@powerhousedao/reactor-workflow 6.2.3-dev.11

package/dist/index.js

@@ -0,0 +1,3771 @@
+import { _ as FileTooLargeError, a as redactMessage, c as DEFAULT_EGRESS_POLICY, f as extractDedupeKey, n as containsRedactedMarker, o as rememberSecrets, r as redact, s as secretsFor, y as maxFileBytes } from "./redact-C7LWgAyD.js";
+import { C as pieceModuleRef, S as localFirstResolver, _ as secretRefFromId, a as CompositeBlockExecutor, b as PieceWorkerError, c as storeHandlers, d as declaredConnectionIds, f as shapeConnection, g as parseSecretRef, h as SecretNotFoundError, i as ActivepiecesBlockExecutor, l as BoundConnectionResolver, m as SecretDeletedError, n as packagePieces, o as parseBlockType, r as runWorkflow, s as reactorHandlers, t as PieceRegistry, v as PieceWorkerPool, w as ensurePieceBundle, x as PieceWorkerTimeoutError, y as PieceWorker } from "./piece-registry-BWWihLyp.js";
+import { WebhookHandshakeStrategy } from "@powerhousedao/pieces-framework";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { open, readFile, rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
+import { Cron } from "croner";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { childLogger, createAction } from "document-model";
+import { actions } from "@powerhousedao/workflow/document-models/connection";
+import { Kind, parse } from "graphql";
+import { BaseReadModel, defaultReadModelIndexingConfig } from "@powerhousedao/reactor";
+//#region src/reactor/attachment-port.ts
+const logger$4 = childLogger(["workflow", "attachments"]);
+function refOf(result) {
+	const direct = result.ref;
+	if (typeof direct === "string") return direct;
+	const nested = result.reservation?.ref;
+	if (typeof nested === "string") return nested;
+	throw new Error("The attachment store returned no reference for the upload");
+}
+async function writeCapped(body, destPath, limit) {
+	const reader = body.getReader();
+	const handle = await open(destPath, "w");
+	let written = 0;
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			written += value.byteLength;
+			if (written > limit) {
+				await reader.cancel();
+				throw new FileTooLargeError(written, limit);
+			}
+			await handle.write(value);
+		}
+	} catch (error) {
+		await handle.close();
+		await rm(destPath, { force: true });
+		throw error;
+	}
+	await handle.close();
+}
+function createAttachmentPort(client, documentIdFor, canReadRef) {
+	return {
+		async read(ref, destPath) {
+			const documentId = documentIdFor();
+			if (!documentId) throw new Error(`Cannot resolve ${ref}: no workflow document is in scope to authorize the read`);
+			if (!await canReadRef(documentId, ref)) throw new Error(`Cannot resolve ${ref}: workflow document "${documentId}" does not reference it`);
+			const limit = maxFileBytes();
+			const { header, body } = await client.download({
+				documentId,
+				ref
+			});
+			if (typeof header.sizeBytes === "number" && Number.isFinite(header.sizeBytes) && header.sizeBytes > limit) {
+				await body.cancel().catch(() => void 0);
+				throw new FileTooLargeError(header.sizeBytes, limit);
+			}
+			await writeCapped(body, destPath, limit);
+			const contentType = header.mimeType !== void 0 && header.mimeType !== "" ? header.mimeType : void 0;
+			return {
+				fileName: header.fileName,
+				contentType
+			};
+		},
+		async write(file) {
+			const bytes = await readFile(file.path);
+			const ref = refOf(await client.upload({
+				file: new Blob([new Uint8Array(bytes)], { type: file.contentType ?? "application/octet-stream" }),
+				fileName: file.fileName,
+				mimeType: file.contentType
+			}));
+			logger$4.debug(`Ingested ${file.fileName} (${file.size} bytes) as ${ref}`);
+			return ref;
+		}
+	};
+}
+//#endregion
+//#region src/reactor/package-name.ts
+const WORKFLOW_PACKAGE_NAME = "@powerhousedao/workflow";
+//#endregion
+//#region src/reactor/reactor-piece.ts
+const REACTOR_PIECE = "@powerhousedao/piece-reactor";
+function action(name) {
+	return `${REACTOR_PIECE}#${name}`;
+}
+function trigger(name) {
+	return `${REACTOR_PIECE}#trigger:${name}`;
+}
+const DOCUMENT_CREATE_BLOCK = action("document-create");
+const DOCUMENT_DISPATCH_BLOCK = action("document-dispatch");
+const DOCUMENT_GET_BLOCK = action("document-get");
+const DOCUMENT_FIND_BLOCK = action("document-find");
+const DOCUMENT_SCHEMA_BLOCK = action("document-schema");
+const DOCUMENT_TYPES_BLOCK = action("document-types");
+const DOCUMENT_EVENT_BLOCK = trigger("document-event");
+const DOCUMENT_CREATED_BLOCK = trigger("document-created");
+const DOCUMENT_DELETED_BLOCK = trigger("document-deleted");
+function staticString(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	if (!trimmed || trimmed.includes("{{")) return void 0;
+	return trimmed;
+}
+//#endregion
+//#region src/reactor/output-tree.ts
+const MAX_DEPTH = 6;
+function typeName(node) {
+	switch (node.kind) {
+		case Kind.NON_NULL_TYPE: {
+			const inner = typeName(node.type);
+			return {
+				name: inner.name,
+				display: `${inner.display}!`
+			};
+		}
+		case Kind.LIST_TYPE: {
+			const inner = typeName(node.type);
+			return {
+				name: inner.name,
+				display: `[${inner.display}]`
+			};
+		}
+		default: return {
+			name: node.name.value,
+			display: node.name.value
+		};
+	}
+}
+function fieldsFromSdl(sdl, rootType) {
+	let definitions;
+	try {
+		definitions = parse(sdl).definitions;
+	} catch {
+		return [];
+	}
+	const types = /* @__PURE__ */ new Map();
+	let firstType;
+	let stateType;
+	for (const def of definitions) {
+		if (def.kind !== Kind.OBJECT_TYPE_DEFINITION && def.kind !== Kind.INPUT_OBJECT_TYPE_DEFINITION) continue;
+		const name = def.name.value;
+		types.set(name, def.fields ?? []);
+		firstType ??= name;
+		if (name.endsWith("State") && !name.endsWith("LocalState")) stateType ??= name;
+	}
+	const root = rootType ?? stateType ?? firstType;
+	if (!root) return [];
+	const build = (name, depth) => {
+		const fields = types.get(name);
+		if (!fields || depth > MAX_DEPTH) return [];
+		return fields.map((field) => {
+			const { name: inner, display } = typeName(field.type);
+			const children = build(inner, depth + 1);
+			return {
+				name: field.name.value,
+				type: display,
+				description: field.description?.value,
+				...children.length > 0 ? { children } : {}
+			};
+		});
+	};
+	return build(root, 0);
+}
+function mergeNodes(nodes) {
+	const byName = /* @__PURE__ */ new Map();
+	for (const node of nodes) {
+		const existing = byName.get(node.name);
+		if (existing?.children && node.children) existing.children = mergeNodes([...existing.children, ...node.children]);
+		else if (!byName.has(node.name)) byName.set(node.name, node);
+	}
+	return [...byName.values()];
+}
+function fromOutputSchema(schema) {
+	const fields = schema?.fields;
+	if (!Array.isArray(fields)) return [];
+	const convert = (field) => {
+		const inner = field.children ?? field.properties;
+		const items = field.listItems;
+		const childNodes = mergeNodes((inner ?? items ?? []).flatMap(convert));
+		const path = typeof field.value === "string" ? field.value : field.key ?? "";
+		if (path === "") return childNodes;
+		const segments = path.split(".");
+		let node = {
+			name: segments[segments.length - 1],
+			type: items ? "array" : field.format ?? (childNodes.length > 0 ? "object" : "value"),
+			description: field.description,
+			...childNodes.length > 0 ? { children: childNodes } : {}
+		};
+		for (let i = segments.length - 2; i >= 0; i--) node = {
+			name: segments[i],
+			type: "object",
+			children: [node]
+		};
+		return [node];
+	};
+	return mergeNodes(fields.flatMap(convert)).filter((node) => node.name);
+}
+function hasOutputSchemaFields(schema) {
+	const fields = schema?.fields;
+	return Array.isArray(fields) && fields.length > 0;
+}
+function fromSample(value, depth = 0) {
+	if (value === null || typeof value !== "object" || depth > MAX_DEPTH) return [];
+	return (Array.isArray(value) ? value.slice(0, 1).map((item) => ["0", item]) : Object.entries(value)).map(([name, child]) => {
+		const kind = Array.isArray(child) ? "array" : child === null ? "null" : typeof child;
+		const children = fromSample(child, depth + 1);
+		return {
+			name,
+			type: kind,
+			...children.length > 0 ? { children } : {}
+		};
+	});
+}
+const leaf = (name, type, description) => ({
+	name,
+	type,
+	...description ? { description } : {}
+});
+const OPERATION_NODE = {
+	name: "operation",
+	type: "object",
+	children: [leaf("index", "Int!"), leaf("timestampUtcMs", "String!")]
+};
+function documentBlockTree(stateChildren) {
+	return [
+		leaf("documentId", "PHID!"),
+		leaf("documentType", "String!"),
+		leaf("name", "String"),
+		{
+			name: "state",
+			type: "object",
+			description: "Document global state after the actions applied",
+			...stateChildren.length > 0 ? { children: stateChildren } : {}
+		}
+	];
+}
+function documentGetTree(stateChildren) {
+	return [
+		...documentBlockTree(stateChildren).filter((node) => node.name !== "state"),
+		leaf("slug", "String"),
+		{
+			name: "state",
+			type: "object",
+			description: "Document global state as read",
+			...stateChildren.length > 0 ? { children: stateChildren } : {}
+		}
+	];
+}
+function documentFindTree() {
+	return [leaf("count", "Int!"), {
+		name: "documents",
+		type: "array",
+		children: [
+			leaf("documentId", "PHID!"),
+			leaf("documentType", "String!"),
+			leaf("name", "String"),
+			leaf("slug", "String")
+		]
+	}];
+}
+function documentTypesTree() {
+	return [leaf("count", "Int!"), {
+		name: "types",
+		type: "array",
+		children: [leaf("documentType", "String!"), leaf("name", "String")]
+	}];
+}
+function documentSchemaTree() {
+	return [
+		leaf("documentType", "String!"),
+		leaf("name", "String"),
+		leaf("stateSchema", "String", "SDL of the global state type"),
+		{
+			name: "actions",
+			type: "array",
+			description: "Dispatchable actions with their input SDL",
+			children: [
+				leaf("type", "String!"),
+				leaf("module", "String"),
+				leaf("inputSchema", "String")
+			]
+		}
+	];
+}
+function lifecycleTriggerTree() {
+	return [
+		leaf("documentId", "PHID!"),
+		leaf("documentType", "String"),
+		leaf("name", "String", "Set on creation only"),
+		leaf("driveId", "PHID", "Null for a document that belongs to no drive"),
+		leaf("parentId", "PHID"),
+		OPERATION_NODE
+	];
+}
+function scheduleTriggerTree() {
+	return [
+		leaf("scheduledFor", "DateTime!", "The slot that came due (ISO 8601)"),
+		leaf("firedAt", "DateTime!", "When the run actually started"),
+		leaf("timezone", "String!"),
+		leaf("cron", "String", "Cron mode only"),
+		leaf("everyMs", "Int", "Interval mode only")
+	];
+}
+function webhookTriggerTree() {
+	return [
+		leaf("method", "String!", "Uppercase HTTP method"),
+		leaf("path", "String!"),
+		leaf("headers", "JSONObject!", "Lowercased names; credentials redacted"),
+		leaf("queryParams", "JSONObject!"),
+		leaf("body", "Unknown", "Parsed JSON or form fields; text otherwise")
+	];
+}
+function documentEventTree(actionInputChildren) {
+	return [
+		leaf("documentId", "PHID!"),
+		leaf("documentType", "String!"),
+		leaf("branch", "String!"),
+		leaf("scope", "String!"),
+		{
+			name: "action",
+			type: "object",
+			children: [leaf("type", "String!"), {
+				name: "input",
+				type: "object",
+				...actionInputChildren.length > 0 ? { children: actionInputChildren } : {}
+			}]
+		},
+		OPERATION_NODE
+	];
+}
+//#endregion
+//#region src/reactor/first-party-logos.ts
+const PAPERLESS_LOGO = "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA0OCA0OCI+PHJlY3Qgd2lkdGg9IjQ4IiBoZWlnaHQ9IjQ4IiByeD0iOCIgZmlsbD0iIzE3NTQxZiIvPjxwYXRoIGQ9Ik0xNCAxMGgxM2w3IDd2MjFhMiAyIDAgMCAxLTIgMkgxNmEyIDIgMCAwIDEtMi0yVjEyYTIgMiAwIDAgMSAyLTJ6IiBmaWxsPSIjZmZmIi8+PHBhdGggZD0iTTI3IDEwbDcgN2gtN3oiIGZpbGw9IiM5ZmQzYTYiLz48ZyBmaWxsPSIjMTc1NDFmIj48cmVjdCB4PSIxOCIgeT0iMjIiIHdpZHRoPSIxNiIgaGVpZ2h0PSIyIiByeD0iMSIvPjxyZWN0IHg9IjE4IiB5PSIyNyIgd2lkdGg9IjE2IiBoZWlnaHQ9IjIiIHJ4PSIxIi8+PHJlY3QgeD0iMTgiIHk9IjMyIiB3aWR0aD0iMTAiIGhlaWdodD0iMiIgcng9IjEiLz48L2c+PC9zdmc+";
+//#endregion
+//#region src/reactor/unsupported-pieces.ts
+const SERVER_ONLY_PIECES = new Set([
+	"@activepieces/piece-ai",
+	"@activepieces/piece-text-ai",
+	"@activepieces/piece-image-ai",
+	"@activepieces/piece-utility-ai",
+	"@activepieces/piece-agent",
+	"@activepieces/piece-todos",
+	"@activepieces/piece-tables",
+	"@activepieces/piece-subflows"
+]);
+//#endregion
+//#region src/reactor/piece-catalog.ts
+const CATALOG_URL = "https://cloud.activepieces.com/api/v1/pieces";
+const CACHE_TTL_MS = 3600 * 1e3;
+function aiLast(audience) {
+	return audience === "ai" ? 1 : 0;
+}
+function pieceUrl(packageName) {
+	return `${CATALOG_URL}/${packageName}?audience=all`;
+}
+async function fetchJson(url, timeoutMs = 3e4) {
+	const response = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
+	if (!response.ok) throw new Error(`${url} responded ${response.status}`);
+	return response.json();
+}
+async function fetchCatalogWithSuggestions() {
+	const raw = await fetchJson(`${CATALOG_URL}?suggestionType=ACTION_AND_TRIGGER`, 12e4);
+	return Array.isArray(raw) ? raw : [];
+}
+let catalogCache;
+const FIRST_PARTY_PIECES = [{
+	name: "@powerhousedao/piece-paperless-ngx",
+	displayName: "Paperless-ngx",
+	description: "Manage documents in a self-hosted paperless-ngx archive: upload, search, tag, and react to new documents.",
+	logoUrl: PAPERLESS_LOGO,
+	version: "0.1.0",
+	actionCount: 9,
+	triggerCount: 2,
+	categories: ["CONTENT_AND_FILES"],
+	auth: {
+		type: "CUSTOM_AUTH",
+		displayName: "paperless-ngx",
+		required: true,
+		props: {
+			base_url: {
+				type: "SHORT_TEXT",
+				displayName: "Base URL",
+				required: true,
+				description: "e.g. https://paperless.example.com — no trailing slash, no /api suffix"
+			},
+			token: {
+				type: "SECRET_TEXT",
+				displayName: "API Token",
+				required: true,
+				description: "paperless web UI -> My Profile -> API Token"
+			}
+		}
+	}
+}, {
+	name: "@powerhousedao/piece-docling",
+	displayName: "Docling",
+	description: "Convert documents (PDF, DOCX, PPTX, images, HTML, …) to Markdown, docling-document JSON, HTML, DocTags and plain text via a docling-serve v1 API (self-hosted or Docling for IBM watsonx).",
+	logoUrl: "data:image/svg+xml," + encodeURIComponent("<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 48 48\"><rect width=\"48\" height=\"48\" rx=\"10\" fill=\"#1e3a8a\"/><path d=\"M14 10h14l8 8v20a2 2 0 0 1-2 2H14a2 2 0 0 1-2-2V12a2 2 0 0 1 2-2z\" fill=\"#fff\"/><path d=\"M28 10v8h8\" fill=\"none\" stroke=\"#1e3a8a\" stroke-width=\"2\"/><path d=\"M18 24h12M18 29h12M18 34h8\" stroke=\"#1e3a8a\" stroke-width=\"2\"/></svg>"),
+	version: "1.0.0",
+	actionCount: 6,
+	triggerCount: 0,
+	categories: ["CONTENT_AND_FILES"],
+	auth: {
+		type: "CUSTOM_AUTH",
+		displayName: "Docling Serve",
+		required: true,
+		props: {
+			base_url: {
+				type: "SHORT_TEXT",
+				displayName: "Service URL",
+				required: true
+			},
+			api_key: {
+				type: "SECRET_TEXT",
+				displayName: "API Key",
+				required: false
+			}
+		}
+	}
+}];
+async function fetchPieceCatalog() {
+	if (catalogCache && catalogCache.expiresAt > Date.now()) return catalogCache.value;
+	const cloud = (await fetchJson(CATALOG_URL)).filter((entry) => typeof entry.name === "string" && typeof entry.version === "string" && !SERVER_ONLY_PIECES.has(entry.name) && (typeof entry.actions === "number" && entry.actions > 0 || typeof entry.triggers === "number" && entry.triggers > 0)).map((entry) => ({
+		name: entry.name,
+		displayName: entry.displayName ?? entry.name,
+		description: entry.description ?? "",
+		logoUrl: entry.logoUrl ?? "",
+		version: entry.version,
+		actionCount: typeof entry.actions === "number" ? entry.actions : 0,
+		triggerCount: typeof entry.triggers === "number" ? entry.triggers : 0,
+		categories: entry.categories ?? [],
+		auth: entry.auth ?? null
+	}));
+	const shortName = (n) => n.slice(n.lastIndexOf("/") + 1);
+	const cloudShorts = new Set(cloud.map((e) => shortName(e.name)));
+	const value = [...cloud, ...FIRST_PARTY_PIECES.filter((p) => !cloudShorts.has(shortName(p.name)))].sort((a, b) => a.displayName.localeCompare(b.displayName));
+	catalogCache = {
+		value,
+		expiresAt: Date.now() + CACHE_TTL_MS
+	};
+	return value;
+}
+const detailCache = /* @__PURE__ */ new Map();
+async function fetchPieceDetail(packageName) {
+	const cached = detailCache.get(packageName);
+	if (cached && cached.expiresAt > Date.now()) return cached.value;
+	const value = await fetchJson(pieceUrl(packageName));
+	detailCache.set(packageName, {
+		value,
+		expiresAt: Date.now() + CACHE_TTL_MS
+	});
+	return value;
+}
+const triggersCache = /* @__PURE__ */ new Map();
+async function fetchPieceTriggers(packageName) {
+	const cached = triggersCache.get(packageName);
+	if (cached && cached.expiresAt > Date.now()) return cached.value;
+	const detail = await fetchJson(pieceUrl(packageName));
+	const version = detail.version ?? "";
+	const triggersRecord = detail.triggers && typeof detail.triggers === "object" ? detail.triggers : {};
+	const triggers = Object.entries(triggersRecord).map(([name, trigger]) => ({
+		name,
+		displayName: trigger.displayName ?? name,
+		description: trigger.description ?? "",
+		strategy: trigger.type ?? "",
+		blockType: `${packageName}@${version}#trigger:${name}`
+	}));
+	const value = {
+		name: packageName,
+		displayName: detail.displayName ?? packageName,
+		version,
+		triggers,
+		auth: detail.auth ?? null
+	};
+	triggersCache.set(packageName, {
+		value,
+		expiresAt: Date.now() + CACHE_TTL_MS
+	});
+	return value;
+}
+const actionsCache = /* @__PURE__ */ new Map();
+async function fetchPieceActions(packageName) {
+	const cached = actionsCache.get(packageName);
+	if (cached && cached.expiresAt > Date.now()) return cached.value;
+	const detail = await fetchJson(pieceUrl(packageName));
+	const version = detail.version ?? "";
+	const actionsRecord = detail.actions && typeof detail.actions === "object" ? detail.actions : {};
+	const actions = Object.entries(actionsRecord).map(([name, action]) => ({
+		name,
+		displayName: action.displayName ?? name,
+		description: action.description ?? "",
+		blockType: `${packageName}@${version}#${name}`,
+		audience: action.audience ?? null
+	})).sort((a, b) => aiLast(a.audience) - aiLast(b.audience));
+	const value = {
+		name: packageName,
+		displayName: detail.displayName ?? packageName,
+		version,
+		actions,
+		auth: detail.auth ?? null
+	};
+	actionsCache.set(packageName, {
+		value,
+		expiresAt: Date.now() + CACHE_TTL_MS
+	});
+	return value;
+}
+//#endregion
+//#region src/reactor/local-catalog.ts
+function localBlockType(pieceName, name, kind) {
+	return kind === "trigger" ? `${pieceName}#trigger:${name}` : `${pieceName}#${name}`;
+}
+function catalogEntry(descriptor, pieceName, version) {
+	return {
+		name: pieceName,
+		displayName: descriptor.displayName || pieceName,
+		description: descriptor.description ?? "",
+		logoUrl: descriptor.logoUrl ?? "",
+		version,
+		actionCount: descriptor.actions.length,
+		triggerCount: descriptor.triggers.length,
+		categories: descriptor.categories ?? [],
+		auth: descriptor.auth ?? null
+	};
+}
+function actionsResult(descriptor, pieceName, version) {
+	return {
+		name: pieceName,
+		displayName: descriptor.displayName || pieceName,
+		version,
+		actions: descriptor.actions.map((action) => ({
+			name: action.name,
+			displayName: action.displayName,
+			description: action.description ?? "",
+			blockType: localBlockType(pieceName, action.name, "action"),
+			audience: null
+		})),
+		auth: descriptor.auth ?? null
+	};
+}
+function triggersResult(descriptor, pieceName, version) {
+	return {
+		name: pieceName,
+		displayName: descriptor.displayName || pieceName,
+		version,
+		triggers: descriptor.triggers.map((trigger) => ({
+			name: trigger.name,
+			displayName: trigger.displayName,
+			description: trigger.description ?? "",
+			strategy: trigger.strategy,
+			blockType: localBlockType(pieceName, trigger.name, "trigger")
+		})),
+		auth: descriptor.auth ?? null
+	};
+}
+function localSearchHits(descriptor, pieceName) {
+	const pieceDisplayName = descriptor.displayName || pieceName;
+	const logoUrl = descriptor.logoUrl ?? "";
+	return [...descriptor.actions.map((action) => ({
+		blockType: localBlockType(pieceName, action.name, "action"),
+		pieceName,
+		pieceDisplayName,
+		logoUrl,
+		displayName: action.displayName,
+		description: action.description ?? "",
+		kind: "action",
+		strategy: null
+	})), ...descriptor.triggers.map((trigger) => ({
+		blockType: localBlockType(pieceName, trigger.name, "trigger"),
+		pieceName,
+		pieceDisplayName,
+		logoUrl,
+		displayName: trigger.displayName,
+		description: trigger.description ?? "",
+		kind: "trigger",
+		strategy: trigger.strategy
+	}))];
+}
+function detailResult(descriptor, pieceName, version) {
+	return {
+		name: pieceName,
+		displayName: descriptor.displayName || pieceName,
+		description: descriptor.description ?? "",
+		logoUrl: descriptor.logoUrl ?? "",
+		version,
+		categories: descriptor.categories ?? [],
+		auth: descriptor.auth ?? null,
+		actions: Object.fromEntries(descriptor.actions.map((action) => [action.name, {
+			name: action.name,
+			displayName: action.displayName,
+			description: action.description ?? "",
+			props: action.props,
+			requireAuth: action.requireAuth
+		}])),
+		triggers: Object.fromEntries(descriptor.triggers.map((trigger) => [trigger.name, {
+			name: trigger.name,
+			displayName: trigger.displayName,
+			description: trigger.description ?? "",
+			type: trigger.strategy,
+			props: trigger.props,
+			requireAuth: trigger.requireAuth
+		}]))
+	};
+}
+//#endregion
+//#region src/reactor/block-search.ts
+const INDEX_TTL_MS = 3600 * 1e3;
+const DEFAULT_LIMIT = 30;
+const MAX_LIMIT = 100;
+function buildSearchIndex(raw) {
+	const entries = [];
+	let pieces = 0;
+	for (const entry of raw) {
+		if (typeof entry.name !== "string" || typeof entry.version !== "string" || SERVER_ONLY_PIECES.has(entry.name)) continue;
+		const pieceName = entry.name;
+		const pieceDisplayName = entry.displayName ?? pieceName;
+		const logoUrl = entry.logoUrl ?? "";
+		const push = (kind, item) => {
+			if (typeof item.name !== "string" || item.name === "") return;
+			const displayName = item.displayName ?? item.name;
+			const description = item.description ?? "";
+			entries.push({
+				hit: {
+					blockType: kind === "trigger" ? `${pieceName}@${entry.version}#trigger:${item.name}` : `${pieceName}@${entry.version}#${item.name}`,
+					pieceName,
+					pieceDisplayName,
+					logoUrl,
+					displayName,
+					description,
+					kind,
+					strategy: kind === "trigger" ? item.type ?? null : null
+				},
+				name: `${displayName} ${item.name}`.toLowerCase(),
+				description: description.toLowerCase(),
+				piece: pieceDisplayName.toLowerCase()
+			});
+		};
+		for (const action of entry.suggestedActions ?? []) push("action", action);
+		for (const trigger of entry.suggestedTriggers ?? []) push("trigger", trigger);
+		pieces += 1;
+	}
+	return {
+		entries,
+		pieces
+	};
+}
+function indexFromHits(hits) {
+	const pieces = /* @__PURE__ */ new Set();
+	return {
+		entries: hits.map((hit) => {
+			pieces.add(hit.pieceName);
+			return {
+				hit,
+				name: `${hit.displayName} ${hit.blockType.split("#").pop() ?? ""}`.toLowerCase(),
+				description: hit.description.toLowerCase(),
+				piece: hit.pieceDisplayName.toLowerCase()
+			};
+		}),
+		pieces: pieces.size
+	};
+}
+function merge(index, local) {
+	const localEntries = local?.entries ?? [];
+	const localNames = new Set(localEntries.map((entry) => entry.hit.pieceName));
+	const published = (index?.entries ?? []).filter((entry) => !localNames.has(entry.hit.pieceName));
+	const shadowed = new Set((index?.entries ?? []).map((entry) => entry.hit.pieceName).filter((name) => localNames.has(name)));
+	return {
+		entries: [...localEntries, ...published],
+		pieces: (local?.pieces ?? 0) + (index?.pieces ?? 0) - shadowed.size
+	};
+}
+function searchIndex(index, query, limit = DEFAULT_LIMIT) {
+	const tokens = query.toLowerCase().split(/\s+/).filter(Boolean);
+	if (tokens.length === 0) return [];
+	const scored = [];
+	for (const entry of index.entries) {
+		const haystack = `${entry.name} ${entry.piece} ${entry.description}`;
+		if (!tokens.every((token) => haystack.includes(token))) continue;
+		const first = tokens[0];
+		const score = entry.name.startsWith(first) ? 0 : entry.name.includes(first) ? 1 : entry.piece.includes(first) ? 2 : 3;
+		scored.push({
+			score,
+			entry
+		});
+	}
+	scored.sort((a, b) => a.score - b.score || a.entry.hit.displayName.localeCompare(b.entry.hit.displayName));
+	return scored.slice(0, Math.min(Math.max(limit, 1), MAX_LIMIT)).map(({ entry }) => entry.hit);
+}
+let cached;
+function ensureIndex() {
+	if (cached && cached.expiresAt > Date.now() && !cached.error) return cached;
+	const entry = {
+		promise: fetchCatalogWithSuggestions().then(buildSearchIndex),
+		expiresAt: Date.now() + INDEX_TTL_MS
+	};
+	entry.promise.then((value) => {
+		entry.value = value;
+	}, (error) => {
+		entry.error = error instanceof Error ? error.message : String(error);
+	});
+	cached = entry;
+	return entry;
+}
+function searchBlocks(query, limit, local) {
+	const index = ensureIndex();
+	if (index.error) {
+		const message = index.error;
+		cached = void 0;
+		return {
+			status: "error",
+			hits: searchIndex(merge(void 0, local), query, limit),
+			indexedPieces: local?.pieces ?? 0,
+			error: message
+		};
+	}
+	if (!index.value) return {
+		status: "indexing",
+		hits: searchIndex(merge(void 0, local), query, limit),
+		indexedPieces: local?.pieces ?? 0,
+		error: null
+	};
+	const merged = merge(index.value, local);
+	return {
+		status: "ready",
+		hits: searchIndex(merged, query, limit),
+		indexedPieces: merged.pieces,
+		error: null
+	};
+}
+//#endregion
+//#region src/reactor/reactor-port.ts
+const DRIVE_DOCUMENT_TYPES = new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
+const FIND_PAGE_LIMIT = 100;
+const DESIGN_TIME_WRITES_REFUSED = "Reactor writes are not available while resolving design-time options";
+const DESIGN_TIME_CALLER_REQUIRED = "Design-time reactor access requires an authenticated request";
+const BASE_ACTIONS = [{
+	type: "SET_NAME",
+	module: "base",
+	inputSchema: "input SetNameInput {\n  name: String!\n}"
+}];
+function stateValueAt(document, path) {
+	let current = document.state.global;
+	for (const segment of path.split(".")) {
+		if (typeof current !== "object" || current === null) return void 0;
+		current = current[segment];
+	}
+	return current;
+}
+function matchesState(document, match) {
+	if (!match) return true;
+	const value = stateValueAt(document, match.path);
+	if (typeof value === "string") return value === match.value;
+	if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return String(value) === match.value;
+	return false;
+}
+function documentSummary(document, withState) {
+	const globalState = document.state.global;
+	const stateName = globalState && typeof globalState === "object" ? globalState.name : void 0;
+	return {
+		documentId: document.header.id,
+		documentType: document.header.documentType,
+		name: typeof stateName === "string" && stateName || document.header.name || "",
+		slug: document.header.slug,
+		...withState ? { state: globalState } : {}
+	};
+}
+function assertOperationsApplied(document, count) {
+	const failed = Object.values(document.operations).flat().sort((a, b) => a.index - b.index).slice(-Math.max(count, 1)).find((operation) => operation.error !== void 0);
+	if (failed) throw new Error(`Action ${failed.action.type} failed: ${failed.error ?? "unknown error"}`);
+}
+var SubgraphReactorPort = class {
+	constructor(host) {
+		this.host = host;
+	}
+	get client() {
+		return this.host.reactorClient;
+	}
+	async models() {
+		return (await this.client.getDocumentModelModules()).results.map((module) => module.documentModel.global).map((model) => ({
+			documentType: model.id,
+			name: model.name
+		})).filter((entry) => entry.documentType).sort((a, b) => a.documentType.localeCompare(b.documentType));
+	}
+	async model(documentType) {
+		const model = (await this.client.getDocumentModelModule(documentType)).documentModel.global;
+		const latest = model.specifications.at(-1);
+		return {
+			documentType,
+			name: model.name,
+			stateSchema: latest?.state.global.schema ?? null,
+			actions: [...(latest?.modules ?? []).flatMap((specModule) => specModule.operations.flatMap((operation) => operation.name ? [{
+				type: operation.name,
+				module: specModule.name,
+				inputSchema: operation.schema ?? null
+			}] : [])), ...BASE_ACTIONS]
+		};
+	}
+	async get(input) {
+		return documentSummary(await this.client.get(input.documentId), true);
+	}
+	async find(input) {
+		const limit = input.limit ?? FIND_PAGE_LIMIT;
+		let results;
+		if (input.documentType) results = await this.findByType(input.documentType, limit, input.parentId);
+		else if (input.parentId) results = (await this.client.find({ parentId: input.parentId }, void 0, {
+			cursor: "",
+			limit
+		})).results;
+		else {
+			const types = (await this.models()).map((model) => model.documentType);
+			results = (await Promise.all(types.map((type) => this.findByType(type, limit)))).flat();
+		}
+		const seen = /* @__PURE__ */ new Set();
+		return results.filter((document) => {
+			if (seen.has(document.header.id)) return false;
+			seen.add(document.header.id);
+			return true;
+		}).filter((document) => matchesState(document, input.match)).map((document) => documentSummary(document, input.withState === true));
+	}
+	async create(input) {
+		const target = input.parentId ? await this.resolveDriveTarget(input.parentId) : null;
+		if (!target) {
+			const created = await this.client.createEmpty(input.documentType, { parentIdentifier: input.parentId });
+			if (!input.name) return documentSummary(created, true);
+			const named = await this.client.execute(created.header.id, "main", [createAction("SET_NAME", { name: input.name })]);
+			assertOperationsApplied(named, 1);
+			return documentSummary(named, true);
+		}
+		const empty = (await this.client.getDocumentModelModule(input.documentType)).utils.createDocument();
+		if (input.name) empty.header.name = input.name;
+		return documentSummary(await this.client.drives.addFile(target.driveId, empty, target.parentFolder), true);
+	}
+	async execute(input) {
+		const actions = input.actions.map((entry) => createAction(entry.type, entry.input, void 0, void 0, entry.scope ?? "global"));
+		const document = await this.client.execute(input.documentId, input.branch ?? "main", actions);
+		assertOperationsApplied(document, actions.length);
+		return documentSummary(document, true);
+	}
+	async findByType(type, limit, parentId) {
+		try {
+			return (await this.client.find({
+				type,
+				...parentId ? { parentId } : {}
+			}, void 0, {
+				cursor: "",
+				limit
+			})).results;
+		} catch {
+			return [];
+		}
+	}
+	async resolveDriveTarget(parentId) {
+		try {
+			const parent = await this.client.get(parentId);
+			return DRIVE_DOCUMENT_TYPES.has(parent.header.documentType) ? { driveId: parent.header.id } : null;
+		} catch {
+			return this.findFolderDrive(parentId);
+		}
+	}
+	async findFolderDrive(nodeId) {
+		const pages = await Promise.all([...DRIVE_DOCUMENT_TYPES].map((type) => this.findByType(type, FIND_PAGE_LIMIT)));
+		for (const drive of pages.flat()) try {
+			if ((await this.client.drives.getNode(drive.header.id, nodeId)).kind === "folder") return {
+				driveId: drive.header.id,
+				parentFolder: nodeId
+			};
+		} catch {}
+		return null;
+	}
+};
+var ScopedDesignTimeReactorPort = class {
+	inner;
+	constructor(host, caller) {
+		this.host = host;
+		this.caller = caller;
+		this.inner = new SubgraphReactorPort(host);
+	}
+	models() {
+		return this.inner.models();
+	}
+	model(documentType) {
+		return this.inner.model(documentType);
+	}
+	async get(input) {
+		if (!this.caller) throw new Error(DESIGN_TIME_CALLER_REQUIRED);
+		await this.host.assertCanRead(input.documentId, this.caller);
+		return this.inner.get(input);
+	}
+	async find(input) {
+		const found = await this.inner.find(input);
+		const allowed = await Promise.all(found.map((document) => this.canRead(document.documentId)));
+		return found.filter((_, index) => allowed[index]);
+	}
+	create(_input) {
+		return Promise.reject(new Error(DESIGN_TIME_WRITES_REFUSED));
+	}
+	execute(_input) {
+		return Promise.reject(new Error(DESIGN_TIME_WRITES_REFUSED));
+	}
+	async canRead(documentId) {
+		if (!this.caller) return false;
+		return this.host.assertCanRead(documentId, this.caller).then(() => true).catch(() => false);
+	}
+};
+//#endregion
+//#region src/reactor/run-scope.ts
+const storage = new AsyncLocalStorage();
+function withRunScope(scope, fn) {
+	return storage.run(scope, fn);
+}
+function currentWorkflowId() {
+	return storage.getStore()?.workflowId;
+}
+function currentBoundConnections() {
+	return storage.getStore()?.connections;
+}
+function currentPieceWorker() {
+	return storage.getStore()?.pieceWorker;
+}
+//#endregion
+//#region src/reactor/connector-id.ts
+function packageFromConnectorId(connectorId) {
+	const separator = connectorId.lastIndexOf("#");
+	return separator > 0 ? connectorId.slice(0, separator) : connectorId;
+}
+//#endregion
+//#region src/reactor/lib.ts
+const pieceLogger = childLogger(["workflow", "piece"]);
+const connectionLogger = childLogger(["workflow", "connection"]);
+function assertConnectorMatches(state, request) {
+	const wanted = request?.piecePackage;
+	const owner = state.connectorId ? packageFromConnectorId(state.connectorId) : "";
+	if (!wanted || !owner || wanted !== owner) throw new ConnectorMismatchError();
+}
+var ConnectorMismatchError = class extends Error {
+	constructor() {
+		super("Connection is not available to this block");
+		this.name = "ConnectorMismatchError";
+	}
+};
+var DocumentConnectionResolver = class {
+	constructor(host, secrets) {
+		this.host = host;
+		this.secrets = secrets;
+	}
+	async resolve(connectionId, request) {
+		return (await this.resolveWithSecrets(connectionId, request)).auth;
+	}
+	async resolveWithSecrets(connectionId, request) {
+		return resolveConnectionWithSecrets(await this.host.reactorClient.get(connectionId), this.secrets, request);
+	}
+};
+async function resolveConnectionAuth(document, secrets, request) {
+	return (await resolveConnectionWithSecrets(document, secrets, request)).auth;
+}
+async function resolveConnectionWithSecrets(document, secrets, request) {
+	if (document.header.documentType !== "powerhouse/connection") throw new ConnectorMismatchError();
+	const state = document.state.global;
+	assertConnectorMatches(state, request);
+	if (state.status === "REVOKED") throw new Error(`Connection "${state.name || document.header.id}" is revoked`);
+	return shapeConnection({
+		authType: state.authType,
+		config: state.config ?? {},
+		secretRefs: state.secretRefs
+	}, secrets);
+}
+const EGRESS_ALLOW_ENV = "WORKFLOW_EGRESS_ALLOW_ADDRESSES";
+function asCidr(entry) {
+	if (entry.includes("/")) return entry;
+	return entry.includes(":") ? `${entry}/128` : `${entry}/32`;
+}
+function configuredEgress() {
+	const raw = process.env[EGRESS_ALLOW_ENV];
+	if (raw === void 0 || raw.trim() === "") return void 0;
+	const allowAddresses = raw.split(",").map((entry) => entry.trim()).filter((entry) => entry !== "").map(asCidr);
+	if (allowAddresses.length === 0) return void 0;
+	pieceLogger.info(`Egress policy widened by ${EGRESS_ALLOW_ENV}: ${allowAddresses.join(", ")}`);
+	return { allowAddresses };
+}
+const BUNDLE_CACHE_DIR = join(process.cwd(), ".ph", "ap-bundles");
+const ATTACHMENT_STAGING_DIR = join(process.cwd(), ".ph", "ap-attachment-staging");
+let resolver;
+function fetchingResolver(cacheDir) {
+	return { async resolve(name, version) {
+		return {
+			name,
+			version,
+			bundleDir: (await ensurePieceBundle({
+				name,
+				version,
+				cacheDir
+			})).dir,
+			local: false
+		};
+	} };
+}
+function pieceResolver() {
+	return resolver ??= localFirstResolver(async (name) => {
+		await packagePieces.ready();
+		return packagePieces.lookup(name);
+	}, fetchingResolver(BUNDLE_CACHE_DIR));
+}
+function boundConnections(inner) {
+	return new BoundConnectionResolver(inner, currentBoundConnections, (connectionId, request) => {
+		connectionLogger.warn(`Step "${request?.stepKey ?? "?"}" of workflow "${currentWorkflowId() ?? "?"}" asked for connection "${connectionId}", which its definition does not declare`);
+	});
+}
+function createBlockExecutor(host, secrets, attachments, pieceStore) {
+	return new CompositeBlockExecutor(new ActivepiecesBlockExecutor({
+		cacheDir: BUNDLE_CACHE_DIR,
+		egress: configuredEgress(),
+		worker: currentPieceWorker,
+		resolver: pieceResolver(),
+		packages: async () => {
+			await packagePieces.ready();
+			return packagePieces.versions();
+		},
+		reactor: new SubgraphReactorPort(host),
+		connections: boundConnections(new DocumentConnectionResolver(host, secrets)),
+		...pieceStore ? { pieceStore } : {},
+		onPieceLog: (entry, execution) => {
+			const line = `[${execution.step.key}] ${entry.message}`;
+			if (entry.level === "error") pieceLogger.error(line);
+			else if (entry.level === "warn") pieceLogger.warn(line);
+			else if (entry.level === "debug") pieceLogger.debug(line);
+			else pieceLogger.info(line);
+		},
+		...attachments ? {
+			attachments,
+			stagingRoot: ATTACHMENT_STAGING_DIR
+		} : {}
+	}));
+}
+function toWorkflowDefinition(state) {
+	if (!state.trigger) throw new Error("Workflow has no trigger binding");
+	return {
+		name: state.name,
+		trigger: {
+			id: state.trigger.id,
+			blockType: state.trigger.blockType,
+			connectionId: state.trigger.connectionId,
+			config: state.trigger.config,
+			filter: state.trigger.filter
+		},
+		steps: state.steps.map((step) => ({
+			id: step.id,
+			key: step.key,
+			name: step.name,
+			blockType: step.blockType,
+			connectionId: step.connectionId,
+			config: step.config,
+			timeoutSeconds: step.timeoutSeconds
+		})),
+		edges: state.edges.map((edge) => ({
+			id: edge.id,
+			from: edge.from,
+			to: edge.to,
+			port: edge.port,
+			condition: edge.condition
+		})),
+		variables: state.variables.map((variable) => ({
+			key: variable.key,
+			value: variable.value
+		}))
+	};
+}
+//#endregion
+//#region src/reactor/schedule.ts
+const SCHEDULE_BLOCK = "core#schedule";
+const MIN_SCHEDULE_INTERVAL_MS = 6e4;
+const INTERVAL_UNIT_MS = {
+	minutes: 6e4,
+	hours: 36e5,
+	days: 864e5
+};
+function asRecord$2(config) {
+	if (config && typeof config === "object" && !Array.isArray(config)) return config;
+	if (typeof config === "string") try {
+		return asRecord$2(JSON.parse(config));
+	} catch {
+		return {};
+	}
+	return {};
+}
+function parseTimezone(value) {
+	if (value === void 0 || value === null || value === "") return "UTC";
+	if (typeof value !== "string") throw new Error(`${SCHEDULE_BLOCK}: "timezone" must be an IANA name`);
+	try {
+		new Intl.DateTimeFormat("en-US", { timeZone: value });
+	} catch {
+		throw new Error(`${SCHEDULE_BLOCK}: unknown timezone "${value}" (use an IANA name such as Europe/Lisbon)`);
+	}
+	return value;
+}
+function toNumber$1(value) {
+	if (typeof value === "number") return value;
+	if (typeof value === "string" && value.trim() !== "") {
+		const parsed = Number(value);
+		return Number.isNaN(parsed) ? void 0 : parsed;
+	}
+}
+function parseCronPattern(cron, timezone) {
+	if (typeof cron !== "string" || cron.trim() === "") throw new Error(`${SCHEDULE_BLOCK}: "cron" is required in cron mode`);
+	const pattern = cron.trim().replace(/\s+/g, " ");
+	if (pattern.split(" ").length !== 5) throw new Error(`${SCHEDULE_BLOCK}: cron "${pattern}" must have exactly five fields (minute hour day month weekday)`);
+	let cronJob;
+	try {
+		cronJob = new Cron(pattern, {
+			timezone,
+			legacyMode: false
+		});
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		throw new Error(`${SCHEDULE_BLOCK}: invalid cron "${pattern}": ${message}`, { cause: error });
+	}
+	if (!cronJob.nextRun()) throw new Error(`${SCHEDULE_BLOCK}: cron "${pattern}" never fires`);
+	return pattern;
+}
+function parseScheduleConfig(config) {
+	const record = asRecord$2(config);
+	const timezone = parseTimezone(record.timezone);
+	const mode = record.mode === "cron" || record.mode === "interval" ? record.mode : record.cron ? "cron" : record.every !== void 0 || record.everyMs !== void 0 ? "interval" : void 0;
+	if (!mode) throw new Error(`${SCHEDULE_BLOCK}: "mode" must be "cron" or "interval" (or set "cron" / "every")`);
+	if (mode === "cron") return {
+		mode,
+		cron: parseCronPattern(record.cron, timezone),
+		timezone
+	};
+	return {
+		mode,
+		everyMs: intervalMsFrom(record),
+		timezone
+	};
+}
+function intervalMsFrom(record) {
+	const every = toNumber$1(record.every);
+	let everyMs;
+	if (every !== void 0) {
+		const unit = record.unit ?? "minutes";
+		if (!(unit in INTERVAL_UNIT_MS)) throw new Error(`${SCHEDULE_BLOCK}: "unit" must be one of ${Object.keys(INTERVAL_UNIT_MS).join(", ")}`);
+		everyMs = every * INTERVAL_UNIT_MS[unit];
+	} else everyMs = toNumber$1(record.everyMs);
+	if (everyMs === void 0) throw new Error(`${SCHEDULE_BLOCK}: "every" (with "unit") or "everyMs" is required in interval mode`);
+	if (!Number.isFinite(everyMs) || everyMs <= 0) throw new Error(`${SCHEDULE_BLOCK}: the interval must be a positive number`);
+	if (everyMs < 6e4) throw new Error(`${SCHEDULE_BLOCK}: the interval must be at least ${MIN_SCHEDULE_INTERVAL_MS / 1e3}s`);
+	return Math.round(everyMs);
+}
+function nextFireAt(schedule, from) {
+	if (schedule.mode === "interval") return new Date(from.getTime() + schedule.everyMs);
+	const next = new Cron(schedule.cron, {
+		timezone: schedule.timezone,
+		legacyMode: false
+	}).nextRun(from);
+	if (!next) throw new Error(`${SCHEDULE_BLOCK}: cron "${schedule.cron}" never fires`);
+	return next;
+}
+function rescheduleAfterFire(schedule, scheduledFor, now) {
+	if (schedule.mode === "interval") {
+		const onPhase = new Date(scheduledFor.getTime() + schedule.everyMs);
+		return onPhase > now ? onPhase : nextFireAt(schedule, now);
+	}
+	return nextFireAt(schedule, now);
+}
+function schedulePayload(schedule, scheduledFor, firedAt) {
+	return {
+		scheduledFor: scheduledFor.toISOString(),
+		firedAt: firedAt.toISOString(),
+		timezone: schedule.timezone,
+		...schedule.mode === "cron" ? { cron: schedule.cron } : { everyMs: schedule.everyMs }
+	};
+}
+function cronIntervalMs(cron, from = /* @__PURE__ */ new Date()) {
+	try {
+		const runs = new Cron(cron.trim(), {
+			timezone: "UTC",
+			legacyMode: false
+		}).nextRuns(2, from);
+		if (runs.length < 2) return void 0;
+		return Math.max(runs[1].getTime() - runs[0].getTime(), MIN_SCHEDULE_INTERVAL_MS);
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/reactor/piece-store-port.ts
+const logger$3 = childLogger(["workflow", "piece-store"]);
+const PROJECT_SCOPE_KEY = "reactor";
+const TEST_PARTITION_SUFFIX = "#test";
+function testPartitionKey(scope, workflowId) {
+	return (scope === "PROJECT" ? `${PROJECT_SCOPE_KEY}#${workflowId}` : workflowId) + TEST_PARTITION_SUFFIX;
+}
+const CURSOR_KEY = "lastPoll";
+const MAX_CURSOR_SKEW_MS = 1440 * 6e4;
+function isPlausibleCursor(value, now) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0 && value <= now + MAX_CURSOR_SKEW_MS;
+}
+function isCursorShaped(value) {
+	return value === null || typeof value === "number";
+}
+function showCursor(value) {
+	return typeof value === "number" ? String(value) : JSON.stringify(value);
+}
+function isCursorRef(key) {
+	return key === CURSOR_KEY || key.endsWith(`/${CURSOR_KEY}`);
+}
+function createPieceStorePort(store, workflowIdFor, sample = false, clock = Date.now) {
+	const flowKey = () => {
+		const workflowId = workflowIdFor();
+		if (!workflowId) throw new Error("ctx.store is unavailable: no workflow is in scope");
+		return workflowId;
+	};
+	const partition = (scope) => sample ? testPartitionKey(scope, flowKey()) : scope === "PROJECT" ? PROJECT_SCOPE_KEY : flowKey();
+	return {
+		get: async (key, scope) => store.getPieceStoreValue(scope, partition(scope), key),
+		put: async (key, value, scope) => {
+			const now = clock();
+			if (!isCursorRef(key) || isPlausibleCursor(value, now)) return store.setPieceStoreValue(scope, partition(scope), key, value);
+			const kept = await store.getPieceStoreValue(scope, partition(scope), key);
+			if (!isCursorShaped(value) && !isPlausibleCursor(kept, now)) return store.setPieceStoreValue(scope, partition(scope), key, value);
+			logger$3.warn(`Rejected ${key}=${showCursor(value)} from workflow ${flowKey()}; keeping ${isPlausibleCursor(kept, now) ? String(kept) : "no cursor"}`);
+			if (!isPlausibleCursor(kept, now)) await store.deletePieceStoreValue(scope, partition(scope), key);
+		},
+		delete: async (key, scope) => store.deletePieceStoreValue(scope, partition(scope), key)
+	};
+}
+//#endregion
+//#region src/reactor/secret-store.ts
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+const KEY_BYTES = 32;
+async function up$1(db) {
+	await db.schema.createTable("secret").addColumn("id", "text", (col) => col.primaryKey()).addColumn("label", "text").addColumn("version", "integer", (col) => col.notNull()).addColumn("enc", "text").addColumn("status", "text", (col) => col.notNull()).addColumn("created_at", "text", (col) => col.notNull()).addColumn("updated_at", "text", (col) => col.notNull()).ifNotExists().execute();
+}
+function loadKey(options) {
+	const hex = options.masterKeyHex ?? process.env.PH_SECRETS_MASTER_KEY;
+	if (hex !== void 0) {
+		if (!/^[0-9a-f]{64}$/i.test(hex)) throw new Error("Secrets master key must be 64 hex chars (32 bytes)");
+		return Buffer.from(hex, "hex");
+	}
+	const file = options.keyFile ?? join(process.cwd(), ".ph", "secrets.key");
+	try {
+		const key = Buffer.from(readFileSync(file, "utf8").trim(), "hex");
+		if (key.length !== KEY_BYTES) throw new Error(`Key file "${file}" is not 32 bytes of hex`);
+		return key;
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+	const key = randomBytes(KEY_BYTES);
+	mkdirSync(dirname(file), { recursive: true });
+	writeFileSync(file, key.toString("hex") + "\n", { mode: 384 });
+	return key;
+}
+var LocalEncryptedSecretStore = class LocalEncryptedSecretStore {
+	constructor(db, key) {
+		this.db = db;
+		this.key = key;
+	}
+	static async create(relationalDb, options = {}) {
+		const db = await relationalDb.createNamespace("secrets");
+		await up$1(db);
+		return new LocalEncryptedSecretStore(db, loadKey(options));
+	}
+	encrypt(value) {
+		const iv = randomBytes(IV_BYTES);
+		const cipher = createCipheriv("aes-256-gcm", this.key, iv);
+		const ciphertext = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+		return Buffer.concat([
+			iv,
+			cipher.getAuthTag(),
+			ciphertext
+		]).toString("base64");
+	}
+	decrypt(enc) {
+		const raw = Buffer.from(enc, "base64");
+		const iv = raw.subarray(0, IV_BYTES);
+		const tag = raw.subarray(IV_BYTES, IV_BYTES + TAG_BYTES);
+		const decipher = createDecipheriv("aes-256-gcm", this.key, iv);
+		decipher.setAuthTag(tag);
+		return Buffer.concat([decipher.update(raw.subarray(IV_BYTES + TAG_BYTES)), decipher.final()]).toString("utf8");
+	}
+	async row(ref) {
+		const id = parseSecretRef(ref);
+		const row = await this.db.selectFrom("secret").selectAll().where("id", "=", id).executeTakeFirst();
+		if (!row) throw new SecretNotFoundError(ref);
+		return row;
+	}
+	toStat(row) {
+		return {
+			ref: secretRefFromId(row.id),
+			label: row.label,
+			version: row.version,
+			status: row.status,
+			createdAt: row.created_at,
+			updatedAt: row.updated_at
+		};
+	}
+	async create(input) {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const row = {
+			id: randomBytes(16).toString("hex"),
+			label: input.label ?? null,
+			version: 1,
+			enc: this.encrypt(input.value),
+			status: "ACTIVE",
+			created_at: now,
+			updated_at: now
+		};
+		await this.db.insertInto("secret").values(row).execute();
+		return this.toStat(row);
+	}
+	async rotate(ref, value) {
+		const row = await this.row(ref);
+		if (row.status !== "ACTIVE") throw new SecretDeletedError(ref);
+		const updated = {
+			...row,
+			version: row.version + 1,
+			enc: this.encrypt(value),
+			updated_at: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.db.updateTable("secret").set({
+			version: updated.version,
+			enc: updated.enc,
+			updated_at: updated.updated_at
+		}).where("id", "=", row.id).execute();
+		return this.toStat(updated);
+	}
+	async get(ref) {
+		const row = await this.row(ref);
+		if (row.status !== "ACTIVE" || row.enc === null) throw new SecretDeletedError(ref);
+		return this.decrypt(row.enc);
+	}
+	async stat(ref) {
+		return this.toStat(await this.row(ref));
+	}
+	async list() {
+		return (await this.db.selectFrom("secret").selectAll().where("status", "=", "ACTIVE").orderBy("created_at", "desc").execute()).map((row) => this.toStat(row));
+	}
+	async delete(ref) {
+		const row = await this.row(ref);
+		await this.db.updateTable("secret").set({
+			status: "DELETED",
+			enc: null,
+			updated_at: (/* @__PURE__ */ new Date()).toISOString()
+		}).where("id", "=", row.id).execute();
+	}
+};
+//#endregion
+//#region src/reactor/store.ts
+const logger$2 = childLogger([
+	"workflow",
+	"runtime",
+	"store"
+]);
+const ORPHANED_RUN_ERROR = "Reactor stopped before the run finished; steps completed before then were journaled";
+const ABANDONED_PENDING_RUN_ERROR = "Reactor stopped before the matched trigger started its run; rerun it to fire the workflow with the same payload";
+const PENDING_RUN_STATUS = "PENDING";
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function isDuplicateObject(error) {
+	if (typeof error !== "object" || error === null) return false;
+	return error.code === "42P07";
+}
+async function up(db) {
+	await db.schema.createTable("run").addColumn("id", "text", (col) => col.primaryKey()).addColumn("workflow_id", "text", (col) => col.notNull()).addColumn("workflow_name", "text", (col) => col.notNull()).addColumn("workflow_version", "integer", (col) => col.notNull()).addColumn("trigger_kind", "text", (col) => col.notNull()).addColumn("trigger_payload", "text").addColumn("status", "text", (col) => col.notNull()).addColumn("error", "text").addColumn("started_at", "text", (col) => col.notNull()).addColumn("ended_at", "text").addColumn("rerun_of", "text").ifNotExists().execute();
+	try {
+		await db.schema.alterTable("run").addColumn("rerun_of", "text").execute();
+	} catch {}
+	await db.schema.createTable("trigger_state").addColumn("workflow_id", "text", (col) => col.primaryKey()).addColumn("block_type", "text", (col) => col.notNull()).addColumn("config_hash", "text", (col) => col.notNull()).addColumn("status", "text", (col) => col.notNull()).addColumn("store_state", "text", (col) => col.notNull()).addColumn("interval_ms", "integer", (col) => col.notNull()).addColumn("next_poll_at", "text").addColumn("last_poll_at", "text").addColumn("last_error", "text").addColumn("consecutive_failures", "integer", (col) => col.notNull()).addColumn("lease_owner", "text").addColumn("lease_expires_at", "text").addColumn("updated_at", "text", (col) => col.notNull()).ifNotExists().execute();
+	await db.schema.createTable("trigger_dedupe").addColumn("workflow_id", "text", (col) => col.notNull()).addColumn("dedupe_key", "text", (col) => col.notNull()).addColumn("run_id", "text").addColumn("created_at", "text", (col) => col.notNull()).addPrimaryKeyConstraint("trigger_dedupe_pk", ["workflow_id", "dedupe_key"]).ifNotExists().execute();
+	await db.schema.createTable("step_execution").addColumn("id", "text", (col) => col.primaryKey()).addColumn("run_id", "text", (col) => col.notNull()).addColumn("ordinal", "integer", (col) => col.notNull()).addColumn("step_id", "text", (col) => col.notNull()).addColumn("step_key", "text", (col) => col.notNull()).addColumn("block_type", "text", (col) => col.notNull()).addColumn("status", "text", (col) => col.notNull()).addColumn("input", "text").addColumn("output", "text").addColumn("port", "text").addColumn("error", "text").addUniqueConstraint("step_execution_run_step", ["run_id", "step_id"]).ifNotExists().execute();
+	try {
+		await db.schema.alterTable("step_execution").addUniqueConstraint("step_execution_run_step", ["run_id", "step_id"]).execute();
+	} catch (error) {
+		if (!isDuplicateObject(error)) throw new Error(`Could not add the step_execution (run_id, step_id) unique constraint, which per-step journaling upserts against: ${errorMessage(error)}`, { cause: error });
+	}
+	await db.schema.createTable("piece_store").addColumn("scope", "text", (col) => col.notNull()).addColumn("scope_key", "text", (col) => col.notNull()).addColumn("key", "text", (col) => col.notNull()).addColumn("value", "text", (col) => col.notNull()).addColumn("updated_at", "text", (col) => col.notNull()).addPrimaryKeyConstraint("piece_store_pk", [
+		"scope",
+		"scope_key",
+		"key"
+	]).ifNotExists().execute();
+	try {
+		await db.schema.dropTable("webhook_endpoint").ifExists().execute();
+	} catch {}
+	return migrateTriggerStoreState(db);
+}
+async function migrateTriggerStoreState(db) {
+	const unmigrated = /* @__PURE__ */ new Set();
+	let rows;
+	try {
+		rows = await db.selectFrom("trigger_state").select(["workflow_id", "store_state"]).orderBy("updated_at", "asc").orderBy("workflow_id", "asc").execute();
+	} catch (error) {
+		logger$2.error("Could not read trigger_state to migrate it: @error", error);
+		return unmigrated;
+	}
+	const pending = [];
+	for (const row of rows) {
+		const entries = parseLegacyBlob(row, unmigrated);
+		if (entries) pending.push({
+			workflowId: row.workflow_id,
+			entries
+		});
+	}
+	const projectWinner = resolveProjectCollisions(pending);
+	for (const row of pending) try {
+		await migrateOneRow(db, row, projectWinner);
+	} catch (error) {
+		unmigrated.add(row.workflowId);
+		logger$2.error(`Could not migrate trigger store state for ${row.workflowId}`, error);
+	}
+	return unmigrated;
+}
+function parseLegacyBlob(row, unmigrated) {
+	if (!row.store_state || row.store_state === "{}") return null;
+	let state;
+	try {
+		state = JSON.parse(row.store_state);
+	} catch {
+		logger$2.warn(`Leaving unparseable store_state for ${row.workflow_id} in place`);
+		unmigrated.add(row.workflow_id);
+		return null;
+	}
+	if (typeof state !== "object" || state === null) {
+		unmigrated.add(row.workflow_id);
+		return null;
+	}
+	const entries = [];
+	for (const [key, value] of Object.entries(state)) {
+		if (/^testflow_.+\//.test(key)) continue;
+		const flow = /^flow_(.+?)\/(.+)$/.exec(key);
+		if (flow) {
+			entries.push({
+				scope: "FLOW",
+				scopeKey: flow[1],
+				key: flow[2],
+				value
+			});
+			continue;
+		}
+		if (key.startsWith("test")) logger$2.info(`Migrating "${key}" for ${row.workflow_id} as a project key; it may be a test leftover`);
+		entries.push({
+			scope: "PROJECT",
+			scopeKey: PROJECT_SCOPE_KEY,
+			key,
+			value
+		});
+	}
+	return entries;
+}
+function resolveProjectCollisions(pending) {
+	const winner = /* @__PURE__ */ new Map();
+	const contested = /* @__PURE__ */ new Map();
+	for (const row of pending) for (const entry of row.entries) {
+		if (entry.scope !== "PROJECT") continue;
+		const previous = winner.get(entry.key);
+		if (previous !== void 0) {
+			const seen = contested.get(entry.key) ?? [previous];
+			contested.set(entry.key, [...seen, row.workflowId]);
+		}
+		winner.set(entry.key, row.workflowId);
+	}
+	for (const [key, workflows] of contested) logger$2.warn(`Project store key "${key}" was written by ${workflows.join(", ")}; keeping the value last updated, from ${winner.get(key)}, and discarding the rest`);
+	return winner;
+}
+async function migrateOneRow(db, row, projectWinner) {
+	for (const entry of row.entries) {
+		if (entry.scope === "PROJECT" && projectWinner.get(entry.key) !== row.workflowId) continue;
+		await insertPieceStoreIfAbsent(db, entry.scope, entry.scopeKey, entry.key, entry.value);
+	}
+	await db.updateTable("trigger_state").set({ store_state: "{}" }).where("workflow_id", "=", row.workflowId).execute();
+}
+async function insertPieceStoreIfAbsent(db, scope, scopeKey, key, value) {
+	const encoded = jsonOrNull(value);
+	if (encoded === null) return;
+	warnIfOverPieceStoreLimits(scope, scopeKey, key, encoded);
+	if (await db.selectFrom("piece_store").select("key").where("scope", "=", scope).where("scope_key", "=", scopeKey).where("key", "=", key).executeTakeFirst()) return;
+	await db.insertInto("piece_store").values({
+		scope,
+		scope_key: scopeKey,
+		key,
+		value: encoded,
+		updated_at: (/* @__PURE__ */ new Date()).toISOString()
+	}).onConflict((oc) => oc.columns([
+		"scope",
+		"scope_key",
+		"key"
+	]).doNothing()).execute();
+}
+function warnIfOverPieceStoreLimits(scope, scopeKey, key, encoded) {
+	const at = `${scope}/${scopeKey}/${key}`;
+	if (key.length > 128) logger$2.warn(`Migrated store key ${at} is ${key.length} chars, over the 128 limit; writes to it will fail`);
+	const size = Buffer.byteLength(encoded, "utf8");
+	if (size > 524288) logger$2.warn(`Migrated store value ${at} is ${size} bytes, over the ${PIECE_STORE_MAX_VALUE_BYTES} limit; writes to it will fail`);
+}
+const PIECE_STORE_MAX_VALUE_BYTES = 512 * 1024;
+var PieceStoreLimitError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "PieceStoreLimitError";
+	}
+};
+function assertPieceStoreEntry(key, value) {
+	if (key.length === 0 || key.length > 128) throw new PieceStoreLimitError(`Store key must be 1-128 characters, got ${key.length}`);
+	const encoded = JSON.stringify(value);
+	if (encoded === void 0) throw new PieceStoreLimitError(`Store value for "${key}" is not JSON`);
+	const size = Buffer.byteLength(encoded, "utf8");
+	if (size > 524288) throw new PieceStoreLimitError(`Store value for "${key}" is ${size} bytes, over the ${PIECE_STORE_MAX_VALUE_BYTES} byte limit`);
+}
+function stepValues(runId, ordinal, step) {
+	return {
+		run_id: runId,
+		ordinal,
+		step_id: step.stepId,
+		step_key: step.key,
+		block_type: step.blockType,
+		status: step.status,
+		input: jsonOrNull(redact(step.input)),
+		output: jsonOrNull(redact(step.output)),
+		port: step.port ?? null,
+		error: step.error ? redactMessage(step.error) : null
+	};
+}
+function jsonOrNull(value) {
+	if (value === void 0) return null;
+	try {
+		return JSON.stringify(value) ?? null;
+	} catch {
+		return null;
+	}
+}
+var WorkflowRunStore = class WorkflowRunStore {
+	runsInFlight = /* @__PURE__ */ new Set();
+	constructor(db, unmigrated) {
+		this.db = db;
+		this.unmigrated = unmigrated;
+	}
+	static async create(relationalDb) {
+		const db = await relationalDb.createNamespace("workflow_runtime");
+		const store = new WorkflowRunStore(db, await up(db));
+		await store.recoverOrphanedRuns();
+		await store.recoverAbandonedRuns();
+		return store;
+	}
+	hasUnmigratedTriggerState(workflowId) {
+		return this.unmigrated.has(workflowId);
+	}
+	clearUnmigratedTriggerState(workflowId) {
+		this.unmigrated.delete(workflowId);
+	}
+	async recoverOrphanedRuns() {
+		let query = this.db.updateTable("run").set({
+			status: "FAILED",
+			error: ORPHANED_RUN_ERROR,
+			ended_at: (/* @__PURE__ */ new Date()).toISOString()
+		}).where("status", "=", "RUNNING");
+		if (this.runsInFlight.size > 0) query = query.where("id", "not in", [...this.runsInFlight]);
+		const result = await query.executeTakeFirst();
+		const recovered = Number(result.numUpdatedRows);
+		if (recovered > 0) logger$2.warn(`Recovered ${recovered} workflow run(s) left RUNNING by a stopped reactor; they are now FAILED and rerunnable`);
+		return recovered;
+	}
+	async recoverAbandonedRuns() {
+		let query = this.db.updateTable("run").set({
+			status: "FAILED",
+			error: ABANDONED_PENDING_RUN_ERROR,
+			ended_at: (/* @__PURE__ */ new Date()).toISOString()
+		}).where("status", "=", PENDING_RUN_STATUS);
+		if (this.runsInFlight.size > 0) query = query.where("id", "not in", [...this.runsInFlight]);
+		const result = await query.executeTakeFirst();
+		const recovered = Number(result.numUpdatedRows);
+		if (recovered > 0) logger$2.warn(`Recovered ${recovered} workflow run(s) journaled by a stopped reactor but never started; they are now FAILED and rerunnable`);
+		return recovered;
+	}
+	async enqueueRun(options) {
+		const id = randomUUID();
+		await this.db.insertInto("run").values({
+			id,
+			workflow_id: options.workflowId,
+			workflow_name: "",
+			workflow_version: 0,
+			trigger_kind: options.triggerKind,
+			trigger_payload: jsonOrNull(redact(options.triggerPayload)),
+			status: PENDING_RUN_STATUS,
+			error: null,
+			started_at: (/* @__PURE__ */ new Date()).toISOString(),
+			ended_at: null,
+			rerun_of: null
+		}).execute();
+		this.runsInFlight.add(id);
+		return id;
+	}
+	async beginRun(runId, details) {
+		this.runsInFlight.add(runId);
+		await this.db.updateTable("run").set({
+			status: "RUNNING",
+			workflow_name: details.workflowName,
+			workflow_version: details.workflowVersion,
+			started_at: (/* @__PURE__ */ new Date()).toISOString()
+		}).where("id", "=", runId).execute();
+	}
+	async startRun(options) {
+		const id = randomUUID();
+		await this.db.insertInto("run").values({
+			id,
+			workflow_id: options.workflowId,
+			workflow_name: options.workflowName,
+			workflow_version: options.workflowVersion,
+			trigger_kind: options.triggerKind,
+			trigger_payload: jsonOrNull(redact(options.triggerPayload)),
+			status: "RUNNING",
+			error: null,
+			started_at: (/* @__PURE__ */ new Date()).toISOString(),
+			ended_at: null,
+			rerun_of: options.rerunOf ?? null
+		}).execute();
+		this.runsInFlight.add(id);
+		return id;
+	}
+	async recordStep(runId, ordinal, step) {
+		const values = stepValues(runId, ordinal, step);
+		const { run_id: _run, step_id: _step, ...mutable } = values;
+		await this.db.insertInto("step_execution").values({
+			id: randomUUID(),
+			...values
+		}).onConflict((oc) => oc.columns(["run_id", "step_id"]).doUpdateSet(mutable)).execute();
+	}
+	async finishRun(runId, result, executionOrder) {
+		this.runsInFlight.delete(runId);
+		if (result.steps.length > 0) try {
+			await this.sweepSteps(runId, result, executionOrder);
+		} catch (error) {
+			logger$2.warn(`Run ${runId}: writing the closing step journal failed; the run is closed out without it`, error);
+		}
+		await this.db.updateTable("run").set({
+			status: result.status,
+			error: result.error ? redactMessage(result.error) : null,
+			ended_at: (/* @__PURE__ */ new Date()).toISOString()
+		}).where("id", "=", runId).execute();
+	}
+	async sweepSteps(runId, result, executionOrder) {
+		const journaled = await this.db.selectFrom("step_execution").select(["step_id", "ordinal"]).where("run_id", "=", runId).execute();
+		const ordinals = new Map(journaled.map((row) => [row.step_id, row.ordinal]));
+		let nextOrdinal = journaled.reduce((max, row) => Math.max(max, row.ordinal + 1), 0);
+		for (const step of result.steps) {
+			const ran = executionOrder?.get(step.stepId);
+			if (ran === void 0 || ordinals.has(step.stepId)) continue;
+			ordinals.set(step.stepId, ran);
+			nextOrdinal = Math.max(nextOrdinal, ran + 1);
+		}
+		const ordinalFor = (step) => ordinals.get(step.stepId) ?? nextOrdinal++;
+		await this.db.insertInto("step_execution").values(result.steps.map((step) => ({
+			id: randomUUID(),
+			...stepValues(runId, ordinalFor(step), step)
+		}))).onConflict((oc) => oc.columns(["run_id", "step_id"]).doUpdateSet((eb) => ({
+			ordinal: eb.ref("excluded.ordinal"),
+			step_key: eb.ref("excluded.step_key"),
+			block_type: eb.ref("excluded.block_type"),
+			status: eb.ref("excluded.status"),
+			input: eb.ref("excluded.input"),
+			output: eb.ref("excluded.output"),
+			port: eb.ref("excluded.port"),
+			error: eb.ref("excluded.error")
+		}))).execute();
+	}
+	async failRun(runId, error) {
+		this.runsInFlight.delete(runId);
+		await this.db.updateTable("run").set({
+			status: "FAILED",
+			error: redactMessage(error),
+			ended_at: (/* @__PURE__ */ new Date()).toISOString()
+		}).where("id", "=", runId).execute();
+	}
+	async listRuns(workflowId, limit = 25) {
+		if (Array.isArray(workflowId) && workflowId.length === 0) return [];
+		let query = this.db.selectFrom("run").selectAll().orderBy("started_at", "desc").limit(Math.min(Math.max(limit, 1), 100));
+		if (Array.isArray(workflowId)) query = query.where("workflow_id", "in", workflowId);
+		else if (workflowId) query = query.where("workflow_id", "=", workflowId);
+		return query.execute();
+	}
+	async getRun(id) {
+		return this.db.selectFrom("run").selectAll().where("id", "=", id).executeTakeFirst();
+	}
+	async getSteps(runId) {
+		return this.db.selectFrom("step_execution").selectAll().where("run_id", "=", runId).orderBy("ordinal", "asc").execute();
+	}
+	async getTriggerState(workflowId) {
+		return this.db.selectFrom("trigger_state").selectAll().where("workflow_id", "=", workflowId).executeTakeFirst();
+	}
+	async upsertTriggerState(row) {
+		const values = {
+			...row,
+			last_error: row.last_error ? redactMessage(row.last_error) : null
+		};
+		await this.db.insertInto("trigger_state").values(values).onConflict((oc) => {
+			const { workflow_id: _, ...rest } = values;
+			return oc.column("workflow_id").doUpdateSet(rest);
+		}).execute();
+	}
+	async setTriggerStatus(workflowId, status, error) {
+		await this.db.updateTable("trigger_state").set({
+			status,
+			last_error: error ? redactMessage(error) : null,
+			updated_at: (/* @__PURE__ */ new Date()).toISOString()
+		}).where("workflow_id", "=", workflowId).execute();
+	}
+	async listDueTriggerStates(nowIso) {
+		return (await this.db.selectFrom("trigger_state").selectAll().where("status", "=", "ENABLED").where("next_poll_at", "<=", nowIso).execute()).filter((row) => !this.unmigrated.has(row.workflow_id));
+	}
+	async listTriggerStates() {
+		return this.db.selectFrom("trigger_state").selectAll().orderBy("workflow_id", "asc").execute();
+	}
+	async recordPollSuccess(workflowId, storeState, nowIso, nextPollAtIso) {
+		await this.db.updateTable("trigger_state").set({
+			store_state: storeState,
+			last_poll_at: nowIso,
+			next_poll_at: nextPollAtIso,
+			last_error: null,
+			consecutive_failures: 0,
+			updated_at: nowIso
+		}).where("workflow_id", "=", workflowId).execute();
+	}
+	async recordPollFailure(workflowId, error, nowIso, nextPollAtIso, consecutiveFailures) {
+		await this.db.updateTable("trigger_state").set({
+			last_poll_at: nowIso,
+			next_poll_at: nextPollAtIso,
+			last_error: redactMessage(error),
+			consecutive_failures: consecutiveFailures,
+			updated_at: nowIso
+		}).where("workflow_id", "=", workflowId).execute();
+	}
+	async claimDedupe(workflowId, dedupeKey, ttlMs, nowIso) {
+		const cutoff = new Date(Date.parse(nowIso) - ttlMs).toISOString();
+		await this.db.deleteFrom("trigger_dedupe").where("workflow_id", "=", workflowId).where("created_at", "<", cutoff).execute();
+		return await this.db.insertInto("trigger_dedupe").values({
+			workflow_id: workflowId,
+			dedupe_key: dedupeKey,
+			run_id: null,
+			created_at: nowIso
+		}).onConflict((oc) => oc.columns(["workflow_id", "dedupe_key"]).doNothing()).returning("dedupe_key").executeTakeFirst() !== void 0;
+	}
+	async recordDedupeRun(workflowId, dedupeKey, runId) {
+		await this.db.updateTable("trigger_dedupe").set({ run_id: runId }).where("workflow_id", "=", workflowId).where("dedupe_key", "=", dedupeKey).execute();
+	}
+	async getPieceStoreValue(scope, scopeKey, key) {
+		const row = await this.db.selectFrom("piece_store").select("value").where("scope", "=", scope).where("scope_key", "=", scopeKey).where("key", "=", key).executeTakeFirst();
+		if (!row) return null;
+		try {
+			return JSON.parse(row.value);
+		} catch {
+			return null;
+		}
+	}
+	async setPieceStoreValue(scope, scopeKey, key, value) {
+		assertPieceStoreEntry(key, value);
+		const encoded = JSON.stringify(value);
+		const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+		await this.db.insertInto("piece_store").values({
+			scope,
+			scope_key: scopeKey,
+			key,
+			value: encoded,
+			updated_at: nowIso
+		}).onConflict((oc) => oc.columns([
+			"scope",
+			"scope_key",
+			"key"
+		]).doUpdateSet({
+			value: encoded,
+			updated_at: nowIso
+		})).execute();
+	}
+	async deletePieceStoreValue(scope, scopeKey, key) {
+		await this.db.deleteFrom("piece_store").where("scope", "=", scope).where("scope_key", "=", scopeKey).where("key", "=", key).execute();
+	}
+	async listPieceStore(scope, scopeKey) {
+		const rows = await this.db.selectFrom("piece_store").selectAll().where("scope", "=", scope).where("scope_key", "=", scopeKey).execute();
+		const out = {};
+		for (const row of rows) try {
+			out[row.key] = JSON.parse(row.value);
+		} catch {}
+		return out;
+	}
+	async deletePieceStore(scope, scopeKey) {
+		await this.db.deleteFrom("piece_store").where("scope", "=", scope).where("scope_key", "=", scopeKey).execute();
+	}
+};
+//#endregion
+//#region src/reactor/trigger-supervisor.ts
+const logger$1 = childLogger(["workflow", "trigger-supervisor"]);
+const SCHEDULE_TRIGGER_KIND = "schedule";
+const MIN_INTERVAL_MS = MIN_SCHEDULE_INTERVAL_MS;
+const MAX_BACKOFF_MS = 30 * 6e4;
+const DEDUPE_TTL_MS = 3e4;
+const DEFAULT_RECONCILE_INTERVAL_MS = 15 * 6e4;
+function isSchedule(binding) {
+	return binding.kind === "schedule";
+}
+function configHash(blockType, config) {
+	return createHash("sha256").update(blockType).update(JSON.stringify(config ?? {})).digest("hex").slice(0, 16);
+}
+function intervalFromSchedules(schedules, defaultMs) {
+	const schedule = schedules?.at(-1);
+	if (!schedule) return Math.max(defaultMs, MIN_INTERVAL_MS);
+	if ("intervalMs" in schedule) return Math.max(schedule.intervalMs, MIN_INTERVAL_MS);
+	const cron = schedule.cronExpression;
+	const intervalMs = cronIntervalMs(cron);
+	if (intervalMs === void 0) {
+		logger$1.warn(`Unsupported setSchedule cron "${cron}"; using the default`);
+		return Math.max(defaultMs, MIN_INTERVAL_MS);
+	}
+	return intervalMs;
+}
+function pollIntervalFor(binding, schedules, defaultMs) {
+	if (binding.pollIntervalMs !== void 0) return Math.max(binding.pollIntervalMs, MIN_INTERVAL_MS);
+	return intervalFromSchedules(schedules, defaultMs);
+}
+const VESTIGIAL_STORE_STATE = "{}";
+var MissingJournalError = class extends Error {
+	constructor(what) {
+		super(`${what} needs a run journal, and none is configured`);
+		this.name = "MissingJournalError";
+	}
+};
+var TriggerConfigError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "TriggerConfigError";
+	}
+};
+function isPermanentFailure(error) {
+	if (error instanceof TriggerConfigError) return true;
+	return error instanceof PieceWorkerError && error.serialized.unsupportedMember !== void 0;
+}
+function backoffMs(intervalMs, failures) {
+	return Math.min(intervalMs * 2 ** failures, MAX_BACKOFF_MS);
+}
+var TriggerSupervisor = class {
+	bindings = /* @__PURE__ */ new Map();
+	worker;
+	tickMs;
+	defaultIntervalMs;
+	hookTimeoutMs;
+	now;
+	egress;
+	timer;
+	ops = Promise.resolve();
+	ticking = false;
+	warnedMissingJournal = false;
+	constructor(options) {
+		this.options = options;
+		this.worker = options.worker ?? new PieceWorker();
+		this.tickMs = options.tickMs ?? 15e3;
+		this.defaultIntervalMs = options.defaultIntervalMs ?? 3e5;
+		this.hookTimeoutMs = options.hookTimeoutMs ?? 6e4;
+		this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+		this.egress = options.egress === void 0 ? DEFAULT_EGRESS_POLICY : options.egress ?? void 0;
+	}
+	start() {
+		if (this.timer) return;
+		this.timer = setInterval(() => {
+			this.tick().catch((error) => {
+				logger$1.error("Trigger tick failed: @error", error);
+			});
+		}, this.tickMs);
+		this.timer.unref();
+		logger$1.info(`Trigger supervisor started (tick ${this.tickMs}ms)`);
+	}
+	stop() {
+		if (this.timer) clearInterval(this.timer);
+		this.timer = void 0;
+		if (!this.options.worker) this.worker.dispose();
+		logger$1.info("Trigger supervisor stopped");
+	}
+	enqueue(task) {
+		const run = this.ops.then(task);
+		this.ops = run.catch(() => void 0);
+		return run;
+	}
+	enabledOk = /* @__PURE__ */ new Set();
+	descriptors = /* @__PURE__ */ new Map();
+	own;
+	resolver() {
+		return this.options.resolver ?? (this.own ??= fetchingResolver(this.options.cacheDir));
+	}
+	enableRetries = /* @__PURE__ */ new Map();
+	upsert(binding) {
+		const previous = this.bindings.get(binding.workflowId);
+		if (previous && this.enabledOk.has(binding.workflowId) && JSON.stringify(previous) === JSON.stringify(binding)) return Promise.resolve();
+		this.bindings.set(binding.workflowId, binding);
+		return this.enqueue(() => this.enable(binding, previous));
+	}
+	remove(workflowId) {
+		const binding = this.bindings.get(workflowId);
+		this.bindings.delete(workflowId);
+		this.enabledOk.delete(workflowId);
+		this.enableRetries.delete(workflowId);
+		return this.enqueue(() => this.disable(workflowId, binding));
+	}
+	test(binding) {
+		return this.enqueue(async () => {
+			const store = await this.options.store();
+			try {
+				return (await this.hook(binding, "test")).output;
+			} finally {
+				await this.dropTestPartitions(store, binding.workflowId);
+			}
+		});
+	}
+	async dropTestPartitions(store, workflowId) {
+		if (!store) return;
+		try {
+			await store.deletePieceStore("FLOW", testPartitionKey("FLOW", workflowId));
+			await store.deletePieceStore("PROJECT", testPartitionKey("PROJECT", workflowId));
+		} catch (error) {
+			logger$1.warn(`Could not clear test store for ${workflowId}`, error);
+		}
+	}
+	handshake(binding, payload) {
+		return this.enqueue(() => this.hook(binding, "onHandshake", { payload }));
+	}
+	deliverWebhook(workflowId, payload) {
+		return this.enqueue(async () => {
+			const binding = this.bindings.get(workflowId);
+			if (!binding || isSchedule(binding)) {
+				logger$1.warn(`Webhook delivery for unknown workflow ${workflowId}`);
+				return;
+			}
+			const store = await this.options.store();
+			if (!store) throw new MissingJournalError("Webhook delivery");
+			const row = await store.getTriggerState(workflowId);
+			const now = this.now();
+			const rewind = await this.cursorRewind(store, workflowId);
+			try {
+				const result = await this.hook(binding, "run", { payload });
+				if (!Array.isArray(result.output)) throw new Error(`Trigger run returned ${typeof result.output}, expected an array`);
+				if (row?.status === "ENABLED") await store.recordPollSuccess(workflowId, VESTIGIAL_STORE_STATE, now.toISOString(), new Date(now.getTime() + row.interval_ms).toISOString());
+				for (const item of result.output) await this.fireItem(store, binding, item, now);
+			} catch (error) {
+				await rewind();
+				throw error;
+			}
+		});
+	}
+	async cursorRewind(store, workflowId) {
+		const before = await store.listPieceStore("FLOW", workflowId);
+		return async () => {
+			try {
+				await store.deletePieceStore("FLOW", workflowId);
+				for (const [key, value] of Object.entries(before)) await store.setPieceStoreValue("FLOW", workflowId, key, value);
+			} catch (error) {
+				logger$1.warn(`Could not rewind the cursor for ${workflowId}`, error);
+			}
+		};
+	}
+	async hook(binding, hook, options = {}) {
+		const store = await this.options.store();
+		if (!store && hook !== "test") throw new MissingJournalError(`Trigger hook "${hook}"`);
+		const pieceStore = store ? createPieceStorePort(store, () => binding.workflowId, hook === "test") : void 0;
+		const piece = await this.resolver().resolve(binding.packageName, binding.version);
+		const auth = await this.options.resolveAuth(binding.connectionId, {
+			blockType: binding.blockType,
+			piecePackage: binding.packageName
+		});
+		const redactValues = secretsFor(auth);
+		return this.worker.runTriggerHook({
+			...pieceModuleRef(piece),
+			triggerName: binding.triggerName,
+			hook,
+			propsValue: binding.config,
+			auth,
+			...redactValues.length > 0 ? { redactValues } : {},
+			...pieceStore ? { durableStore: true } : {},
+			identity: { flowId: binding.workflowId },
+			isRepublish: options.isRepublish,
+			payload: options.payload,
+			webhookUrl: options.webhookUrl ?? `http://localhost:0/v1/webhooks/${binding.workflowId}`,
+			...this.egress ? { egress: this.egress } : {}
+		}, {
+			timeoutMs: this.hookTimeoutMs,
+			...pieceStore ? { hostCalls: storeHandlers(pieceStore) } : {}
+		});
+	}
+	async strategyFor(binding) {
+		const key = `${binding.packageName}@${binding.version}`;
+		let descriptor = this.descriptors.get(key);
+		if (!descriptor) {
+			const piece = await this.resolver().resolve(binding.packageName, binding.version);
+			descriptor = (await this.worker.describePiece({
+				...pieceModuleRef(piece),
+				packageName: binding.packageName,
+				version: binding.version,
+				...this.egress ? { egress: this.egress } : {}
+			}, { timeoutMs: this.hookTimeoutMs })).output;
+			this.descriptors.set(key, descriptor);
+		}
+		return descriptor.triggers.find((candidate) => candidate.name === binding.triggerName)?.strategy ?? "POLLING";
+	}
+	async enable(binding, superseded) {
+		const store = await this.options.store();
+		if (!store) throw new MissingJournalError("Enabling a trigger");
+		const hash = configHash(binding.blockType, binding.config);
+		const existing = await store.getTriggerState(binding.workflowId);
+		const now = this.now();
+		const isRepublish = existing?.config_hash === hash && existing.status === "ENABLED" && !store.hasUnmigratedTriggerState(binding.workflowId);
+		if (existing && !isRepublish && existing.status === "ENABLED") await this.disableRow(binding.workflowId, existing, superseded);
+		const pending = this.enableRetries.get(binding.workflowId);
+		if (isSchedule(binding)) {
+			this.enableRetries.delete(binding.workflowId);
+			if (pending?.release && existing && superseded && !isSchedule(superseded)) await this.releaseRegistration(superseded);
+			await this.enableSchedule(store, binding, hash, existing);
+			return;
+		}
+		if (this.deferToStoredRetry(binding, hash, existing, now)) return;
+		if (pending?.release && existing) await this.releaseRegistration(binding);
+		if (!isRepublish) await store.deletePieceStore("FLOW", binding.workflowId);
+		let reachedProvider = false;
+		try {
+			const strategy = await this.strategyFor(binding);
+			const webhook = strategy === "WEBHOOK" || strategy === "APP_WEBHOOK";
+			const webhookUrl = webhook ? await this.webhookUrlOrThrow(binding.workflowId) : void 0;
+			if (webhook && !webhookUrl) throw new Error("This trigger delivers by webhook, but no public webhook endpoint is configured for the reactor");
+			reachedProvider = true;
+			const result = await this.hook(binding, "onEnable", {
+				isRepublish,
+				webhookUrl
+			});
+			const intervalMs = webhook ? this.options.reconcileIntervalMs ?? DEFAULT_RECONCILE_INTERVAL_MS : pollIntervalFor(binding, result.schedules, this.defaultIntervalMs);
+			await store.upsertTriggerState({
+				workflow_id: binding.workflowId,
+				block_type: binding.blockType,
+				config_hash: hash,
+				status: "ENABLED",
+				store_state: VESTIGIAL_STORE_STATE,
+				interval_ms: intervalMs,
+				next_poll_at: new Date(now.getTime() + intervalMs).toISOString(),
+				last_poll_at: null,
+				last_error: null,
+				consecutive_failures: 0,
+				lease_owner: null,
+				lease_expires_at: null,
+				updated_at: now.toISOString()
+			});
+			this.enabledOk.add(binding.workflowId);
+			this.enableRetries.delete(binding.workflowId);
+			store.clearUnmigratedTriggerState(binding.workflowId);
+			logger$1.info(`Enabled ${binding.blockType} for workflow ${binding.workflowId} (every ${intervalMs}ms)`);
+		} catch (error) {
+			this.enabledOk.delete(binding.workflowId);
+			const message = error instanceof Error ? error.message : String(error);
+			const failures = (existing?.consecutive_failures ?? 0) + 1;
+			const intervalMs = pollIntervalFor(binding, void 0, this.defaultIntervalMs);
+			const retryAt = isPermanentFailure(error) ? void 0 : new Date(now.getTime() + backoffMs(intervalMs, failures));
+			if (retryAt) this.enableRetries.set(binding.workflowId, {
+				at: retryAt.getTime(),
+				failures,
+				release: reachedProvider
+			});
+			else this.enableRetries.delete(binding.workflowId);
+			await store.upsertTriggerState({
+				workflow_id: binding.workflowId,
+				block_type: binding.blockType,
+				config_hash: hash,
+				status: "ERROR",
+				store_state: VESTIGIAL_STORE_STATE,
+				interval_ms: intervalMs,
+				next_poll_at: retryAt?.toISOString() ?? null,
+				last_poll_at: null,
+				last_error: message,
+				consecutive_failures: failures,
+				lease_owner: null,
+				lease_expires_at: null,
+				updated_at: now.toISOString()
+			});
+			logger$1.error(`onEnable failed for workflow ${binding.workflowId} (${failures}x): ${message}` + (retryAt ? `; retrying at ${retryAt.toISOString()}` : "; not retrying"));
+		}
+	}
+	async webhookUrlOrThrow(workflowId) {
+		const mint = this.options.webhookUrlFor;
+		if (!mint) throw new TriggerConfigError("This trigger delivers by webhook, but no public webhook endpoint is configured for the reactor");
+		const url = await mint(workflowId);
+		if (!url) throw new Error("The reactor's webhook endpoint is not available yet for this workflow");
+		return url;
+	}
+	deferToStoredRetry(binding, hash, existing, now) {
+		if (existing?.status !== "ERROR" || existing.config_hash !== hash) return false;
+		const pending = this.enableRetries.get(binding.workflowId);
+		const stored = existing.next_poll_at ? Date.parse(existing.next_poll_at) : NaN;
+		const at = pending?.at ?? (Number.isFinite(stored) ? stored : void 0);
+		if (at === void 0 || at <= now.getTime()) return false;
+		if (!pending) {
+			this.enableRetries.set(binding.workflowId, {
+				at,
+				failures: existing.consecutive_failures,
+				release: true
+			});
+			logger$1.info(`Enable for workflow ${binding.workflowId} still backing off until ${existing.next_poll_at}`);
+		}
+		return true;
+	}
+	async releaseRegistration(binding) {
+		try {
+			await this.hook(binding, "onDisable");
+		} catch (error) {
+			logger$1.warn(`onDisable before retrying workflow ${binding.workflowId} failed`, error);
+		}
+	}
+	async enableSchedule(store, binding, hash, existing) {
+		const now = this.now();
+		const base = {
+			workflow_id: binding.workflowId,
+			block_type: binding.blockType,
+			config_hash: hash,
+			store_state: VESTIGIAL_STORE_STATE,
+			last_poll_at: existing?.last_poll_at ?? null,
+			lease_owner: null,
+			lease_expires_at: null,
+			updated_at: now.toISOString()
+		};
+		try {
+			const schedule = parseScheduleConfig(binding.config);
+			const carried = existing?.status === "ENABLED" && existing.config_hash === hash ? existing.next_poll_at : null;
+			const nextAt = carried ? new Date(carried) : nextFireAt(schedule, now);
+			await store.upsertTriggerState({
+				...base,
+				status: "ENABLED",
+				interval_ms: schedule.mode === "interval" ? schedule.everyMs : MIN_SCHEDULE_INTERVAL_MS,
+				next_poll_at: nextAt.toISOString(),
+				last_error: null,
+				consecutive_failures: 0
+			});
+			this.enabledOk.add(binding.workflowId);
+			logger$1.info(`Scheduled workflow ${binding.workflowId}: next fire ${nextAt.toISOString()}` + (carried ? " (carried over)" : ""));
+		} catch (error) {
+			this.enabledOk.delete(binding.workflowId);
+			const message = error instanceof Error ? error.message : String(error);
+			await store.upsertTriggerState({
+				...base,
+				status: "ERROR",
+				interval_ms: MIN_SCHEDULE_INTERVAL_MS,
+				next_poll_at: null,
+				last_error: message,
+				consecutive_failures: (existing?.consecutive_failures ?? 0) + 1
+			});
+			logger$1.error(`Invalid schedule for workflow ${binding.workflowId}: ${message}`);
+		}
+	}
+	async disable(workflowId, binding) {
+		const store = await this.options.store();
+		if (!store) throw new MissingJournalError("Disabling a trigger");
+		const row = await store.getTriggerState(workflowId);
+		if (!row || row.status === "DISABLED") return;
+		await this.disableRow(workflowId, row, binding);
+	}
+	async disableRow(workflowId, row, binding) {
+		const store = await this.options.store();
+		if (!store) return;
+		const target = binding ?? this.bindingFromRow(row);
+		if (target && !isSchedule(target) && row.block_type !== "core#schedule") try {
+			await this.hook(target, "onDisable");
+		} catch (error) {
+			logger$1.warn(`onDisable failed for workflow ${workflowId}`, error);
+		}
+		await store.setTriggerStatus(workflowId, "DISABLED");
+	}
+	bindingFromRow(row) {
+		return this.bindings.get(row.workflow_id);
+	}
+	async tick() {
+		if (this.ticking) return;
+		this.ticking = true;
+		try {
+			await this.enqueue(() => this.pollDue());
+		} finally {
+			this.ticking = false;
+		}
+	}
+	async retryOneEnable() {
+		const now = this.now().getTime();
+		const next = [...this.enableRetries].filter(([, retry]) => retry.at <= now).sort((a, b) => a[1].at - b[1].at).at(0);
+		if (!next) return;
+		const [workflowId, retry] = next;
+		const binding = this.bindings.get(workflowId);
+		if (!binding) {
+			this.enableRetries.delete(workflowId);
+			return;
+		}
+		try {
+			await this.enable(binding);
+		} catch (error) {
+			const failures = retry.failures + 1;
+			const intervalMs = isSchedule(binding) ? MIN_INTERVAL_MS : pollIntervalFor(binding, void 0, this.defaultIntervalMs);
+			this.enableRetries.set(workflowId, {
+				at: now + backoffMs(intervalMs, failures),
+				failures,
+				release: retry.release
+			});
+			logger$1.error(`Enable retry for workflow ${workflowId} threw`, error);
+		}
+	}
+	async pollDue() {
+		const store = await this.options.store();
+		if (!store) {
+			if (!this.warnedMissingJournal) {
+				this.warnedMissingJournal = true;
+				logger$1.error("Trigger polling is off: @error", new MissingJournalError("Polling"));
+			}
+			return;
+		}
+		const due = await store.listDueTriggerStates(this.now().toISOString());
+		for (const row of due) {
+			const binding = this.bindings.get(row.workflow_id);
+			if (!binding) {
+				await store.setTriggerStatus(row.workflow_id, "DISABLED");
+				continue;
+			}
+			if (isSchedule(binding)) await this.fireSchedule(store, row, binding);
+			else await this.poll(store, row, binding);
+		}
+		await this.retryOneEnable();
+	}
+	async fireSchedule(store, row, binding) {
+		const now = this.now();
+		try {
+			const schedule = parseScheduleConfig(binding.config);
+			const scheduledFor = row.next_poll_at ? new Date(row.next_poll_at) : now;
+			const nextAt = rescheduleAfterFire(schedule, scheduledFor, now);
+			await store.recordPollSuccess(row.workflow_id, "{}", now.toISOString(), nextAt.toISOString());
+			this.options.fire(binding.workflowId, schedulePayload(schedule, scheduledFor, now), SCHEDULE_TRIGGER_KIND);
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			this.enabledOk.delete(binding.workflowId);
+			await store.setTriggerStatus(row.workflow_id, "ERROR", message);
+			logger$1.error(`Schedule fire failed for workflow ${row.workflow_id}: ${message}`);
+		}
+	}
+	async poll(store, row, binding) {
+		const now = this.now();
+		const rewind = await this.cursorRewind(store, row.workflow_id);
+		try {
+			const result = await this.hook(binding, "run");
+			if (!Array.isArray(result.output)) throw new Error(`Trigger run returned ${typeof result.output}, expected an array`);
+			await store.recordPollSuccess(row.workflow_id, VESTIGIAL_STORE_STATE, now.toISOString(), new Date(now.getTime() + row.interval_ms).toISOString());
+			for (const item of result.output) await this.fireItem(store, binding, item, now);
+		} catch (error) {
+			await rewind();
+			const message = error instanceof Error ? error.message : String(error);
+			const failures = row.consecutive_failures + 1;
+			const backoff = backoffMs(row.interval_ms, failures);
+			await store.recordPollFailure(row.workflow_id, message, now.toISOString(), new Date(now.getTime() + backoff).toISOString(), failures);
+			logger$1.warn(`Poll failed for workflow ${row.workflow_id} (${failures}x): ${message}`);
+		}
+	}
+	async fireItem(store, binding, item, now) {
+		const dedupeKey = extractDedupeKey(item);
+		if (dedupeKey) {
+			if (!await store.claimDedupe(binding.workflowId, dedupeKey, DEDUPE_TTL_MS, now.toISOString())) return;
+		}
+		this.options.fire(binding.workflowId, item, `piece:${binding.blockType}`);
+	}
+};
+//#endregion
+//#region src/reactor/webhook.ts
+const WEBHOOK_BLOCK = "core#webhook";
+const WEBHOOK_TRIGGER_KIND = "webhook";
+const ALGORITHMS = new Set([
+	"sha1",
+	"sha256",
+	"sha512"
+]);
+const ENCODINGS = new Set(["hex", "base64"]);
+const SIGNED_SCHEMES = new Set([
+	"token",
+	"hmac",
+	"hmac-prefixed",
+	"hmac-timestamped"
+]);
+const SCHEMES = new Set([
+	"none",
+	"token",
+	"hmac",
+	"hmac-prefixed",
+	"hmac-timestamped"
+]);
+const DEFAULT_HEADER = {
+	none: "",
+	token: "x-webhook-token",
+	hmac: "x-signature",
+	"hmac-prefixed": "x-hub-signature-256",
+	"hmac-timestamped": "stripe-signature"
+};
+const HTTP_METHODS = [
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE",
+	"HEAD"
+];
+function asRecord$1(config) {
+	if (config && typeof config === "object" && !Array.isArray(config)) return config;
+	if (typeof config === "string") try {
+		return asRecord$1(JSON.parse(config));
+	} catch {
+		return {};
+	}
+	return {};
+}
+function toNumber(value) {
+	if (typeof value === "number") return value;
+	if (typeof value === "string" && value.trim() !== "") {
+		const parsed = Number(value);
+		return Number.isNaN(parsed) ? void 0 : parsed;
+	}
+}
+function nonEmptyString(value) {
+	return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+}
+function parseWebhookField(value) {
+	if (value && typeof value === "object" && !Array.isArray(value)) {
+		const record = value;
+		const header = nonEmptyString(record.header);
+		if (header) return { header: header.toLowerCase() };
+		const body = nonEmptyString(record.body);
+		if (body) return { body };
+		throw new Error(`${WEBHOOK_BLOCK}: a field source must name either "header" or "body"`);
+	}
+	const text = nonEmptyString(value);
+	if (!text) return void 0;
+	const match = /^(header|body)\s*:\s*(\S.*)$/i.exec(text);
+	if (!match) return text;
+	const source = match[1].toLowerCase();
+	const name = match[2].trim();
+	return source === "header" ? { header: name.toLowerCase() } : { body: name };
+}
+function parseEnum(value, allowed, field) {
+	const text = nonEmptyString(value)?.toLowerCase();
+	if (!text) return void 0;
+	if (!allowed.has(text)) throw new Error(`${WEBHOOK_BLOCK}: "${field}" must be one of ${[...allowed].join(", ")}`);
+	return text;
+}
+function parseMethods(value) {
+	const list = typeof value === "string" ? value === "" || value.toUpperCase() === "ANY" ? [] : [value] : Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+	if (list.length === 0) return void 0;
+	const methods = list.map((method) => method.trim().toUpperCase());
+	for (const method of methods) if (!HTTP_METHODS.includes(method)) throw new Error(`${WEBHOOK_BLOCK}: "${method}" is not one of ${HTTP_METHODS.join(", ")}`);
+	return methods;
+}
+function parseWebhookConfig(config) {
+	const record = asRecord$1(config);
+	const rawScheme = nonEmptyString(record.scheme) ?? "none";
+	if (!SCHEMES.has(rawScheme)) throw new Error(`${WEBHOOK_BLOCK}: "scheme" must be one of ${[...SCHEMES].join(", ")}`);
+	const scheme = rawScheme;
+	const secretRef = nonEmptyString(record.secretRef);
+	if (SIGNED_SCHEMES.has(scheme) && !secretRef) throw new Error(`${WEBHOOK_BLOCK}: the "${scheme}" scheme needs a "secretRef"`);
+	const responseMode = record.responseMode === "sync" ? "sync" : "async";
+	const status = toNumber(record.responseStatus) ?? (responseMode === "sync" ? 200 : 202);
+	if (!Number.isInteger(status) || status < 200 || status > 599) throw new Error(`${WEBHOOK_BLOCK}: "responseStatus" must be an integer between 200 and 599`);
+	const tolerance = toNumber(record.toleranceSeconds) ?? 300;
+	if (!Number.isFinite(tolerance) || tolerance <= 0) throw new Error(`${WEBHOOK_BLOCK}: "toleranceSeconds" must be a positive number`);
+	const dedupeTtl = toNumber(record.dedupeTtlSeconds) ?? 300;
+	if (!Number.isFinite(dedupeTtl) || dedupeTtl <= 0) throw new Error(`${WEBHOOK_BLOCK}: "dedupeTtlSeconds" must be a positive number`);
+	return {
+		methods: parseMethods(record.methods),
+		scheme,
+		header: (nonEmptyString(record.header) ?? DEFAULT_HEADER[scheme]).toLowerCase(),
+		secretRef,
+		toleranceSeconds: tolerance,
+		responseMode,
+		responseStatus: status,
+		algorithm: parseEnum(record.algorithm, ALGORITHMS, "algorithm"),
+		encoding: parseEnum(record.encoding, ENCODINGS, "encoding"),
+		prefix: typeof record.prefix === "string" ? record.prefix : void 0,
+		challengeField: parseWebhookField(record.challengeField),
+		dedupeField: parseWebhookField(record.dedupeField),
+		dedupeTtlSeconds: dedupeTtl
+	};
+}
+//#endregion
+//#region src/reactor/piece-handshake.ts
+const strategies = WebhookHandshakeStrategy;
+function handshakeMatches(handshake, request) {
+	if (handshake.strategy === strategies.HEAD_REQUEST) return request.method.toUpperCase() === "HEAD";
+	const name = handshake.paramName;
+	if (!name) return false;
+	switch (handshake.strategy) {
+		case strategies.HEADER_PRESENT: return Object.hasOwn(request.headers, name.toLowerCase());
+		case strategies.QUERY_PRESENT: return Object.hasOwn(request.queryParams, name);
+		case strategies.BODY_PARAM_PRESENT: return typeof request.body === "object" && request.body !== null && !Array.isArray(request.body) && name in request.body;
+		default: return false;
+	}
+}
+function handshakeReply(output) {
+	if (typeof output !== "object" || output === null) return { status: 200 };
+	const record = output;
+	const status = typeof record.status === "number" ? record.status : 200;
+	const body = record.body;
+	if (body === void 0 || body === null) return { status };
+	if (typeof body === "string") return {
+		status,
+		body
+	};
+	return {
+		status,
+		body: JSON.stringify(body),
+		contentType: "application/json"
+	};
+}
+//#endregion
+//#region src/reactor/trigger-filters.ts
+const TRIGGER_KIND_BY_BLOCK = {
+	[DOCUMENT_EVENT_BLOCK]: "document-event",
+	[DOCUMENT_CREATED_BLOCK]: "document-created",
+	[DOCUMENT_DELETED_BLOCK]: "document-deleted"
+};
+function lifecycleKindForDocumentAction(actionType) {
+	if (actionType === "CREATE_DOCUMENT") return "document-created";
+	if (actionType === "DELETE_DOCUMENT") return "document-deleted";
+}
+function lifecycleKindForDriveAction(actionType) {
+	if (actionType === "ADD_FILE") return "document-created";
+	if (actionType === "DELETE_NODE") return "document-deleted";
+}
+function toList(value) {
+	if (typeof value === "string") return value ? [value] : void 0;
+	if (Array.isArray(value)) {
+		const strings = value.filter((item) => typeof item === "string");
+		return strings.length > 0 ? strings : void 0;
+	}
+}
+function asRecord(config) {
+	if (config === null || typeof config !== "object") return {};
+	return config;
+}
+function parseEventFilter(config) {
+	const record = asRecord(config);
+	return {
+		documentType: toList(record.documentType),
+		documentId: toList(record.documentId),
+		actionType: toList(record.actionType)
+	};
+}
+function parseLifecycleFilter(config) {
+	const record = asRecord(config);
+	return {
+		documentType: toList(record.documentType),
+		driveId: toList(record.driveId)
+	};
+}
+const ok = (list, value) => !list || value !== void 0 && list.includes(value);
+function matchesEventFilter(filter, documentType, documentId, actionType) {
+	return ok(filter.documentType, documentType) && ok(filter.documentId, documentId) && ok(filter.actionType, actionType);
+}
+function matchesLifecycleFilter(filter, documentType, driveId) {
+	return ok(filter.documentType, documentType ?? void 0) && ok(filter.driveId, driveId ?? void 0);
+}
+//#endregion
+//#region src/reactor/service.ts
+const CHECK_TIMEOUT_MS = 3e4;
+const DESCRIBE_TIMEOUT_MS = 3e4;
+const SEED_ATTEMPTS = 3;
+const SEED_RETRY_BASE_MS = 250;
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms).unref());
+const logger = childLogger(["workflow", "runtime"]);
+const DRIVE_DOCUMENT_TYPE = "powerhouse/document-drive";
+const WORKFLOW_DOCUMENT_TYPE = "powerhouse/workflow";
+const DOCUMENT_SCOPE = "document";
+const CHILD_RELATIONSHIP = "child";
+function operationKey(op) {
+	return op.context.ordinal > 0 ? `o:${op.context.ordinal}` : `${op.context.documentId}:${op.context.scope}:${op.context.branch}:${op.operation.index}`;
+}
+const OPERATION_DEDUPE_TTL_MS = 1440 * 6e4;
+function stringField(record, key) {
+	const value = record[key];
+	return typeof value === "string" && value !== "" ? value : void 0;
+}
+function inputRecord(input) {
+	if (input === null || typeof input !== "object") return {};
+	return input;
+}
+function collectLifecycleParentHints(operations) {
+	const hints = /* @__PURE__ */ new Map();
+	const merge = (documentId, hint) => {
+		const existing = hints.get(documentId);
+		hints.set(documentId, existing ? {
+			...existing,
+			...hint
+		} : hint);
+	};
+	for (const { operation, context } of operations) {
+		const actionType = operation.action.type;
+		const input = inputRecord(operation.action.input);
+		if (context.scope === DOCUMENT_SCOPE) {
+			if (actionType !== "ADD_RELATIONSHIP" && actionType !== "REMOVE_RELATIONSHIP") continue;
+			if (stringField(input, "relationshipType") !== CHILD_RELATIONSHIP) continue;
+			const target = stringField(input, "targetId");
+			const source = stringField(input, "sourceId");
+			if (!target || !source) continue;
+			merge(target, {
+				parentId: source,
+				parentCandidate: source
+			});
+			continue;
+		}
+		if (context.documentType !== DRIVE_DOCUMENT_TYPE) continue;
+		if (actionType !== "ADD_FILE" && actionType !== "DELETE_NODE") continue;
+		const nodeId = stringField(input, "id");
+		if (!nodeId) continue;
+		merge(nodeId, {
+			driveId: context.documentId,
+			parentId: stringField(input, "parentFolder")
+		});
+	}
+	return hints;
+}
+function accountLabelFromCheckResult(result) {
+	if (!result || typeof result !== "object") return void 0;
+	const record = result;
+	for (const key of [
+		"name",
+		"username",
+		"email",
+		"sub"
+	]) {
+		const value = record[key];
+		if (typeof value === "string" && value !== "") return value;
+	}
+}
+function pieceFailureDetail(error, timeoutDetail) {
+	if (error instanceof PieceWorkerTimeoutError) return timeoutDetail;
+	if (error instanceof PieceWorkerError) return error.serialized.message;
+	return error instanceof Error ? error.message : String(error);
+}
+function checkFailureDetail(error) {
+	return pieceFailureDetail(error, `Connection check timed out after ${Math.round(CHECK_TIMEOUT_MS / 1e3)}s`);
+}
+const PIECE_WEBHOOK_KIND = "piece-webhook";
+const SUPERVISED_KINDS = new Set([
+	"piece",
+	"schedule",
+	PIECE_WEBHOOK_KIND
+]);
+const UNAUTHORIZED = { status: 401 };
+const JSON_CONTENT_TYPE = "application/json; charset=utf-8";
+const DELIVERY_TIMEOUT_MS = Number(process.env.WORKFLOW_WEBHOOK_TIMEOUT_MS) || 3e4;
+const TIMED_OUT = Symbol("webhook delivery timed out");
+/** Resolves to TIMED_OUT, and never keeps the process alive waiting to. */
+function timeout(ms) {
+	return new Promise((resolve) => {
+		setTimeout(() => resolve(TIMED_OUT), ms).unref();
+	});
+}
+/** Shaped like Activepieces' catch-webhook contract so authored expressions and adapted
+* pieces agree where a request's parts are; headers arrive redacted, body decoded. */
+function webhookPayload(request) {
+	return {
+		method: request.method,
+		path: request.path,
+		headers: request.headers,
+		queryParams: request.queryParams,
+		body: request.body
+	};
+}
+const POLL_INTERVAL_CONFIG_KEY = "pollEverySeconds";
+function splitPollInterval(config) {
+	if (!("pollEverySeconds" in config)) return { config };
+	const { [POLL_INTERVAL_CONFIG_KEY]: raw, ...rest } = config;
+	const seconds = typeof raw === "string" ? Number(raw) : raw;
+	if (typeof seconds !== "number" || !Number.isFinite(seconds) || seconds <= 0) {
+		logger.warn(`Ignoring ${POLL_INTERVAL_CONFIG_KEY}=${JSON.stringify(raw)}: expected a positive number of seconds`);
+		return { config: rest };
+	}
+	return {
+		config: rest,
+		pollIntervalMs: Math.round(seconds * 1e3)
+	};
+}
+function parseWorkflowState(resultingState) {
+	if (!resultingState) return void 0;
+	try {
+		return JSON.parse(resultingState);
+	} catch {
+		return;
+	}
+}
+function configRecord(config) {
+	if (config && typeof config === "object" && !Array.isArray(config)) return config;
+	if (typeof config === "string") try {
+		const parsed = JSON.parse(config);
+		if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+	} catch {}
+	return {};
+}
+var WorkflowRuntimeService = class {
+	host;
+	logger;
+	attachments;
+	executor;
+	pieceWorkers;
+	storePromise;
+	secretsPromise;
+	registry = /* @__PURE__ */ new Map();
+	seedPromise;
+	seedError;
+	constructor(host) {
+		this.host = host;
+		this.logger = host.logger ?? logger;
+		this.attachments = host.attachments ? createAttachmentPort(host.attachments, () => currentWorkflowId(), (documentId, ref) => host.canReadAttachmentRef?.(documentId, ref) ?? Promise.resolve(false)) : void 0;
+		this.storePromise = WorkflowRunStore.create(host.relationalDb);
+		this.storePromise.catch((error) => {
+			this.logger.error("Failed to open the workflow run store: @error", error);
+		});
+		this.seedPromise = this.seedWithRetries();
+	}
+	async store() {
+		try {
+			return await this.storePromise;
+		} catch {
+			return;
+		}
+	}
+	secrets() {
+		this.secretsPromise ??= this.host.secrets !== void 0 ? Promise.resolve(this.host.secrets) : LocalEncryptedSecretStore.create(this.host.relationalDb);
+		return this.secretsPromise;
+	}
+	secretProvider() {
+		return { get: (ref) => this.secrets().then((store) => store.get(ref)) };
+	}
+	/** The seeding failure a restart is needed to clear, or undefined while the
+	* registry is seeded. Resolves once seeding has finished either way. */
+	async seedFailure() {
+		await this.seedPromise;
+		return this.seedError;
+	}
+	async seedWithRetries() {
+		for (let attempt = 1; attempt <= SEED_ATTEMPTS; attempt += 1) try {
+			await this.seedRegistry();
+			this.seedError = void 0;
+			return;
+		} catch (error) {
+			this.seedError = error;
+			if (attempt === SEED_ATTEMPTS) break;
+			this.logger.warn(`Seeding the trigger registry failed (attempt ${attempt}/${SEED_ATTEMPTS}), retrying: @error`, error);
+			await sleep(SEED_RETRY_BASE_MS * 2 ** (attempt - 1));
+		}
+		this.logger.error(`Failed to seed the trigger registry after ${SEED_ATTEMPTS} attempts; its workflows stay inactive until the reactor restarts: @error`, this.seedError);
+	}
+	async seedRegistry() {
+		const page = await this.host.reactorClient.find({ type: "powerhouse/workflow" });
+		for (const document of page.results) await this.updateRegistration(document.header.id, document.state.global);
+		if (this.registry.size === 0 && await this.hasWebhookEndpoints()) {
+			this.logger.warn("Trigger registry seeded no workflows, but @count webhook endpoint(s) exist: their deliveries will be refused as unknown tokens", await this.endpointCount());
+			return;
+		}
+		this.logger.info(`Trigger registry seeded: ${this.registry.size} workflow(s)`);
+	}
+	async endpointCount() {
+		const endpoints = await this.endpoints();
+		return endpoints ? (await endpoints.list()).length : 0;
+	}
+	async hasWebhookEndpoints() {
+		return await this.endpointCount() > 0;
+	}
+	async updateRegistration(workflowId, state) {
+		await packagePieces.ready();
+		const trigger = state.status === "ENABLED" ? state.trigger : void 0;
+		if (trigger?.blockType === "core#webhook") {
+			await this.registerWebhook(workflowId, trigger.config);
+			return;
+		}
+		const kind = trigger ? TRIGGER_KIND_BY_BLOCK[trigger.blockType] : void 0;
+		const supervised = trigger && !kind ? this.supervisedBinding(workflowId, trigger) : void 0;
+		if (!kind && !supervised) {
+			const had = this.registry.get(workflowId);
+			this.registry.delete(workflowId);
+			if (had && SUPERVISED_KINDS.has(had.kind)) this.dropSupervised(workflowId);
+			return;
+		}
+		if (supervised) {
+			if (supervised.kind === "schedule") {
+				this.registry.set(workflowId, {
+					workflowId,
+					kind: "schedule"
+				});
+				this.enableSupervised(workflowId, supervised);
+				return;
+			}
+			this.registry.set(workflowId, {
+				workflowId,
+				kind: "piece"
+			});
+			await this.registerPieceTrigger(workflowId, supervised);
+			return;
+		}
+		const had = this.registry.get(workflowId);
+		if (had && SUPERVISED_KINDS.has(had.kind)) this.dropSupervised(workflowId);
+		const config = trigger?.config;
+		this.registry.set(workflowId, kind === "document-event" ? {
+			workflowId,
+			kind,
+			filter: parseEventFilter(config)
+		} : {
+			workflowId,
+			kind,
+			filter: parseLifecycleFilter(config)
+		});
+	}
+	enableSupervised(workflowId, binding) {
+		this.supervisor().upsert(binding).catch((error) => {
+			this.logger.error(`Trigger enable failed for ${workflowId}`, error);
+		});
+	}
+	async registerPieceTrigger(workflowId, binding) {
+		const delivery = await this.pieceDelivery(binding);
+		const resolved = {
+			...binding,
+			delivery
+		};
+		if (delivery === "webhook") {
+			this.registry.set(workflowId, {
+				workflowId,
+				kind: PIECE_WEBHOOK_KIND,
+				binding: resolved
+			});
+			await (await this.endpoints())?.endpointFor(workflowId);
+		}
+		this.enableSupervised(workflowId, resolved);
+	}
+	async pieceDelivery(binding) {
+		try {
+			const { triggers } = await this.pieceTriggers(binding.packageName);
+			return triggers.find((entry) => entry.name === binding.triggerName)?.strategy === "WEBHOOK" ? "webhook" : "poll";
+		} catch (error) {
+			this.logger.warn("Could not resolve the trigger strategy for @block; polling", binding.blockType, error);
+			return "poll";
+		}
+	}
+	async registerWebhook(workflowId, rawConfig) {
+		const had = this.registry.get(workflowId);
+		if (had && SUPERVISED_KINDS.has(had.kind)) this.dropSupervised(workflowId);
+		let config;
+		try {
+			config = parseWebhookConfig(configRecord(rawConfig));
+		} catch (error) {
+			this.registry.delete(workflowId);
+			const message = error instanceof Error ? error.message : String(error);
+			this.logger.error(`Webhook trigger rejected for ${workflowId}: ${message}`);
+			return;
+		}
+		this.registry.set(workflowId, {
+			workflowId,
+			kind: WEBHOOK_TRIGGER_KIND,
+			config
+		});
+		await (await this.endpoints())?.endpointFor(workflowId);
+	}
+	supervisedBinding(workflowId, trigger) {
+		if (trigger.blockType === "core#schedule") return {
+			kind: "schedule",
+			workflowId,
+			blockType: SCHEDULE_BLOCK,
+			config: configRecord(trigger.config)
+		};
+		return this.pieceBinding(workflowId, trigger);
+	}
+	pieceBinding(workflowId, trigger) {
+		const parsed = parseBlockType(trigger.blockType, packagePieces.versions());
+		if (!parsed || parsed.kind !== "trigger") return void 0;
+		const { config, pollIntervalMs } = splitPollInterval(configRecord(trigger.config));
+		return {
+			workflowId,
+			blockType: trigger.blockType,
+			packageName: parsed.packageName,
+			version: parsed.version,
+			triggerName: parsed.name,
+			config,
+			connectionId: trigger.connectionId,
+			pollIntervalMs
+		};
+	}
+	dropSupervised(workflowId) {
+		this.supervisor().remove(workflowId).catch((error) => {
+			this.logger.error(`Trigger disable failed for ${workflowId}`, error);
+		});
+	}
+	async refreshRegistration(workflowId, resultingState) {
+		const carried = parseWorkflowState(resultingState);
+		if (carried) {
+			await this.updateRegistration(workflowId, carried);
+			return;
+		}
+		const document = await this.host.reactorClient.get(workflowId);
+		await this.updateRegistration(workflowId, document.state.global);
+	}
+	seenOps = /* @__PURE__ */ new Set();
+	seenOpsQueue = [];
+	alreadySeen(key) {
+		if (this.seenOps.has(key)) return true;
+		this.seenOps.add(key);
+		this.seenOpsQueue.push(key);
+		if (this.seenOpsQueue.length > 8192) {
+			const evicted = this.seenOpsQueue.shift();
+			if (evicted) this.seenOps.delete(evicted);
+		}
+		return false;
+	}
+	async onOperations(operations) {
+		const hints = collectLifecycleParentHints(operations);
+		for (const { operation, context } of operations) {
+			if (context.scope !== DOCUMENT_SCOPE && context.scope !== "global") continue;
+			const opKey = operationKey({
+				operation,
+				context
+			});
+			if (this.alreadySeen(opKey)) continue;
+			if (context.scope === DOCUMENT_SCOPE) {
+				await this.matchDocumentLifecycle(operation, context, hints, opKey);
+				continue;
+			}
+			if (context.documentType === "powerhouse/workflow") await this.refreshRegistration(context.documentId, operation.resultingState);
+			if (operation.error !== void 0) continue;
+			for (const registration of this.registry.values()) {
+				if (registration.kind !== "document-event") continue;
+				if (!matchesEventFilter(registration.filter, context.documentType, context.documentId, operation.action.type)) continue;
+				const payload = {
+					documentId: context.documentId,
+					documentType: context.documentType,
+					branch: context.branch,
+					scope: context.scope,
+					action: {
+						type: operation.action.type,
+						input: operation.action.input
+					},
+					operation: {
+						index: operation.index,
+						timestampUtcMs: operation.timestampUtcMs
+					}
+				};
+				await this.enqueueFire(registration.workflowId, payload, registration.kind, opKey);
+			}
+			if (context.documentType === DRIVE_DOCUMENT_TYPE) await this.matchDriveLifecycle(context.documentId, operation.action.type, operation.action.input, {
+				index: operation.index,
+				timestampUtcMs: operation.timestampUtcMs
+			}, opKey);
+		}
+	}
+	async enqueueFire(workflowId, payload, kind, opKey) {
+		const store = await this.store();
+		if (!store) {
+			this.fireFromTrigger(workflowId, payload, kind);
+			return;
+		}
+		if (!await store.claimDedupe(workflowId, `op:${opKey}`, OPERATION_DEDUPE_TTL_MS, (/* @__PURE__ */ new Date()).toISOString())) return;
+		let runId;
+		try {
+			runId = await store.enqueueRun({
+				workflowId,
+				triggerKind: kind,
+				triggerPayload: payload
+			});
+		} catch (error) {
+			this.logger.error(`Could not journal the ${kind} fire for workflow ${workflowId}; running it without a durable record`, error);
+			this.fireFromTrigger(workflowId, payload, kind);
+			return;
+		}
+		this.fireFromTrigger(workflowId, payload, kind, runId);
+	}
+	fireFromTrigger(workflowId, payload, kind, enqueuedRunId) {
+		this.fire(workflowId, payload, kind, void 0, void 0, enqueuedRunId).then((run) => {
+			this.logger.info(`${kind} fired workflow ${workflowId}: ${run.status}`);
+		}, (error) => {
+			this.logger.error(`${kind} run failed for workflow ${workflowId}`, error);
+		});
+	}
+	firedLifecycle = /* @__PURE__ */ new Set();
+	firedLifecycleQueue = [];
+	lifecycleAlreadyFired(kind, documentId) {
+		return this.firedLifecycle.has(`${kind}:${documentId}`);
+	}
+	recordLifecycleFired(kind, documentId) {
+		const key = `${kind}:${documentId}`;
+		if (this.firedLifecycle.has(key)) return;
+		this.firedLifecycle.add(key);
+		this.firedLifecycleQueue.push(key);
+		if (this.firedLifecycleQueue.length > 4096) {
+			const evicted = this.firedLifecycleQueue.shift();
+			if (evicted) this.firedLifecycle.delete(evicted);
+		}
+	}
+	lifecycleTargets(kind) {
+		const targets = [];
+		for (const registration of this.registry.values()) {
+			if (registration.kind !== kind) continue;
+			if (registration.kind === "document-event") continue;
+			targets.push({
+				workflowId: registration.workflowId,
+				filter: registration.filter
+			});
+		}
+		return targets;
+	}
+	async fireLifecycle(kind, payload, opKey) {
+		let matched = false;
+		for (const target of this.lifecycleTargets(kind)) {
+			if (!matchesLifecycleFilter(target.filter, payload.documentType, payload.driveId)) continue;
+			matched = true;
+			await this.enqueueFire(target.workflowId, payload, kind, opKey);
+		}
+		if (matched) this.recordLifecycleFired(kind, payload.documentId);
+	}
+	driveParentCache = /* @__PURE__ */ new Map();
+	async driveIdFromParent(parentId) {
+		if (!parentId) return void 0;
+		const cached = this.driveParentCache.get(parentId);
+		if (cached !== void 0) return cached ? parentId : void 0;
+		try {
+			const isDrive = (await this.host.reactorClient.get(parentId)).header.documentType === DRIVE_DOCUMENT_TYPE;
+			if (this.driveParentCache.size > 1024) this.driveParentCache.clear();
+			this.driveParentCache.set(parentId, isDrive);
+			return isDrive ? parentId : void 0;
+		} catch {
+			return;
+		}
+	}
+	async matchDocumentLifecycle(operation, context, hints, opKey) {
+		const kind = lifecycleKindForDocumentAction(operation.action.type);
+		if (!kind) return;
+		if (operation.error !== void 0) return;
+		const input = inputRecord(operation.action.input);
+		const documentId = stringField(input, "documentId") ?? context.documentId;
+		if (this.lifecycleAlreadyFired(kind, documentId)) return;
+		if (this.lifecycleTargets(kind).length === 0) return;
+		const hint = hints.get(documentId);
+		const driveId = hint?.driveId ?? await this.driveIdFromParent(hint?.parentCandidate);
+		const created = kind === "document-created";
+		await this.fireLifecycle(kind, {
+			documentId,
+			documentType: (created ? stringField(input, "model") : void 0) ?? (context.documentType || null),
+			name: stringField(input, "name") ?? null,
+			driveId: driveId ?? null,
+			parentId: hint?.parentId ?? null,
+			operation: {
+				index: operation.index,
+				timestampUtcMs: operation.timestampUtcMs
+			}
+		}, opKey);
+	}
+	async matchDriveLifecycle(driveId, actionType, input, operation, opKey) {
+		const kind = lifecycleKindForDriveAction(actionType);
+		if (!kind) return;
+		if (this.lifecycleTargets(kind).length === 0) return;
+		const record = inputRecord(input);
+		const documentId = stringField(record, "id");
+		if (!documentId) return;
+		if (this.lifecycleAlreadyFired(kind, documentId)) return;
+		let documentType = stringField(record, "documentType");
+		let name = stringField(record, "name") ?? null;
+		if (kind === "document-deleted") try {
+			const document = await this.host.reactorClient.get(documentId);
+			documentType = document.header.documentType;
+			name ??= document.header.name;
+		} catch {
+			documentType = void 0;
+		}
+		await this.fireLifecycle(kind, {
+			documentId,
+			documentType: documentType ?? null,
+			name,
+			driveId,
+			parentId: stringField(record, "parentFolder") ?? null,
+			operation
+		}, opKey);
+	}
+	triggerSupervisor;
+	supervisor() {
+		this.triggerSupervisor ??= new TriggerSupervisor({
+			store: () => this.store(),
+			resolveAuth: async (connectionId, request) => {
+				if (!connectionId) return void 0;
+				const resolved = await new DocumentConnectionResolver(this.host, this.secretProvider()).resolveWithSecrets(connectionId, request);
+				return rememberSecrets(resolved.auth, resolved.secretValues);
+			},
+			fire: (workflowId, payload, kind) => {
+				this.fireFromTrigger(workflowId, payload, kind);
+			},
+			webhookUrlFor: async (workflowId) => (await this.mintWebhookEndpoint(workflowId))?.url,
+			cacheDir: BUNDLE_CACHE_DIR,
+			resolver: pieceResolver(),
+			egress: configuredEgress(),
+			defaultIntervalMs: Number(process.env.WORKFLOW_POLL_INTERVAL_MS) || void 0,
+			reconcileIntervalMs: Number(process.env.WORKFLOW_WEBHOOK_RECONCILE_MS) || void 0
+		});
+		return this.triggerSupervisor;
+	}
+	startTriggerSupervisor() {
+		this.supervisor().start();
+	}
+	stopTriggerSupervisor() {
+		this.triggerSupervisor?.stop();
+	}
+	shutdown() {
+		this.stopTriggerSupervisor();
+		this.pieceWorkers?.dispose();
+		this.designWorker?.dispose();
+		this.designWorker = void 0;
+	}
+	async triggerStates(ctx) {
+		const store = await this.store();
+		if (!store) return [];
+		const rows = await store.listTriggerStates();
+		return this.readableRows(rows, (row) => row.workflow_id, ctx);
+	}
+	webhookEndpoints;
+	webhookScope;
+	webhookRegistration;
+	/** Registers the workflow endpoint family with the reactor's webhook service
+	* (idempotent). Everything transport-shaped is the service's; only workflow identity is ours. */
+	async registerWebhookEndpoint() {
+		if (this.webhookRegistration) {
+			await this.webhookRegistration;
+			return;
+		}
+		const webhooks = this.host.webhooks;
+		if (!webhooks) {
+			this.logger.warn("This host serves no webhooks; workflows with a webhook trigger will not arm");
+			return;
+		}
+		this.webhookScope = webhooks;
+		this.webhookRegistration = webhooks.register({
+			name: "trigger",
+			policyFor: (workflowId) => this.webhookPolicy(workflowId),
+			onRequest: (request) => this.deliverWebhook(request)
+		}).then((endpoints) => {
+			this.webhookEndpoints = endpoints;
+			return endpoints;
+		}).catch((error) => {
+			this.logger.warn("Webhook triggers are unavailable on this host; other triggers are unaffected: @error", error);
+		});
+		await this.webhookRegistration;
+	}
+	/** The endpoint family, once registered. Seeding runs before the host starts
+	* the runtime, so a caller that needs a token waits rather than finds it missing. */
+	async endpoints() {
+		if (this.webhookEndpoints) return this.webhookEndpoints;
+		if (!this.webhookRegistration && this.host.webhooks) await this.registerWebhookEndpoint();
+		return await this.webhookRegistration;
+	}
+	/** The per-document policy the service enforces before a delivery reaches this code;
+	* undefined means the workflow is not armed, answered exactly as an unknown token is. */
+	async webhookPolicy(workflowId) {
+		await this.seedPromise;
+		const registration = this.registry.get(workflowId);
+		if (!registration) return void 0;
+		if (registration.kind === "piece-webhook") return {};
+		if (registration.kind !== "webhook") return void 0;
+		const { config } = registration;
+		return {
+			methods: config.methods,
+			challengeField: config.challengeField,
+			dedupe: config.dedupeField ? {
+				field: config.dedupeField,
+				ttlSeconds: config.dedupeTtlSeconds
+			} : void 0,
+			verify: config.scheme === "none" ? void 0 : {
+				scheme: config.scheme,
+				header: config.header,
+				secret: await this.webhookSecret(config, workflowId),
+				toleranceSeconds: config.toleranceSeconds,
+				algorithm: config.algorithm,
+				encoding: config.encoding,
+				prefix: config.prefix
+			}
+		};
+	}
+	async webhookEndpoint(workflowId, ctx) {
+		await this.assertCanReadDocument(workflowId, ctx);
+		return this.mintWebhookEndpoint(workflowId);
+	}
+	async mintWebhookEndpoint(workflowId) {
+		const endpoints = await this.endpoints();
+		if (!endpoints) return null;
+		const registration = this.registry.get(workflowId);
+		const armed = registration?.kind === "webhook" || registration?.kind === "piece-webhook";
+		const absoluteUrl = this.webhookScope?.hasPublicOrigin ?? false;
+		const minted = await endpoints.endpointFor(workflowId);
+		return {
+			workflowId,
+			url: minted.url,
+			absoluteUrl,
+			armed,
+			createdAt: minted.createdAt
+		};
+	}
+	/** A delivery the service has already rate-limited, verified, de-duplicated and
+	* answered any challenge for; all that is left is deciding what it means. */
+	async deliverWebhook(request) {
+		const workflowId = request.key;
+		const registration = this.registry.get(workflowId);
+		if (!registration) return UNAUTHORIZED;
+		if (registration.kind === "piece-webhook") return this.deliverToPiece(registration.binding, request);
+		if (registration.kind !== "webhook") return UNAUTHORIZED;
+		const { config } = registration;
+		const payload = webhookPayload(request);
+		if (config.responseMode === "async") {
+			this.fireFromTrigger(workflowId, payload, WEBHOOK_TRIGGER_KIND);
+			return { status: config.responseStatus };
+		}
+		const run = await Promise.race([this.fire(workflowId, payload, WEBHOOK_TRIGGER_KIND).then((result) => ({
+			ok: true,
+			result
+		}), (error) => ({
+			ok: false,
+			error
+		})), timeout(DELIVERY_TIMEOUT_MS)]);
+		if (run === TIMED_OUT) {
+			this.logger.warn(`Webhook run for ${workflowId} exceeded ${DELIVERY_TIMEOUT_MS}ms; answering 504 while it continues`);
+			return {
+				status: 504,
+				contentType: JSON_CONTENT_TYPE,
+				body: JSON.stringify({
+					status: "RUNNING",
+					error: "The run did not finish in time"
+				})
+			};
+		}
+		if (!run.ok) {
+			const message = run.error instanceof Error ? run.error.message : String(run.error);
+			this.logger.error(`Webhook run failed for ${workflowId}: ${message}`);
+			return {
+				status: 500,
+				contentType: JSON_CONTENT_TYPE,
+				body: JSON.stringify({ error: message })
+			};
+		}
+		return {
+			status: run.result.status === "SUCCEEDED" ? config.responseStatus : 500,
+			contentType: JSON_CONTENT_TYPE,
+			body: JSON.stringify({
+				runId: run.result.runId,
+				status: run.result.status,
+				error: run.result.error ?? null
+			})
+		};
+	}
+	async pieceHandshake(binding, request) {
+		const handshake = await this.pieceHandshakeConfig(binding);
+		if (!handshake || !handshakeMatches(handshake, request)) return void 0;
+		try {
+			return handshakeReply((await this.supervisor().handshake(binding, webhookPayload(request))).output);
+		} catch (error) {
+			this.logger.error("Handshake failed for @block on workflow @workflow", binding.blockType, binding.workflowId, error);
+			return { status: 500 };
+		}
+	}
+	async pieceHandshakeConfig(binding) {
+		try {
+			return (await this.pieceDescriptor(binding.packageName, binding.version)).triggers.find((entry) => entry.name === binding.triggerName)?.handshake;
+		} catch (error) {
+			this.logger.warn("Could not read the handshake config for @block", binding.blockType, error);
+			return;
+		}
+	}
+	async deliverToPiece(binding, request) {
+		const probe = await this.pieceHandshake(binding, request);
+		if (probe) return probe;
+		const payload = webhookPayload(request);
+		this.supervisor().deliverWebhook(binding.workflowId, payload).then(() => {
+			this.logger.info("Webhook delivered to @block for workflow @workflow", binding.blockType, binding.workflowId);
+		}, (error) => {
+			this.logger.error(`Webhook delivery failed for workflow ${binding.workflowId}`, error);
+		});
+		return { status: 200 };
+	}
+	async webhookSecret(config, workflowId) {
+		if (!config.secretRef) return void 0;
+		try {
+			return await (await this.secrets()).get(config.secretRef);
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			this.logger.error(`Webhook secret unavailable for ${workflowId}: ${message}`);
+			return;
+		}
+	}
+	descriptors = /* @__PURE__ */ new Map();
+	designWorker;
+	designEgress = configuredEgress() ?? DEFAULT_EGRESS_POLICY;
+	async pieceDescriptor(packageName, version) {
+		const cacheKey = `${packageName}@${version}`;
+		let descriptor = this.descriptors.get(cacheKey);
+		if (!descriptor) {
+			const piece = await pieceResolver().resolve(packageName, version);
+			this.designWorker ??= new PieceWorker();
+			let output;
+			try {
+				output = (await this.designWorker.describePiece({
+					...pieceModuleRef(piece),
+					packageName,
+					version,
+					...this.designEgress ? { egress: this.designEgress } : {}
+				}, { timeoutMs: DESCRIBE_TIMEOUT_MS })).output;
+			} catch (error) {
+				throw new Error(pieceFailureDetail(error, `Loading piece "${packageName}" timed out after ${Math.round(DESCRIBE_TIMEOUT_MS / 1e3)}s`), { cause: error });
+			}
+			descriptor = output;
+			this.descriptors.set(cacheKey, descriptor);
+		}
+		return descriptor;
+	}
+	async driveWorkflowIds(driveId, ctx) {
+		await this.assertCanReadDocument(driveId, ctx);
+		let page = await this.host.reactorClient.drives.listNodes(driveId);
+		const nodes = [...page.results];
+		while (page.next) {
+			page = await page.next();
+			nodes.push(...page.results);
+		}
+		const ids = nodes.filter((node) => "documentType" in node && node.documentType === WORKFLOW_DOCUMENT_TYPE).map((node) => node.id);
+		return this.readableRows(ids, (id) => id, ctx);
+	}
+	async runs(args, ctx) {
+		const store = await this.store();
+		if (!store) return [];
+		let scope;
+		if (args.workflowId) {
+			await this.assertCanReadDocument(args.workflowId, ctx);
+			scope = args.workflowId;
+		} else if (args.driveId) {
+			scope = await this.driveWorkflowIds(args.driveId, ctx);
+			if (scope.length === 0) return [];
+		} else if (!ctx) return [];
+		const rows = await store.listRuns(scope, args.limit ?? 25);
+		const readable = await this.readableRows(rows, (row) => row.workflow_id, ctx);
+		return Promise.all(readable.map(async (row) => ({
+			row,
+			steps: await store.getSteps(row.id)
+		})));
+	}
+	async run(runId, ctx) {
+		const store = await this.store();
+		if (!store || !ctx) return null;
+		const row = await store.getRun(runId);
+		if (!row) return null;
+		if (!await this.canReadDocument(row.workflow_id, ctx)) return null;
+		return {
+			row,
+			steps: await store.getSteps(row.id)
+		};
+	}
+	async connections(ctx) {
+		const page = await this.host.reactorClient.find({ type: "powerhouse/connection" });
+		return (await this.readableDocuments(page.results, ctx)).map((document) => {
+			const state = document.state.global;
+			return {
+				id: document.header.id,
+				name: state.name,
+				connectorId: state.connectorId,
+				authType: state.authType,
+				status: state.status,
+				accountLabel: state.accountLabel ?? null
+			};
+		});
+	}
+	async checkConnection(connectionId, ctx) {
+		await this.assertCanReadDocument(connectionId, ctx);
+		await this.assertCanWriteDocument(connectionId, ctx);
+		const document = await this.host.reactorClient.get(connectionId);
+		if (document.header.documentType !== "powerhouse/connection") throw new Error(`Document "${connectionId}" is not a powerhouse/connection`);
+		const state = document.state.global;
+		const accountLabel = state.accountLabel ?? null;
+		if (state.status === "REVOKED") return {
+			ok: false,
+			detail: "Connection is revoked",
+			accountLabel
+		};
+		if (state.status === "UNCONFIGURED") return this.recordCheckResult(document, {
+			ok: false,
+			detail: "Connection is not configured",
+			accountLabel
+		});
+		if (state.authType === "OAUTH2" || state.authType === "OIDC") return this.recordCheckResult(document, {
+			ok: false,
+			detail: `${state.authType} connections are not supported by the runtime yet`,
+			accountLabel
+		});
+		const packageName = packageFromConnectorId(state.connectorId);
+		let moduleRef;
+		try {
+			const version = await this.pieceVersion(packageName);
+			moduleRef = pieceModuleRef(await pieceResolver().resolve(packageName, version));
+		} catch (error) {
+			return this.recordCheckResult(document, {
+				ok: false,
+				detail: error instanceof Error ? error.message : String(error),
+				accountLabel
+			});
+		}
+		let shapedAuth;
+		try {
+			shapedAuth = await resolveConnectionAuth(document, this.secretProvider(), {
+				blockType: state.connectorId,
+				piecePackage: packageName
+			});
+		} catch (error) {
+			return this.recordCheckResult(document, {
+				ok: false,
+				detail: error instanceof Error ? error.message : String(error),
+				accountLabel
+			});
+		}
+		let outcome;
+		try {
+			this.designWorker ??= new PieceWorker();
+			outcome = (await this.designWorker.checkConnection({
+				...moduleRef,
+				auth: shapedAuth,
+				...this.designEgress ? { egress: this.designEgress } : {}
+			}, { timeoutMs: CHECK_TIMEOUT_MS })).output;
+		} catch (error) {
+			return this.recordCheckResult(document, {
+				ok: false,
+				detail: checkFailureDetail(error),
+				accountLabel
+			});
+		}
+		if (!outcome.declared) return this.recordCheckResult(document, {
+			ok: true,
+			detail: "piece declares no connection check; credentials resolved",
+			accountLabel
+		});
+		if (outcome.result === false) return this.recordCheckResult(document, {
+			ok: false,
+			detail: "Connection check failed",
+			accountLabel
+		});
+		return this.recordCheckResult(document, {
+			ok: true,
+			detail: null,
+			accountLabel: accountLabelFromCheckResult(outcome.result) ?? accountLabel
+		});
+	}
+	async pieceVersion(packageName) {
+		await packagePieces.ready();
+		const local = packagePieces.lookup(packageName);
+		if (local) return local.version;
+		try {
+			const version = (await fetchPieceCatalog()).find((entry) => entry.name === packageName)?.version;
+			if (version) return version;
+		} catch {}
+		const detail = await fetchPieceDetail(packageName);
+		if (typeof detail.version === "string" && detail.version !== "") return detail.version;
+		throw new Error(`Could not resolve a version for piece "${packageName}"`);
+	}
+	async recordCheckResult(document, result) {
+		const action = actions.recordCheckResult({
+			status: result.ok ? "OK" : "ERROR",
+			checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			error: result.ok ? void 0 : result.detail ?? void 0
+		});
+		await this.host.reactorClient.execute(document.header.id, "main", [action]);
+		return result;
+	}
+	async localPieces() {
+		await packagePieces.ready();
+		return (await Promise.all(packagePieces.entries().map(async (piece) => {
+			try {
+				return {
+					piece,
+					descriptor: await this.pieceDescriptor(piece.name, piece.version)
+				};
+			} catch (error) {
+				this.logger.warn(`Could not describe the package piece "${piece.name}": ${String(error)}`);
+				return;
+			}
+		}))).filter((entry) => entry !== void 0);
+	}
+	async localPiece(packageName) {
+		await packagePieces.ready();
+		const piece = packagePieces.lookup(packageName);
+		if (!piece) return void 0;
+		return {
+			piece,
+			descriptor: await this.pieceDescriptor(piece.name, piece.version)
+		};
+	}
+	async pieceCatalog() {
+		const entries = (await this.localPieces()).map(({ piece, descriptor }) => catalogEntry(descriptor, piece.name, piece.version));
+		const names = new Set(entries.map((entry) => entry.name));
+		let published;
+		try {
+			published = await fetchPieceCatalog();
+		} catch (error) {
+			if (entries.length === 0) throw error;
+			this.logger.warn(`Serving package pieces only: ${String(error)}`);
+			published = [];
+		}
+		return [...entries, ...published.filter((entry) => !names.has(entry.name))].sort((a, b) => a.displayName.localeCompare(b.displayName));
+	}
+	async pieceActions(packageName) {
+		const local = await this.localPiece(packageName);
+		return local ? actionsResult(local.descriptor, local.piece.name, local.piece.version) : fetchPieceActions(packageName);
+	}
+	async pieceTriggers(packageName) {
+		const local = await this.localPiece(packageName);
+		return local ? triggersResult(local.descriptor, local.piece.name, local.piece.version) : fetchPieceTriggers(packageName);
+	}
+	async searchBlocks(query, limit) {
+		let local;
+		try {
+			local = indexFromHits((await this.localPieces()).flatMap(({ piece, descriptor }) => localSearchHits(descriptor, piece.name)));
+		} catch (error) {
+			this.logger.warn(`Could not index the package pieces: ${String(error)}`);
+		}
+		return searchBlocks(query, limit, local);
+	}
+	async pieceDetail(packageName) {
+		const local = await this.localPiece(packageName);
+		return local ? detailResult(local.descriptor, local.piece.name, local.piece.version) : fetchPieceDetail(packageName);
+	}
+	async blockDescriptor(blockType) {
+		await packagePieces.ready();
+		const parsed = parseBlockType(blockType, packagePieces.versions());
+		if (!parsed) return null;
+		const descriptor = await this.pieceDescriptor(parsed.packageName, parsed.version);
+		const common = {
+			displayName: descriptor.displayName,
+			logoUrl: descriptor.logoUrl,
+			auth: descriptor.auth ?? null
+		};
+		if (parsed.kind === "trigger") {
+			const trigger = descriptor.triggers.find((entry) => entry.name === parsed.name);
+			return trigger ? {
+				...common,
+				trigger
+			} : null;
+		}
+		const action = descriptor.actions.find((entry) => entry.name === parsed.name);
+		return action ? {
+			...common,
+			action
+		} : null;
+	}
+	async readableDocuments(documents, ctx) {
+		if (!ctx) return [];
+		const host = this.host;
+		const allowed = await Promise.all(documents.map((document) => host.assertCanRead(document.header.id, ctx).then(() => true).catch(() => false)));
+		return documents.filter((_, index) => allowed[index]);
+	}
+	async readableRows(rows, documentIdOf, ctx) {
+		if (!ctx) return [];
+		const allowed = await Promise.all(rows.map((row) => this.canReadDocument(documentIdOf(row), ctx)));
+		return rows.filter((_, index) => allowed[index]);
+	}
+	canReadDocument(documentId, ctx) {
+		return this.host.assertCanRead(documentId, ctx).then(() => true).catch(() => false);
+	}
+	async assertCanReadDocument(documentId, ctx) {
+		if (!ctx) throw new Error("Connection access requires an authenticated request");
+		await this.host.assertCanRead(documentId, ctx);
+	}
+	async assertCanWriteDocument(documentId, ctx) {
+		if (!ctx) throw new Error("Connection access requires an authenticated request");
+		await this.host.assertCanWrite(documentId, ctx);
+	}
+	async blockOptions(blockType, propName, input, connectionId, ctx) {
+		await packagePieces.ready();
+		const parsed = parseBlockType(blockType, packagePieces.versions());
+		if (!parsed) throw new Error(`Not a piece block type: "${blockType}"`);
+		let auth;
+		if (connectionId) {
+			await this.assertCanReadDocument(connectionId, ctx);
+			auth = await new DocumentConnectionResolver(this.host, this.secretProvider()).resolve(connectionId, {
+				blockType,
+				piecePackage: parsed.packageName
+			});
+		}
+		const piece = await pieceResolver().resolve(parsed.packageName, parsed.version);
+		this.designWorker ??= new PieceWorker();
+		return (await this.designWorker.resolveOptions({
+			...pieceModuleRef(piece),
+			actionName: parsed.name,
+			kind: parsed.kind,
+			propName,
+			refresherValues: input ?? {},
+			auth,
+			...piece.local ? { reactorAccess: true } : {},
+			...this.designEgress ? { egress: this.designEgress } : {}
+		}, piece.local ? { hostCalls: reactorHandlers(new ScopedDesignTimeReactorPort(this.host, ctx)) } : {})).output;
+	}
+	async blockOutputTree(blockType, config) {
+		await packagePieces.ready();
+		const record = config ?? {};
+		switch (blockType) {
+			case "core#manual": return {
+				source: "none",
+				nodes: []
+			};
+			case SCHEDULE_BLOCK: return {
+				source: "static",
+				nodes: scheduleTriggerTree()
+			};
+			case WEBHOOK_BLOCK: return {
+				source: "static",
+				nodes: webhookTriggerTree()
+			};
+			case "core#branch": return {
+				source: "static",
+				nodes: [{
+					name: "condition",
+					type: "value"
+				}]
+			};
+			case "core#assert": return {
+				source: "static",
+				nodes: [{
+					name: "value",
+					type: "value"
+				}]
+			};
+			case DOCUMENT_CREATED_BLOCK:
+			case DOCUMENT_DELETED_BLOCK: return {
+				source: "static",
+				nodes: lifecycleTriggerTree()
+			};
+			case DOCUMENT_EVENT_BLOCK: {
+				const inputChildren = await this.operationInputFields(staticString(record.documentType), staticString(record.actionType));
+				return {
+					source: inputChildren.length > 0 ? "schema" : "static",
+					nodes: documentEventTree(inputChildren)
+				};
+			}
+			case DOCUMENT_FIND_BLOCK: return {
+				source: "static",
+				nodes: documentFindTree()
+			};
+			case DOCUMENT_SCHEMA_BLOCK: return {
+				source: "static",
+				nodes: documentSchemaTree()
+			};
+			case DOCUMENT_TYPES_BLOCK: return {
+				source: "static",
+				nodes: documentTypesTree()
+			};
+			case DOCUMENT_GET_BLOCK: {
+				const stateChildren = await this.stateFields(staticString(record.documentType));
+				return {
+					source: stateChildren.length > 0 ? "schema" : "static",
+					nodes: documentGetTree(stateChildren)
+				};
+			}
+			case DOCUMENT_CREATE_BLOCK:
+			case DOCUMENT_DISPATCH_BLOCK: {
+				const stateChildren = await this.stateFields(staticString(record.documentType));
+				return {
+					source: stateChildren.length > 0 ? "schema" : "static",
+					nodes: documentBlockTree(stateChildren)
+				};
+			}
+			default: {
+				const parsed = parseBlockType(blockType, packagePieces.versions());
+				if (!parsed) return {
+					source: "none",
+					nodes: []
+				};
+				const detail = await this.pieceDetail(parsed.packageName);
+				const entry = (parsed.kind === "trigger" ? detail.triggers : detail.actions)?.[parsed.name];
+				if (entry?.outputSchema) {
+					const nodes = fromOutputSchema(entry.outputSchema);
+					if (nodes.length > 0) return {
+						source: "schema",
+						nodes
+					};
+					if (hasOutputSchemaFields(entry.outputSchema)) return {
+						source: "schema",
+						nodes: []
+					};
+				}
+				if (entry?.sampleData !== void 0 && entry.sampleData !== null) {
+					const nodes = fromSample(entry.sampleData);
+					if (nodes.length > 0) return {
+						source: "sample",
+						nodes
+					};
+				}
+				return {
+					source: "none",
+					nodes: []
+				};
+			}
+		}
+	}
+	async stateFields(documentType) {
+		if (!documentType) return [];
+		try {
+			const sdl = (await this.host.reactorClient.getDocumentModelModule(documentType)).documentModel.global.specifications.at(-1)?.state.global.schema;
+			return sdl ? fieldsFromSdl(sdl) : [];
+		} catch {
+			return [];
+		}
+	}
+	async operationInputFields(documentType, actionType) {
+		if (!documentType || !actionType) return [];
+		try {
+			const latest = (await this.host.reactorClient.getDocumentModelModule(documentType)).documentModel.global.specifications.at(-1);
+			for (const specModule of latest?.modules ?? []) for (const operation of specModule.operations) if (operation.name === actionType && operation.schema) return fieldsFromSdl(operation.schema);
+			return [];
+		} catch {
+			return [];
+		}
+	}
+	async testTrigger(workflowId, ctx) {
+		await this.assertCanReadDocument(workflowId, ctx);
+		const trigger = (await this.host.reactorClient.get(workflowId)).state.global.trigger;
+		if (!trigger) throw new Error("Workflow has no trigger");
+		if (trigger.connectionId) await this.assertCanReadDocument(trigger.connectionId, ctx);
+		await packagePieces.ready();
+		const binding = this.pieceBinding(workflowId, trigger);
+		if (!binding) throw new Error(`"${trigger.blockType}" is not a piece trigger`);
+		return this.supervisor().test(binding);
+	}
+	workers() {
+		return this.pieceWorkers ??= new PieceWorkerPool({
+			size: Number(process.env.WORKFLOW_RUN_CONCURRENCY) || void 0,
+			maxQueueDepth: Number(process.env.WORKFLOW_RUN_QUEUE_DEPTH) || void 0
+		});
+	}
+	async fire(workflowId, triggerPayload, triggerKind = "manual", resume, ctx, enqueuedRunId) {
+		const store = await this.store();
+		let state;
+		let definition;
+		try {
+			if (triggerKind === "manual") await this.assertCanReadDocument(workflowId, ctx);
+			const document = await this.host.reactorClient.get(workflowId);
+			if (document.header.documentType !== "powerhouse/workflow") throw new Error(`Document "${workflowId}" is not a powerhouse/workflow`);
+			state = document.state.global;
+			if (state.status !== "ENABLED") throw new Error(`Workflow is ${state.status}; only ENABLED workflows can fire`);
+			definition = toWorkflowDefinition(state);
+		} catch (error) {
+			if (enqueuedRunId) await store?.failRun(enqueuedRunId, error instanceof Error ? error.message : String(error));
+			throw error;
+		}
+		const connections = declaredConnectionIds(definition);
+		this.executor ??= createBlockExecutor(this.host, this.secretProvider(), this.attachments, store ? createPieceStorePort(store, currentWorkflowId) : void 0);
+		let runId = enqueuedRunId ?? null;
+		if (enqueuedRunId) await store?.beginRun(enqueuedRunId, {
+			workflowName: state.name,
+			workflowVersion: state.version
+		});
+		else runId = await store?.startRun({
+			workflowId,
+			workflowName: state.name,
+			workflowVersion: state.version,
+			triggerKind,
+			triggerPayload,
+			rerunOf: resume?.rerunOf
+		}) ?? null;
+		let journalFailed = false;
+		const executionOrder = /* @__PURE__ */ new Map();
+		let session;
+		try {
+			session = this.workers().session();
+			const result = await withRunScope({
+				workflowId,
+				runId,
+				connections,
+				pieceWorker: session
+			}, () => runWorkflow({
+				definition,
+				executor: this.executor,
+				triggerPayload,
+				completedSteps: resume?.completedSteps,
+				onStep: store && runId ? async (record, ordinal) => {
+					executionOrder.set(record.stepId, ordinal);
+					try {
+						await store.recordStep(runId, ordinal, record);
+					} catch (error) {
+						if (journalFailed) return;
+						journalFailed = true;
+						this.logger.warn(`Run ${runId}: journaling step "${record.key}" failed; the run continues without per-step durability`, error);
+					}
+				} : void 0
+			}));
+			if (store && runId) try {
+				await store.finishRun(runId, result, executionOrder);
+			} catch (error) {
+				this.logger.warn(`Run ${runId}: closing the run journal out failed; the run's outcome stands`, error);
+			}
+			return {
+				...result,
+				runId
+			};
+		} catch (error) {
+			if (store && runId) await store.failRun(runId, error instanceof Error ? error.message : String(error));
+			throw error;
+		} finally {
+			session?.close();
+		}
+	}
+	async rerun(runId, ctx) {
+		const store = await this.store();
+		if (!store) throw new Error("Run journal is unavailable");
+		const run = await store.getRun(runId);
+		if (!run) throw new Error(`Run "${runId}" not found`);
+		await this.assertCanReadDocument(run.workflow_id, ctx);
+		if (run.status !== "FAILED") throw new Error(`Only FAILED runs can be rerun; run is ${run.status}`);
+		const triggerPayload = run.trigger_payload === null ? void 0 : JSON.parse(run.trigger_payload);
+		if (containsRedactedMarker(triggerPayload)) throw new Error(`Trigger payload of run "${runId}" was redacted and cannot be replayed; fire the workflow again instead of rerunning it`);
+		const document = await this.host.reactorClient.get(run.workflow_id);
+		const currentSteps = new Map(document.state.global.steps.map((step) => [step.id, step]));
+		const completedSteps = /* @__PURE__ */ new Map();
+		for (const row of await store.getSteps(runId)) {
+			if (row.status !== "SUCCEEDED" && row.status !== "REPLAYED") continue;
+			const current = currentSteps.get(row.step_id);
+			if (!current || current.blockType !== row.block_type || current.key !== row.step_key) continue;
+			completedSteps.set(row.step_id, {
+				output: row.output === null ? void 0 : JSON.parse(row.output),
+				port: row.port
+			});
+		}
+		return this.fire(run.workflow_id, triggerPayload, "rerun", {
+			completedSteps,
+			rerunOf: runId
+		});
+	}
+};
+/** The runtime a host composes: one instance, its lifetime the host's. */
+function createWorkflowRuntime(deps) {
+	return new WorkflowRuntimeService(deps);
+}
+//#endregion
+//#region src/reactor/workflow-triggers-read-model.ts
+const WORKFLOW_TRIGGERS_READ_MODEL = "workflow-triggers";
+const WORKFLOW_TRIGGERS_READ_MODEL_STAGE = "post_ready";
+var WorkflowTriggersReadModel = class extends BaseReadModel {
+	freshRegistration = false;
+	constructor(db, operationIndex, writeCache, consistencyTracker, runtime) {
+		super(db, operationIndex, writeCache, consistencyTracker, {
+			readModelId: WORKFLOW_TRIGGERS_READ_MODEL,
+			rebuildStateOnInit: false,
+			indexing: defaultReadModelIndexingConfig
+		});
+		this.runtime = runtime;
+	}
+	async init() {
+		if (await this.loadState() === void 0) {
+			this.freshRegistration = true;
+			return;
+		}
+		this.freshRegistration = false;
+		await super.init();
+	}
+	async indexOperations(items) {
+		if (items.length === 0) return;
+		await super.indexOperations(items);
+		this.freshRegistration = false;
+	}
+	async commitOperations(items) {
+		await this.runtime.onOperations(items);
+	}
+	async saveState(trx, items) {
+		if (this.freshRegistration) await trx.insertInto("ViewState").values({
+			readModelId: this.config.readModelId,
+			lastOrdinal: 0
+		}).onConflict((oc) => oc.column("readModelId").doNothing()).execute();
+		await super.saveState(trx, items);
+	}
+};
+//#endregion
+export { PieceRegistry, WORKFLOW_PACKAGE_NAME, WORKFLOW_TRIGGERS_READ_MODEL, WORKFLOW_TRIGGERS_READ_MODEL_STAGE, WorkflowRuntimeService, WorkflowTriggersReadModel, createAttachmentPort, createWorkflowRuntime, packagePieces };
+
+//# sourceMappingURL=index.js.map