@powerhousedao/switchboard 6.2.3-dev.11 → 6.2.3-dev.13

package/CHANGELOG.md

@@ -1,3 +1,20 @@
+## 6.2.3-dev.13 (2026-09-18)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.3-dev.12 (2026-09-17)
+
+### 🚀 Features
+
+- **switchboard:** own the workflow runtime, feed it through a read model, and take workflows out of reactor-api ([#3042](https://github.com/powerhouse-inc/powerhouse/issues/3042))
+- **reactor-workflow:** the workflow engine, composed in reactor-api behind the workflows flag ([cb807bf5d](https://github.com/powerhouse-inc/powerhouse/commit/cb807bf5d))
+- **workflow:** the Connect-loaded workflow package, and the workflows flag in reactor-api ([0953fc254](https://github.com/powerhouse-inc/powerhouse/commit/0953fc254))
+- **pieces-framework:** vendor the Activepieces piece framework as a Powerhouse package ([3da5dbea8](https://github.com/powerhouse-inc/powerhouse/commit/3da5dbea8))
+
+### ❤️ Thank You
+
+- acaldas
+
 ## 6.2.3-dev.11 (2026-09-17)
 
 ### 🚀 Features

package/dist/index.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c6c10af1-f4cc-56a5-abf6-fa35cf0de956")}catch(e){}}();
-import { a as parseForcePgVersion, r as startSwitchboard } from "./server-CiKkVE6g.mjs";
+import { a as parseForcePgVersion, r as startSwitchboard } from "./server-DndPNlPT.mjs";
 import "./utils-Baw7rThP.mjs";
 import { metrics } from "@opentelemetry/api";
 import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";

package/dist/{server-CiKkVE6g.mjs → server-DndPNlPT.mjs}

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e2c62b7b-68fd-59c2-ab82-7d035e11698b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bf9f4a7e-71d0-5c0a-b467-a07a4938dc34")}catch(e){}}();
 import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-Baw7rThP.mjs";
 import { register } from "node:module";
 import { ReactorInstrumentation } from "@powerhousedao/opentelemetry-instrumentation-reactor";
@@ -11,9 +11,10 @@ import { existsSync, promises, realpathSync } from "node:fs";
 import path from "node:path";
 import { AtomicNodeFs } from "@powerhousedao/pglite-fs";
 import { ChannelScheme, DriveCollectionId, EventBus, REACTOR_SCHEMA, ReactorBuilder, ReactorClientBuilder, createHybridProjectionCoordinatorFactory, instrumentPgPool, parseDriveUrl, supportsLiveReadModelRegistration } from "@powerhousedao/reactor";
-import { HttpPackageLoader, ImportPackageLoader, PGLITE_UTC_PARSERS, PackageManagementService, PackagesSubgraph, getUniqueDocumentModels, initializeAndStartAPI, resolveRenownConfig } from "@powerhousedao/reactor-api";
+import { AuthorizationPolicy, BaseSubgraph, ForbiddenError, HttpPackageLoader, ImportPackageLoader, PGLITE_UTC_PARSERS, PackageManagementService, PackagesSubgraph, createCanonicalDocumentIdResolver, getUniqueDocumentModels, initializeAndStartAPI, resolveRenownConfig } from "@powerhousedao/reactor-api";
 import { httpsHooksPath } from "@powerhousedao/reactor-api/https-hooks";
-import { AttachmentAlreadyExists, AttachmentNotFound, AttachmentPending, AttachmentReferenceReadModel, AttachmentSchemaCompiler, HashMismatch, InvalidAttachmentRef, ReservationNotFound, SizeMismatch, UploadTooLarge, createRef, createRemoteAttachmentService, parseAttachmentDownloadTarget } from "@powerhousedao/reactor-attachments";
+import { AttachmentAlreadyExists, AttachmentNotFound, AttachmentPending, AttachmentReferenceReadModel, AttachmentSchemaCompiler, HashMismatch, InvalidAttachmentRef, ReservationNotFound, SizeMismatch, UploadTooLarge, createRef, createRemoteAttachmentService, parseAttachmentDownloadTarget, parseRef } from "@powerhousedao/reactor-attachments";
+import { createAttachmentClient } from "@powerhousedao/reactor-attachments/client";
 import { DriveNodeView, NodeProcessor, ReactorDriveClient, createReactorDriveResolvers, reactorDriveDocumentModelModule, reactorDriveSubgraphTypeDefs } from "@powerhousedao/reactor-drive";
 import { DEFAULT_RENOWN_URL, NodeKeyStorage, RENOWN_READ_MODEL_SUBGRAPH, RenownBuilder, RenownCryptoBuilder, createLocalCredentialVerifier, createSignatureVerifier } from "@renown/sdk/node";
 import { Kysely, PostgresDialect } from "kysely";
@@ -28,6 +29,8 @@ import os from "node:os";
 import { fileURLToPath } from "node:url";
 import { EnvVarProvider } from "@openfeature/env-var-provider";
 import { OpenFeature } from "@openfeature/server-sdk";
+import { GraphQLError } from "graphql";
+import { gql } from "graphql-tag";
 import { PGliteDialect } from "kysely-pglite-dialect";
 //#region src/pglite-version.ts
 const SUPPORTED_PG_MAJORS = [16, 17];
@@ -865,6 +868,486 @@ async function initFeatureFlags() {
 	return OpenFeature.getClient();
 }
 //#endregion
+//#region src/workflow/resolvers.ts
+function requireAdmin(authorizationService, ctx) {
+	if (!authorizationService.isSupremeAdmin(ctx.user?.address)) throw new GraphQLError("Admin access required");
+}
+function parseJson(value) {
+	if (value === null) return null;
+	try {
+		return JSON.parse(value);
+	} catch {
+		return value;
+	}
+}
+function toStepRecord(row) {
+	return {
+		stepId: row.step_id,
+		stepKey: row.step_key,
+		blockType: row.block_type,
+		status: row.status,
+		input: parseJson(row.input),
+		output: parseJson(row.output),
+		port: row.port,
+		error: row.error
+	};
+}
+function toRunRecord(row, steps) {
+	return {
+		id: row.id,
+		workflowId: row.workflow_id,
+		workflowName: row.workflow_name,
+		workflowVersion: row.workflow_version,
+		triggerKind: row.trigger_kind,
+		triggerPayload: parseJson(row.trigger_payload),
+		status: row.status,
+		error: row.error,
+		startedAt: row.started_at,
+		endedAt: row.ended_at,
+		rerunOf: row.rerun_of,
+		steps: steps.map(toStepRecord)
+	};
+}
+const getResolvers = (runtime, authorizationService) => {
+	return {
+		Query: { workflowRuntime: () => ({}) },
+		WorkflowRuntimeQueries: {
+			health: () => "ok",
+			blockDescriptor: (_parent, args) => runtime.blockDescriptor(args.blockType),
+			blockOptions: (_parent, args, ctx) => runtime.blockOptions(args.blockType, args.propName, args.input, args.connectionId ?? void 0, ctx),
+			pieceCatalog: () => runtime.pieceCatalog(),
+			pieceActions: (_parent, args) => runtime.pieceActions(args.packageName),
+			pieceTriggers: (_parent, args) => runtime.pieceTriggers(args.packageName),
+			blockOutputTree: (_parent, args) => runtime.blockOutputTree(args.blockType, args.config),
+			pieceDetail: (_parent, args) => runtime.pieceDetail(args.packageName),
+			searchBlocks: (_parent, args) => runtime.searchBlocks(args.query, args.limit ?? void 0),
+			connections: (_parent, _args, ctx) => runtime.connections(ctx),
+			webhookEndpoint: (_parent, args, ctx) => runtime.webhookEndpoint(args.workflowId, ctx),
+			secret: async (_parent, args) => {
+				try {
+					return await (await runtime.secrets()).stat(args.ref);
+				} catch {
+					return null;
+				}
+			},
+			secrets: async () => (await runtime.secrets()).list(),
+			triggerStates: async (_parent, _args, ctx) => (await runtime.triggerStates(ctx)).map((row) => ({
+				workflowId: row.workflow_id,
+				blockType: row.block_type,
+				status: row.status,
+				intervalMs: row.interval_ms,
+				nextPollAt: row.next_poll_at,
+				lastPollAt: row.last_poll_at,
+				lastError: row.last_error,
+				consecutiveFailures: row.consecutive_failures
+			})),
+			runs: async (_parent, args, ctx) => (await runtime.runs(args, ctx)).map((record) => toRunRecord(record.row, record.steps)),
+			run: async (_parent, args, ctx) => {
+				const record = await runtime.run(args.id, ctx);
+				return record ? toRunRecord(record.row, record.steps) : null;
+			}
+		},
+		Mutation: { workflowRuntime: () => ({}) },
+		WorkflowRuntimeMutations: {
+			fire: (_parent, args, ctx) => runtime.fire(args.workflowId, args.payload, "manual", void 0, ctx),
+			testTrigger: (_parent, args, ctx) => runtime.testTrigger(args.workflowId, ctx),
+			rerun: (_parent, args, ctx) => runtime.rerun(args.runId, ctx),
+			createSecret: async (_parent, args, ctx) => {
+				requireAdmin(authorizationService, ctx);
+				return (await runtime.secrets()).create({
+					value: args.value,
+					label: args.label ?? void 0
+				});
+			},
+			rotateSecret: async (_parent, args, ctx) => {
+				requireAdmin(authorizationService, ctx);
+				return (await runtime.secrets()).rotate(args.ref, args.value);
+			},
+			deleteSecret: async (_parent, args, ctx) => {
+				requireAdmin(authorizationService, ctx);
+				await (await runtime.secrets()).delete(args.ref);
+				return true;
+			},
+			checkConnection: (_parent, args, ctx) => runtime.checkConnection(args.connectionId, ctx)
+		}
+	};
+};
+//#endregion
+//#region src/workflow/schema.ts
+const schema = gql`
+  """
+  WorkflowRuntime Queries
+  """
+  type WorkflowRuntimeQueries {
+    health: String!
+    """
+    Persisted runs, newest first. Scope them to one workflow, or to every
+    workflow a drive holds; workflowId wins when both are given.
+    """
+    runs(workflowId: String, driveId: String, limit: Int): [WorkflowRunRecord!]!
+    run(id: String!): WorkflowRunRecord
+    """
+    Action descriptor (props, auth) for a piece block type; null for core blocks.
+    """
+    blockDescriptor(blockType: String!): Unknown
+    """
+    Resolves a dynamic prop against the current config values: a DROPDOWN
+    yields { options, placeholder, disabled }, a DYNAMIC prop yields the
+    resolved sub-property descriptor list.
+    """
+    blockOptions(
+      blockType: String!
+      propName: String!
+      input: Unknown
+      connectionId: String
+    ): Unknown
+    """
+    All published Activepieces pieces with at least one action.
+    """
+    pieceCatalog: Unknown
+    """
+    A piece's actions, each with a ready-to-use blockType.
+    """
+    pieceActions(packageName: String!): Unknown
+    """
+    A piece's triggers, each with a ready-to-use "#trigger:" blockType.
+    """
+    pieceTriggers(packageName: String!): Unknown
+    """
+    Full piece detail (PieceMetadataModel-shaped), verbatim from the cloud API.
+    """
+    pieceDetail(packageName: String!): Unknown
+    """
+    Action/trigger name search across the catalog. The index builds lazily on
+    first use; poll while status is "indexing".
+    """
+    searchBlocks(query: String!, limit: Int): BlockSearchResult!
+    """
+    Health of every registered piece trigger (poll schedule, errors).
+    """
+    triggerStates: [TriggerStateRecord!]!
+    """
+    Authored output shape of a block (SDL / outputSchema / sampleData).
+    """
+    blockOutputTree(blockType: String!, config: Unknown): Unknown
+    """
+    Every powerhouse/connection document, for connection pickers.
+    """
+    connections: [ConnectionRecord!]!
+    """
+    The webhook endpoint for a workflow: the URL to hand the provider. Minted
+    on first ask, whether or not the workflow is armed — an author needs the
+    URL before enabling, and the armed field carries that difference. Null
+    only when the host has no webhook service.
+    """
+    webhookEndpoint(workflowId: String!): WebhookEndpointRecord
+    """
+    Secret metadata (label, version, status). Never the value.
+    """
+    secret(ref: String!): SecretRecord
+    secrets: [SecretRecord!]!
+  }
+
+  type BlockSearchHit {
+    blockType: String!
+    pieceName: String!
+    pieceDisplayName: String!
+    logoUrl: String!
+    displayName: String!
+    description: String!
+    "action | trigger"
+    kind: String!
+    "Triggers only: POLLING | WEBHOOK | APP_WEBHOOK"
+    strategy: String
+  }
+
+  type BlockSearchResult {
+    "ready | indexing | error"
+    status: String!
+    hits: [BlockSearchHit!]!
+    indexedPieces: Int!
+    error: String
+  }
+
+  type SecretRecord {
+    ref: String!
+    label: String
+    version: Int!
+    status: String!
+    createdAt: String!
+    updatedAt: String!
+  }
+
+  type ConnectionRecord {
+    id: String!
+    name: String!
+    connectorId: String!
+    authType: String!
+    status: String!
+    accountLabel: String
+  }
+
+  type ConnectionCheckResult {
+    ok: Boolean!
+    detail: String
+    accountLabel: String
+  }
+
+  type WebhookEndpointRecord {
+    workflowId: String!
+    url: String!
+    """
+    False when the reactor does not know its own public origin, so the url
+    above is a bare path no provider can call: the author supplies the origin.
+    """
+    absoluteUrl: Boolean!
+    "True while the workflow is ENABLED with a valid webhook trigger"
+    armed: Boolean!
+    createdAt: String!
+  }
+
+  type TriggerStateRecord {
+    workflowId: String!
+    blockType: String!
+    status: String!
+    intervalMs: Int!
+    nextPollAt: String
+    lastPollAt: String
+    lastError: String
+    consecutiveFailures: Int!
+  }
+
+  type Query {
+    workflowRuntime: WorkflowRuntimeQueries!
+  }
+
+  type WorkflowStepRunRecord {
+    stepId: String!
+    stepKey: String!
+    blockType: String!
+    status: String!
+    input: Unknown
+    output: Unknown
+    port: String
+    error: String
+  }
+
+  type WorkflowRunRecord {
+    id: String!
+    workflowId: String!
+    workflowName: String!
+    workflowVersion: Int!
+    triggerKind: String!
+    triggerPayload: Unknown
+    status: String!
+    error: String
+    startedAt: String!
+    endedAt: String
+    rerunOf: String
+    steps: [WorkflowStepRunRecord!]!
+  }
+
+  type WorkflowStepRun {
+    stepId: String!
+    key: String!
+    blockType: String!
+    status: String!
+    input: Unknown
+    output: Unknown
+    port: String
+    error: String
+  }
+
+  type WorkflowRunPayload {
+    runId: String
+    status: String!
+    error: String
+    steps: [WorkflowStepRun!]!
+  }
+
+  """
+  WorkflowRuntime Mutations
+  """
+  type WorkflowRuntimeMutations {
+    """
+    Fires a workflow's core#manual trigger and runs it to completion.
+    """
+    fire(workflowId: String!, payload: Unknown): WorkflowRunPayload!
+    """
+    Runs a piece trigger's test hook; sample items, no cursor changes.
+    """
+    testTrigger(workflowId: String!): Unknown
+    """
+    Resumes a FAILED run: succeeded steps replay from the journal,
+    execution restarts at the failure. Produces a new run.
+    """
+    rerun(runId: String!): WorkflowRunPayload!
+    """
+    Mints a managed secret and returns its ref; the value is stored
+    encrypted and is never readable back over any API.
+    """
+    createSecret(value: String!, label: String): SecretRecord!
+    """
+    Replaces the value behind an existing ref; documents stay untouched.
+    """
+    rotateSecret(ref: String!, value: String!): SecretRecord!
+    """
+    Tombstones a secret; its value becomes unrecoverable.
+    """
+    deleteSecret(ref: String!): Boolean!
+    """
+    Runs the piece's app.checkConnection against the connection's
+    credentials and records the outcome on the connection document.
+    """
+    checkConnection(connectionId: String!): ConnectionCheckResult!
+  }
+
+  type Mutation {
+    workflowRuntime: WorkflowRuntimeMutations!
+  }
+`;
+//#endregion
+//#region src/workflow/subgraph.ts
+/** The runtime's read/write surface. The runtime itself is composed by the
+* host, so the subgraph only serves what it is handed. */
+function createWorkflowRuntimeSubgraph(runtime) {
+	return class WorkflowRuntimeSubgraph extends BaseSubgraph {
+		name = "workflow-runtime";
+		typeDefs = schema;
+		resolvers = getResolvers(runtime, this.authorizationService);
+		additionalContextFields = {};
+	};
+}
+//#endregion
+//#region src/workflow-runtime.mts
+/** The npm name the workflow package owns: its HTTP namespace and its models. */
+const WORKFLOW_PACKAGE_NAME = "@powerhousedao/workflow";
+/** The env var and OpenFeature flag key that turns workflows on. */
+const PH_WORKFLOWS_ENABLED = "PH_WORKFLOWS_ENABLED";
+/** Precedence, unchanged from the reactor-api resolver this replaces: the
+* host's option, then PH_WORKFLOWS_ENABLED, then the config file, then off. */
+async function resolveWorkflowsEnabled({ featureFlags, override, configEnabled = false, env = process.env }) {
+	if (override !== void 0) return override;
+	const raw = env[PH_WORKFLOWS_ENABLED]?.trim();
+	if (raw === "1") return true;
+	if (raw === "0") return false;
+	return featureFlags.getBooleanValue(PH_WORKFLOWS_ENABLED, configEnabled);
+}
+async function loadWorkflowDocumentModels(load = () => import("@powerhousedao/workflow/document-models")) {
+	try {
+		return Object.values(await load()).filter((module) => typeof module === "object" && module !== null && "documentModel" in module && "reducer" in module);
+	} catch (error) {
+		throw new Error(`Workflows are enabled but ${WORKFLOW_PACKAGE_NAME} could not be loaded`, { cause: error });
+	}
+}
+function readAssertion(authorizationService, reactorClient) {
+	const resolveCanonical = createCanonicalDocumentIdResolver(reactorClient);
+	return async (identifier, caller) => {
+		const ctx = caller;
+		if (authorizationService.isSupremeAdmin(ctx.user?.address)) return;
+		if (authorizationService.config.policy !== AuthorizationPolicy.DOCUMENT_PERMISSIONS) throw new ForbiddenError();
+		let documentId;
+		try {
+			documentId = await resolveCanonical(identifier);
+		} catch {
+			throw new ForbiddenError();
+		}
+		if (!await authorizationService.canRead(documentId, ctx.user?.address)) throw new ForbiddenError("to read this document");
+	};
+}
+/** The same, for a design-time call that writes what it names. */
+function writeAssertion(authorizationService, reactorClient) {
+	const resolveCanonical = createCanonicalDocumentIdResolver(reactorClient);
+	return async (identifier, caller) => {
+		const ctx = caller;
+		if (authorizationService.isSupremeAdmin(ctx.user?.address)) return;
+		if (authorizationService.config.policy !== AuthorizationPolicy.DOCUMENT_PERMISSIONS) throw new ForbiddenError();
+		let documentId;
+		try {
+			documentId = await resolveCanonical(identifier);
+		} catch {
+			throw new ForbiddenError();
+		}
+		if (!await authorizationService.canWrite(documentId, ctx.user?.address)) throw new ForbiddenError("to write this document");
+	};
+}
+/** Whether the workflow document really references the attachment. A step
+* carries no caller, so the relationship is the whole check. */
+function attachmentRefCheck(deps) {
+	const resolveCanonical = createCanonicalDocumentIdResolver(deps.reactorClient);
+	const references = deps.attachmentReferences;
+	const projection = deps.attachmentReferenceProjection;
+	return async (documentId, ref) => {
+		if (!references || projection?.status !== "available") return false;
+		let parsed;
+		try {
+			parsed = parseRef(ref);
+		} catch {
+			return false;
+		}
+		if (parsed.version !== 1) return false;
+		const canonicalRef = createRef(parsed.hash.toLowerCase());
+		try {
+			return await references.hasReference(await resolveCanonical(documentId), canonicalRef);
+		} catch {
+			return false;
+		}
+	};
+}
+async function registerWorkflowTriggersReadModel(engine, runtime, clientModule) {
+	const reactorModule = clientModule?.reactorModule;
+	if (!reactorModule) return {
+		status: "unavailable",
+		reason: "in-process-reactor-module-unavailable"
+	};
+	const coordinator = reactorModule.readModelCoordinator;
+	if (!supportsLiveReadModelRegistration(coordinator)) return {
+		status: "unavailable",
+		reason: "live-read-model-registration-unsupported"
+	};
+	const readModel = new engine.WorkflowTriggersReadModel(reactorModule.database.withSchema(REACTOR_SCHEMA), reactorModule.operationIndex, reactorModule.writeCache, reactorModule.processorManagerConsistencyTracker, runtime);
+	await readModel.init();
+	coordinator.addReadModel(readModel, engine.WORKFLOW_TRIGGERS_READ_MODEL_STAGE);
+	return { status: "available" };
+}
+async function composeWorkflowRuntime(deps) {
+	const load = deps.load ?? (() => import("@powerhousedao/reactor-workflow"));
+	let engine;
+	try {
+		engine = await load();
+	} catch (error) {
+		throw new Error("Workflows are enabled but @powerhousedao/reactor-workflow could not be loaded", { cause: error });
+	}
+	const runtime = engine.createWorkflowRuntime({
+		relationalDb: deps.relationalDb,
+		reactorClient: deps.reactorClient,
+		assertCanRead: readAssertion(deps.authorizationService, deps.reactorClient),
+		assertCanWrite: writeAssertion(deps.authorizationService, deps.reactorClient),
+		webhooks: deps.webhooks,
+		attachments: deps.attachments,
+		canReadAttachmentRef: attachmentRefCheck(deps),
+		logger: deps.logger
+	});
+	const triggers = await registerWorkflowTriggersReadModel(engine, runtime, deps.clientModule);
+	if (triggers.status === "available") deps.logger.info(`Workflow trigger read model registered (${engine.WORKFLOW_TRIGGERS_READ_MODEL}, ${engine.WORKFLOW_TRIGGERS_READ_MODEL_STAGE})`);
+	else deps.logger.error("Workflow document triggers are NOT armed (@reason): this reactor's read-model coordinator takes no live registration, so no document operation reaches the runtime. Webhook and schedule triggers are unaffected.", triggers.reason);
+	let stopped = false;
+	return {
+		subgraph: createWorkflowRuntimeSubgraph(runtime),
+		triggers,
+		async start() {
+			await runtime.registerWebhookEndpoint();
+			runtime.startTriggerSupervisor();
+		},
+		stop() {
+			if (stopped) return Promise.resolve();
+			stopped = true;
+			runtime.shutdown();
+			return Promise.resolve();
+		}
+	};
+}
+//#endregion
 //#region src/pglite-dialect.ts
 var ClosablePGliteDialect = class extends PGliteDialect {
 	#pglite;
@@ -1077,6 +1560,13 @@ function isPortAvailable(port) {
 function resolveConfigPath(configFile) {
 	return configFile ?? path$1.join(process.cwd(), "powerhouse.config.json");
 }
+function readConfigWorkflowsEnabled(configPath) {
+	try {
+		return getConfig(configPath).workflows?.enabled ?? false;
+	} catch {
+		return false;
+	}
+}
 async function resolveServerPort(requested, strictPort, logger) {
 	if (strictPort) return requested;
 	for (let i = 0; i < PORT_FALLBACK_ATTEMPTS; i++) {
@@ -1224,6 +1714,7 @@ async function initServer(serverPort, options, renown, renownConfig) {
 		reactorLogger.error(`Projection worker ${shardId} died; shutting down so the supervisor restarts a healthy process`, reason);
 		process.kill(process.pid, "SIGTERM");
 	};
+	const workflowsEnabled = options.workflows?.enabled === true;
 	let ownedReactorModule;
 	const initializeClient = async (documentModels, { attachmentReferenceWriter, upgradeManifests }) => {
 		if (options.reactor) {
@@ -1255,8 +1746,13 @@ async function initServer(serverPort, options, renown, renownConfig) {
 		if (poolInstrumentation) reactorBuilder.withInstrumentedPool(poolInstrumentation);
 		const clientBuilder = new ReactorClientBuilder().withReactorBuilder(reactorBuilder);
 		const vetraDocumentModels = dev ? Object.values(await import("@powerhousedao/vetra/document-models")).filter((m) => typeof m === "object" && m !== null && "documentModel" in m && "reducer" in m) : [];
+		const workflowDocumentModels = workflowsEnabled ? await loadWorkflowDocumentModels() : [];
 		applySwitchboardReactorDefaults(reactorBuilder, clientBuilder, {
-			documentModels: [...documentModels, ...vetraDocumentModels],
+			documentModels: [
+				...documentModels,
+				...vetraDocumentModels,
+				...workflowDocumentModels
+			],
 			upgradeManifests,
 			executorConfig: hasSkipThreshold || enabledFeatureFlags.length > 0 ? {
 				...hasSkipThreshold ? { maxSkipThreshold } : {},
@@ -1409,6 +1905,41 @@ async function initServer(serverPort, options, renown, renownConfig) {
 	if (process.env.SENTRY_DSN) api.httpAdapter.setupSentryErrorHandler(Sentry);
 	const { client, graphqlManager, documentModelRegistry } = api;
 	const lateSubgraphs = [];
+	let workflows;
+	if (workflowsEnabled) {
+		workflows = await composeWorkflowRuntime({
+			reactorClient: client,
+			clientModule: options.reactor ?? ownedReactorModule,
+			relationalDb: api.relationalDb,
+			attachments: createAttachmentClient(api.attachments.service),
+			attachmentReferences: api.attachmentReferenceIndex.store,
+			attachmentReferenceProjection: api.attachmentReferenceProjection,
+			webhooks: api.httpRoutes.scopeFor(WORKFLOW_PACKAGE_NAME).webhooks,
+			authorizationService: api.authorizationService,
+			logger: logger.child(["workflow-runtime"])
+		});
+		const WorkflowRuntimeSubgraph = workflows.subgraph;
+		const workflowSubgraph = new WorkflowRuntimeSubgraph({
+			reactorClient: client,
+			http: graphqlManager.scopeForPackage(WORKFLOW_PACKAGE_NAME),
+			relationalDb: api.relationalDb,
+			analyticsStore: void 0,
+			graphqlManager,
+			syncManager: api.syncManager,
+			authorizationService: graphqlManager.getAuthorizationService(),
+			path: graphqlManager.getBasePath()
+		});
+		lateSubgraphs.push(graphqlManager.registerSubgraphInstance(workflowSubgraph, "graphql", false).catch((error) => {
+			logger.error("Failed to register workflow-runtime subgraph: @error", error);
+		}));
+		await workflows.start();
+		logger.info("Workflow runtime started");
+	}
+	const shutdown = async () => {
+		await workflows?.stop();
+		await api.dispose();
+	};
+	apiRef.current = { dispose: shutdown };
 	if (httpLoader) {
 		const packageManagementService = new PackageManagementService({
 			defaultRegistryUrl: registryUrl,
@@ -1492,9 +2023,10 @@ async function initServer(serverPort, options, renown, renownConfig) {
 		reactor: client,
 		attachmentService,
 		attachmentReferenceProjection: api.attachmentReferenceProjection,
+		workflowTriggers: workflows?.triggers,
 		renown,
 		port: serverPort,
-		shutdown: () => api.dispose()
+		shutdown
 	};
 }
 /**
@@ -1522,6 +2054,13 @@ const startSwitchboard = async (options = {}) => {
 	const enableDocumentModelSubgraphs = await featureFlags.getBooleanValue(DOCUMENT_MODEL_SUBGRAPHS_ENABLED, options.enableDocumentModelSubgraphs ?? DOCUMENT_MODEL_SUBGRAPHS_ENABLED_DEFAULT);
 	options.enableDocumentModelSubgraphs = enableDocumentModelSubgraphs;
 	const requireSignatures = options.identity?.requireSignatures ?? await featureFlags.getBooleanValue(REQUIRE_SIGNATURES, REQUIRE_SIGNATURES_DEFAULT);
+	const configPathForFlags = resolveConfigPath(options.configFile);
+	const workflowsEnabled = await resolveWorkflowsEnabled({
+		featureFlags,
+		override: options.workflows?.enabled,
+		configEnabled: readConfigWorkflowsEnabled(configPathForFlags)
+	});
+	options.workflows = { enabled: workflowsEnabled };
 	const renownConfig = resolveRenownConfig(getConfig(resolveConfigPath(options.configFile)).auth?.renown, process.env, logger);
 	options.identity = {
 		...options.identity,
@@ -1530,7 +2069,8 @@ const startSwitchboard = async (options = {}) => {
 	};
 	logger.info("Feature flags: @flags", JSON.stringify({
 		DOCUMENT_MODEL_SUBGRAPHS_ENABLED: enableDocumentModelSubgraphs,
-		REQUIRE_SIGNATURES: requireSignatures
+		REQUIRE_SIGNATURES: requireSignatures,
+		PH_WORKFLOWS_ENABLED: workflowsEnabled
 	}, null, 2));
 	let renown = null;
 	try {
@@ -1551,5 +2091,5 @@ if (import.meta.main) await startSwitchboard();
 //#endregion
 export { parseForcePgVersion as a, applySwitchboardReactorDefaults as i, isPortAvailable as n, startSwitchboard as r, deriveAttachmentServiceConfig as t };
 
-//# sourceMappingURL=server-CiKkVE6g.mjs.map
-//# debugId=e2c62b7b-68fd-59c2-ab82-7d035e11698b
+//# sourceMappingURL=server-DndPNlPT.mjs.map
+//# debugId=bf9f4a7e-71d0-5c0a-b467-a07a4938dc34