dist/cli/index.js",
-    "workflows-mcp": "dist/mcp/index.js",
-    "workflows-serve": "dist/serve/index.js"
-  },
-  exports: {
-    ".": {
-      types: "./types/index.d.ts",
-      import: "./dist/index.js"
-    },
-    "./sdk": {
-      types: "./types/index.d.ts",
-      import: "./dist/index.js"
-    },
-    "./cli": {
-      types: "./types/cli/index.d.ts",
-      import: "./dist/cli/index.js"
+    return left;
+  }
+  parseNot() {
+    if (this.peek()?.kind === "ident" && this.peek().value === "not") {
+      this.next();
+      return { kind: "not", operand: this.parseNot() };
     }
-  },
-  files: [
-    "dist",
-    "types",
-    "README.md",
-    "LICENSE",
-    "hasna.contract.json"
-  ],
-  scripts: {
-    build: "bun run build:runtime && bun run build:types",
-    "build:runtime": "rm -rf dist && bun build src/cli/index.ts --outdir dist/cli --target bun --packages external && bun build src/mcp/index.ts --outdir dist/mcp --target bun --packages external && bun build src/serve/index.ts --outdir dist/serve --target bun --packages external && bun build src/index.ts src/service.ts src/handlers.ts src/agent-tools.ts src/types.ts --root src --outdir dist --target bun --packages external",
-    "build:types": "rm -rf types && tsc -p tsconfig.build.json --emitDeclarationOnly --outDir types",
-    "artifact-scan": "bun scripts/contracts-cli.mjs artifact-scan dist",
-    "contract:check": "bun scripts/contracts-cli.mjs repo-conformance .",
-    typecheck: "tsc --noEmit",
-    test: "bun test",
-    "test:pg": 'WORKFLOWS_TEST_DATABASE_URL="${WORKFLOWS_TEST_DATABASE_URL:?point it at a throwaway Postgres; the live-PG gate must not pass without one}" WORKFLOWS_REQUIRE_POSTGRES=1 bun test src/db/pg-live.test.ts',
-    prepack: "bun run build && bun run artifact-scan",
-    prepublishOnly: "bun run test && bun run build"
-  },
-  keywords: [
-    "workflows",
-    "graph",
-    "automation",
-    "cli",
-    "typescript",
-    "bun",
-    "hasna"
-  ],
-  publishConfig: {
-    registry: "https://registry.npmjs.org",
-    access: "public"
-  },
-  repository: {
-    type: "git",
-    url: "git+https://github.com/hasna/apps.git"
-  },
-  homepage: "https://github.com/hasna/apps/tree/main/apps/workflows",
-  bugs: {
-    url: "https://github.com/hasna/apps/issues"
-  },
-  engines: {
-    bun: ">=1.0.0"
-  },
-  author: "Hasna",
-  license: "Apache-2.0",
-  dependencies: {
-    "@anthropic-ai/claude-agent-sdk": "0.3.234",
-    "@cursor/sdk": "^1.0.28",
-    "@hasna/paths": "0.1.0",
-    "@openai/codex-sdk": "0.147.0",
-    commander: "^13.1.0"
-  },
-  devDependencies: {
-    "@hasna/contracts": "0.14.2",
-    "@types/bun": "1.3.14",
-    "@types/pg": "^8.15.6",
-    pg: "^8.16.3",
-    typescript: "^5.7.3"
+    return this.parseComparison();
+  }
+  parseComparison() {
+    const left = this.parsePrimary();
+    const t = this.peek();
+    if (t && t.kind === "op" && COMPARISON_OPS.has(t.value)) {
+      this.next();
+      const right = this.parsePrimary();
+      return { kind: "comparison", op: t.value, left, right };
+    }
+    return left;
+  }
+  parsePrimary() {
+    const t = this.next();
+    if (!t)
+      throw new ExprSyntaxError("unexpected end of expression");
+    if (t.kind === "lparen") {
+      const inner = this.parseOr();
+      this.expectCloseParen();
+      return inner;
+    }
+    if (t.kind === "number") {
+      const value = Number(t.value);
+      if (!Number.isFinite(value))
+        throw new ExprSyntaxError(`invalid number ${JSON.stringify(t.value)}`);
+      return { kind: "literal", value };
+    }
+    if (t.kind === "string")
+      return { kind: "literal", value: t.value };
+    if (t.kind === "ident") {
+      if (t.value === "true")
+        return { kind: "literal", value: true };
+      if (t.value === "false")
+        return { kind: "literal", value: false };
+      return { kind: "path", segments: t.value.split(".") };
+    }
+    throw new ExprSyntaxError(`unexpected token ${JSON.stringify(t.value)}`);
   }
-};
-
-// src/expr.ts
-class ExprSyntaxError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ExprSyntaxError";
+  expectCloseParen() {
+    const t = this.next();
+    if (!t || t.kind !== "rparen")
+      throw new ExprSyntaxError("expected )");
   }
 }
-
-class ExprEvalError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ExprEvalError";
+function parseExpr(input) {
+  return new Parser(tokenize(input)).parse();
+}
+function resolvePath(segments, context) {
+  let current = context;
+  for (const segment of segments) {
+    if (current === null || typeof current !== "object")
+      return;
+    const record = current;
+    if (!(segment in record))
+      return;
+    current = record[segment];
+  }
+  if (typeof current === "number" || typeof current === "string" || typeof current === "boolean") {
+    return current;
   }
+  return;
 }
-var COMPARISON_OPS = new Set(["==", "!=", "<", "<=", ">", ">="]);
-function tokenize(input) {
-  const tokens = [];
-  let i = 0;
-  while (i < input.length) {
-    const ch = input[i];
-    if (ch === " " || ch === "\t" || ch === `
-` || ch === "\r") {
-      i++;
-      continue;
-    }
-    if (ch === "(") {
-      tokens.push({ kind: "lparen", value: "(" });
-      i++;
-      continue;
+function evalNode(node, context) {
+  switch (node.kind) {
+    case "literal":
+      return node.value;
+    case "path":
+      return resolvePath(node.segments, context);
+    case "comparison": {
+      const left = evalNode(node.left, context);
+      const right = evalNode(node.right, context);
+      if (left === undefined || right === undefined) {
+        if (node.op === "==")
+          return left === undefined && right === undefined;
+        if (node.op === "!=")
+          return left !== right;
+        throw new ExprEvalError("cannot order-compare an unknown path");
+      }
+      if (typeof left !== typeof right) {
+        throw new ExprEvalError(`cannot compare ${JSON.stringify(left)} (${typeof left}) with ${JSON.stringify(right)} (${typeof right})`);
+      }
+      switch (node.op) {
+        case "==":
+          return left === right;
+        case "!=":
+          return left !== right;
+        case "<":
+          return left < right;
+        case "<=":
+          return left <= right;
+        case ">":
+          return left > right;
+        case ">=":
+          return left >= right;
+        default:
+          throw new ExprEvalError(`unknown operator ${node.op}`);
+      }
     }
-    if (ch === ")") {
-      tokens.push({ kind: "rparen", value: ")" });
-      i++;
-      continue;
+    case "and": {
+      const left = evalNode(node.left, context);
+      const right = evalNode(node.right, context);
+      if (typeof left !== "boolean" || typeof right !== "boolean") {
+        throw new ExprEvalError("and requires boolean operands");
+      }
+      return left && right;
     }
-    if (ch === '"' || ch === "'") {
-      const quote = ch;
-      let j = i + 1;
-      let out = "";
-      let closed = false;
-      while (j < input.length) {
-        if (input[j] === quote) {
-          closed = true;
-          break;
-        }
-        out += input[j];
-        j++;
+    case "or": {
+      const left = evalNode(node.left, context);
+      const right = evalNode(node.right, context);
+      if (typeof left !== "boolean" || typeof right !== "boolean") {
+        throw new ExprEvalError("or requires boolean operands");
       }
-      if (!closed)
-        throw new ExprSyntaxError(`unterminated string literal at offset ${i}`);
-      tokens.push({ kind: "string", value: out });
-      i = j + 1;
-      continue;
+      return left || right;
     }
-    const two = input.slice(i, i + 2);
-    if (COMPARISON_OPS.has(two)) {
-      tokens.push({ kind: "op", value: two });
-      i += 2;
-      continue;
+    case "not": {
+      const operand = evalNode(node.operand, context);
+      if (typeof operand !== "boolean")
+        throw new ExprEvalError("not requires a boolean operand");
+      return !operand;
     }
-    if (ch === "<" || ch === ">" || ch === "=" || ch === "!") {
-      tokens.push({ kind: "op", value: ch });
-      i++;
-      continue;
+  }
+}
+function evaluateExpr(input, context) {
+  const ast = parseExpr(input);
+  const value = evalNode(ast, context);
+  if (typeof value !== "boolean") {
+    throw new ExprEvalError(`condition must evaluate to a boolean, got ${typeof value}`);
+  }
+  return value;
+}
+var ExprSyntaxError, ExprEvalError, COMPARISON_OPS;
+var init_expr = __esm(() => {
+  ExprSyntaxError = class ExprSyntaxError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "ExprSyntaxError";
     }
-    if (/[0-9]/.test(ch)) {
-      let j = i;
-      while (j < input.length && /[0-9.]/.test(input[j]))
-        j++;
-      tokens.push({ kind: "number", value: input.slice(i, j) });
-      i = j;
-      continue;
+  };
+  ExprEvalError = class ExprEvalError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "ExprEvalError";
     }
-    if (/[A-Za-z_]/.test(ch)) {
-      let j = i;
-      while (j < input.length && /[A-Za-z0-9_.]/.test(input[j]))
-        j++;
-      tokens.push({ kind: "ident", value: input.slice(i, j) });
-      i = j;
+  };
+  COMPARISON_OPS = new Set(["==", "!=", "<", "<=", ">", ">="]);
+});
+
+// src/graph.ts
+function issue(issues, path, message) {
+  issues.push({ path, message });
+}
+function findNode(graph, id) {
+  return graph.nodes.find((n) => n.id === id);
+}
+function collectEdges(graph) {
+  const edges = [];
+  for (const node of graph.nodes) {
+    switch (node.type) {
+      case "start":
+      case "step":
+        if (node.next)
+          edges.push({ from: node.id, to: node.next });
+        break;
+      case "decision":
+        if (node.then)
+          edges.push({ from: node.id, to: node.then });
+        if (node.else)
+          edges.push({ from: node.id, to: node.else });
+        break;
+      case "while":
+        if (node.next)
+          edges.push({ from: node.id, to: node.next });
+        break;
+      case "end":
+        break;
+    }
+  }
+  return edges;
+}
+function reachableNodes(graph) {
+  const start = graph.nodes.find((n) => n.type === "start");
+  if (!start)
+    return [];
+  const seen = new Set;
+  const stack = [start.id];
+  while (stack.length > 0) {
+    const id = stack.pop();
+    if (seen.has(id))
+      continue;
+    seen.add(id);
+    const node = findNode(graph, id);
+    if (!node)
       continue;
+    if (node.type === "start" || node.type === "step") {
+      if (node.next)
+        stack.push(node.next);
+    } else if (node.type === "decision") {
+      if (node.then)
+        stack.push(node.then);
+      if (node.else)
+        stack.push(node.else);
+    } else if (node.type === "while") {
+      for (const bodyId of node.body)
+        stack.push(bodyId);
+      if (node.next)
+        stack.push(node.next);
+    }
+  }
+  return [...seen];
+}
+function findCycles(graph) {
+  const edges = collectEdges(graph);
+  const adj = new Map;
+  for (const e of edges) {
+    const list = adj.get(e.from) ?? [];
+    list.push(e.to);
+    adj.set(e.from, list);
+  }
+  const color = new Map;
+  const stack = [];
+  const cycles = [];
+  function visit(id) {
+    color.set(id, "grey");
+    stack.push(id);
+    for (const to of adj.get(id) ?? []) {
+      const c = color.get(to);
+      if (c === "grey") {
+        const idx = stack.indexOf(to);
+        cycles.push([...stack.slice(idx), to]);
+      } else if (c === undefined) {
+        visit(to);
+      }
     }
-    throw new ExprSyntaxError(`unexpected character ${JSON.stringify(ch)} at offset ${i}`);
+    stack.pop();
+    color.set(id, "black");
   }
-  return tokens;
+  for (const node of graph.nodes) {
+    if (color.get(node.id) === undefined)
+      visit(node.id);
+  }
+  return cycles;
 }
-
-class Parser {
-  tokens;
-  pos = 0;
-  constructor(tokens) {
-    this.tokens = tokens;
+function validateGraph(graph) {
+  const issues = [];
+  if (graph === null || typeof graph !== "object" || Array.isArray(graph)) {
+    return { ok: false, issues: [{ path: "graph", message: "graph must be an object" }] };
   }
-  peek() {
-    return this.tokens[this.pos];
+  if (typeof graph.name !== "string" || graph.name.trim() === "") {
+    issue(issues, "name", "graph requires a non-empty name");
   }
-  next() {
-    return this.tokens[this.pos++];
+  if (typeof graph.version !== "string" || graph.version.trim() === "") {
+    issue(issues, "version", "graph requires a version string");
   }
-  expectOp(value) {
-    const t = this.next();
-    if (!t || t.kind !== "op" || t.value !== value) {
-      throw new ExprSyntaxError(`expected ${JSON.stringify(value)}`);
+  if (graph.memoWatch !== undefined) {
+    if (!Array.isArray(graph.memoWatch) || graph.memoWatch.length === 0) {
+      issue(issues, "memoWatch", "memoWatch must be a non-empty array of file paths or globs");
+    } else {
+      for (const entry of graph.memoWatch) {
+        if (typeof entry !== "string" || entry.trim() === "") {
+          issue(issues, "memoWatch", "each memoWatch entry must be a non-empty path or glob string");
+          break;
+        }
+      }
     }
   }
-  parse() {
-    if (this.tokens.length === 0)
-      throw new ExprSyntaxError("empty expression");
-    const node = this.parseOr();
-    if (this.pos < this.tokens.length) {
-      throw new ExprSyntaxError(`unexpected trailing token ${JSON.stringify(this.peek().value)}`);
-    }
-    return node;
+  if (!Array.isArray(graph.nodes) || graph.nodes.length === 0) {
+    issue(issues, "nodes", "graph requires at least one node");
+    return { ok: false, issues };
   }
-  parseOr() {
-    let left = this.parseAnd();
-    while (this.peek()?.kind === "ident" && this.peek().value === "or") {
-      this.next();
-      const right = this.parseAnd();
-      left = { kind: "or", left, right };
+  for (let index = 0;index < graph.nodes.length; index++) {
+    const node = graph.nodes[index];
+    if (node === null || typeof node !== "object" || Array.isArray(node)) {
+      issue(issues, `nodes.${index}`, "node must be an object");
+      continue;
     }
-    return left;
-  }
-  parseAnd() {
-    let left = this.parseNot();
-    while (this.peek()?.kind === "ident" && this.peek().value === "and") {
-      this.next();
-      const right = this.parseNot();
-      left = { kind: "and", left, right };
+    if (!GRAPH_NODE_TYPES.includes(node.type))
+      issue(issues, `nodes.${index}.type`, "type must be start, step, decision, while, or end");
+    for (const key of ["next", "then", "else", "prompt", "command"]) {
+      const value = node[key];
+      if (value !== undefined && (typeof value !== "string" || value.trim() === ""))
+        issue(issues, `nodes.${index}.${key}`, `${key} must be a non-empty string`);
     }
-    return left;
+    if (node.type === "while" && (!Array.isArray(node.body) || node.body.some((id) => typeof id !== "string")))
+      issue(issues, `nodes.${index}.body`, "body must be an array of node ids");
   }
-  parseNot() {
-    if (this.peek()?.kind === "ident" && this.peek().value === "not") {
-      this.next();
-      return { kind: "not", operand: this.parseNot() };
+  if (issues.length)
+    return { ok: false, issues };
+  const starts = graph.nodes.filter((n) => n.type === "start");
+  if (starts.length === 0)
+    issue(issues, "nodes", "graph requires exactly one start node (found none)");
+  if (starts.length > 1)
+    issue(issues, "nodes", "graph requires exactly one start node (found multiple)");
+  const ends = graph.nodes.filter((n) => n.type === "end");
+  if (ends.length === 0)
+    issue(issues, "nodes", "graph requires at least one end node");
+  const seenIds = new Map;
+  for (const node of graph.nodes) {
+    if (typeof node.id !== "string" || !NODE_ID_RE.test(node.id)) {
+      issue(issues, "nodes", `node id ${JSON.stringify(node.id)} must match ${String(NODE_ID_RE)}`);
+      continue;
     }
-    return this.parseComparison();
-  }
-  parseComparison() {
-    const left = this.parsePrimary();
-    const t = this.peek();
-    if (t && t.kind === "op" && COMPARISON_OPS.has(t.value)) {
-      this.next();
-      const right = this.parsePrimary();
-      return { kind: "comparison", op: t.value, left, right };
+    if (seenIds.has(node.id)) {
+      issue(issues, `nodes.${node.id}`, `duplicate node id ${node.id}`);
+      continue;
     }
-    return left;
-  }
-  parsePrimary() {
-    const t = this.next();
-    if (!t)
-      throw new ExprSyntaxError("unexpected end of expression");
-    if (t.kind === "lparen") {
-      const inner = this.parseOr();
-      this.expectCloseParen();
-      return inner;
+    seenIds.set(node.id, node);
+    if (!GRAPH_NODE_TYPES.includes(node.type)) {
+      issue(issues, `nodes.${node.id}`, `unknown node type ${JSON.stringify(node.type)}`);
+      continue;
     }
-    if (t.kind === "number") {
-      const value = Number(t.value);
-      if (!Number.isFinite(value))
-        throw new ExprSyntaxError(`invalid number ${JSON.stringify(t.value)}`);
-      return { kind: "literal", value };
+    validateNode(graph, node, issues);
+  }
+  for (const node of graph.nodes) {
+    const edges = nodeEdges(node);
+    for (const { kind, target } of edges) {
+      if (!seenIds.has(target)) {
+        issue(issues, `nodes.${node.id}`, `${kind} edge targets nonexistent node ${target}`);
+      }
     }
-    if (t.kind === "string")
-      return { kind: "literal", value: t.value };
-    if (t.kind === "ident") {
-      if (t.value === "true")
-        return { kind: "literal", value: true };
-      if (t.value === "false")
-        return { kind: "literal", value: false };
-      return { kind: "path", segments: t.value.split(".") };
+  }
+  if (starts.length === 1) {
+    const reachable = new Set(reachableNodes(graph));
+    for (const node of graph.nodes) {
+      if (!reachable.has(node.id)) {
+        issue(issues, `nodes.${node.id}`, `node ${node.id} is unreachable from start`);
+      }
     }
-    throw new ExprSyntaxError(`unexpected token ${JSON.stringify(t.value)}`);
   }
-  expectCloseParen() {
-    const t = this.next();
-    if (!t || t.kind !== "rparen")
-      throw new ExprSyntaxError("expected )");
+  const cycles = findCycles(graph);
+  for (const cycle of cycles) {
+    issue(issues, "nodes", `explicit cycle detected: ${cycle.join(" -> ")} (loop only via a while node)`);
   }
+  return { ok: issues.length === 0, issues };
 }
-function parseExpr(input) {
-  return new Parser(tokenize(input)).parse();
-}
-function resolvePath(segments, context) {
-  let current = context;
-  for (const segment of segments) {
-    if (current === null || typeof current !== "object")
-      return;
-    const record = current;
-    if (!(segment in record))
-      return;
-    current = record[segment];
-  }
-  if (typeof current === "number" || typeof current === "string" || typeof current === "boolean") {
-    return current;
+function nodeEdges(node) {
+  switch (node.type) {
+    case "start":
+    case "step":
+      return node.next ? [{ kind: "next", target: node.next }] : [];
+    case "decision":
+      return [
+        ...node.then ? [{ kind: "then", target: node.then }] : [],
+        ...node.else ? [{ kind: "else", target: node.else }] : []
+      ];
+    case "while":
+      return node.next ? [{ kind: "next", target: node.next }] : [];
+    case "end":
+      return [];
+    default:
+      return [];
   }
-  return;
 }
-function evalNode(node, context) {
-  switch (node.kind) {
-    case "literal":
-      return node.value;
-    case "path":
-      return resolvePath(node.segments, context);
-    case "comparison": {
-      const left = evalNode(node.left, context);
-      const right = evalNode(node.right, context);
-      if (left === undefined || right === undefined) {
-        if (node.op === "==")
-          return left === undefined && right === undefined;
-        if (node.op === "!=")
-          return left !== right;
-        throw new ExprEvalError("cannot order-compare an unknown path");
+function validateNode(graph, node, issues) {
+  switch (node.type) {
+    case "start":
+      if (!node.next)
+        issue(issues, `nodes.${node.id}`, "start node requires a next edge");
+      break;
+    case "step": {
+      if (!node.prompt && !node.command) {
+        issue(issues, `nodes.${node.id}`, "step node requires prompt or command");
       }
-      if (typeof left !== typeof right) {
-        throw new ExprEvalError(`cannot compare ${JSON.stringify(left)} (${typeof left}) with ${JSON.stringify(right)} (${typeof right})`);
+      if (node.lane !== undefined && !LANE_KINDS.includes(node.lane)) {
+        issue(issues, `nodes.${node.id}`, `unknown lane ${JSON.stringify(node.lane)} (expected one of ${LANE_KINDS.join(", ")})`);
       }
-      switch (node.op) {
-        case "==":
-          return left === right;
-        case "!=":
-          return left !== right;
-        case "<":
-          return left < right;
-        case "<=":
-          return left <= right;
-        case ">":
-          return left > right;
-        case ">=":
-          return left >= right;
-        default:
-          throw new ExprEvalError(`unknown operator ${node.op}`);
+      if (node.cwd !== undefined && (typeof node.cwd !== "string" || !node.cwd.trim() || node.cwd.includes("\x00"))) {
+        issue(issues, `nodes.${node.id}.cwd`, "cwd must be a non-empty path string without NUL characters on the executor");
+      }
+      if (node.codexMode !== undefined) {
+        if (!CODEX_EXECUTION_MODES.includes(node.codexMode)) {
+          issue(issues, `nodes.${node.id}.codexMode`, "codexMode must be repository or read-only");
+        } else if (node.lane !== "codex" || !node.prompt || node.command !== undefined) {
+          issue(issues, `nodes.${node.id}.codexMode`, "codexMode is supported only for a codex prompt step without command");
+        }
+      }
+      if (node.maxRetries !== undefined && (!Number.isInteger(node.maxRetries) || node.maxRetries < 0)) {
+        issue(issues, `nodes.${node.id}`, "maxRetries must be a non-negative integer");
+      }
+      if (node.timeoutMs !== undefined && (!Number.isInteger(node.timeoutMs) || node.timeoutMs < 1)) {
+        issue(issues, `nodes.${node.id}`, "timeoutMs must be a positive integer");
       }
+      break;
     }
-    case "and": {
-      const left = evalNode(node.left, context);
-      const right = evalNode(node.right, context);
-      if (typeof left !== "boolean" || typeof right !== "boolean") {
-        throw new ExprEvalError("and requires boolean operands");
+    case "decision": {
+      if (typeof node.condition !== "string" || node.condition.trim() === "") {
+        issue(issues, `nodes.${node.id}`, "decision node requires a condition expression");
+      } else {
+        try {
+          parseExpr(node.condition);
+        } catch (err) {
+          if (err instanceof ExprSyntaxError) {
+            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
+          } else {
+            throw err;
+          }
+        }
+      }
+      if (!node.then && !node.else) {
+        issue(issues, `nodes.${node.id}`, "decision node requires then and/or else edge");
       }
-      return left && right;
+      break;
     }
-    case "or": {
-      const left = evalNode(node.left, context);
-      const right = evalNode(node.right, context);
-      if (typeof left !== "boolean" || typeof right !== "boolean") {
-        throw new ExprEvalError("or requires boolean operands");
+    case "while": {
+      if (typeof node.condition !== "string" || node.condition.trim() === "") {
+        issue(issues, `nodes.${node.id}`, "while node requires a condition expression");
+      } else {
+        try {
+          parseExpr(node.condition);
+        } catch (err) {
+          if (err instanceof ExprSyntaxError) {
+            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
+          } else {
+            throw err;
+          }
+        }
       }
-      return left || right;
-    }
-    case "not": {
-      const operand = evalNode(node.operand, context);
-      if (typeof operand !== "boolean")
-        throw new ExprEvalError("not requires a boolean operand");
-      return !operand;
+      if (node.maxIterations === undefined) {
+        issue(issues, `nodes.${node.id}`, "while node requires maxIterations (finite loop bound)");
+      } else if (!Number.isInteger(node.maxIterations) || node.maxIterations < 1) {
+        issue(issues, `nodes.${node.id}`, "maxIterations must be a positive integer");
+      }
+      if (!Array.isArray(node.body) || node.body.length === 0) {
+        issue(issues, `nodes.${node.id}`, "while node requires a non-empty body");
+      } else {
+        for (const bodyId of node.body) {
+          const bodyNode = findNode(graph, bodyId);
+          if (!bodyNode) {
+            issue(issues, `nodes.${node.id}`, `while body references nonexistent node ${bodyId}`);
+            continue;
+          }
+          if (bodyNode.type === "start" || bodyNode.type === "end" || bodyNode.type === "while") {
+            issue(issues, `nodes.${node.id}`, `while body may only contain step/decision nodes in v1 (found ${bodyNode.type})`);
+          }
+        }
+        const bodySet = new Set(node.body);
+        for (const bodyId of node.body) {
+          const bodyNode = findNode(graph, bodyId);
+          if (!bodyNode)
+            continue;
+          for (const { kind, target } of nodeEdges(bodyNode)) {
+            if (!bodySet.has(target)) {
+              issue(issues, `nodes.${node.id}`, `while body node ${bodyId} ${kind}-edge leaves the body (target ${target})`);
+            }
+          }
+        }
+      }
+      break;
     }
+    case "end":
+      break;
   }
 }
-function evaluateExpr(input, context) {
-  const ast = parseExpr(input);
-  const value = evalNode(ast, context);
-  if (typeof value !== "boolean") {
-    throw new ExprEvalError(`condition must evaluate to a boolean, got ${typeof value}`);
+var GRAPH_NODE_TYPES, LANE_KINDS, CODEX_EXECUTION_MODES, NODE_ID_RE;
+var init_graph = __esm(() => {
+  init_expr();
+  GRAPH_NODE_TYPES = ["start", "step", "decision", "while", "end"];
+  LANE_KINDS = ["claude", "codex", "cursor", "grok"];
+  CODEX_EXECUTION_MODES = ["repository", "read-only"];
+  NODE_ID_RE = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+});
+
+// src/lanes/types.ts
+import { statSync as statSync2 } from "fs";
+function binaryOnPath(binary) {
+  const pathEntries = (process.env.PATH ?? "").split(":").filter(Boolean);
+  for (const entry of pathEntries) {
+    try {
+      const stat = statSync2(`${entry}/${binary}`);
+      if (stat.isFile())
+        return true;
+    } catch {}
   }
-  return value;
+  return false;
 }
-
-// src/graph.ts
-var GRAPH_NODE_TYPES = ["start", "step", "decision", "while", "end"];
-var LANE_KINDS = ["claude", "codex", "cursor", "grok"];
-var NODE_ID_RE = /^[A-Za-z_][A-Za-z0-9_-]*$/;
-function issue(issues, path, message) {
-  issues.push({ path, message });
+function subscriptionEnvironment(overrides = {}) {
+  const paid = /^(OPENAI_API_KEY|ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|CODEX_API_KEY|CURSOR_API_KEY)$/;
+  const sensitive = /(?:API[_-]?KEY|SECRET|PASSWORD|TOKEN|DATABASE_URL|CREDENTIAL)/i;
+  const env = {};
+  for (const [name, value] of Object.entries(process.env)) {
+    if (value !== undefined && !paid.test(name) && (!sensitive.test(name) || name === "CLAUDE_CODE_OAUTH_TOKEN"))
+      env[name] = value;
+  }
+  for (const [name, value] of Object.entries(overrides)) {
+    if (paid.test(name) || sensitive.test(name))
+      throw new Error(`lane environment field ${name} requires a supported scoped credential consumer`);
+    env[name] = value;
+  }
+  return env;
 }
-function findNode(graph, id) {
-  return graph.nodes.find((n) => n.id === id);
+function subscriptionSdkEnvironment(overrides = {}) {
+  const safe = subscriptionEnvironment(overrides);
+  return { ...Object.fromEntries(Object.keys(process.env).map((name) => [name, undefined])), ...safe };
 }
-function collectEdges(graph) {
-  const edges = [];
-  for (const node of graph.nodes) {
-    switch (node.type) {
-      case "start":
-      case "step":
-        if (node.next)
-          edges.push({ from: node.id, to: node.next });
-        break;
-      case "decision":
-        if (node.then)
-          edges.push({ from: node.id, to: node.then });
-        if (node.else)
-          edges.push({ from: node.id, to: node.else });
-        break;
-      case "while":
-        if (node.next)
-          edges.push({ from: node.id, to: node.next });
-        break;
-      case "end":
-        break;
+function withTimeout(promise, timeoutMs, what, cancel) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      cancel?.();
+      reject(new LaneTimeoutError(what, timeoutMs));
+    }, timeoutMs);
+    promise.then((value) => {
+      clearTimeout(timer);
+      resolve(value);
+    }, (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+  });
+}
+async function spawnCli(cmd, opts) {
+  const started = Date.now();
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+  let proc;
+  try {
+    proc = Bun.spawn({
+      cmd,
+      cwd: opts.cwd,
+      env: subscriptionEnvironment(opts.env),
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "pipe",
+      timeout: timeoutMs
+    });
+  } catch (err) {
+    const message = String(err instanceof Error ? err.message : err);
+    if (message.includes("ENOENT") || /not found/i.test(message)) {
+      throw new LaneDependencyMissingError(`lane binary ${JSON.stringify(opts.binaryName)} not found on PATH; install it or provide ${opts.packageHint}`);
     }
+    return { ok: false, exitCode: 1, output: "", durationMs: Date.now() - started, error: message };
   }
-  return edges;
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
+  const output = opts.stdoutOnly ? stdout.trim() : stderr ? `${stdout}
+${stderr}`.trim() : stdout.trim();
+  return {
+    ok: exitCode === 0,
+    exitCode,
+    output,
+    durationMs: Date.now() - started,
+    ...opts.stdoutOnly && exitCode !== 0 && stderr.trim() ? { error: stderr.trim() } : {}
+  };
 }
-function reachableNodes(graph) {
-  const start = graph.nodes.find((n) => n.type === "start");
-  if (!start)
-    return [];
-  const seen = new Set;
-  const stack = [start.id];
-  while (stack.length > 0) {
-    const id = stack.pop();
-    if (seen.has(id))
-      continue;
-    seen.add(id);
-    const node = findNode(graph, id);
-    if (!node)
-      continue;
-    if (node.type === "start" || node.type === "step") {
-      if (node.next)
-        stack.push(node.next);
-    } else if (node.type === "decision") {
-      if (node.then)
-        stack.push(node.then);
-      if (node.else)
-        stack.push(node.else);
-    } else if (node.type === "while") {
-      for (const bodyId of node.body)
-        stack.push(bodyId);
-      if (node.next)
-        stack.push(node.next);
+var LANE_KINDS2, LaneDependencyMissingError, LaneAdapterShapeError, DEFAULT_LANE_TIMEOUT_MS = 120000, LaneTimeoutError;
+var init_types = __esm(() => {
+  LANE_KINDS2 = ["claude", "codex", "cursor", "grok"];
+  LaneDependencyMissingError = class LaneDependencyMissingError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "LaneDependencyMissingError";
+    }
+  };
+  LaneAdapterShapeError = class LaneAdapterShapeError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "LaneAdapterShapeError";
+    }
+  };
+  LaneTimeoutError = class LaneTimeoutError extends Error {
+    constructor(what, timeoutMs) {
+      super(`${what} exceeded the ${timeoutMs}ms budget`);
+      this.name = "LaneTimeoutError";
+    }
+  };
+});
+
+// src/lanes/claude.ts
+function createClaudeAdapter(deps = {}) {
+  return {
+    kind: "claude",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
+      try {
+        await loader();
+        return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "sdk" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "claude")) {
+          return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "claude",
+          sdk: "@anthropic-ai/claude-agent-sdk",
+          wired: false,
+          reason: "neither @anthropic-ai/claude-agent-sdk nor the claude CLI is available on this machine"
+        };
+      }
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "claude lane requires a prompt" };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch (err) {
+        return runClaudeCli(job, deps.cliPath ?? "claude", started, timeoutMs);
+      }
+      const query = sdk.query;
+      if (typeof query !== "function") {
+        throw new LaneAdapterShapeError("@anthropic-ai/claude-agent-sdk exports no query() function");
+      }
+      const prompt = job.prompt;
+      const abortController = new AbortController;
+      try {
+        const { output, isError } = await withTimeout((async () => {
+          const generator = await query({
+            prompt,
+            options: { model: job.model, cwd: job.cwd, maxTurns: 32, abortController, env: subscriptionSdkEnvironment(job.env) }
+          });
+          let output2 = "";
+          let isError2 = false;
+          for await (const message of generator) {
+            if (message.type === "assistant") {
+              const content = message.message?.content;
+              if (Array.isArray(content)) {
+                for (const block of content) {
+                  if (block && typeof block === "object" && "text" in block && typeof block.text === "string") {
+                    output2 += block.text;
+                  }
+                }
+              }
+            }
+            if (message.type === "error")
+              isError2 = true;
+          }
+          return { output: output2, isError: isError2 };
+        })(), timeoutMs, "claude lane", () => abortController.abort());
+        const durationMs = Date.now() - started;
+        return { ok: !isError, exitCode: isError ? 1 : 0, output: output.trim(), durationMs };
+      } catch (err) {
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
+      }
+    }
+  };
+}
+async function runClaudeCli(job, cliPath, started, timeoutMs) {
+  try {
+    const result = await spawnCli([cliPath, "-p", job.prompt], {
+      binaryName: cliPath,
+      packageHint: "@anthropic-ai/claude-agent-sdk or the claude CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd
+    });
+    return { ...result, durationMs: Date.now() - started };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
     }
+    throw err;
   }
-  return [...seen];
 }
-function findCycles(graph) {
-  const edges = collectEdges(graph);
-  const adj = new Map;
-  for (const e of edges) {
-    const list = adj.get(e.from) ?? [];
-    list.push(e.to);
-    adj.set(e.from, list);
-  }
-  const color = new Map;
-  const stack = [];
-  const cycles = [];
-  function visit(id) {
-    color.set(id, "grey");
-    stack.push(id);
-    for (const to of adj.get(id) ?? []) {
-      const c = color.get(to);
-      if (c === "grey") {
-        const idx = stack.indexOf(to);
-        cycles.push([...stack.slice(idx), to]);
-      } else if (c === undefined) {
-        visit(to);
+var init_claude = __esm(() => {
+  init_types();
+});
+
+// src/lanes/codex.ts
+function createCodexAdapter(deps = {}) {
+  return {
+    kind: "codex",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
+      try {
+        await loader();
+        return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "sdk" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "codex")) {
+          return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "codex",
+          sdk: "@openai/codex-sdk",
+          wired: false,
+          reason: "neither @openai/codex-sdk nor the codex CLI is available on this machine"
+        };
+      }
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codex lane requires a prompt" };
+      }
+      if (job.codexMode !== undefined && (!CODEX_EXECUTION_MODES.includes(job.codexMode) || job.lane !== "codex" || job.command !== undefined)) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codexMode must be repository or read-only on a codex prompt without command", retryable: false };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch {
+        return runCodexCli(job, deps.cliPath ?? "codex", started, timeoutMs);
+      }
+      const CodexClass = sdk.Codex;
+      if (typeof CodexClass !== "function") {
+        throw new LaneAdapterShapeError("@openai/codex-sdk exports no Codex class");
+      }
+      const abortController = new AbortController;
+      try {
+        const client = await withTimeout(Promise.resolve(new CodexClass({
+          config: { model: job.model },
+          env: subscriptionEnvironment(job.env)
+        })), timeoutMs, "codex lane");
+        const thread = client.startThread?.({
+          model: job.model,
+          workingDirectory: job.cwd,
+          ...job.codexMode === "read-only" ? { sandboxMode: "read-only", skipGitRepoCheck: true, approvalPolicy: "never" } : {}
+        });
+        if (!thread || typeof thread.run !== "function") {
+          throw new LaneAdapterShapeError("@openai/codex-sdk Codex.startThread() returned no run()");
+        }
+        const turn = await withTimeout(thread.run(job.prompt, { signal: abortController.signal }), timeoutMs, "codex lane", () => abortController.abort());
+        const durationMs = Date.now() - started;
+        const output = turn?.finalResponse;
+        if (typeof output !== "string" || !output.trim()) {
+          return missingResponse(durationMs);
+        }
+        return { ok: true, exitCode: 0, output, durationMs };
+      } catch (err) {
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
       }
     }
-    stack.pop();
-    color.set(id, "black");
-  }
-  for (const node of graph.nodes) {
-    if (color.get(node.id) === undefined)
-      visit(node.id);
-  }
-  return cycles;
+  };
 }
-function validateGraph(graph) {
-  const issues = [];
-  if (typeof graph.name !== "string" || graph.name.trim() === "") {
-    issue(issues, "name", "graph requires a non-empty name");
-  }
-  if (typeof graph.version !== "string" || graph.version.trim() === "") {
-    issue(issues, "version", "graph requires a version string");
+async function runCodexCli(job, cliPath, started, timeoutMs) {
+  try {
+    const controls = job.codexMode === "read-only" ? ["--sandbox", "read-only", "--skip-git-repo-check", "--config", 'approval_policy="never"'] : [];
+    const result = await spawnCli([cliPath, "exec", ...controls, "--", job.prompt], {
+      binaryName: cliPath,
+      packageHint: "@openai/codex-sdk or the codex CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd,
+      stdoutOnly: true
+    });
+    const durationMs = Date.now() - started;
+    return result.ok && !result.output.trim() ? missingResponse(durationMs) : { ...result, durationMs };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    }
+    throw err;
   }
-  if (graph.memoWatch !== undefined) {
-    if (!Array.isArray(graph.memoWatch) || graph.memoWatch.length === 0) {
-      issue(issues, "memoWatch", "memoWatch must be a non-empty array of file paths or globs");
-    } else {
-      for (const entry of graph.memoWatch) {
-        if (typeof entry !== "string" || entry.trim() === "") {
-          issue(issues, "memoWatch", "each memoWatch entry must be a non-empty path or glob string");
-          break;
+}
+function missingResponse(durationMs) {
+  return { ok: false, exitCode: 1, output: "", durationMs, error: "Codex completed without an agent response; verify the native subscription and model route", retryable: false };
+}
+var init_codex = __esm(() => {
+  init_graph();
+  init_types();
+});
+
+// src/lanes/cursor.ts
+function createCursorAdapter(deps = {}) {
+  return {
+    kind: "cursor",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
+      try {
+        await loader();
+        return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "sdk (local mode)" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "cursor-agent")) {
+          return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "cli" };
         }
+        return {
+          kind: "cursor",
+          sdk: "@cursor/sdk",
+          wired: false,
+          reason: "neither @cursor/sdk nor the cursor-agent CLI is available on this machine"
+        };
+      }
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "cursor lane requires a prompt" };
+      }
+      if (!deps.sdkLoader && binaryOnPath(deps.cliPath ?? "cursor-agent"))
+        return runCursorCli(job, deps.cliPath ?? "cursor-agent", Date.now(), job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS);
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch {
+        return runCursorCli(job, deps.cliPath ?? "cursor-agent", started, timeoutMs);
+      }
+      let cancel;
+      try {
+        subscriptionEnvironment(job.env);
+        if (!deps.sdkLoader && process.env.CURSOR_API_KEY)
+          throw new Error("cursor lane refuses ambient API billing; use the native subscription CLI");
+        const run2 = await withTimeout(runLocalAgent(sdk, job, (callback) => {
+          cancel = callback;
+        }), timeoutMs, "cursor lane", () => cancel?.());
+        const durationMs = Date.now() - started;
+        const status = run2.status;
+        const ok = status === "finished";
+        return { ok, exitCode: ok ? 0 : 1, output: run2.result, durationMs };
+      } catch (err) {
+        if (err instanceof LaneAdapterShapeError)
+          throw err;
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
       }
     }
+  };
+}
+async function runLocalAgent(sdk, job, onCancel) {
+  const AgentClass = sdk.Agent;
+  const CursorClass = sdk.Cursor;
+  if (typeof AgentClass !== "function" && typeof CursorClass !== "function") {
+    throw new LaneAdapterShapeError("@cursor/sdk exports no Agent/Cursor class");
   }
-  if (!Array.isArray(graph.nodes) || graph.nodes.length === 0) {
-    issue(issues, "nodes", "graph requires at least one node");
-    return { ok: false, issues };
+  const create = AgentClass.create;
+  const agent = typeof create === "function" ? await create.call(AgentClass, { local: { cwd: job.cwd, enableAgentRetries: false } }) : typeof AgentClass === "function" ? new AgentClass : undefined;
+  if (!agent || typeof agent.send !== "function") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent has no send()");
   }
-  const starts = graph.nodes.filter((n) => n.type === "start");
-  if (starts.length === 0)
-    issue(issues, "nodes", "graph requires exactly one start node (found none)");
-  if (starts.length > 1)
-    issue(issues, "nodes", "graph requires exactly one start node (found multiple)");
-  const ends = graph.nodes.filter((n) => n.type === "end");
-  if (ends.length === 0)
-    issue(issues, "nodes", "graph requires at least one end node");
-  const seenIds = new Map;
-  for (const node of graph.nodes) {
-    if (typeof node.id !== "string" || !NODE_ID_RE.test(node.id)) {
-      issue(issues, "nodes", `node id ${JSON.stringify(node.id)} must match ${String(NODE_ID_RE)}`);
-      continue;
-    }
-    if (seenIds.has(node.id)) {
-      issue(issues, `nodes.${node.id}`, `duplicate node id ${node.id}`);
-      continue;
-    }
-    seenIds.set(node.id, node);
-    if (!GRAPH_NODE_TYPES.includes(node.type)) {
-      issue(issues, `nodes.${node.id}`, `unknown node type ${JSON.stringify(node.type)}`);
-      continue;
-    }
-    validateNode(graph, node, issues);
+  let run2 = await agent.send(job.prompt, { model: job.model });
+  if (run2 && typeof run2 === "object") {
+    const handle = run2;
+    if (typeof handle.cancel === "function")
+      onCancel(() => {
+        handle.cancel().catch(() => {});
+      });
+    if (typeof handle.wait === "function")
+      run2 = await handle.wait();
   }
-  for (const node of graph.nodes) {
-    const edges = nodeEdges(node);
-    for (const { kind, target } of edges) {
-      if (!seenIds.has(target)) {
-        issue(issues, `nodes.${node.id}`, `${kind} edge targets nonexistent node ${target}`);
-      }
-    }
+  if (!run2 || typeof run2 !== "object") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned no Run");
   }
-  if (starts.length === 1) {
-    const reachable = new Set(reachableNodes(graph));
-    for (const node of graph.nodes) {
-      if (!reachable.has(node.id)) {
-        issue(issues, `nodes.${node.id}`, `node ${node.id} is unreachable from start`);
-      }
-    }
+  const candidate = run2;
+  if (typeof candidate.status !== "string" || !["finished", "error", "cancelled"].includes(candidate.status)) {
+    throw new LaneAdapterShapeError(`@cursor/sdk Agent.send() returned a Run without a terminal status (got ${JSON.stringify(candidate.status)}; expected finished|error|cancelled)`);
   }
-  const cycles = findCycles(graph);
-  for (const cycle of cycles) {
-    issue(issues, "nodes", `explicit cycle detected: ${cycle.join(" -> ")} (loop only via a while node)`);
+  if (typeof candidate.result !== "string") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned a Run without a string result");
   }
-  return { ok: issues.length === 0, issues };
+  return { status: candidate.status, result: candidate.result };
 }
-function nodeEdges(node) {
-  switch (node.type) {
-    case "start":
-    case "step":
-      return node.next ? [{ kind: "next", target: node.next }] : [];
-    case "decision":
-      return [
-        ...node.then ? [{ kind: "then", target: node.then }] : [],
-        ...node.else ? [{ kind: "else", target: node.else }] : []
-      ];
-    case "while":
-      return node.next ? [{ kind: "next", target: node.next }] : [];
-    case "end":
-      return [];
+async function runCursorCli(job, cliPath, started, timeoutMs) {
+  try {
+    const result = await spawnCli([cliPath, "--print", job.prompt, ...job.model ? ["--model", job.model] : []], {
+      binaryName: cliPath,
+      packageHint: "@cursor/sdk (local mode) or the cursor-agent CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd
+    });
+    return { ...result, durationMs: Date.now() - started };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    }
+    throw err;
   }
 }
-function validateNode(graph, node, issues) {
-  switch (node.type) {
-    case "start":
-      if (!node.next)
-        issue(issues, `nodes.${node.id}`, "start node requires a next edge");
-      break;
-    case "step": {
-      if (!node.prompt && !node.command) {
-        issue(issues, `nodes.${node.id}`, "step node requires prompt or command");
-      }
-      if (node.lane !== undefined && !LANE_KINDS.includes(node.lane)) {
-        issue(issues, `nodes.${node.id}`, `unknown lane ${JSON.stringify(node.lane)} (expected one of ${LANE_KINDS.join(", ")})`);
-      }
-      if (node.maxRetries !== undefined && (!Number.isInteger(node.maxRetries) || node.maxRetries < 0)) {
-        issue(issues, `nodes.${node.id}`, "maxRetries must be a non-negative integer");
+var init_cursor = __esm(() => {
+  init_types();
+});
+
+// src/lanes/grok.ts
+function createGrokAdapter(deps = {}) {
+  return {
+    kind: "grok",
+    async probe() {
+      const cliPath = deps.cliPath ?? "grok";
+      if (binaryOnPath(cliPath)) {
+        return { kind: "grok", sdk: "no npm SDK (measured 2026-08-25)", wired: true, via: "cli" };
       }
-      if (node.timeoutMs !== undefined && (!Number.isInteger(node.timeoutMs) || node.timeoutMs < 1)) {
-        issue(issues, `nodes.${node.id}`, "timeoutMs must be a positive integer");
+      return {
+        kind: "grok",
+        sdk: "no npm SDK (measured 2026-08-25)",
+        wired: false,
+        reason: `no xAI Grok SDK exists on npm (measured 2026-08-25) and the grok CLI is not on PATH`
+      };
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "grok lane requires a prompt" };
       }
-      break;
-    }
-    case "decision": {
-      if (typeof node.condition !== "string" || node.condition.trim() === "") {
-        issue(issues, `nodes.${node.id}`, "decision node requires a condition expression");
-      } else {
-        try {
-          parseExpr(node.condition);
-        } catch (err) {
-          if (err instanceof ExprSyntaxError) {
-            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
-          } else {
-            throw err;
-          }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const cliPath = deps.cliPath ?? "grok";
+      try {
+        const result = await spawnCli([cliPath, job.prompt], {
+          binaryName: cliPath,
+          packageHint: "the grok CLI (no xAI Grok SDK exists on npm \u2014 measured 2026-08-25)",
+          timeoutMs,
+          env: job.env,
+          cwd: job.cwd
+        });
+        return { ...result, durationMs: Date.now() - started };
+      } catch (err) {
+        if (err instanceof LaneDependencyMissingError) {
+          return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
         }
+        throw err;
       }
-      if (!node.then && !node.else) {
-        issue(issues, `nodes.${node.id}`, "decision node requires then and/or else edge");
-      }
-      break;
     }
-    case "while": {
-      if (typeof node.condition !== "string" || node.condition.trim() === "") {
-        issue(issues, `nodes.${node.id}`, "while node requires a condition expression");
-      } else {
-        try {
-          parseExpr(node.condition);
-        } catch (err) {
-          if (err instanceof ExprSyntaxError) {
-            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
-          } else {
-            throw err;
-          }
-        }
-      }
-      if (node.maxIterations === undefined) {
-        issue(issues, `nodes.${node.id}`, "while node requires maxIterations (finite loop bound)");
-      } else if (!Number.isInteger(node.maxIterations) || node.maxIterations < 1) {
-        issue(issues, `nodes.${node.id}`, "maxIterations must be a positive integer");
-      }
-      if (!Array.isArray(node.body) || node.body.length === 0) {
-        issue(issues, `nodes.${node.id}`, "while node requires a non-empty body");
-      } else {
-        for (const bodyId of node.body) {
-          const bodyNode = findNode(graph, bodyId);
-          if (!bodyNode) {
-            issue(issues, `nodes.${node.id}`, `while body references nonexistent node ${bodyId}`);
-            continue;
-          }
-          if (bodyNode.type === "start" || bodyNode.type === "end" || bodyNode.type === "while") {
-            issue(issues, `nodes.${node.id}`, `while body may only contain step/decision nodes in v1 (found ${bodyNode.type})`);
-          }
-        }
-        const bodySet = new Set(node.body);
-        for (const bodyId of node.body) {
-          const bodyNode = findNode(graph, bodyId);
-          if (!bodyNode)
-            continue;
-          for (const { kind, target } of nodeEdges(bodyNode)) {
-            if (!bodySet.has(target)) {
-              issue(issues, `nodes.${node.id}`, `while body node ${bodyId} ${kind}-edge leaves the body (target ${target})`);
-            }
-          }
-        }
-      }
-      break;
+  };
+}
+var init_grok = __esm(() => {
+  init_types();
+});
+
+// src/lanes/index.ts
+var exports_lanes = {};
+__export(exports_lanes, {
+  runLaneJob: () => runLaneJob,
+  resolveLane: () => resolveLane,
+  probeLane: () => probeLane,
+  laneInventory: () => laneInventory,
+  createGrokAdapter: () => createGrokAdapter,
+  createCursorAdapter: () => createCursorAdapter,
+  createCodexAdapter: () => createCodexAdapter,
+  createClaudeAdapter: () => createClaudeAdapter,
+  binaryOnPath: () => binaryOnPath,
+  LaneDependencyMissingError: () => LaneDependencyMissingError,
+  LaneAdapterShapeError: () => LaneAdapterShapeError,
+  LANE_KINDS: () => LANE_KINDS2
+});
+function resolveLane(kind) {
+  const adapter = adapters.get(kind);
+  if (!adapter)
+    throw new Error(`unknown lane ${kind} (expected one of ${LANE_KINDS2.join(", ")})`);
+  return adapter;
+}
+async function runLaneJob(job) {
+  return resolveLane(job.lane).run(job);
+}
+async function probeLane(kind) {
+  return resolveLane(kind).probe();
+}
+async function laneInventory() {
+  return Promise.all(LANE_KINDS2.map((kind) => probeLane(kind)));
+}
+var adapters;
+var init_lanes = __esm(() => {
+  init_claude();
+  init_codex();
+  init_cursor();
+  init_grok();
+  init_types();
+  init_types();
+  init_claude();
+  init_codex();
+  init_cursor();
+  init_grok();
+  adapters = new Map([
+    ["claude", createClaudeAdapter()],
+    ["codex", createCodexAdapter()],
+    ["cursor", createCursorAdapter()],
+    ["grok", createGrokAdapter()]
+  ]);
+});
+
+// src/service.ts
+import { createHash as createHash3 } from "crypto";
+// package.json
+var package_default = {
+  name: "@hasna/workflows",
+  version: "0.2.1",
+  description: "Universal graph workflow app \u2014 graph language (start/step/decision/while/end), three-table store, session WAL, daemon with claims/leases, four lane adapters (claude/codex/cursor/grok), and a full CLI on four surfaces",
+  type: "module",
+  main: "./dist/index.js",
+  types: "./types/index.d.ts",
+  bin: {
+    workflows: "dist/cli/index.js",
+    "workflows-mcp": "dist/mcp/index.js",
+    "workflows-serve": "dist/serve/index.js"
+  },
+  exports: {
+    ".": {
+      types: "./types/index.d.ts",
+      import: "./dist/index.js"
+    },
+    "./sdk": {
+      types: "./types/sdk.d.ts",
+      import: "./dist/sdk.js"
+    },
+    "./cli": {
+      types: "./types/cli/index.d.ts",
+      import: "./dist/cli/index.js"
     }
-    case "end":
-      break;
+  },
+  files: [
+    "dist",
+    "types",
+    "README.md",
+    "LICENSE",
+    "hasna.contract.json"
+  ],
+  scripts: {
+    build: "bun run check:sdk && bun run build:runtime && bun run build:types",
+    "generate:sdk": "bun scripts/generate-sdk.ts --write",
+    "check:sdk": "bun scripts/generate-sdk.ts",
+    "test:artifacts": "bun scripts/artifact-acceptance.ts",
+    "build:runtime": "bun build src/cli/index.ts --outdir dist/cli --target bun && bun build src/mcp/index.ts --outdir dist/mcp --target bun && bun build src/serve/index.ts src/serve/admin.ts --outdir dist/serve --target bun --packages external && bun build src/index.ts src/service.ts src/handlers.ts src/agent-tools.ts src/types.ts --root src --outdir dist --target bun --packages external && bun build src/sdk.ts --outdir dist --target node",
+    "build:types": "tsc -p tsconfig.build.json --emitDeclarationOnly --outDir types",
+    "artifact-scan": "bun scripts/contracts-cli.mjs artifact-scan dist",
+    "contract:check": "bun scripts/contracts-cli.mjs repo-conformance .",
+    typecheck: "tsc --noEmit",
+    test: "bun test",
+    "test:pg": 'WORKFLOWS_TEST_DATABASE_URL="${WORKFLOWS_TEST_DATABASE_URL:?point it at a fresh test Postgres database}" WORKFLOWS_REQUIRE_POSTGRES=1 bun test src/db/postgres-store.test.ts src/db/postgres-http.test.ts src/db/postgres-fencing.test.ts',
+    prepack: "bun run build && bun run artifact-scan",
+    prepublishOnly: "bun run test && bun run build"
+  },
+  keywords: [
+    "workflows",
+    "graph",
+    "automation",
+    "cli",
+    "typescript",
+    "bun",
+    "hasna"
+  ],
+  publishConfig: {
+    registry: "https://registry.npmjs.org",
+    access: "public"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/hasna/apps.git",
+    directory: "apps/workflows"
+  },
+  homepage: "https://github.com/hasna/apps/tree/main/apps/workflows",
+  bugs: {
+    url: "https://github.com/hasna/apps/issues"
+  },
+  engines: {
+    bun: ">=1.0.0"
+  },
+  author: "Hasna",
+  license: "Apache-2.0",
+  dependencies: {
+    "@anthropic-ai/claude-agent-sdk": "0.3.234",
+    "@cursor/sdk": "^1.0.28",
+    "@hasna/contracts": "1.3.3",
+    "@openai/codex-sdk": "0.160.0",
+    commander: "^13.1.0",
+    pg: "^8.16.3"
+  },
+  devDependencies: {
+    "@types/bun": "1.3.14",
+    "@types/pg": "^8.15.6",
+    typescript: "^5.7.3"
   }
+};
+
+// src/version.ts
+function packageVersion() {
+  return package_default.version;
 }
 
+// src/daemon.ts
+init_expr();
+init_graph();
+import { randomUUID as randomUUID2 } from "crypto";
+
 // src/secrets.ts
 class SecretsGateError extends Error {
   constructor(message) {
@@ -1159,34 +1286,49 @@ import { readFileSync, statSync } from "fs";
 import { isAbsolute, join } from "path";
 var DEFAULT_MAX_ATTEMPTS = 3;
 function repairTornRuns(store, wal, opts = {}) {
+  const sequence = repairSteps(store, wal, opts);
+  let step = sequence.next();
+  while (!step.done) {
+    if (step.value instanceof Promise) {
+      return (async () => {
+        while (!step.done)
+          step = sequence.next(await step.value);
+        return step.value;
+      })();
+    }
+    step = sequence.next(step.value);
+  }
+  return step.value;
+}
+function* repairSteps(store, wal, opts) {
   const maxAttempts = opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
   const replay = wal.replay();
   const liveClaims = replay.liveClaims(opts.now);
   const report = { interrupted: 0, requeued: 0, failed: 0 };
-  const running = store.listRuns({ status: "running", limit: 1000 });
+  const running = yield store.listRuns({ status: "running", limit: 1000 });
   for (const run of running) {
     if (liveClaims.has(run.id))
       continue;
     report.interrupted++;
-    const nodes = store.listRunNodes(run.id);
+    const nodes = yield store.listRunNodes(run.id);
     if (run.attempts < maxAttempts) {
-      store.bumpAttempts(run.id);
-      store.setRunStatus(run.id, "interrupted", {
+      yield store.bumpAttempts(run.id);
+      yield store.setRunStatus(run.id, "interrupted", {
         error: `torn run interrupted after claim loss (attempt ${run.attempts + 1}/${maxAttempts})`
       });
       for (const node of nodes) {
         if (node.status === "running") {
-          store.setRunNodeStatus(node.id, "pending", { error: undefined });
+          yield store.setRunNodeStatus(node.id, "pending", { error: undefined });
         }
       }
       report.requeued++;
     } else {
-      store.setRunStatus(run.id, "failed", {
+      yield store.setRunStatus(run.id, "failed", {
         error: `torn run failed after ${maxAttempts} interrupted attempts`
       });
       for (const node of nodes) {
         if (node.status === "running") {
-          store.setRunNodeStatus(node.id, "failed", { error: "run interrupted beyond retry budget" });
+          yield store.setRunNodeStatus(node.id, "failed", { error: "run interrupted beyond retry budget" });
         }
       }
       report.failed++;
@@ -1202,15 +1344,17 @@ function memoKey(graphName, nodeId, input) {
 }
 function tryMemoHit(store, graphName, nodeId, input) {
   const key = memoKey(graphName, nodeId, input);
-  const memo = store.memoGet(key);
-  if (!memo)
-    return;
-  store.memoHit(key);
-  return memo;
-}
-function recordMemo(store, graphName, nodeId, input, output) {
-  const key = memoKey(graphName, nodeId, input);
-  store.memoPut(key, graphName, nodeId, inputHash(input), JSON.stringify(output));
+  const value = store.memoGet(key);
+  if (value instanceof Promise) {
+    return value.then(async (row) => {
+      if (row)
+        await store.memoHit(key);
+      return row;
+    });
+  }
+  if (value)
+    store.memoHit(key);
+  return value;
 }
 function memoWatchFingerprint(graph, dataDir) {
   if (!graph.memoWatch || graph.memoWatch.length === 0)
@@ -1252,20 +1396,377 @@ function fingerprintFile(pattern, path) {
     return { pattern, path, missing: true, mtimeMs: null, size: null, sha256: null };
   }
 }
-function findRunByIdempotencyKey(store, key) {
-  const runs = store.listRuns({ limit: 1000 });
-  for (const run of runs) {
+
+// src/db/postgres-store.ts
+import { randomUUID } from "crypto";
+import { Pool } from "pg";
+var run = (r) => ({
+  id: String(r.id),
+  graphName: String(r.graph_name),
+  graphVersion: String(r.graph_version),
+  status: r.status,
+  attempts: Number(r.attempts),
+  contextJson: String(r.context_json),
+  resultJson: r.result_json == null ? null : String(r.result_json),
+  error: r.error == null ? null : String(r.error),
+  startedAt: r.started_at == null ? null : String(r.started_at),
+  finishedAt: r.finished_at == null ? null : String(r.finished_at),
+  createdAt: String(r.created_at),
+  updatedAt: String(r.updated_at)
+});
+var node = (r) => ({
+  id: String(r.id),
+  runId: String(r.run_id),
+  nodeId: String(r.node_id),
+  status: r.status,
+  attempts: Number(r.attempts),
+  lane: r.lane == null ? null : String(r.lane),
+  exitCode: r.exit_code == null ? null : Number(r.exit_code),
+  outputJson: r.output_json == null ? null : String(r.output_json),
+  error: r.error == null ? null : String(r.error),
+  startedAt: r.started_at == null ? null : String(r.started_at),
+  finishedAt: r.finished_at == null ? null : String(r.finished_at)
+});
+var memo = (r) => ({
+  key: String(r.key),
+  graphName: String(r.graph_name),
+  nodeId: String(r.node_id),
+  inputHash: String(r.input_hash),
+  outputJson: String(r.output_json),
+  hitCount: Number(r.hit_count),
+  createdAt: String(r.created_at)
+});
+
+class WorkflowStorageError extends Error {
+  constructor() {
+    super("PostgreSQL workflow storage is unavailable or its schema is invalid");
+    this.name = "WorkflowStorageError";
+  }
+}
+
+class PostgresWorkflowsStore {
+  pool;
+  prefix;
+  dataDir;
+  execution;
+  constructor(options) {
+    const schema = options.schema ?? "workflows";
+    if (!/^[a-z][a-z0-9_]{0,62}$/.test(schema))
+      throw new Error("PostgreSQL schema must be a lowercase SQL identifier");
+    this.prefix = `"${schema}"`;
+    this.dataDir = options.dataDir;
+    this.pool = new Pool({
+      connectionString: options.databaseUrl,
+      max: 4,
+      connectionTimeoutMillis: 5000,
+      idleTimeoutMillis: 1e4,
+      statement_timeout: 1e4,
+      application_name: "workflows"
+    });
+  }
+  async rows(sql, values = []) {
     try {
-      const context = JSON.parse(run.contextJson);
-      if (context?.__wf?.idempotencyKey === key)
-        return run;
-    } catch {}
+      if (this.execution?.lost)
+        throw new WorkflowStorageError;
+      return (await (this.execution?.client ?? this.pool).query(sql, values)).rows;
+    } catch (error) {
+      if (error?.code === "23505")
+        throw Object.assign(new Error("workflow uniqueness conflict"), { code: "23505" });
+      throw new WorkflowStorageError;
+    }
+  }
+  async close() {
+    await this.releaseExecution();
+    await this.pool.end();
+  }
+  async acquireExecution(runId) {
+    if (this.execution)
+      return this.execution.runId === runId && !this.execution.lost;
+    const client = await this.pool.connect();
+    let lost = false;
+    client.on("error", () => {
+      lost = true;
+      if (this.execution?.client === client)
+        this.execution.lost = true;
+    });
+    try {
+      const acquired = await client.query("SELECT pg_try_advisory_lock(hashtextextended($1,0)) AS owned", [`${this.prefix}:${runId}`]);
+      if (!acquired.rows[0]?.owned) {
+        client.release();
+        return false;
+      }
+      this.execution = { runId, client, lost };
+      return !lost;
+    } catch {
+      client.release(true);
+      throw new WorkflowStorageError;
+    }
+  }
+  async releaseExecution() {
+    const owned = this.execution;
+    if (!owned)
+      return;
+    this.execution = undefined;
+    try {
+      if (!owned.lost)
+        await owned.client.query("SELECT pg_advisory_unlock(hashtextextended($1,0))", [`${this.prefix}:${owned.runId}`]);
+    } finally {
+      owned.client.release(owned.lost);
+    }
+  }
+  async transaction(action) {
+    if (this.execution?.lost)
+      throw new WorkflowStorageError;
+    const client = this.execution?.client ?? await this.pool.connect();
+    const retained = client === this.execution?.client;
+    try {
+      await client.query("BEGIN");
+      const result = await action(client);
+      await client.query("COMMIT");
+      return result;
+    } catch {
+      try {
+        await client.query("ROLLBACK");
+      } catch {}
+      throw new WorkflowStorageError;
+    } finally {
+      if (!retained)
+        client.release();
+    }
+  }
+  async listTables() {
+    return (await this.rows("SELECT table_name FROM information_schema.tables WHERE table_schema=$1 AND table_type='BASE TABLE' ORDER BY table_name", [this.prefix.slice(1, -1)])).map((row) => String(row.table_name));
+  }
+  async checkSchema() {
+    if ((await this.listTables()).join(",") !== "memos,run_nodes,runs")
+      return false;
+    await this.rows(`SELECT id,graph_name,graph_version,status,attempts,context_json,result_json,error,started_at,finished_at,created_at,updated_at FROM ${this.prefix}.runs LIMIT 0`);
+    await this.rows(`SELECT id,sequence,run_id,node_id,status,attempts,lane,exit_code,output_json,error,started_at,finished_at FROM ${this.prefix}.run_nodes LIMIT 0`);
+    await this.rows(`SELECT key,graph_name,node_id,input_hash,output_json,hit_count,created_at FROM ${this.prefix}.memos LIMIT 0`);
+    const schema = this.prefix.slice(1, -1);
+    const indices = await this.rows(`SELECT i.indisunique,i.indisvalid,i.indisready,i.indnkeyatts,i.indnatts,i.indpred IS NULL AS unfiltered,pg_get_expr(i.indexprs,i.indrelid) AS expression FROM pg_index i JOIN pg_class c ON c.oid=i.indexrelid JOIN pg_class t ON t.oid=i.indrelid JOIN pg_namespace n ON n.oid=c.relnamespace WHERE n.nspname=$1 AND c.relname='runs_idempotency' AND t.relname='runs'`, [schema]);
+    const index = indices[0];
+    if (indices.length !== 1 || !index?.indisunique || !index.indisvalid || !index.indisready || !index.unfiltered || Number(index.indnkeyatts) !== 1 || Number(index.indnatts) !== 1 || String(index.expression).replace(/[()\s]/g, "") !== "context_json::jsonb#>>'{__wf,idempotencyKey}'::text[]")
+      return false;
+    const columns = await this.rows("SELECT table_name,column_name,data_type,is_nullable,is_identity,identity_generation FROM information_schema.columns WHERE table_schema=$1", [schema]);
+    const required = {
+      runs: ["id:text", "graph_name:text", "graph_version:text", "status:text", "attempts:integer", "context_json:text", "created_at:text", "updated_at:text"],
+      run_nodes: ["id:text", "sequence:bigint", "run_id:text", "node_id:text", "status:text", "attempts:integer"],
+      memos: ["key:text", "graph_name:text", "node_id:text", "input_hash:text", "output_json:text", "hit_count:integer", "created_at:text"]
+    };
+    for (const [table, fields] of Object.entries(required))
+      for (const field of fields) {
+        const [name, type] = field.split(":");
+        const c = columns.find((row) => row.table_name === table && row.column_name === name);
+        if (!c || c.data_type !== type || c.is_nullable !== "NO")
+          return false;
+        if (name === "sequence" && (c.is_identity !== "YES" || c.identity_generation !== "ALWAYS"))
+          return false;
+      }
+    const constraints = await this.rows(`SELECT c.relname AS table_name,co.contype,pg_get_constraintdef(co.oid) AS definition FROM pg_constraint co JOIN pg_class c ON c.oid=co.conrelid JOIN pg_namespace n ON n.oid=c.relnamespace WHERE n.nspname=$1`, [schema]);
+    for (const [table, key] of [["runs", "id"], ["run_nodes", "id"], ["memos", "key"]])
+      if (!constraints.some((row) => row.table_name === table && row.contype === "p" && row.definition === `PRIMARY KEY (${key})`))
+        return false;
+    return constraints.some((row) => row.table_name === "run_nodes" && row.contype === "f" && String(row.definition).replaceAll('"', "") === `FOREIGN KEY (run_id) REFERENCES ${schema}.runs(id)`);
+  }
+  async initialize() {
+    const tables = await this.listTables();
+    if (tables.length) {
+      if (await this.checkSchema())
+        return;
+      throw new WorkflowStorageError;
+    }
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query(`CREATE SCHEMA IF NOT EXISTS ${this.prefix};
+      CREATE TABLE IF NOT EXISTS ${this.prefix}.runs (
+        id TEXT PRIMARY KEY, graph_name TEXT NOT NULL, graph_version TEXT NOT NULL, status TEXT NOT NULL,
+        attempts INTEGER NOT NULL DEFAULT 0, context_json TEXT NOT NULL, result_json TEXT, error TEXT,
+        started_at TEXT, finished_at TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS ${this.prefix}.run_nodes (
+        id TEXT PRIMARY KEY, sequence BIGINT GENERATED ALWAYS AS IDENTITY, run_id TEXT NOT NULL REFERENCES ${this.prefix}.runs(id), node_id TEXT NOT NULL,
+        status TEXT NOT NULL, attempts INTEGER NOT NULL DEFAULT 0, lane TEXT, exit_code INTEGER,
+        output_json TEXT, error TEXT, started_at TEXT, finished_at TEXT);
+      CREATE TABLE IF NOT EXISTS ${this.prefix}.memos (
+        key TEXT PRIMARY KEY, graph_name TEXT NOT NULL, node_id TEXT NOT NULL, input_hash TEXT NOT NULL,
+        output_json TEXT NOT NULL, hit_count INTEGER NOT NULL DEFAULT 0, created_at TEXT NOT NULL);
+      CREATE UNIQUE INDEX IF NOT EXISTS runs_idempotency ON ${this.prefix}.runs ((context_json::jsonb #>> '{__wf,idempotencyKey}'));
+      CREATE INDEX IF NOT EXISTS runs_status ON ${this.prefix}.runs(status);
+      CREATE INDEX IF NOT EXISTS nodes_run ON ${this.prefix}.run_nodes(run_id);`);
+      await client.query("COMMIT");
+    } catch {
+      await client.query("ROLLBACK");
+      throw new WorkflowStorageError;
+    } finally {
+      client.release();
+    }
+    if (!await this.checkSchema())
+      throw new WorkflowStorageError;
+  }
+  async createRun(input) {
+    const at = new Date().toISOString();
+    const rows = await this.rows(`INSERT INTO ${this.prefix}.runs(id,graph_name,graph_version,status,context_json,created_at,updated_at)
+      VALUES($1,$2,$3,'pending',$4,$5,$5) RETURNING *`, [randomUUID(), input.graphName, input.graphVersion, JSON.stringify(input.context ?? {}), at]);
+    return run(rows[0]);
+  }
+  async getRun(id) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.runs WHERE id=$1`, [id]);
+    return rows[0] ? run(rows[0]) : undefined;
+  }
+  async getRunByIdempotencyKey(key) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.runs WHERE context_json::jsonb #>> '{__wf,idempotencyKey}'=$1`, [key]);
+    return rows[0] ? run(rows[0]) : undefined;
+  }
+  async listRuns(options = {}) {
+    const limit = Math.max(1, Math.min(1000, options.limit ?? 100));
+    return (await this.rows(`SELECT * FROM ${this.prefix}.runs ${options.status ? "WHERE status=$2" : ""} ORDER BY created_at DESC,id DESC LIMIT $1`, options.status ? [limit, options.status] : [limit])).map(run);
+  }
+  async setRunStatus(id, status, patch = {}) {
+    const values = [id, status, new Date().toISOString()];
+    const sets = ["status=$2", "updated_at=$3"];
+    for (const [field, key] of [["result_json", "result"], ["error", "error"], ["started_at", "startedAt"], ["finished_at", "finishedAt"]]) {
+      if (Object.hasOwn(patch, key)) {
+        values.push(key === "result" ? JSON.stringify(patch.result) : patch[key]);
+        sets.push(`${field}=$${values.length}`);
+      }
+    }
+    if (status === "running" && !Object.hasOwn(patch, "startedAt"))
+      sets.push("started_at=COALESCE(started_at,$3)");
+    await this.rows(`UPDATE ${this.prefix}.runs SET ${sets.join(",")} WHERE id=$1`, values);
+  }
+  async compareRunStatus(id, expected, status, patch = {}) {
+    const values = [id, expected, status, new Date().toISOString()];
+    const sets = ["status=$3", "updated_at=$4"];
+    for (const [field, key] of [["result_json", "result"], ["error", "error"], ["started_at", "startedAt"], ["finished_at", "finishedAt"]]) {
+      if (patch && Object.hasOwn(patch, key)) {
+        values.push(key === "result" ? JSON.stringify(patch.result) : patch[key]);
+        sets.push(`${field}=$${values.length}`);
+      }
+    }
+    return (await this.rows(`UPDATE ${this.prefix}.runs SET ${sets.join(",")} WHERE id=$1 AND status=ANY($2::text[]) RETURNING id`, values)).length === 1;
+  }
+  async setRunContext(id, context) {
+    await this.rows(`UPDATE ${this.prefix}.runs SET context_json=$2,updated_at=$3 WHERE id=$1`, [id, JSON.stringify(context), new Date().toISOString()]);
+  }
+  async setRunningContext(id, context) {
+    return (await this.rows(`UPDATE ${this.prefix}.runs SET context_json=$2,updated_at=$3 WHERE id=$1 AND status='running' RETURNING id`, [id, JSON.stringify(context), new Date().toISOString()])).length === 1;
+  }
+  async blockRunResume(id) {
+    await this.rows(`UPDATE ${this.prefix}.runs SET context_json=jsonb_set(context_json::jsonb,'{__wf,resumeBlocked}',to_jsonb($2::text))::text,updated_at=$3 WHERE id=$1`, [id, "execution cancellation has not been confirmed", new Date().toISOString()]);
+  }
+  async dispatchIfRunning(id, action) {
+    const marked = await this.rows(`UPDATE ${this.prefix}.runs SET context_json=jsonb_set(context_json::jsonb,'{__wf,executionMayBeActive}','true'::jsonb)::text WHERE id=$1 AND status='running' RETURNING id`, [id]);
+    if (!marked.length)
+      return { started: false };
+    return this.transaction(async (client) => {
+      const run2 = await client.query(`SELECT status FROM ${this.prefix}.runs WHERE id=$1 FOR UPDATE`, [id]);
+      if (run2.rows[0]?.status !== "running")
+        return { started: false };
+      return { started: true, result: action() };
+    });
+  }
+  async finishDispatch(id, unconfirmed) {
+    await this.rows(`UPDATE ${this.prefix}.runs SET context_json=(CASE WHEN $2 THEN jsonb_set(context_json::jsonb #- '{__wf,executionMayBeActive}','{__wf,resumeBlocked}',to_jsonb($3::text)) ELSE context_json::jsonb #- '{__wf,executionMayBeActive}' END)::text,updated_at=$4 WHERE id=$1`, [id, unconfirmed, "execution cancellation has not been confirmed", new Date().toISOString()]);
+  }
+  async commitStep(input) {
+    return this.transaction(async (client) => {
+      const nodes = await client.query(`SELECT run_id FROM ${this.prefix}.run_nodes WHERE id=$1 FOR UPDATE`, [input.nodeRowId]);
+      if (nodes.rows[0]?.run_id !== input.runId)
+        return false;
+      const run2 = await client.query(`SELECT status FROM ${this.prefix}.runs WHERE id=$1 FOR UPDATE`, [input.runId]);
+      if (run2.rows[0]?.status !== "running")
+        return false;
+      const patch = input.patch ?? {}, values = [input.nodeRowId, input.status];
+      const sets = ["status=$2"];
+      for (const [field, key] of [["exit_code", "exitCode"], ["output_json", "output"], ["error", "error"], ["started_at", "startedAt"], ["finished_at", "finishedAt"]]) {
+        if (Object.hasOwn(patch, key)) {
+          values.push(key === "output" ? JSON.stringify(patch.output) : patch[key]);
+          sets.push(`${field}=$${values.length}`);
+        }
+      }
+      if (input.status === "running") {
+        values.push(new Date().toISOString());
+        sets.push(`started_at=COALESCE(started_at,$${values.length})`);
+      }
+      if (["completed", "failed", "skipped"].includes(input.status)) {
+        values.push(new Date().toISOString());
+        sets.push(`finished_at=$${values.length}`);
+      }
+      if (input.incrementAttempts)
+        sets.push("attempts=attempts+1");
+      await client.query(`UPDATE ${this.prefix}.run_nodes SET ${sets.join(",")} WHERE id=$1`, values);
+      if (input.context !== undefined)
+        await client.query(`UPDATE ${this.prefix}.runs SET context_json=$2,updated_at=$3 WHERE id=$1`, [input.runId, JSON.stringify(input.context), new Date().toISOString()]);
+      if (input.memo) {
+        const m = input.memo;
+        await client.query(`INSERT INTO ${this.prefix}.memos(key,graph_name,node_id,input_hash,output_json,created_at) VALUES($1,$2,$3,$4,$5,$6) ON CONFLICT(key) DO UPDATE SET output_json=EXCLUDED.output_json`, [m.key, m.graphName, m.nodeId, m.inputHash, m.outputJson, new Date().toISOString()]);
+      }
+      return true;
+    });
+  }
+  async bumpAttempts(id) {
+    await this.rows(`UPDATE ${this.prefix}.runs SET attempts=attempts+1,updated_at=$2 WHERE id=$1`, [id, new Date().toISOString()]);
+  }
+  async createRunNode(input) {
+    const rows = await this.rows(`INSERT INTO ${this.prefix}.run_nodes(id,run_id,node_id,lane,status) VALUES($1,$2,$3,$4,'pending') RETURNING *`, [randomUUID(), input.runId, input.nodeId, input.lane ?? null]);
+    return node(rows[0]);
+  }
+  async getRunNode(id) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.run_nodes WHERE id=$1`, [id]);
+    return rows[0] ? node(rows[0]) : undefined;
+  }
+  async listRunNodes(runId) {
+    return (await this.rows(`SELECT * FROM ${this.prefix}.run_nodes WHERE run_id=$1 ORDER BY sequence`, [runId])).map(node);
+  }
+  async getLatestRunNode(runId, nodeId) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.run_nodes WHERE run_id=$1 AND node_id=$2 ORDER BY sequence DESC LIMIT 1`, [runId, nodeId]);
+    return rows[0] ? node(rows[0]) : undefined;
+  }
+  async setRunNodeStatus(id, status, patch = {}) {
+    const values = [id, status];
+    const sets = ["status=$2"];
+    for (const [field, key] of [["exit_code", "exitCode"], ["output_json", "output"], ["error", "error"], ["started_at", "startedAt"], ["finished_at", "finishedAt"]]) {
+      if (Object.hasOwn(patch, key)) {
+        values.push(key === "output" ? JSON.stringify(patch.output) : patch[key]);
+        sets.push(`${field}=$${values.length}`);
+      }
+    }
+    if (status === "running" && !Object.hasOwn(patch, "startedAt")) {
+      values.push(new Date().toISOString());
+      sets.push(`started_at=COALESCE(started_at,$${values.length})`);
+    }
+    if (["completed", "failed", "skipped"].includes(status) && !Object.hasOwn(patch, "finishedAt")) {
+      values.push(new Date().toISOString());
+      sets.push(`finished_at=$${values.length}`);
+    }
+    await this.rows(`UPDATE ${this.prefix}.run_nodes SET ${sets.join(",")} WHERE id=$1`, values);
+  }
+  async bumpAttemptsNode(id) {
+    await this.rows(`UPDATE ${this.prefix}.run_nodes SET attempts=attempts+1 WHERE id=$1`, [id]);
+  }
+  async memoPut(key, graphName, nodeId, inputHash2, outputJson) {
+    await this.rows(`INSERT INTO ${this.prefix}.memos(key,graph_name,node_id,input_hash,output_json,created_at) VALUES($1,$2,$3,$4,$5,$6)
+      ON CONFLICT(key) DO UPDATE SET output_json=EXCLUDED.output_json`, [key, graphName, nodeId, inputHash2, outputJson, new Date().toISOString()]);
+  }
+  async memoGet(key) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.memos WHERE key=$1`, [key]);
+    return rows[0] ? memo(rows[0]) : undefined;
+  }
+  async memoHit(key) {
+    await this.rows(`UPDATE ${this.prefix}.memos SET hit_count=hit_count+1 WHERE key=$1`, [key]);
+  }
+  async memoList() {
+    return (await this.rows(`SELECT * FROM ${this.prefix}.memos ORDER BY created_at DESC,key LIMIT 1000`)).map(memo);
+  }
+  async memoClear() {
+    throw new Error("PostgreSQL memo removal requires the reviewed server-operator preservation procedure");
   }
-  return;
 }
 
 // src/daemon.ts
 init_types();
+init_types();
 var DEFAULT_LEASE_TTL_MS = 120000;
 var DEFAULT_MAX_ATTEMPTS2 = 3;
 var DEFAULT_MAX_DISPATCH = 4;
@@ -1278,27 +1779,28 @@ function stripRunState(context) {
   const { __wf: _wf, steps: _steps, ...user } = context;
   return user;
 }
-function runCommand(job) {
+async function runCommand(job) {
   if (!job.command) {
     return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "no command" };
   }
   const started = Date.now();
   const timeoutMs = job.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const proc = Bun.spawnSync({
+  const proc = Bun.spawn({
     cmd: ["/bin/sh", "-c", job.command],
     cwd: job.cwd,
-    env: { ...process.env, ...job.env ?? {} },
+    env: subscriptionEnvironment(job.env),
     stdout: "pipe",
     stderr: "pipe",
     timeout: timeoutMs
   });
-  const durationMs = Date.now() - started;
-  const stdout = proc.stdout ? new TextDecoder().decode(proc.stdout) : "";
-  const stderr = proc.stderr ? new TextDecoder().decode(proc.stderr) : "";
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
   const output = stderr ? `${stdout}
 ${stderr}`.trim() : stdout.trim();
-  const exitCode = proc.exitCode ?? (proc.signalCode ? 1 : 1);
-  return { ok: exitCode === 0, exitCode, output, durationMs };
+  return { ok: exitCode === 0, exitCode, output, durationMs: Date.now() - started };
 }
 
 class WorkflowsDaemon {
@@ -1319,7 +1821,7 @@ class WorkflowsDaemon {
   constructor(store, wal, options = {}) {
     this.store = store;
     this.wal = wal;
-    this.worker = options.worker ?? "local";
+    this.worker = options.worker ?? `worker-${randomUUID2()}`;
     this.leaseTtlMs = options.leaseTtlMs ?? DEFAULT_LEASE_TTL_MS;
     this.maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS2;
     this.maxDispatchPerCycle = options.maxDispatchPerCycle ?? DEFAULT_MAX_DISPATCH;
@@ -1351,17 +1853,22 @@ class WorkflowsDaemon {
     return this.leases;
   }
   claim(runId) {
+    return this.wal.exclusive(() => this.claimLocked(runId));
+  }
+  claimLocked(runId) {
     const now = this.time();
     const existing = this.leases.get(runId);
     if (existing && existing.worker !== this.worker && existing.expiresAtMs > now) {
       return null;
     }
-    const liveClaims = this.wal.replay().liveClaims(now);
+    const replay = this.wal.replay();
+    const liveClaims = replay.liveClaims(now);
     const foreign = liveClaims.get(runId);
     if (foreign && foreign.worker !== this.worker && foreign.expiresAtMs > now) {
       return null;
     }
-    const fencing = (this.fencingCounter.get(runId) ?? 0) + 1;
+    const lastFencing = replay.entries.reduce((max, entry) => entry.op.op === "claim_acquired" && entry.op.runId === runId ? Math.max(max, entry.op.fencing) : max, 0);
+    const fencing = Math.max(lastFencing, this.fencingCounter.get(runId) ?? 0) + 1;
     this.fencingCounter.set(runId, fencing);
     const lease = { runId, worker: this.worker, expiresAtMs: now + this.leaseTtlMs, fencing };
     this.leases.set(runId, lease);
@@ -1376,16 +1883,36 @@ class WorkflowsDaemon {
     return lease;
   }
   heartbeat(runId, fencing) {
+    return this.wal.exclusive(() => this.heartbeatLocked(runId, fencing));
+  }
+  heartbeatLocked(runId, fencing) {
     const lease = this.leases.get(runId);
     if (!lease || lease.fencing !== fencing)
       return false;
+    const current = this.wal.replay({ repair: false }).liveClaims(this.time()).get(runId);
+    if (!current || current.worker !== lease.worker || current.fencing !== fencing)
+      return false;
     lease.expiresAtMs = this.time() + this.leaseTtlMs;
+    this.wal.append({
+      op: "claim_acquired",
+      runId,
+      worker: lease.worker,
+      fencing,
+      expiresAt: new Date(lease.expiresAtMs).toISOString(),
+      at: nowIso()
+    });
     return true;
   }
   release(runId, fencing) {
+    return this.wal.exclusive(() => this.releaseLocked(runId, fencing));
+  }
+  releaseLocked(runId, fencing) {
     const lease = this.leases.get(runId);
     if (!lease || lease.fencing !== fencing)
       return false;
+    const current = this.wal.replay().liveClaims(this.time()).get(runId);
+    if (current && (current.worker !== lease.worker || current.fencing !== fencing))
+      return false;
     this.leases.delete(runId);
     this.wal.append({ op: "claim_released", runId, fencing, at: nowIso() });
     return true;
@@ -1400,30 +1927,30 @@ class WorkflowsDaemon {
       }
     }
     if (this.isolatedRunId === null) {
-      const repair = repairTornRuns(this.store, this.wal, { maxAttempts: this.maxAttempts, now });
+      const repair = await repairTornRuns(this.store, this.wal, { maxAttempts: this.maxAttempts, now });
       report.interrupted += repair.interrupted;
       report.requeued += repair.requeued;
       report.failed += repair.failed;
     }
-    const pending = this.store.listRuns({ status: "pending", limit: this.maxDispatchPerCycle }).concat(this.store.listRuns({ status: "interrupted", limit: this.maxDispatchPerCycle })).sort((a, b) => a.createdAt === b.createdAt ? a.id < b.id ? 1 : -1 : a.createdAt < b.createdAt ? 1 : -1).slice(0, this.maxDispatchPerCycle);
-    for (const run of pending) {
-      if (this.isolatedRunId !== null && run.id !== this.isolatedRunId)
+    const pending = (await this.store.listRuns({ status: "pending", limit: this.maxDispatchPerCycle })).concat(await this.store.listRuns({ status: "interrupted", limit: this.maxDispatchPerCycle })).sort((a, b) => a.createdAt === b.createdAt ? a.id < b.id ? 1 : -1 : a.createdAt < b.createdAt ? 1 : -1).slice(0, this.maxDispatchPerCycle);
+    for (const run2 of pending) {
+      if (this.isolatedRunId !== null && run2.id !== this.isolatedRunId)
         continue;
-      const lease = this.claim(run.id);
+      const lease = this.claim(run2.id);
       if (!lease)
         continue;
-      this.store.setRunStatus(run.id, "running");
-      this.wal.append({ op: "run_started", runId: run.id, at: nowIso() });
+      await this.store.setRunStatus(run2.id, "running");
+      this.wal.append({ op: "run_started", runId: run2.id, at: nowIso() });
       report.dispatched++;
     }
-    const running = this.store.listRuns({ status: "running", limit: this.maxStepsPerCycle });
+    const running = await this.store.listRuns({ status: "running", limit: this.maxStepsPerCycle });
     let steps = 0;
-    for (const run of running) {
-      if (this.isolatedRunId !== null && run.id !== this.isolatedRunId)
+    for (const run2 of running) {
+      if (this.isolatedRunId !== null && run2.id !== this.isolatedRunId)
         continue;
       if (steps >= this.maxStepsPerCycle)
         break;
-      const outcome = await this.advanceRun(run.id);
+      const outcome = await this.advanceRun(run2.id);
       steps++;
       if (outcome.kind === "completed")
         report.completed++;
@@ -1449,66 +1976,78 @@ class WorkflowsDaemon {
     } else {
       this.graphCache.set(graph.name, existing);
     }
-    return this.store.createRun({ graphName: graph.name, graphVersion: graph.version, context: context ?? {} });
+    const initial = context !== null && typeof context === "object" ? context : {};
+    return this.store.createRun({
+      graphName: graph.name,
+      graphVersion: graph.version,
+      context: { ...initial, __wf: { ...initial.__wf ?? {}, graph } }
+    });
   }
   async advanceRun(runId) {
-    const run = this.store.getRun(runId);
-    if (!run || run.status !== "running")
+    const run2 = await this.store.getRun(runId);
+    if (!run2 || run2.status !== "running")
       return { kind: "noop" };
     const lease = this.leases.get(runId);
     if (!lease || lease.expiresAtMs <= this.time())
       return { kind: "blocked" };
-    const graph = this.loadGraph(run.graphName);
+    const storedContext = JSON.parse(run2.contextJson);
+    const pinned = storedContext.__wf?.graph;
+    const graph = pinned ?? this.loadGraph(run2.graphName);
     if (!graph) {
-      this.failRun(run, `graph ${run.graphName} not found in daemon graph cache`);
+      await this.failRun(run2, `graph ${run2.graphName} not found in daemon graph cache`);
       return { kind: "failed", error: "graph not found" };
     }
-    const context = JSON.parse(run.contextJson);
+    const context = storedContext;
     const rawWf = context.__wf ?? {};
     const wf = {
       ...rawWf,
       cursor: typeof rawWf.cursor === "string" ? rawWf.cursor : undefined,
-      loops: rawWf.loops ?? {},
-      completedLoops: rawWf.completedLoops ?? {}
+      loops: Object.assign(Object.create(null), rawWf.loops ?? {}),
+      completedLoops: Object.assign(Object.create(null), rawWf.completedLoops ?? {})
     };
     try {
+      if (rawWf.stepTerminal === true) {
+        context.__wf = wf;
+        await this.completeRun(run2, context);
+        return { kind: "completed" };
+      }
       const cursor = wf.cursor;
-      const node = cursor === undefined ? graph.nodes.find((n) => n.type === "start") : findNode(graph, cursor);
-      if (!node) {
-        this.failRun(run, `cursor ${cursor ?? "<start>"} resolves to no node`);
+      const node2 = cursor === undefined ? graph.nodes.find((n) => n.type === "start") : findNode(graph, cursor);
+      if (!node2) {
+        await this.failRun(run2, `cursor ${cursor ?? "<start>"} resolves to no node`);
         return { kind: "failed", error: "no node at cursor" };
       }
-      switch (node.type) {
+      switch (node2.type) {
         case "start": {
-          wf.cursor = node.next;
-          this.persistContext(run, context, wf);
-          return { kind: "advanced", nodeId: node.id };
+          wf.cursor = node2.next;
+          await this.persistContext(run2, context, wf);
+          return { kind: "advanced", nodeId: node2.id };
         }
         case "step": {
-          return await this.executeStep(run, graph, context, wf, node);
+          return await this.executeStep(run2, graph, context, wf, node2);
         }
         case "decision": {
-          const value = evaluateExpr(node.condition, this.conditionScope(context));
-          const next = value ? node.then : node.else;
+          const value = evaluateExpr(node2.condition, this.conditionScope(context));
+          const next = value ? node2.then : node2.else;
           if (!next) {
-            this.failRun(run, `decision ${node.id} evaluated ${value} but no ${value ? "then" : "else"} edge`);
+            await this.failRun(run2, `decision ${node2.id} evaluated ${value} but no ${value ? "then" : "else"} edge`);
             return { kind: "failed", error: "missing decision edge" };
           }
           wf.cursor = next;
-          this.persistContext(run, context, wf);
-          return { kind: "advanced", nodeId: node.id };
+          await this.persistContext(run2, context, wf);
+          return { kind: "advanced", nodeId: node2.id };
         }
         case "while": {
-          return this.executeWhile(run, graph, context, wf, node);
+          return await this.executeWhile(run2, graph, context, wf, node2);
         }
         case "end": {
-          this.completeRun(run, context);
+          await this.completeRun(run2, context);
           return { kind: "completed" };
         }
       }
     } catch (err) {
       if (err instanceof ExprEvalError || err instanceof ExprSyntaxError) {
-        this.failRun(run, `condition error at ${wf.cursor ?? "<start>"}: ${err.message}`);
+        await this.failRun(run2, `condition error at ${wf.cursor ?? "<start>"}: ${err.message}`);
         return { kind: "failed", error: err.message };
       }
       throw err;
@@ -1520,131 +2059,189 @@ class WorkflowsDaemon {
   conditionScope(context) {
     return { ...context, steps: context.steps ?? {} };
   }
-  persistContext(run, context, wf) {
+  async persistContext(run2, context, wf) {
     context.__wf = wf;
-    this.store.setRunContext(run.id, context);
-  }
-  async executeStep(run, graph, context, wf, node) {
-    const nodeId = node.id;
-    const latest = this.store.getLatestRunNode(run.id, nodeId);
+    await this.store.setRunningContext(run2.id, context);
+  }
+  async discardStep(run2, nodeRowId) {
+    const current = await this.store.getRun(run2.id);
+    const node2 = await this.store.getRunNode(nodeRowId);
+    if (current?.status === "cancelled" && node2 && ["pending", "running"].includes(node2.status))
+      await this.store.setRunNodeStatus(nodeRowId, "skipped", { error: "run cancelled", finishedAt: nowIso() });
+    return { kind: "noop" };
+  }
+  async executeStep(run2, graph, context, wf, node2) {
+    const nodeId = node2.id;
+    const latest = await this.store.getLatestRunNode(run2.id, nodeId);
     const isLoopBody = graph.nodes.some((candidate) => candidate.type === "while" && candidate.body.includes(nodeId));
-    const nodeRow = latest === undefined || isLoopBody && latest.status === "completed" ? this.store.createRunNode({ runId: run.id, nodeId, lane: node.lane ?? "claude" }) : latest;
-    const memoWatch = node.memo ? memoWatchFingerprint(graph, this.store.dataDir) : undefined;
-    const memoSource = { command: node.command, prompt: node.prompt, context: stripRunState(context) };
-    const memoInput = node.memo ? memoWatch !== undefined ? { ...memoSource, memoWatch } : memoSource : undefined;
+    const nodeRow = latest === undefined || isLoopBody && latest.status === "completed" ? await this.store.createRunNode({ runId: run2.id, nodeId, lane: node2.lane ?? "claude" }) : latest;
+    const memoWatch = node2.memo ? memoWatchFingerprint(graph, this.store.dataDir) : undefined;
+    const memoSource = {
+      command: node2.command,
+      prompt: node2.prompt,
+      context: stripRunState(context),
+      lane: node2.lane ?? "claude",
+      cwd: node2.cwd,
+      codexMode: node2.lane === "codex" ? node2.codexMode ?? "repository" : undefined
+    };
+    const memoInput = node2.memo ? memoWatch !== undefined ? { ...memoSource, memoWatch } : memoSource : undefined;
     if (memoInput !== undefined) {
-      const hit = tryMemoHit(this.store, run.graphName, nodeId, memoInput);
+      const hit = await tryMemoHit(this.store, run2.graphName, nodeId, memoInput);
       if (hit) {
         const cached = JSON.parse(hit.outputJson);
-        this.store.setRunNodeStatus(nodeRow.id, "completed", { exitCode: Number(cached.exitCode ?? 0), output: { ...cached, memoHit: true } });
-        this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "completed", at: nowIso() });
         this.recordStepResult(context, nodeId, { ...cached, memoHit: true });
-        return this.afterNode(run, context, wf, node.next);
+        const continuation2 = this.advanceAfterStep(graph, context, wf, node2.next);
+        if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "completed", patch: { exitCode: Number(cached.exitCode ?? 0), output: { ...cached, memoHit: true } }, context }))
+          return this.discardStep(run2, nodeRow.id);
+        this.wal.append({ op: "node_finished", runId: run2.id, nodeId, status: "completed", at: nowIso() });
+        if (continuation2.kind === "completed")
+          await this.completeRun(run2, context);
+        return continuation2;
       }
     }
     if (nodeRow.status !== "running") {
-      this.store.setRunNodeStatus(nodeRow.id, "running");
-      this.wal.append({ op: "node_started", runId: run.id, nodeId, at: nowIso() });
+      if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "running" }))
+        return this.discardStep(run2, nodeRow.id);
+      this.wal.append({ op: "node_started", runId: run2.id, nodeId, at: nowIso() });
     }
     const job = {
-      lane: node.lane ?? "claude",
-      prompt: node.prompt,
-      command: node.command,
-      timeoutMs: node.timeoutMs,
+      lane: node2.lane ?? "claude",
+      prompt: node2.prompt,
+      command: node2.command,
+      cwd: node2.cwd,
+      codexMode: node2.codexMode,
+      timeoutMs: node2.timeoutMs,
       env: this.env
     };
     let result;
+    const activeLease = this.leases.get(run2.id);
+    const pulse = setInterval(() => {
+      this.heartbeat(run2.id, activeLease.fencing);
+    }, Math.max(1, Math.floor(this.leaseTtlMs / 3)));
     try {
-      result = await this.laneRunner(job);
-    } catch (err) {
-      result = { ok: false, exitCode: 1, output: "", durationMs: 0, error: String(err instanceof Error ? err.message : err) };
+      const dispatched = await this.store.dispatchIfRunning(run2.id, async () => {
+        try {
+          return await this.laneRunner(job);
+        } catch (err) {
+          return { ok: false, exitCode: 1, output: "", durationMs: 0, error: String(err instanceof Error ? err.message : err) };
+        }
+      });
+      if (!dispatched.started) {
+        await this.store.finishDispatch(run2.id, false);
+        return this.discardStep(run2, nodeRow.id);
+      }
+      result = await dispatched.result;
+    } finally {
+      clearInterval(pulse);
+    }
+    const unconfirmed = result.retryable === false && /exceeded.*budget/.test(result.error ?? "");
+    await this.store.finishDispatch(run2.id, unconfirmed);
+    if (unconfirmed)
+      Object.assign(wf, { resumeBlocked: "execution cancellation has not been confirmed" });
+    const current = await this.store.getRun(run2.id);
+    const currentClaim = this.wal.replay({ repair: false }).liveClaims(this.time()).get(run2.id);
+    const lease = this.leases.get(run2.id);
+    if (!current || current.status !== "running" || !currentClaim || !lease || currentClaim.worker !== lease.worker || currentClaim.fencing !== lease.fencing) {
+      if (current?.status === "cancelled")
+        await this.store.setRunNodeStatus(nodeRow.id, "skipped", { error: "run cancelled", finishedAt: nowIso() });
+      return { kind: "noop" };
+    }
+    try {
+      assertNoSecrets({ output: result.output, error: result.error }, `node ${nodeId} execution`);
+    } catch {
+      result = { ok: false, exitCode: 1, output: "", durationMs: result.durationMs, error: "execution result refused by secrets write-gate", retryable: false };
     }
     const output = { ok: result.ok, exitCode: result.exitCode, output: result.output, durationMs: result.durationMs };
     if (!result.ok) {
-      const shouldRetry = nodeRow.attempts < (node.maxRetries ?? 0);
-      this.store.bumpAttemptsNode(nodeRow.id);
+      const shouldRetry = result.retryable !== false && nodeRow.attempts < (node2.maxRetries ?? 0);
       if (shouldRetry) {
-        this.store.setRunNodeStatus(nodeRow.id, "pending", { error: result.error ?? `exit ${result.exitCode}` });
+        if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "pending", patch: { error: result.error ?? `exit ${result.exitCode}` }, incrementAttempts: true }))
+          return this.discardStep(run2, nodeRow.id);
         return { kind: "advanced", nodeId };
       }
       const error = result.error ?? `step ${nodeId} failed with exit ${result.exitCode}`;
-      this.store.setRunNodeStatus(nodeRow.id, "failed", { exitCode: result.exitCode, error });
-      this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "failed", at: nowIso() });
-      this.failRun(run, error);
+      if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "failed", patch: { exitCode: result.exitCode, error }, incrementAttempts: true }))
+        return this.discardStep(run2, nodeRow.id);
+      this.wal.append({ op: "node_finished", runId: run2.id, nodeId, status: "failed", at: nowIso() });
+      await this.failRun(run2, error);
       return { kind: "failed", error };
     }
     try {
       assertNoSecrets(output, `node ${nodeId} output`);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      this.store.setRunNodeStatus(nodeRow.id, "failed", { error: message });
-      this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "failed", at: nowIso() });
-      this.failRun(run, message);
+      if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "failed", patch: { error: message } }))
+        return this.discardStep(run2, nodeRow.id);
+      this.wal.append({ op: "node_finished", runId: run2.id, nodeId, status: "failed", at: nowIso() });
+      await this.failRun(run2, message);
       return { kind: "failed", error: message };
     }
-    this.store.setRunNodeStatus(nodeRow.id, "completed", { exitCode: result.exitCode, output });
-    this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "completed", at: nowIso() });
+    let memo2;
     if (memoInput !== undefined) {
-      const memoInputAfter = node.memo ? memoWatchFingerprint(graph, this.store.dataDir) : undefined;
+      const memoInputAfter = node2.memo ? memoWatchFingerprint(graph, this.store.dataDir) : undefined;
       const stable = memoWatch === undefined && memoInputAfter === undefined || memoWatch !== undefined && memoInputAfter !== undefined && JSON.stringify(memoWatch) === JSON.stringify(memoInputAfter);
       if (stable) {
-        recordMemo(this.store, run.graphName, nodeId, memoInput, output);
-        this.wal.append({ op: "memo_set", key: memoKey(run.graphName, nodeId, memoInput), at: nowIso() });
+        memo2 = { key: memoKey(run2.graphName, nodeId, memoInput), graphName: run2.graphName, nodeId, inputHash: inputHash(memoInput), outputJson: JSON.stringify(output) };
       }
     }
     this.recordStepResult(context, nodeId, output);
-    return this.afterNode(run, context, wf, node.next);
-  }
-  afterNode(run, context, wf, next) {
+    const continuation = this.advanceAfterStep(graph, context, wf, node2.next);
+    if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "completed", patch: { exitCode: result.exitCode, output }, context, memo: memo2 }))
+      return this.discardStep(run2, nodeRow.id);
+    this.wal.append({ op: "node_finished", runId: run2.id, nodeId, status: "completed", at: nowIso() });
+    if (memo2)
+      this.wal.append({ op: "memo_set", key: memo2.key, at: nowIso() });
+    if (continuation.kind === "completed")
+      await this.completeRun(run2, context);
+    return continuation;
+  }
+  advanceAfterStep(graph, context, wf, next) {
+    context.__wf = wf;
     if (next) {
       wf.cursor = next;
-      this.persistContext(run, context, wf);
       return { kind: "advanced", nodeId: wf.cursor };
     }
     const cursor = wf.cursor;
-    const graph = this.loadGraph(run.graphName);
     const whileNode = graph.nodes.find((n) => n.type === "while" && n.body.includes(cursor ?? ""));
     if (whileNode) {
       const index = whileNode.body.indexOf(cursor ?? "");
       if (index >= 0 && index < whileNode.body.length - 1) {
         wf.cursor = whileNode.body[index + 1];
-        this.persistContext(run, context, wf);
         return { kind: "advanced", nodeId: wf.cursor };
       }
       wf.loops[whileNode.id] = (wf.loops[whileNode.id] ?? 0) + 1;
       wf.cursor = whileNode.id;
-      this.persistContext(run, context, wf);
       return { kind: "advanced", nodeId: whileNode.id };
     }
-    this.completeRun(run, context);
+    wf.stepTerminal = true;
     return { kind: "completed" };
   }
-  executeWhile(run, graph, context, wf, node) {
-    const iteration = wf.loops[node.id] ?? 0;
-    if (iteration >= node.maxIterations) {
-      const error = `while node ${node.id} exceeded maxIterations (${node.maxIterations})`;
-      this.failRun(run, error);
+  async executeWhile(run2, graph, context, wf, node2) {
+    const iteration = wf.loops[node2.id] ?? 0;
+    if (iteration >= node2.maxIterations) {
+      const error = `while node ${node2.id} exceeded maxIterations (${node2.maxIterations})`;
+      await this.failRun(run2, error);
       return { kind: "failed", error };
     }
     const scope = { ...this.conditionScope(context), i: iteration };
-    const keepGoing = evaluateExpr(node.condition, scope);
+    const keepGoing = evaluateExpr(node2.condition, scope);
     if (!keepGoing) {
-      wf.completedLoops[node.id] = iteration;
-      delete wf.loops[node.id];
-      wf.cursor = node.next;
-      this.persistContext(run, context, wf);
-      return { kind: "advanced", nodeId: node.id };
+      wf.completedLoops[node2.id] = iteration;
+      delete wf.loops[node2.id];
+      wf.cursor = node2.next;
+      await this.persistContext(run2, context, wf);
+      return { kind: "advanced", nodeId: node2.id };
     }
-    wf.cursor = node.body[0];
-    this.persistContext(run, context, wf);
-    return { kind: "advanced", nodeId: node.id };
+    wf.cursor = node2.body[0];
+    await this.persistContext(run2, context, wf);
+    return { kind: "advanced", nodeId: node2.id };
   }
   recordStepResult(context, nodeId, output) {
-    const steps = context.steps ?? {};
+    const steps = Object.assign(Object.create(null), context.steps ?? {});
     steps[nodeId] = output;
     context.steps = steps;
   }
-  completeRun(run, context) {
+  async completeRun(run2, context) {
     const result = {
       steps: context.steps ?? {},
       iterations: context.__wf?.completedLoops ?? {}
@@ -1653,21 +2250,23 @@ class WorkflowsDaemon {
       assertNoSecrets(result, "run result");
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      this.failRun(run, message);
+      await this.failRun(run2, message);
       return;
     }
-    this.store.setRunStatus(run.id, "completed", { result, finishedAt: nowIso(), error: null });
-    this.wal.append({ op: "run_finished", runId: run.id, status: "completed", at: nowIso() });
-    const lease = this.leases.get(run.id);
+    if (!await this.store.compareRunStatus(run2.id, ["running"], "completed", { result, finishedAt: nowIso(), error: null }))
+      return;
+    this.wal.append({ op: "run_finished", runId: run2.id, status: "completed", at: nowIso() });
+    const lease = this.leases.get(run2.id);
     if (lease)
-      this.release(run.id, lease.fencing);
+      this.release(run2.id, lease.fencing);
   }
-  failRun(run, error) {
-    this.store.setRunStatus(run.id, "failed", { error, finishedAt: nowIso() });
-    this.wal.append({ op: "run_finished", runId: run.id, status: "failed", at: nowIso() });
-    const lease = this.leases.get(run.id);
+  async failRun(run2, error) {
+    if (!await this.store.compareRunStatus(run2.id, ["running"], "failed", { error, finishedAt: nowIso() }))
+      return;
+    this.wal.append({ op: "run_finished", runId: run2.id, status: "failed", at: nowIso() });
+    const lease = this.leases.get(run2.id);
     if (lease)
-      this.release(run.id, lease.fencing);
+      this.release(run2.id, lease.fencing);
   }
 }
 var defaultLaneRunner = async (job) => {
@@ -1678,33 +2277,109 @@ var defaultLaneRunner = async (job) => {
 };
 async function runGraphToCompletion(store, wal, graph, context, options = {}) {
   const daemon = new WorkflowsDaemon(store, wal, {
-    worker: "local",
+    worker: `foreground-${randomUUID2()}`,
     laneRunner: options.laneRunner,
     time: options.time,
     env: options.env,
     isolatedRunId: options.isolatedRunId
   });
-  const run = daemon.startRun(graph, context);
-  options.onRunCreated?.(run);
-  daemon.isolateRun(run.id);
+  const run2 = options.existingRunId ? await store.getRun(options.existingRunId) : await daemon.startRun(graph, context);
+  if (!run2)
+    throw new Error("run not found");
+  options.onRunCreated?.(run2);
+  daemon.isolateRun(run2.id);
   const maxCycles = options.maxCycles ?? 500;
-  for (let cycle = 0;cycle < maxCycles; cycle++) {
-    const report = await daemon.reap();
-    const current = store.getRun(run.id);
-    if (current.status !== "running")
-      return current;
-    if (report.advanced === 0 && report.dispatched === 0) {
-      return store.getRun(run.id);
-    }
+  const hosted = store instanceof PostgresWorkflowsStore ? store : undefined;
+  if (hosted && !await hosted.acquireExecution(run2.id))
+    return await store.getRun(run2.id);
+  const lease = daemon.claim(run2.id);
+  if (!lease) {
+    await hosted?.releaseExecution();
+    return await store.getRun(run2.id);
+  }
+  try {
+    if (!await store.compareRunStatus(run2.id, ["pending"], "running", { startedAt: nowIso() }))
+      return await store.getRun(run2.id);
+    wal.append({ op: "run_started", runId: run2.id, at: nowIso() });
+    for (let cycle = 0;cycle < maxCycles; cycle++) {
+      daemon.heartbeat(run2.id, lease.fencing);
+      const outcome = await daemon.advanceRun(run2.id);
+      const current = await store.getRun(run2.id);
+      if (current.status !== "running" || outcome.kind === "blocked" || outcome.kind === "noop")
+        return current;
+    }
+    await store.compareRunStatus(run2.id, ["running"], "interrupted", { error: "run reached maxCycles; resume to continue" });
+    return await store.getRun(run2.id);
+  } finally {
+    daemon.release(run2.id, lease.fencing);
+    await hosted?.releaseExecution();
   }
-  return store.getRun(run.id);
 }
 
 // src/paths.ts
 import { existsSync } from "fs";
 import { homedir } from "os";
 import { join as join2 } from "path";
-import { dataDir } from "@hasna/paths";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+var PATHS_RESOLVER_KIND_ENV = {
+  config: "HASNA_CONFIG_HOME",
+  data: "HASNA_DATA_HOME",
+  state: "HASNA_STATE_HOME",
+  cache: "HASNA_CACHE_HOME"
+};
+var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function pathsResolverAssertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
+}
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
+    return override;
+  const home = options.home ?? pathsResolverHomedir();
+  const platform = options.platform ?? process.platform;
+  if (platform === "darwin") {
+    switch (kind) {
+      case "config":
+      case "data":
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
+      case "state":
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return pathsResolverJoin(home, ".config", "hasna");
+    case "data":
+      return pathsResolverJoin(home, ".local", "share", "hasna");
+    case "state":
+      return pathsResolverJoin(home, ".local", "state", "hasna");
+    case "cache":
+      return pathsResolverJoin(home, ".cache", "hasna");
+  }
+}
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
+}
+function dataDir(options) {
+  return pathsResolverResolve("data", options);
+}
 var APP = "workflows";
 var STORE_DB_FILE = "workflows.db";
 function getHomeDir(env = process.env) {
@@ -1713,8 +2388,8 @@ function getHomeDir(env = process.env) {
 function getLegacyDataDir(env = process.env) {
   return join2(getHomeDir(env), ".hasna", APP);
 }
-function getResolverDataDir(env = process.env) {
-  return dataDir({ app: APP, home: getHomeDir(env), env });
+function getResolverDataDir(env = process.env, platform = process.platform) {
+  return dataDir({ app: APP, home: getHomeDir(env), env, platform });
 }
 function adoptResolverDataDir(resolved, env = process.env) {
   const dataOverride = env.HASNA_DATA_HOME;
@@ -1731,7 +2406,8 @@ function getEffectiveDataDir(env = process.env) {
 import { Database } from "bun:sqlite";
 import { mkdirSync } from "fs";
 import { join as join3 } from "path";
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
+var RUN_STATUSES = ["pending", "running", "completed", "failed", "cancelled", "interrupted"];
 function nowIso2() {
   return new Date().toISOString();
 }
@@ -1801,6 +2477,8 @@ function openStore(dataDir2) {
       hit_count   INTEGER NOT NULL DEFAULT 0,
       created_at  TEXT NOT NULL
     );
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_runs_idempotency ON runs(json_extract(context_json, '$.__wf.idempotencyKey'))
+      WHERE json_type(context_json, '$.__wf.idempotencyKey') = 'text';
     CREATE INDEX IF NOT EXISTS idx_runs_status ON runs(status);
     CREATE INDEX IF NOT EXISTS idx_runs_created ON runs(created_at);
     CREATE INDEX IF NOT EXISTS idx_run_nodes_run ON run_nodes(run_id);
@@ -1851,7 +2529,7 @@ function openStore(dataDir2) {
       return rows.map((r) => r.name);
     },
     createRun(input) {
-      const id = randomUUID();
+      const id = randomUUID3();
       const now = nowIso2();
       retryBusy(() => db.query(`INSERT INTO runs (id, graph_name, graph_version, status, attempts, context_json, created_at, updated_at)
              VALUES (?, ?, ?, 'pending', 0, ?, ?, ?)`).run(id, input.graphName, input.graphVersion, JSON.stringify(input.context ?? {}), now, now));
@@ -1861,6 +2539,10 @@ function openStore(dataDir2) {
       const row = retryBusy(() => db.query(`SELECT * FROM runs WHERE id = ?`).get(id));
       return row ? rowToRun(row) : undefined;
     },
+    getRunByIdempotencyKey(key) {
+      const row = retryBusy(() => db.query(`SELECT * FROM runs WHERE json_valid(context_json) AND json_extract(context_json, '$.__wf.idempotencyKey') = ? ORDER BY created_at DESC LIMIT 1`).get(key));
+      return row ? rowToRun(row) : undefined;
+    },
     listRuns(opts = {}) {
       const limit = Math.min(opts.limit ?? 100, 1000);
       if (opts.status) {
@@ -1881,14 +2563,81 @@ function openStore(dataDir2) {
       const finishedAt = patch.finishedAt !== undefined ? patch.finishedAt : terminal && existing?.finishedAt === null ? now : existing?.finishedAt ?? null;
       retryBusy(() => db.query(`UPDATE runs SET status = ?, result_json = ?, error = ?, started_at = ?, finished_at = ?, updated_at = ? WHERE id = ?`).run(status, resultJson, error, startedAt, finishedAt, now, id));
     },
+    compareRunStatus(id, expected, status, patch = {}) {
+      return retryBusy(() => db.transaction(() => {
+        const current = this.getRun(id);
+        if (!current || !expected.includes(current.status))
+          return false;
+        this.setRunStatus(id, status, patch);
+        return true;
+      }).immediate());
+    },
     bumpAttempts(id) {
       retryBusy(() => db.query(`UPDATE runs SET attempts = attempts + 1, updated_at = ? WHERE id = ?`).run(nowIso2(), id));
     },
     setRunContext(id, context) {
       retryBusy(() => db.query(`UPDATE runs SET context_json = ?, updated_at = ? WHERE id = ?`).run(JSON.stringify(context), nowIso2(), id));
     },
+    setRunningContext(id, context) {
+      return retryBusy(() => db.transaction(() => {
+        if (this.getRun(id)?.status !== "running")
+          return false;
+        this.setRunContext(id, context);
+        return true;
+      }).immediate());
+    },
+    blockRunResume(id) {
+      retryBusy(() => db.transaction(() => {
+        const run2 = this.getRun(id);
+        if (!run2)
+          return;
+        const context = JSON.parse(run2.contextJson);
+        context.__wf = { ...context.__wf, resumeBlocked: "execution cancellation has not been confirmed" };
+        this.setRunContext(id, context);
+      }).immediate());
+    },
+    dispatchIfRunning(id, action) {
+      return retryBusy(() => db.transaction(() => {
+        const run2 = this.getRun(id);
+        if (run2?.status !== "running")
+          return { started: false };
+        const context = JSON.parse(run2.contextJson);
+        context.__wf = { ...context.__wf, executionMayBeActive: true };
+        this.setRunContext(id, context);
+        return { started: true, result: action() };
+      }).immediate());
+    },
+    finishDispatch(id, unconfirmed) {
+      retryBusy(() => db.transaction(() => {
+        const run2 = this.getRun(id);
+        if (!run2)
+          return;
+        const context = JSON.parse(run2.contextJson);
+        delete context.__wf?.executionMayBeActive;
+        if (unconfirmed)
+          context.__wf = { ...context.__wf, resumeBlocked: "execution cancellation has not been confirmed" };
+        this.setRunContext(id, context);
+      }).immediate());
+    },
+    commitStep(input) {
+      return retryBusy(() => db.transaction(() => {
+        if (this.getRun(input.runId)?.status !== "running")
+          return false;
+        const node2 = this.getRunNode(input.nodeRowId);
+        if (!node2 || node2.runId !== input.runId)
+          return false;
+        this.setRunNodeStatus(input.nodeRowId, input.status, input.patch);
+        if (input.incrementAttempts)
+          this.bumpAttemptsNode(input.nodeRowId);
+        if (input.context !== undefined)
+          this.setRunContext(input.runId, input.context);
+        if (input.memo)
+          this.memoPut(input.memo.key, input.memo.graphName, input.memo.nodeId, input.memo.inputHash, input.memo.outputJson);
+        return true;
+      }).immediate());
+    },
     createRunNode(input) {
-      const id = randomUUID();
+      const id = randomUUID3();
       retryBusy(() => db.query(`INSERT INTO run_nodes (id, run_id, node_id, status, attempts, lane)
              VALUES (?, ?, ?, 'pending', 0, ?)`).run(id, input.runId, input.nodeId, input.lane ?? null));
       return this.getRunNode(id);
@@ -1944,9 +2693,10 @@ function openStore(dataDir2) {
 }
 
 // src/wal.ts
+import { Database as Database2 } from "bun:sqlite";
 import { createHash as createHash2 } from "crypto";
-import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, truncateSync, writeFileSync } from "fs";
-import { join as join4 } from "path";
+import { appendFileSync, copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, truncateSync, writeFileSync, constants } from "fs";
+import { basename, dirname, join as join4 } from "path";
 var WAL_FILE_NAME = "session.wal";
 var SESSIONS_DIR_NAME = "sessions";
 var MAX_WAL_BYTES = 256 * 1024 * 1024;
@@ -1958,15 +2708,17 @@ function checksumOf(op) {
 
 class SessionWAL {
   filePath;
+  journalLocked = false;
   constructor(filePath) {
     this.filePath = filePath;
   }
   static open(dataDir2) {
-    mkdirSync2(join4(dataDir2, SESSIONS_DIR_NAME), { recursive: true });
+    mkdirSync2(join4(dataDir2, SESSIONS_DIR_NAME), { recursive: true, mode: 448 });
     const canonical = join4(dataDir2, SESSIONS_DIR_NAME, WAL_FILE_NAME);
     const legacy = join4(dataDir2, WAL_FILE_NAME);
     if (existsSync2(legacy) && !existsSync2(canonical)) {
       try {
+        preserveOriginal(legacy);
         renameSync(legacy, canonical);
       } catch {
         return new SessionWAL(legacy);
@@ -1978,19 +2730,53 @@ class SessionWAL {
     return new SessionWAL(filePath);
   }
   append(op) {
+    return this.withJournalLock(() => this.appendLocked(op));
+  }
+  withJournalLock(operation) {
+    if (this.journalLocked)
+      return operation();
+    const parent = dirname(this.filePath);
+    const dataDir2 = basename(parent) === SESSIONS_DIR_NAME ? dirname(parent) : parent;
+    mkdirSync2(dataDir2, { recursive: true, mode: 448 });
+    const mutex = new Database2(join4(dataDir2, "workflows.db"));
+    try {
+      mutex.exec("PRAGMA busy_timeout = 5000");
+      mutex.exec("BEGIN IMMEDIATE");
+      this.journalLocked = true;
+      try {
+        const result = operation();
+        mutex.exec("COMMIT");
+        return result;
+      } catch (error) {
+        mutex.exec("ROLLBACK");
+        throw error;
+      } finally {
+        this.journalLocked = false;
+      }
+    } finally {
+      mutex.close();
+    }
+  }
+  exclusive(operation) {
+    return this.withJournalLock(operation);
+  }
+  appendLocked(op) {
     const at = op.at ?? new Date().toISOString();
     const full = { ...op, at };
     const nextSeq = this.nextSeq();
     const entry = { seq: nextSeq, at, checksum: checksumOf(full), op: full };
     appendFileSync(this.filePath, JSON.stringify(entry) + `
-`, "utf8");
+`, { encoding: "utf8", mode: 384 });
     return entry;
   }
   nextSeq() {
     const replay = this.replay();
     return replay.entries.length + 1;
   }
-  replay() {
+  replay(options = {}) {
+    return this.withJournalLock(() => this.replayLocked(options));
+  }
+  replayLocked(options) {
     const entries = [];
     let torn = false;
     let repaired = false;
@@ -2034,6 +2820,9 @@ class SessionWAL {
     if (badOffset !== null) {
       torn = true;
       try {
+        if (options.repair === false)
+          return { entries, torn, repaired, liveClaims: (nowMs) => reconstructLiveClaims(entries, nowMs) };
+        preserveOriginal(this.filePath);
         truncateSync(this.filePath, badOffset);
         repaired = true;
       } catch {}
@@ -2073,13 +2862,22 @@ function reconstructLiveClaims(entries, nowMs = Date.now()) {
   }
   return claims;
 }
+function preserveOriginal(filePath) {
+  const original = readFileSync2(filePath);
+  const digest = createHash2("sha256").update(original).digest("hex");
+  const backup = `${filePath}.preserved-${digest}`;
+  if (!existsSync2(backup))
+    copyFileSync(filePath, backup, constants.COPYFILE_EXCL);
+  if (!readFileSync2(backup).equals(original))
+    throw new Error("session WAL preservation readback failed; source retained");
+  return backup;
+}
 
 // src/service.ts
+import { hostname } from "os";
+import { resolveDatabaseUrl } from "@hasna/contracts";
 var DEFAULT_PORT = 8790;
 var DEFAULT_HOST = "127.0.0.1";
-function packageVersion() {
-  return package_default.version;
-}
 function envString(names) {
   for (const name of names) {
     const value = process.env[name];
@@ -2096,69 +2894,218 @@ function envInt(names, fallback) {
   return Number.isFinite(parsed) ? parsed : fallback;
 }
 function resolveWorkflowsConfig(overrides = {}) {
+  const originAuth = overrides.originAuth ?? process.env.HASNA_WORKFLOWS_ORIGIN_AUTH;
+  if (originAuth !== undefined && !/^[A-Za-z0-9_-]{32,256}$/.test(originAuth))
+    throw new Error("HASNA_WORKFLOWS_ORIGIN_AUTH must be a valid gateway origin identity");
   return {
     port: overrides.port ?? envInt(["HASNA_WORKFLOWS_PORT", "WORKFLOWS_PORT"], DEFAULT_PORT),
     host: overrides.host ?? envString(["HASNA_WORKFLOWS_HOST", "WORKFLOWS_HOST"]) ?? DEFAULT_HOST,
     dataDir: overrides.dataDir ?? envString(["HASNA_WORKFLOWS_DATA_DIR", "WORKFLOWS_DATA_DIR"]) ?? getEffectiveDataDir(),
-    apiUrl: overrides.apiUrl ?? envString(["WORKFLOWS_API_URL"]),
-    apiKey: overrides.apiKey ?? envString(["WORKFLOWS_API_KEY"])
+    apiUrl: overrides.apiUrl ?? envString(["HASNA_WORKFLOWS_API_URL", "WORKFLOWS_API_URL"]),
+    apiKey: overrides.apiKey ?? envString(["HASNA_WORKFLOWS_API_KEY", "WORKFLOWS_API_KEY"]),
+    originAuth,
+    storageBackend: overrides.storageBackend ?? "postgresql",
+    databaseUrl: overrides.databaseUrl ?? envString(["HASNA_WORKFLOWS_DATABASE_URL", "WORKFLOWS_DATABASE_URL"]),
+    databaseSchema: overrides.databaseSchema ?? envString(["HASNA_WORKFLOWS_DATABASE_SCHEMA", "WORKFLOWS_DATABASE_SCHEMA"])
   };
 }
 
 class WorkflowsService {
+  execution;
   name = "workflows";
   version;
   config;
   startedAt = Date.now();
-  constructor(config = {}) {
+  databaseEnv;
+  constructor(config = {}, execution = {}) {
+    this.execution = execution;
     this.config = resolveWorkflowsConfig(config);
+    this.databaseEnv = config.databaseUrl !== undefined ? { HASNA_WORKFLOWS_DATABASE_URL: config.databaseUrl } : {
+      HASNA_WORKFLOWS_DATABASE_URL: process.env.HASNA_WORKFLOWS_DATABASE_URL,
+      WORKFLOWS_DATABASE_URL: process.env.WORKFLOWS_DATABASE_URL
+    };
     this.version = packageVersion();
   }
   health() {
     return {
       ok: true,
+      status: "ok",
+      backend: this.config.storageBackend,
       service: this.name,
       version: this.version,
       pid: process.pid,
       uptimeMs: Date.now() - this.startedAt
     };
   }
-  ready() {
+  async ready() {
+    const checks = { version: "ok", auth: this.config.apiKey ? "ok" : "missing", storage: "not-checked" };
+    if (this.config.apiKey) {
+      try {
+        checks.storage = await this.withStore(async (store) => (store instanceof PostgresWorkflowsStore ? await store.checkSchema() : (await store.listTables()).sort().join(",") === "memos,run_nodes,runs") ? "ok" : "invalid-schema");
+      } catch (error) {
+        checks.storage = error instanceof WorkflowRequestError && error.code === "invalid_schema" ? "invalid-schema" : "unavailable";
+      }
+    }
+    return { ok: checks.auth === "ok" && checks.storage === "ok", service: this.name, version: this.version, checks };
+  }
+  async openEngineStore(verifySchema = true) {
+    if (this.config.storageBackend === "sqlite")
+      return openStore(this.config.dataDir);
+    if (this.config.storageBackend !== "postgresql")
+      throw new WorkflowRequestError("invalid_storage_backend", "storage backend must be postgresql or explicit embedded sqlite", 503);
+    let databaseUrl;
+    try {
+      databaseUrl = resolveDatabaseUrl("workflows", this.databaseEnv);
+    } catch (error) {
+      throw new WorkflowRequestError("invalid_database_configuration", error instanceof Error ? error.message : "HASNA_WORKFLOWS_DATABASE_URL must configure PostgreSQL", 503);
+    }
+    let store;
+    try {
+      store = new PostgresWorkflowsStore({ databaseUrl, dataDir: this.config.dataDir, schema: this.config.databaseSchema });
+    } catch {
+      throw new WorkflowRequestError("invalid_database_schema", "HASNA_WORKFLOWS_DATABASE_SCHEMA must be a lowercase SQL identifier", 503);
+    }
+    try {
+      if (verifySchema && !await store.checkSchema())
+        throw new WorkflowRequestError("invalid_schema", "PostgreSQL workflow schema requires explicit initialization or a reviewed migration", 503);
+      return store;
+    } catch (error) {
+      await store.close();
+      throw error;
+    }
+  }
+  async withStore(operation) {
+    const store = await this.openEngineStore();
+    try {
+      return await operation(store);
+    } finally {
+      await store.close();
+    }
+  }
+  async initializeStorage() {
+    const store = await this.openEngineStore(false);
+    try {
+      if (!(store instanceof PostgresWorkflowsStore))
+        throw new WorkflowRequestError("invalid_storage_backend", "init-db requires PostgreSQL", 503);
+      await store.initialize();
+    } finally {
+      await store.close();
+    }
+  }
+  listRuns(options = {}) {
+    return this.withStore((store) => store.listRuns(options));
+  }
+  getRun(id) {
+    return this.withStore((store) => store.getRun(id));
+  }
+  listNodes(id) {
+    return this.withStore((store) => store.listRunNodes(id));
+  }
+  events(id) {
+    return SessionWAL.open(this.config.dataDir).replay({ repair: false }).entries.filter((entry) => ("runId" in entry.op) && entry.op.runId === id);
+  }
+  cancelRun(id) {
+    return this.withStore(async (store) => {
+      const run2 = await store.getRun(id);
+      if (!run2)
+        return;
+      if (["completed", "failed", "cancelled"].includes(run2.status))
+        throw new WorkflowRequestError("invalid_run_status", "cancellation requires a pending, running, or interrupted run", 409);
+      if (!await store.compareRunStatus(id, ["pending", "running", "interrupted"], "cancelled", { finishedAt: new Date().toISOString() }))
+        throw new WorkflowRequestError("run_status_conflict", "run changed before cancellation", 409);
+      return store.getRun(id);
+    });
+  }
+  async resumeRun(id) {
+    const store = await this.openEngineStore();
+    const wal = SessionWAL.open(this.config.dataDir);
+    try {
+      const run2 = await store.getRun(id);
+      if (!run2)
+        throw new WorkflowRequestError("run_not_found", "run id does not exist", 404);
+      if (!["failed", "cancelled", "interrupted"].includes(run2.status))
+        throw new WorkflowRequestError("invalid_run_status", "resume requires a failed, cancelled, or interrupted run", 409);
+      const context = JSON.parse(run2.contextJson);
+      if (context.__wf?.resumeBlocked || context.__wf?.executionMayBeActive || wal.replay({ repair: false }).liveClaims().has(id))
+        throw new WorkflowRequestError("execution_active", "previous execution must finish before resume", 409);
+      if (store instanceof PostgresWorkflowsStore && !await store.acquireExecution(id))
+        throw new WorkflowRequestError("execution_active", "another executor still owns this run", 409);
+      const graph = context.__wf?.graph;
+      if (!graph)
+        throw new WorkflowRequestError("graph_unavailable", "legacy run needs its original graph registered by the server operator", 409);
+      if (!await store.compareRunStatus(id, ["failed", "cancelled", "interrupted"], "pending", { error: null }))
+        throw new WorkflowRequestError("run_status_conflict", "run changed before resume", 409);
+      for (const node2 of await store.listRunNodes(id)) {
+        if (node2.status !== "completed")
+          await store.setRunNodeStatus(node2.id, "pending", { error: null });
+      }
+      const final = await runGraphToCompletion(store, wal, graph, context, { ...this.execution, existingRunId: id });
+      return runSummary(final, false);
+    } finally {
+      await store.close();
+    }
+  }
+  sessions(action) {
+    const replay = SessionWAL.open(this.config.dataDir).replay({ repair: false });
+    if (action === "list")
+      return replay.entries.slice(-100).map(({ seq, at, op }) => ({ seq, at, operation: op.op }));
     return {
-      ok: true,
-      service: this.name,
-      version: this.version,
-      checks: { version: "ok" }
+      entries: replay.entries.length,
+      torn: replay.torn,
+      repaired: false,
+      liveClaims: [...replay.liveClaims().entries()].map(([runId, claim]) => ({ runId, worker: claim.worker, fencing: claim.fencing, expiresAt: new Date(claim.expiresAtMs).toISOString() }))
     };
   }
+  machines(action) {
+    const local = { name: hostname(), role: "server", version: this.version };
+    if (action === "list")
+      return [local];
+    return { ...local, health: this.health(), sessions: this.sessions("pull") };
+  }
+  daemonStatus() {
+    const replay = SessionWAL.open(this.config.dataDir).replay({ repair: false });
+    return { activeClaims: replay.liveClaims().size, mode: "bounded-trigger", continuousDaemon: false };
+  }
+  listMemos() {
+    return this.withStore(async (store) => (await store.memoList()).slice(0, 100));
+  }
   async triggerRun(graph, context = {}, opts = {}) {
-    const store = openStore(this.config.dataDir);
+    const store = await this.openEngineStore();
     const wal = SessionWAL.open(this.config.dataDir);
     try {
-      if (opts.idempotencyKey) {
-        const existing = findRunByIdempotencyKey(store, opts.idempotencyKey);
-        if (existing) {
-          return {
-            runId: existing.id,
-            status: existing.status,
-            error: existing.error ?? null,
-            result: existing.resultJson ? JSON.parse(existing.resultJson) : null,
-            reused: true
-          };
+      if (context === null || typeof context !== "object" || Array.isArray(context))
+        throw new WorkflowRequestError("invalid_context", "context must be an object");
+      if (Object.hasOwn(context, "__wf") || Object.hasOwn(context, "steps"))
+        throw new WorkflowRequestError("reserved_context", "context.__wf and context.steps are reserved for the workflow engine");
+      const maxCycles = opts.maxCycles ?? 500;
+      if (!Number.isSafeInteger(maxCycles) || maxCycles < 1 || maxCycles > 2000)
+        throw new WorkflowRequestError("invalid_max_cycles", "maxCycles must be an integer from 1 to 2000");
+      if (opts.idempotencyKey !== undefined && !/^[A-Za-z0-9_.:-]{1,128}$/.test(opts.idempotencyKey))
+        throw new WorkflowRequestError("invalid_idempotency_key", "idempotencyKey must contain 1 to 128 ASCII letters, digits, or _.:-");
+      const requestHash = createHash3("sha256").update(canonicalJson({ graph, context, maxCycles })).digest("hex");
+      const reuse = async () => {
+        const existing2 = opts.idempotencyKey ? await store.getRunByIdempotencyKey(opts.idempotencyKey) : undefined;
+        if (!existing2)
+          return;
+        if (JSON.parse(existing2.contextJson).__wf?.requestHash !== requestHash)
+          throw new WorkflowRequestError("idempotency_conflict", "idempotencyKey is already bound to a different request", 409);
+        return runSummary(existing2, true);
+      };
+      const existing = await reuse();
+      if (existing)
+        return existing;
+      const contextWithKey = { ...context, __wf: { requestHash, ...opts.idempotencyKey ? { idempotencyKey: opts.idempotencyKey } : {} } };
+      let final;
+      try {
+        final = await runGraphToCompletion(store, wal, graph, contextWithKey, { ...this.execution, maxCycles });
+      } catch (err) {
+        if (err instanceof Error && (/UNIQUE constraint failed/.test(err.message) || err.code === "23505")) {
+          const winner = await reuse();
+          if (winner)
+            return winner;
         }
+        throw err;
       }
-      const contextWithKey = opts.idempotencyKey ? {
-        ...context,
-        __wf: {
-          cursor: undefined,
-          loops: {},
-          completedLoops: {},
-          ...context?.__wf ?? {},
-          idempotencyKey: opts.idempotencyKey
-        }
-      } : context;
-      const maxCycles = Math.min(Math.max(opts.maxCycles ?? 500, 1), 2000);
-      const final = await runGraphToCompletion(store, wal, graph, contextWithKey, { maxCycles });
       return {
         runId: final.id,
         status: final.status,
@@ -2167,16 +3114,111 @@ class WorkflowsService {
         reused: false
       };
     } finally {
-      store.close();
+      await store.close();
     }
   }
 }
-function createWorkflowsService(config = {}) {
-  return new WorkflowsService(config);
+function createWorkflowsService(config = {}, execution = {}) {
+  return new WorkflowsService(config, execution);
+}
+
+class WorkflowRequestError extends Error {
+  code;
+  status;
+  constructor(code, message, status = 400) {
+    super(message);
+    this.code = code;
+    this.status = status;
+    this.name = "WorkflowRequestError";
+  }
+}
+function canonicalJson(value) {
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object")
+    return `{${Object.keys(value).sort().filter((k) => value[k] !== undefined).map((k) => `${JSON.stringify(k)}:${canonicalJson(value[k])}`).join(",")}}`;
+  return JSON.stringify(value) ?? "null";
+}
+function runSummary(run2, reused) {
+  return { runId: run2.id, status: run2.status, error: run2.error ?? null, result: run2.resultJson ? JSON.parse(run2.resultJson) : null, reused };
+}
+
+// src/handlers.ts
+import { createHash as createHash4, timingSafeEqual } from "crypto";
+
+// src/openapi.ts
+function buildOpenApi(version) {
+  const string = { type: "string" }, integer = { type: "integer" }, nullableString = { type: "string", nullable: true };
+  const ref = (name) => ({ $ref: `#/components/schemas/${name}` });
+  const object = (properties, required = Object.keys(properties)) => ({ type: "object", properties, required });
+  const response = (schema, description = "Success") => ({ description, content: { "application/json": { schema } } });
+  const id = [{ name: "id", in: "path", required: true, schema: { type: "string", pattern: "^[a-zA-Z0-9_-]{1,128}$" } }];
+  const body = (schema) => ({ required: true, description: "JSON object, at most 1 MiB", content: { "application/json": { schema } } });
+  const statuses = ["pending", "running", "completed", "failed", "interrupted", "cancelled"];
+  const operation = (operationId, summary, schema, extra = {}, publicRoute = false) => ({
+    operationId,
+    summary,
+    ...publicRoute ? {} : { security: [{ bearerAuth: [] }] },
+    ...extra,
+    responses: { "200": response(schema), ...publicRoute ? {} : {
+      "400": response(ref("ApiError"), "Invalid field or request shape"),
+      "401": response(ref("ApiError"), "Bearer credential missing or refused"),
+      "404": response(ref("ApiError"), "Run or route absent"),
+      "409": response(ref("ApiError"), "Conflicting key, run state or execution ownership"),
+      "503": response(ref("ApiError"), "Authentication or PostgreSQL storage unavailable")
+    } }
+  });
+  const doc = {
+    openapi: "3.0.3",
+    info: { title: "workflows", version },
+    servers: [{ url: "./" }],
+    paths: {
+      "/health": { get: operation("getHealth", "Service health", ref("HealthReport"), {}, true) },
+      "/ready": { get: { ...operation("getReadiness", "Authentication and actual schema readiness", ref("ReadinessReport"), {}, true), responses: { "200": response(ref("ReadinessReport")), "503": response(ref("ReadinessReport"), "Not ready") } } },
+      "/version": { get: operation("getVersion", "Package version", object({ service: string, version: string }), {}, true) },
+      "/validate": { post: operation("validateWorkflow", "Validate a workflow graph", ref("GraphValidation"), { requestBody: body(object({ graph: ref("WorkflowGraph") })) }) },
+      "/trigger": { post: operation("triggerWorkflow", "Execute a bounded workflow; identical keyed retries reuse the original run", ref("RunSummary"), { requestBody: body(object({ graph: ref("WorkflowGraph"), context: { type: "object", description: "__wf and steps are reserved", additionalProperties: true }, idempotencyKey: { type: "string", pattern: "^[A-Za-z0-9_.:-]{1,128}$" }, maxCycles: { type: "integer", minimum: 1, maximum: 2000, default: 500 } }, ["graph"])) }) },
+      "/runs": { get: operation("listRunRecords", "List recent runs", { type: "array", items: ref("RunRow") }, { parameters: [{ name: "status", in: "query", schema: { type: "string", enum: statuses } }, { name: "limit", in: "query", schema: { type: "integer", minimum: 1, maximum: 1000, default: 100 } }] }) },
+      "/runs/{id}": { get: operation("getRunRecord", "Read a durable run", ref("RunRow"), { parameters: id }) },
+      "/runs/{id}/nodes": { get: operation("getRunNodes", "Ordered node execution history", { type: "array", items: ref("RunNodeRow") }, { parameters: id }) },
+      "/runs/{id}/events": { get: operation("getRunEvents", "Preserved execution journal events", { type: "array", items: { type: "object" } }, { parameters: id }) },
+      "/runs/{id}/cancel": { post: operation("cancelWorkflow", "Cancel a pending, running or interrupted run and fence late results", ref("RunRow"), { parameters: id }) },
+      "/runs/{id}/resume": { post: operation("resumeWorkflow", "Continue a failed, cancelled or interrupted run using its pinned graph; active or unconfirmed execution refuses resume", ref("RunSummary"), { parameters: id }) },
+      "/lanes": { get: operation("listLanes", "Inspect lane substrates; this does not prove sign-in or model capacity", { type: "array", items: { type: "object" } }) },
+      "/lanes/{lane}": { get: operation("probeLane", "Inspect one lane substrate", { type: "object" }, { parameters: [{ name: "lane", in: "path", required: true, schema: { type: "string", enum: ["claude", "codex", "cursor", "grok"] } }] }) },
+      "/sessions/list": { get: operation("listSessionEvents", "Recent journal event metadata", { type: "array", items: { type: "object" } }) },
+      "/sessions/pull": { get: operation("inspectSession", "Read journal and claim state without repair", { type: "object" }) },
+      "/machines/list": { get: operation("listServerMachines", "This executor, not a fleet census", { type: "array", items: { type: "object" } }) },
+      "/machines/status": { get: operation("inspectServerMachine", "This executor's health and claims", { type: "object" }) },
+      "/daemon/status": { get: operation("inspectDaemon", "Bounded-trigger executor status", { type: "object" }) },
+      "/memos/list": { get: operation("listMemoRecords", "Recent memo results", { type: "array", items: { type: "object" } }) }
+    },
+    components: {
+      securitySchemes: { bearerAuth: { type: "http", scheme: "bearer" } },
+      schemas: {
+        ApiError: object({ error: string, message: string }, ["error"]),
+        HealthReport: object({ ok: { type: "boolean" }, status: { type: "string", enum: ["ok"] }, backend: { type: "string", enum: ["postgresql", "sqlite"] }, service: string, version: string, pid: integer, uptimeMs: integer }),
+        ReadinessReport: object({ ok: { type: "boolean" }, service: string, version: string, checks: { type: "object", additionalProperties: string } }),
+        GraphValidation: object({ ok: { type: "boolean" }, issues: { type: "array", items: object({ path: string, message: string }) } }),
+        StartNode: object({ id: string, type: { type: "string", enum: ["start"] }, next: string }, ["id", "type"]),
+        StepNode: object({ id: string, type: { type: "string", enum: ["step"] }, next: string, lane: { type: "string", enum: ["claude", "codex", "cursor", "grok"] }, prompt: string, command: string, cwd: { type: "string", minLength: 1 }, codexMode: { type: "string", enum: ["repository", "read-only"], default: "repository", description: "Codex prompt steps only. Read-only permits nonrepository execution with a read-only sandbox and no approvals. Repository retains native trust, sandbox and approval defaults." }, maxRetries: { type: "integer", minimum: 0 }, memo: { type: "boolean" }, timeoutMs: { type: "integer", minimum: 1 } }, ["id", "type"]),
+        DecisionNode: object({ id: string, type: { type: "string", enum: ["decision"] }, condition: string, then: string, else: string }, ["id", "type", "condition"]),
+        WhileNode: object({ id: string, type: { type: "string", enum: ["while"] }, condition: string, body: { type: "array", items: string }, maxIterations: { type: "integer", minimum: 1 }, next: string }, ["id", "type", "condition", "body", "maxIterations"]),
+        EndNode: object({ id: string, type: { type: "string", enum: ["end"] } }),
+        GraphNode: { oneOf: ["StartNode", "StepNode", "DecisionNode", "WhileNode", "EndNode"].map(ref) },
+        WorkflowGraph: object({ name: string, version: string, nodes: { type: "array", items: ref("GraphNode") }, memoWatch: { type: "array", items: string } }, ["name", "version", "nodes"]),
+        RunSummary: object({ runId: string, status: { type: "string", enum: statuses }, error: nullableString, result: {}, reused: { type: "boolean" } }),
+        RunRow: object({ id: string, graphName: string, graphVersion: string, status: { type: "string", enum: statuses }, attempts: integer, contextJson: string, resultJson: nullableString, error: nullableString, startedAt: nullableString, finishedAt: nullableString, createdAt: string, updatedAt: string }),
+        RunNodeRow: object({ id: string, runId: string, nodeId: string, status: { type: "string", enum: ["pending", "running", "completed", "failed", "skipped"] }, attempts: integer, lane: nullableString, exitCode: { type: "integer", nullable: true }, outputJson: nullableString, error: nullableString, startedAt: nullableString, finishedAt: nullableString })
+      }
+    }
+  };
+  return doc;
 }
 
 // src/handlers.ts
-import { createHash as createHash3, timingSafeEqual } from "crypto";
+init_graph();
+init_lanes();
 function jsonResponse(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
@@ -2184,47 +3226,41 @@ function jsonResponse(body, status = 200) {
   });
 }
 function openApiDoc(service) {
-  return {
-    openapi: "3.0.3",
-    info: { title: "workflows", version: service.version },
-    paths: {
-      "/health": { get: { summary: "Service health", responses: { "200": { description: "ok" } } } },
-      "/ready": { get: { summary: "Service readiness", responses: { "200": { description: "ok" } } } },
-      "/version": { get: { summary: "Service version", responses: { "200": { description: "ok" } } } },
-      "/trigger": {
-        post: {
-          summary: "Authenticated trigger: run a workflow graph to a terminal state",
-          security: [{ bearerAuth: [] }],
-          requestBody: {
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  required: ["graph"],
-                  properties: {
-                    graph: { type: "object", description: "the workflow graph" },
-                    context: { type: "object", description: "optional run context" },
-                    idempotencyKey: { type: "string", description: "re-run with the same key returns the same run" },
-                    maxCycles: { type: "number", description: "bound on reap cycles (default 500, max 2000)" }
-                  }
-                }
-              }
-            }
-          },
-          responses: {
-            "200": { description: "run summary" },
-            "401": { description: "missing or invalid Bearer token" },
-            "503": { description: "trigger not configured (WORKFLOWS_API_KEY unset)" }
-          }
-        }
-      }
-    },
-    components: {
-      securitySchemes: {
-        bearerAuth: { type: "http", scheme: "bearer" }
+  return buildOpenApi(service.version);
+}
+function authenticate(service, req) {
+  if (!service.config.apiKey)
+    return jsonResponse({ error: "auth_not_configured" }, 503);
+  if (!bearerMatches(req.headers.get("authorization") ?? "", service.config.apiKey)) {
+    return jsonResponse({ error: "unauthorized", message: "a valid Bearer token is required" }, 401);
+  }
+}
+async function readObject(req) {
+  const limit = 1048576;
+  const reader = req.body?.getReader();
+  if (!reader)
+    throw new Error("invalid_json");
+  const chunks = [];
+  let size = 0;
+  try {
+    for (;; ) {
+      const { value, done } = await reader.read();
+      if (done)
+        break;
+      size += value.byteLength;
+      if (size > limit) {
+        await reader.cancel();
+        throw new Error("body_too_large");
       }
+      chunks.push(value);
     }
-  };
+  } finally {
+    reader.releaseLock();
+  }
+  const body = JSON.parse(await new Blob(chunks).text());
+  if (body === null || typeof body !== "object" || Array.isArray(body))
+    throw new Error("invalid_body");
+  return body;
 }
 function bearerMatches(authHeader, expected) {
   if (!authHeader.startsWith("Bearer "))
@@ -2232,8 +3268,8 @@ function bearerMatches(authHeader, expected) {
   const supplied = authHeader.slice("Bearer ".length);
   if (supplied.length === 0)
     return false;
-  const a = createHash3("sha256").update(supplied).digest();
-  const b = createHash3("sha256").update(expected).digest();
+  const a = createHash4("sha256").update(supplied).digest();
+  const b = createHash4("sha256").update(expected).digest();
   return timingSafeEqual(a, b);
 }
 async function handleTrigger(service, req) {
@@ -2245,57 +3281,148 @@ async function handleTrigger(service, req) {
   if (!bearerMatches(auth, expected)) {
     return jsonResponse({ error: "unauthorized", message: "a valid Bearer token is required" }, 401);
   }
-  let body;
+  let record;
   try {
-    body = await req.json();
+    record = await readObject(req);
   } catch {
-    return jsonResponse({ error: "invalid_json", message: "request body must be JSON" }, 400);
+    return jsonResponse({ error: "invalid_json", message: "request body must be a JSON object within 1 MiB" }, 400);
   }
-  const record = body;
   if (record.graph === null || typeof record.graph !== "object" || Array.isArray(record.graph)) {
     return jsonResponse({ error: "graph_required", message: "body.graph must be a workflow graph object" }, 400);
   }
   const context = record.context ?? {};
-  if (typeof context !== "object" || Array.isArray(context)) {
+  if (context === null || typeof context !== "object" || Array.isArray(context)) {
     return jsonResponse({ error: "invalid_context", message: "body.context must be an object" }, 400);
   }
+  if (record.maxCycles !== undefined && (typeof record.maxCycles !== "number" || !Number.isSafeInteger(record.maxCycles) || record.maxCycles < 1 || record.maxCycles > 2000)) {
+    return jsonResponse({ error: "invalid_max_cycles", message: "maxCycles must be an integer from 1 to 2000" }, 400);
+  }
+  if (record.idempotencyKey !== undefined && (typeof record.idempotencyKey !== "string" || !/^[A-Za-z0-9_.:-]{1,128}$/.test(record.idempotencyKey))) {
+    return jsonResponse({ error: "invalid_idempotency_key", message: "idempotencyKey must contain 1 to 128 ASCII letters, digits, or _.:-" }, 400);
+  }
+  const validation = validateGraph(record.graph);
+  if (!validation.ok)
+    return jsonResponse({ error: "invalid_graph", issues: validation.issues }, 400);
   const maxCycles = typeof record.maxCycles === "number" ? record.maxCycles : undefined;
   const idempotencyKey = typeof record.idempotencyKey === "string" ? record.idempotencyKey : undefined;
   try {
     const summary = await service.triggerRun(record.graph, context, { maxCycles, idempotencyKey });
     return jsonResponse(summary);
   } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return jsonResponse({ error: "trigger_failed", message }, 400);
+    if (err instanceof WorkflowStorageError)
+      return jsonResponse({ error: "storage_unavailable", message: err.message }, 503);
+    if (err instanceof WorkflowRequestError)
+      return jsonResponse({ error: err.code, message: err.message }, err.status);
+    return jsonResponse({ error: "trigger_failed", message: "workflow execution was refused" }, 400);
   }
 }
 function createRequestHandler(service) {
-  return (req) => {
+  return async (req) => {
     const url = new URL(req.url);
-    switch (url.pathname) {
+    if (service.config.originAuth !== undefined && !["/health", "/ready"].includes(url.pathname)) {
+      if (!bearerMatches(`Bearer ${req.headers.get("x-hasna-origin-auth") ?? ""}`, service.config.originAuth)) {
+        return jsonResponse({ error: "WORKFLOWS_ORIGIN_DENIED" }, 403);
+      }
+    }
+    const path = url.pathname.replace(/^\/v1(?=\/|$)/, "") || "/";
+    const method = req.method;
+    const allowed = path === "/trigger" || path === "/validate" || /^\/runs\/[^/]+\/(cancel|resume)$/.test(path) ? "POST" : "GET";
+    if (method !== allowed)
+      return new Response(JSON.stringify({ error: "method_not_allowed" }), { status: 405, headers: { "content-type": "application/json", allow: allowed } });
+    switch (path) {
       case "/health":
         return jsonResponse(service.health());
-      case "/ready":
-        return jsonResponse(service.ready());
+      case "/ready": {
+        const ready = await service.ready();
+        return jsonResponse(ready, ready.ok ? 200 : 503);
+      }
       case "/version":
         return jsonResponse({ service: service.name, version: service.version });
       case "/trigger":
         return handleTrigger(service, req);
       case "/openapi.json":
         return jsonResponse(openApiDoc(service));
-      default:
-        return jsonResponse({ error: "not_found", path: url.pathname }, 404);
+    }
+    if (path !== "/validate" && path !== "/runs" && path !== "/lanes" && !/^\/lanes\/[^/]+$/.test(path) && !/^\/runs\/[^/]+(?:\/(nodes|events|cancel|resume))?$/.test(path) && !/^\/(sessions|machines|daemon|memos)\/(list|pull|status)$/.test(path)) {
+      return jsonResponse({ error: "not_found" }, 404);
+    }
+    const refused = authenticate(service, req);
+    if (refused)
+      return refused;
+    try {
+      if (path === "/validate") {
+        const body = await readObject(req);
+        return jsonResponse(validateGraph(body.graph));
+      }
+      if (path === "/runs") {
+        const limit = Number(url.searchParams.get("limit") ?? 100);
+        const status = url.searchParams.get("status") ?? undefined;
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000 || status !== undefined && !RUN_STATUSES.includes(status))
+          return jsonResponse({ error: "invalid_query" }, 400);
+        return jsonResponse(await service.listRuns({ limit, status }));
+      }
+      if (path === "/lanes")
+        return jsonResponse(await laneInventory());
+      if (path.startsWith("/lanes/")) {
+        const lane = path.slice("/lanes/".length);
+        if (!LANE_KINDS2.includes(lane))
+          return jsonResponse({ error: "invalid_lane" }, 400);
+        return jsonResponse(await probeLane(lane));
+      }
+      if (path === "/sessions/list")
+        return jsonResponse(service.sessions("list"));
+      if (path === "/sessions/pull")
+        return jsonResponse(service.sessions("pull"));
+      if (path === "/machines/list")
+        return jsonResponse(service.machines("list"));
+      if (path === "/machines/status")
+        return jsonResponse(service.machines("status"));
+      if (path === "/daemon/status")
+        return jsonResponse(service.daemonStatus());
+      if (path === "/memos/list")
+        return jsonResponse(await service.listMemos());
+      const match = /^\/runs\/([^/]+)(?:\/(nodes|events|cancel|resume))?$/.exec(path);
+      if (match) {
+        const id = decodeURIComponent(match[1]);
+        if (!/^[a-zA-Z0-9_-]{1,128}$/.test(id))
+          return jsonResponse({ error: "invalid_run_id" }, 400);
+        const run2 = await service.getRun(id);
+        if (!run2)
+          return jsonResponse({ error: "run_not_found" }, 404);
+        switch (match[2]) {
+          case "nodes":
+            return jsonResponse(await service.listNodes(id));
+          case "events":
+            return jsonResponse(service.events(id));
+          case "cancel":
+            return jsonResponse(await service.cancelRun(id));
+          case "resume":
+            return jsonResponse(await service.resumeRun(id));
+          default:
+            return jsonResponse(run2);
+        }
+      }
+      return jsonResponse({ error: "not_found" }, 404);
+    } catch (err) {
+      if (err instanceof WorkflowStorageError)
+        return jsonResponse({ error: "storage_unavailable", message: err.message }, 503);
+      if (err instanceof WorkflowRequestError)
+        return jsonResponse({ error: err.code, message: err.message }, err.status);
+      return jsonResponse({ error: "invalid_request", message: "request was refused" }, 400);
     }
   };
 }
 
 // src/agent-tools.ts
+init_graph();
 init_lanes();
+
+// src/tool-definitions.ts
 function textResult(payload) {
   return { content: [{ type: "text", text: JSON.stringify(payload) }], isError: false };
 }
 function workflowsTools(_service) {
-  return [
+  const tools = [
     {
       name: "workflows_version",
       description: "Report the installed @hasna/workflows version.",
@@ -2308,7 +3435,7 @@ function workflowsTools(_service) {
     },
     {
       name: "workflows_ready",
-      description: "Report the workflows service readiness (version check).",
+      description: "Report the hosted workflows service readiness.",
       inputSchema: { type: "object", properties: {} }
     },
     {
@@ -2327,14 +3454,16 @@ function workflowsTools(_service) {
         type: "object",
         properties: {
           graph: { type: "object", description: "the workflow graph" },
-          context: { type: "object", description: "optional run context" }
+          context: { type: "object", description: "optional run context" },
+          idempotencyKey: { type: "string", description: "stable request key" },
+          maxCycles: { type: "integer", minimum: 1, maximum: 2000 }
         },
-        required: ["graph"]
+        required: ["graph", "idempotencyKey"]
       }
     },
     {
       name: "workflows_runs_list",
-      description: "List recent runs from the local store.",
+      description: "List recent runs from the configured hosted service.",
       inputSchema: {
         type: "object",
         properties: {
@@ -2349,7 +3478,13 @@ function workflowsTools(_service) {
       inputSchema: { type: "object", properties: {} }
     }
   ];
+  return tools.map((tool) => ({ ...tool, inputSchema: { ...tool.inputSchema, properties: {
+    ...tool.inputSchema.properties,
+    agent: { type: "string", description: "calling agent identity" }
+  } } }));
 }
+
+// src/agent-tools.ts
 async function callWorkflowTool(service, name, args) {
   switch (name) {
     case "workflows_version":
@@ -2357,42 +3492,26 @@ async function callWorkflowTool(service, name, args) {
     case "workflows_health":
       return textResult(service.health());
     case "workflows_ready":
-      return textResult(service.ready());
+      return textResult(await service.ready());
     case "workflows_validate": {
       const graph = args.graph;
       const result = validateGraph(graph);
       return textResult(result);
     }
-    case "workflows_run": {
-      const graph = args.graph;
-      const store = openStore(service.config.dataDir);
-      const wal = SessionWAL.open(service.config.dataDir);
-      try {
-        const final = await runGraphToCompletion(store, wal, graph, args.context ?? {});
-        return textResult({
-          runId: final.id,
-          status: final.status,
-          error: final.error ?? null,
-          result: final.resultJson ? JSON.parse(final.resultJson) : null
-        });
-      } finally {
-        store.close();
-      }
-    }
-    case "workflows_runs_list": {
-      const store = openStore(service.config.dataDir);
-      try {
-        const status = typeof args.status === "string" ? args.status : undefined;
-        const limit = typeof args.limit === "number" ? args.limit : 100;
-        return textResult(store.listRuns({ status, limit }));
-      } finally {
-        store.close();
-      }
-    }
+    case "workflows_run":
+      return textResult(await service.triggerRun(args.graph, args.context ?? {}, {
+        idempotencyKey: typeof args.idempotencyKey === "string" ? args.idempotencyKey : undefined,
+        maxCycles: typeof args.maxCycles === "number" ? args.maxCycles : undefined
+      }));
+    case "workflows_runs_list":
+      return textResult(await service.listRuns({
+        status: typeof args.status === "string" ? args.status : undefined,
+        limit: typeof args.limit === "number" ? args.limit : 100
+      }));
     case "workflows_lanes_list":
       return textResult(await laneInventory());
     default:
-      throw new Error(`Unknown tool: ${name}`);
+      throw new Error("Unknown workflows tool");
   }
 }
 export {