@powerhousedao/switchboard 6.2.3-dev.43 → 6.2.3-dev.45

package/dist/{server-CMAxYG6D.mjs → server-Dvw8_NeM.mjs}

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e04a905d-8b84-5d81-aff7-5e3f6387cda0")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b9c02424-1406-5d63-abbd-6c32caa53205")}catch(e){}}();
 import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-uaBlzyjS.mjs";
 import { createRequire, register } from "node:module";
 import { ReactorInstrumentation } from "@powerhousedao/opentelemetry-instrumentation-reactor";
@@ -9,7 +9,7 @@ import dotenv from "dotenv";
 import { getConfig } from "@powerhousedao/config/node";
 import { existsSync, promises, realpathSync } from "node:fs";
 import path, { resolve } from "node:path";
-import { AtomicNodeFs } from "@powerhousedao/pglite-fs";
+import { createDurableNodeFs, preparePgliteDataDir, removeStalePgliteFiles, resolvePgliteFsync, syncTree } from "@powerhousedao/reactor-api/pglite-node";
 import { ChannelScheme, DriveCollectionId, EventBus, REACTOR_SCHEMA, ReactorBuilder, ReactorClientBuilder, UnsupportedStoredProtocolError, createHybridProjectionCoordinatorFactory, instrumentPgPool, parseDriveUrl, supportsLiveReadModelRegistration } from "@powerhousedao/reactor";
 import { AuthorizationPolicy, BaseSubgraph, ForbiddenError, HttpPackageLoader, ImportPackageLoader, PGLITE_UTC_PARSERS, PackageManagementService, PackagesSubgraph, PrivacyPermissionAdapter, callerSubject, createCanonicalDocumentIdResolver, getUniqueDocumentModels, initializeAndStartAPI, resolveRenownConfig } from "@powerhousedao/reactor-api";
 import { httpsHooksPath } from "@powerhousedao/reactor-api/https-hooks";
@@ -29,7 +29,7 @@ import { driveDocumentModelModule } from "@powerhousedao/shared/document-drive";
 import { DEFAULT_SIGNATURE_POLICY, isSignaturePolicy } from "@powerhousedao/shared/document-model";
 import { readFile } from "node:fs/promises";
 import os from "node:os";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { EnvVarProvider } from "@openfeature/env-var-provider";
 import { OpenFeature } from "@openfeature/server-sdk";
 import { GraphQLError, Kind } from "graphql";
@@ -65,6 +65,19 @@ async function loadPGliteModule(major) {
 	if (major === 16) return await import("pglite-legacy-02");
 	return import("@electric-sql/pglite");
 }
+/** The stock NodeFS class of the PGlite module that opens `major` dirs. */
+async function loadNodeFsClass(major) {
+	if (major === 16) return (await import("pglite-legacy-02/nodefs")).NodeFS;
+	return (await import("@electric-sql/pglite/nodefs")).NodeFS;
+}
+/** Opens a converted dir over stock NodeFS so the conversion can check it. */
+async function openForVerify(major, dataDir) {
+	if (!isSupportedMajor(major)) throw new Error(`Cannot verify PGlite data dir ${dataDir}: PG_VERSION=${major} is not supported (expected one of ${SUPPORTED_PG_MAJORS.join(", ")})`);
+	const [{ PGlite }, NodeFS] = await Promise.all([loadPGliteModule(major), loadNodeFsClass(major)]);
+	const pg = new PGlite({ fs: new NodeFS(dataDir) });
+	await pg.waitReady;
+	return pg;
+}
 async function loadPgDump(major) {
 	if (major === 16) return (await import("pglite-tools-legacy-02/pg_dump")).pgDump;
 	return (await import("@electric-sql/pglite-tools/pg_dump")).pgDump;
@@ -798,9 +811,11 @@ const fatalHandlers = /* @__PURE__ */ new WeakMap();
 /**
 * Sends an uncaught exception or unhandled rejection through the SIGTERM
 * shutdown that `withSignalHandlers()` installs, so the reactor and read-model
-* PGlite stores write their snapshots before the process exits with code 1.
-* Node's default is to exit at once, which drops every write AtomicNodeFs has
-* not flushed yet. A shutdown that hangs is cut off after FORCED_EXIT_MS.
+* PGlite stores close with a shutdown checkpoint before the process exits
+* with code 1. Node's default is to exit at once, which leaves both stores
+* to WAL recovery on the next open. A store whose wasm runtime aborted
+* (ENOSPC) rejects its close; the builder logs that and still exits. A
+* shutdown that hangs is cut off after FORCED_EXIT_MS.
 *
 * A rejection is fatal only when this is its sole listener: Node exits on an
 * unhandled rejection only when nothing listens for it, and Sentry's
@@ -810,13 +825,26 @@ function installFatalErrorShutdown(logger, proc = process) {
 	if (fatalHandlers.has(proc)) return;
 	const realExit = proc.exit.bind(proc);
 	let shuttingDown = false;
+	/**
+	* Logs without ever throwing. onFatal runs inside the uncaughtException
+	* handler, so a logger whose transport is gone (EPIPE on a closed stdout)
+	* would otherwise throw from the handler that reports throws, killing the
+	* process before the shutdown it is supposed to run. A logging failure is
+	* swallowed: there is nowhere left to report it.
+	*/
+	const logFatal = (message, err) => {
+		try {
+			if (err === void 0) logger.error(message);
+			else logger.error(message, err);
+		} catch {}
+	};
 	const onFatal = (kind, err) => {
-		logger.error(`${kind}: @error`, err);
+		logFatal(`${kind}: @error`, err);
 		if (shuttingDown) return;
 		shuttingDown = true;
 		proc.exitCode = 1;
 		setTimeout(() => {
-			logger.error("Shutdown after fatal error timed out; exiting");
+			logFatal("Shutdown after fatal error timed out; exiting");
 			realExit(1);
 		}, FORCED_EXIT_MS).unref();
 		proc.kill(proc.pid, "SIGTERM");
@@ -1035,6 +1063,20 @@ const BASE_MODEL_SPECIFIERS = [
 	"@powerhousedao/reactor-drive",
 	"@powerhousedao/reactor-group/document-models"
 ];
+function isModelModule(value) {
+	const candidate = value;
+	return typeof candidate?.reducer === "function" && typeof candidate.documentModel?.global?.id === "string";
+}
+async function keepImportableSources(sources, logger) {
+	const kept = [];
+	for (const source of sources) try {
+		const exports = await import(pathToFileURL(source.filePath).href);
+		if (Object.values(exports).some(isModelModule)) kept.push(source);
+	} catch (error) {
+		logger.warn(`Worker model sources: "${source.filePath}" does not import, so workflow pieces will not see its models: ${String(error)}`);
+	}
+	return kept;
+}
 /**
 * Resolves base models and configured package identifiers to `{ filePath }`
 * sources for the reactor builder. Resolution to absolute paths happens here
@@ -1349,6 +1391,7 @@ function toStepRecord(row) {
 		output: parseJson(row.output),
 		port: row.port,
 		error: row.error,
+		errorName: row.error_name,
 		startedAt: row.started_at,
 		endedAt: row.ended_at,
 		pieceVersion: row.piece_version,
@@ -1367,6 +1410,7 @@ function toRunRecord(row, steps) {
 		triggerPayload: parseJson(row.trigger_payload),
 		status: row.status,
 		error: row.error,
+		errorName: row.error_name,
 		startedAt: row.started_at,
 		endedAt: row.ended_at,
 		rerunOf: row.rerun_of,
@@ -1375,6 +1419,14 @@ function toRunRecord(row, steps) {
 		steps: steps.map(toStepRecord)
 	};
 }
+const UNKNOWN_ACCESS = {
+	authEnforcement: true,
+	authConditions: false,
+	identity: null
+};
+function signedIn(ctx) {
+	return Boolean(ctx.user?.address);
+}
 function isAbsolute(url) {
 	return /^https?:\/\//i.test(url);
 }
@@ -1403,13 +1455,21 @@ function returnUrlFor(requested, ctx) {
 	if (!url || !origin || url.origin !== origin) throw new GraphQLError("returnUrl must be on the requesting page's origin");
 	return url.href;
 }
-const getResolvers = (runtime, authorizationService, oauth) => {
+const getResolvers = (runtime, authorizationService, oauth, access = UNKNOWN_ACCESS, assertCanRead) => {
 	return {
 		Query: { workflowRuntime: () => ({}) },
 		WorkflowRuntimeQueries: {
 			health: () => "ok",
+			authEnforcement: () => access.authEnforcement,
+			reactorIdentity: (_parent, _args, ctx) => signedIn(ctx) ? access.identity : null,
+			authConditions: (_parent, _args, ctx) => signedIn(ctx) ? access.authConditions : null,
+			reactorAccessDenial: async (_parent, args, ctx) => {
+				if (!assertCanRead) throw new GraphQLError("No read check configured");
+				await assertCanRead(args.workflowId, ctx);
+				return runtime.reactorAccessDenial(args.workflowId) ?? null;
+			},
 			blockDescriptor: (_parent, args) => runtime.blockDescriptor(blockRef(args.block)),
-			blockOptions: (_parent, args, ctx) => runtime.blockOptions(blockRef(args.block), args.propName, args.input, args.connectionId ?? void 0, ctx, args.searchValue ?? void 0),
+			blockOptions: (_parent, args, ctx) => runtime.blockOptions(blockRef(args.block), args.propName, args.input, args.connectionId ?? void 0, ctx, args.searchValue ?? void 0, args.reactorConnectionId ?? void 0),
 			pieceCatalog: () => runtime.pieceCatalog(),
 			pieceActions: (_parent, args) => runtime.pieceActions(args.packageName, args.version ?? void 0),
 			pieceTriggers: (_parent, args) => runtime.pieceTriggers(args.packageName, args.version ?? void 0),
@@ -1520,6 +1580,28 @@ const schema = gql`
   type WorkflowRuntimeQueries {
     health: String!
     """
+    Whether this reactor enforces document auth (REACTOR_AUTH_ENFORCEMENT).
+    On, a workflow needs a signed publish, and the host grants, to reach
+    documents. Answered to any caller.
+    """
+    authEnforcement: Boolean!
+    """
+    Who this host signs as: grant it on each document a step writes. Null for
+    a caller who is not signed in, or a host with no signer.
+    """
+    reactorIdentity: ReactorIdentity
+    """
+    REACTOR_AUTH_CONDITIONS. True: grant the host by key, with
+    { match: subject.key == key }; false: by address. Null for a caller who
+    is not signed in.
+    """
+    authConditions: Boolean
+    """
+    Why the workflow's last publish or enable got no reactor access, naming
+    the publisher and the connection; null when the check passed.
+    """
+    reactorAccessDenial(workflowId: String!): String
+    """
     Persisted runs, newest first. Scope them to one workflow, or to every
     workflow a drive holds; workflowId wins when both are given.
     """
@@ -1560,6 +1642,8 @@ const schema = gql`
       connectionId: String
       "What the author typed, for a DROPDOWN declared with refreshOnSearch."
       searchValue: String
+      "The step's reactor connection; its filter narrows what the resolver reads."
+      reactorConnectionId: String
     ): Unknown
     """
     Every piece this reactor offers: the core piece, its package pieces, and
@@ -1737,6 +1821,13 @@ const schema = gql`
     accountLabel: String
   }
 
+  type ReactorIdentity {
+    "The address the host signs as; null without a signed-in identity."
+    address: String
+    "The did:key that signs the host's operations."
+    key: String!
+  }
+
   type ConnectionCheckResult {
     ok: Boolean!
     detail: String
@@ -1798,6 +1889,8 @@ const schema = gql`
     output: Unknown
     port: String
     error: String
+    "The thrown error's name, e.g. ReactorAccessDeniedError."
+    errorName: String
     startedAt: String
     endedAt: String
     "The piece version that ran; null for an unresolved block."
@@ -1819,6 +1912,7 @@ const schema = gql`
     triggerPayload: Unknown
     status: String!
     error: String
+    errorName: String
     "When the run began executing; a PENDING run's is when it was journaled."
     startedAt: String!
     endedAt: String
@@ -1856,12 +1950,14 @@ const schema = gql`
     output: Unknown
     port: String
     error: String
+    errorName: String
   }
 
   type WorkflowRunPayload {
     runId: String
     status: String!
     error: String
+    errorName: String
     steps: [WorkflowStepRun!]!
   }
 
@@ -1872,6 +1968,7 @@ const schema = gql`
     status: String!
     output: Unknown
     error: String
+    errorName: String
     durationMs: Int!
   }
 
@@ -1956,11 +2053,11 @@ const schema = gql`
 //#region src/workflow/subgraph.ts
 /** The runtime's read/write surface. The runtime itself is composed by the
 * host, so the subgraph only serves what it is handed. */
-function createWorkflowRuntimeSubgraph(runtime, oauth) {
+function createWorkflowRuntimeSubgraph(runtime, oauth, access) {
 	return class WorkflowRuntimeSubgraph extends BaseSubgraph {
 		name = "workflow-runtime";
 		typeDefs = schema;
-		resolvers = getResolvers(runtime, this.authorizationService, oauth);
+		resolvers = getResolvers(runtime, this.authorizationService, oauth, access, (documentId, ctx) => this.assertCanRead(documentId, ctx));
 		additionalContextFields = {};
 	};
 }
@@ -1986,6 +2083,12 @@ async function assertWorkflowPackageLoadable(load = () => import("@powerhousedao
 		throw new Error(`Workflows are enabled but ${WORKFLOW_PACKAGE_NAME} could not be loaded`, { cause: error });
 	}
 }
+function modelManifestSource(builder) {
+	return {
+		modelManifest: () => builder.getResolvedModelManifest() ?? [],
+		modelEntries: (documentType) => builder.getImportableEntries(documentType)
+	};
+}
 function readAssertion(authorizationService, reactorClient) {
 	const resolveCanonical = createCanonicalDocumentIdResolver(reactorClient);
 	const hostCanRead = async (identifier, ctx) => {
@@ -2027,6 +2130,37 @@ function writeAssertion(authorizationService, reactorClient) {
 		if (!await authorizationService.canWrite(documentId, ctx.user?.address)) throw new ForbiddenError("to write this document");
 	};
 }
+/** What the reactor enforces and who it signs as; unknown counts as enforced. */
+function reactorAccessOf(clientModule) {
+	const flags = clientModule?.reactorModule?.featureFlags;
+	const signer = clientModule?.signer;
+	const key = signer?.app?.key;
+	const identity = key ? {
+		address: signer.user?.address ?? null,
+		key
+	} : null;
+	return {
+		authEnforcement: flags ? flags.authEnforcement : true,
+		authConditions: flags?.authConditions === true,
+		identity
+	};
+}
+/** Whom a run's created documents also grant: the host, as §8 grants it. */
+function hostPrincipalOf(access) {
+	const identity = access.identity;
+	if (!identity) return void 0;
+	if (access.authConditions) return { match: { eq: [{ attr: "subject.key" }, { lit: identity.key }] } };
+	return identity.address ? { address: identity.address } : void 0;
+}
+/** Who the host signs as, so a publish it signs makes no run user. */
+function hostIdentityOf(access) {
+	const identity = access.identity;
+	if (!identity) return void 0;
+	return identity.address ? {
+		address: identity.address,
+		key: identity.key
+	} : { key: identity.key };
+}
 /** A step reads any well-formed attachment, as it reads any document: a run
 * carries no caller to check against. */
 function canReadAttachmentRef(_documentId, ref) {
@@ -2069,6 +2203,8 @@ async function composeWorkflowRuntime(deps) {
 	}
 	engine.setPieceRegistryUrl(deps.pieceRegistryUrl);
 	if (deps.pieces) bindPackagePieces(engine.packagePieces, deps.pieces);
+	const access = reactorAccessOf(deps.clientModule);
+	const models = deps.models;
 	const runtime = engine.createWorkflowRuntime({
 		relationalDb: deps.relationalDb,
 		secretsKeyFile: deps.secretsKeyFile,
@@ -2076,6 +2212,13 @@ async function composeWorkflowRuntime(deps) {
 		assertCanRead: readAssertion(deps.authorizationService, deps.reactorClient),
 		subjectOf: (caller) => callerSubject(caller.user),
 		assertCanWrite: writeAssertion(deps.authorizationService, deps.reactorClient),
+		...deps.clientModule?.reactorModule ? { authEnforcement: access.authEnforcement } : {},
+		hostPrincipal: hostPrincipalOf(access),
+		hostIdentity: hostIdentityOf(access),
+		...models ? {
+			modelManifest: () => models.modelManifest(),
+			modelEntries: (documentType) => models.modelEntries(documentType)
+		} : {},
 		webhooks: deps.webhooks,
 		attachments: deps.attachments,
 		canReadAttachmentRef,
@@ -2087,7 +2230,7 @@ async function composeWorkflowRuntime(deps) {
 	let stopped = false;
 	const oauthCallback = deps.http ? registerOAuthCallback(deps.http, runtime) : void 0;
 	return {
-		subgraph: createWorkflowRuntimeSubgraph(runtime, deps.http ? { callbackUrl: callbackUrlOf(deps.http) } : void 0),
+		subgraph: createWorkflowRuntimeSubgraph(runtime, deps.http ? { callbackUrl: callbackUrlOf(deps.http) } : void 0, access),
 		triggers,
 		async start() {
 			await runtime.registerWebhookEndpoint();
@@ -2116,7 +2259,12 @@ var ClosablePGliteDialect = class extends PGliteDialect {
 		const innerDestroy = driver.destroy.bind(driver);
 		driver.destroy = async () => {
 			await innerDestroy();
-			if (!pglite.closed) await pglite.close();
+			if (pglite.closed) return;
+			try {
+				await pglite.close();
+			} catch (err) {
+				if (!/PGlite aborted/.test(String(err))) throw err;
+			}
 		};
 		return driver;
 	}
@@ -2171,7 +2319,15 @@ async function migratePgliteDir(dataDir, logger) {
 	try {
 		const [legacyMod, pgDump] = await Promise.all([loadPGliteModule(major), loadPgDump(major)]);
 		const LegacyPGlite = legacyMod.PGlite;
-		const pg = new LegacyPGlite(backupDir);
+		const onDisk = new LegacyPGlite(backupDir);
+		let tar;
+		try {
+			await onDisk.waitReady;
+			tar = await onDisk.dumpDataDir("none");
+		} finally {
+			await onDisk.close();
+		}
+		const pg = new LegacyPGlite({ loadDataDir: tar });
 		try {
 			await pg.waitReady;
 			sql = await (await pgDump({ pg })).text();
@@ -2201,6 +2357,7 @@ async function migratePgliteDir(dataDir, logger) {
 		} finally {
 			await pg.close();
 		}
+		syncTree(dataDir);
 	} catch (err) {
 		await rollback(dataDir, backupDir, err, logger);
 		throw err;
@@ -2221,6 +2378,59 @@ async function rollback(dataDir, backupDir, originalError, logger) {
 	logger.error(`[pglite-migration] Migration failed for ${dataDir}; rolled back from ${backupDir}. Original error: ${String(originalError)}`);
 }
 //#endregion
+//#region src/pglite-preflight.ts
+const RM_OPTIONS = {
+	recursive: true,
+	force: true,
+	maxRetries: 10,
+	retryDelay: 100
+};
+/**
+* Prepares every local PGlite dir before the first open and returns the
+* PG major detected on disk per dir. Conversion of an AtomicNodeFs snapshot
+* runs for every dir, before the major is read, so a pure-snapshot PG16 dir
+* is converted and then migrated.
+*/
+async function runPglitePreflight(options) {
+	const { dirs, logger } = options;
+	const detectedMajors = /* @__PURE__ */ new Map();
+	if (options.inMemory || dirs.length === 0) return detectedMajors;
+	if (options.forcePgVersion !== void 0) {
+		if (options.migratePglite) logger.warn("PH_FORCE_PG_VERSION is set; ignoring --migrate-pglite/PH_MIGRATE_PGLITE because the data dirs will be wiped.");
+		logger.warn(`PH_FORCE_PG_VERSION=${options.forcePgVersion} set; wiping PGLite data dirs and re-initializing at PG${options.forcePgVersion}.`);
+		for (const dir of dirs) {
+			for (const p of [
+				dir,
+				`${dir}.converting`,
+				`${dir}.old`
+			]) await promises.rm(p, RM_OPTIONS);
+			logger.info(`Wiped PGLite data dir ${dir}`);
+		}
+		return detectedMajors;
+	}
+	const deps = {
+		openForVerify: options.openForVerify ?? openForVerify,
+		logger
+	};
+	for (const dir of dirs) {
+		await preparePgliteDataDir(dir, deps);
+		const major = await readPgVersionFile(dir);
+		if (major !== null) detectedMajors.set(dir, major);
+	}
+	if (options.migratePglite) for (const [dir, major] of detectedMajors) {
+		if (major === 17) continue;
+		await migratePgliteDir(dir, logger);
+		await removeStalePgliteFiles(dir, logger);
+		const after = await readPgVersionFile(dir);
+		if (after !== null) detectedMajors.set(dir, after);
+	}
+	else for (const [dir, major] of detectedMajors) {
+		if (major === 17) continue;
+		logger.warn(`PGLite data dir at ${dir} was created with PG${major} but Switchboard ships PG17. Running on legacy PGLite. Re-start with --migrate-pglite (or PH_MIGRATE_PGLITE=true) to upgrade.`);
+	}
+	return detectedMajors;
+}
+//#endregion
 //#region src/reactor-feature-flags.mts
 /**
 * Enforcement flags from the REACTOR_* env vars. Each flag requires the ones
@@ -2409,14 +2619,29 @@ const DOCUMENT_MODEL_SUBGRAPHS_ENABLED = "DOCUMENT_MODEL_SUBGRAPHS_ENABLED";
 const DOCUMENT_MODEL_SUBGRAPHS_ENABLED_DEFAULT = true;
 const DEFAULT_PORT = process.env.PORT ? Number(process.env.PORT) : 4001;
 const PORT_FALLBACK_ATTEMPTS = 20;
-const PGLITE_FLUSH_INTERVAL_MS = (() => {
-	const raw = process.env.PGLITE_FLUSH_INTERVAL_MS;
-	if (raw === void 0) return 100;
-	const parsed = Number(raw);
-	return Number.isFinite(parsed) && parsed >= 0 ? parsed : 100;
-})();
-function onPgliteFlushError(err) {
-	triggerFatalShutdown("PGlite snapshot flush failed", err);
+let flushIntervalWarned = false;
+function warnIgnoredFlushInterval(logger) {
+	if (flushIntervalWarned) return;
+	if (process.env.PGLITE_FLUSH_INTERVAL_MS === void 0) return;
+	flushIntervalWarned = true;
+	logger.warn("PGLITE_FLUSH_INTERVAL_MS is set but ignored: PGlite stores no longer snapshot on a timer.");
+}
+function onPgliteAbort(logger, what) {
+	if (!triggerFatalShutdown("PGlite aborted", what)) logger.error("PGlite aborted: @error", what);
+}
+function pgliteFsyncFor(major, dir, logger) {
+	const wanted = resolvePgliteFsync(process.env);
+	if (wanted && major === 16) logger.warn(`PGlite data dir ${dir} is PG16 on pglite-legacy-02, which does not sync commits to disk; only checkpoints are synced until --migrate-pglite upgrades it.`);
+	return wanted;
+}
+/** Preloads the module's NodeFS so the returned factory can be synchronous. */
+async function loadDurableFsFactory(major, logger) {
+	const NodeFS = await loadNodeFsClass(major);
+	return (dir) => createDurableNodeFs(NodeFS, dir, {
+		fsync: pgliteFsyncFor(major, dir, logger),
+		logger,
+		onAbort: (what) => onPgliteAbort(logger, what)
+	});
 }
 const PGLITE_IN_MEMORY = process.env.PH_PGLITE_IN_MEMORY === "1";
 /**
@@ -2463,7 +2688,7 @@ async function resolveServerPort(requested, strictPort, logger) {
 	return requested;
 }
 async function createReactorKysely(opts) {
-	const { reactorDbUrl, reactorPgliteDir, reactorPgliteMajor, inMemory, flushIntervalMs, hostPoolSize, logger } = opts;
+	const { reactorDbUrl, reactorPgliteDir, reactorPgliteMajor, inMemory, hostPoolSize, logger } = opts;
 	if (reactorDbUrl && isPostgresUrl(reactorDbUrl)) {
 		const connectionString = reactorDbUrl.includes("?") ? reactorDbUrl : `${reactorDbUrl}?sslmode=disable`;
 		const poolSize = hostPoolSize();
@@ -2480,11 +2705,7 @@ async function createReactorKysely(opts) {
 	}
 	if (!reactorPgliteDir || reactorPgliteMajor === null) throw new Error("Reactor PGLite directory not resolved");
 	const { PGlite } = await loadPGliteModule(reactorPgliteMajor);
-	const pglite = inMemory ? new PGlite() : new PGlite({ fs: new AtomicNodeFs(reactorPgliteDir, {
-		logger,
-		flushIntervalMs,
-		onFlushError: onPgliteFlushError
-	}) });
+	const pglite = inMemory ? new PGlite() : new PGlite({ fs: (await loadDurableFsFactory(reactorPgliteMajor, logger))(reactorPgliteDir) });
 	logger.info(inMemory ? `Using in-memory PGlite (PG${reactorPgliteMajor}) for reactor storage [PH_PGLITE_IN_MEMORY=1]` : `Using PGlite (PG${reactorPgliteMajor}) for reactor storage at ${reactorPgliteDir}`);
 	return {
 		kysely: new Kysely({ dialect: new ClosablePGliteDialect(pglite) }),
@@ -2512,42 +2733,14 @@ async function initServer(serverPort, options, renown, renownConfig) {
 	const reactorPgliteDir = options.reactor ? null : !reactorDbUrl || !isPostgresUrl(reactorDbUrl) ? reactorPath : null;
 	const readModelPgliteDir = !dbPath || !isPostgresUrl(dbPath) ? readModelPath : null;
 	const pgliteDirs = [reactorPgliteDir, readModelPgliteDir].filter((d) => d !== null);
-	const detectedMajors = /* @__PURE__ */ new Map();
-	for (const dir of pgliteDirs) {
-		const lockPath = path$1.join(dir, "postmaster.pid");
-		try {
-			await promises.unlink(lockPath);
-			logger.warn(`Removed stale PGLite lockfile ${lockPath}`);
-		} catch (err) {
-			if (err.code !== "ENOENT") throw err;
-		}
-	}
-	if (options.forcePgVersion !== void 0 && pgliteDirs.length > 0) {
-		if (options.migratePglite) logger.warn("PH_FORCE_PG_VERSION is set; ignoring --migrate-pglite/PH_MIGRATE_PGLITE because the data dirs will be wiped.");
-		logger.warn(`PH_FORCE_PG_VERSION=${options.forcePgVersion} set; wiping PGLite data dirs and re-initializing at PG${options.forcePgVersion}.`);
-		for (const dir of pgliteDirs) {
-			await promises.rm(dir, {
-				recursive: true,
-				force: true
-			});
-			logger.info(`Wiped PGLite data dir ${dir}`);
-		}
-	} else if (options.forcePgVersion === void 0) {
-		for (const dir of pgliteDirs) {
-			const major = await readPgVersionFile(dir);
-			if (major !== null) detectedMajors.set(dir, major);
-		}
-		if (options.migratePglite) for (const [dir, major] of detectedMajors) {
-			if (major === 17) continue;
-			await migratePgliteDir(dir, logger);
-			const after = await readPgVersionFile(dir);
-			if (after !== null) detectedMajors.set(dir, after);
-		}
-		else for (const [dir, major] of detectedMajors) {
-			if (major === 17) continue;
-			logger.warn(`PGLite data dir at ${dir} was created with PG${major} but Switchboard ships PG17. Running on legacy PGLite. Re-start with --migrate-pglite (or PH_MIGRATE_PGLITE=true) to upgrade.`);
-		}
-	}
+	warnIgnoredFlushInterval(logger);
+	const detectedMajors = await runPglitePreflight({
+		dirs: pgliteDirs,
+		forcePgVersion: options.forcePgVersion,
+		migratePglite: options.migratePglite,
+		inMemory: PGLITE_IN_MEMORY,
+		logger
+	});
 	function resolvePgliteMajorForDir(dir) {
 		if (options.forcePgVersion !== void 0) return options.forcePgVersion;
 		const detected = detectedMajors.get(dir);
@@ -2614,6 +2807,7 @@ async function initServer(serverPort, options, renown, renownConfig) {
 		if (!packages.includes("@powerhousedao/workflow")) packages.push(WORKFLOW_PACKAGE_NAME);
 	}
 	let ownedReactorModule;
+	let workerModels;
 	let localRenownRequest;
 	const initializeClient = async (documentModels, { attachmentReferenceWriter, upgradeManifests }) => {
 		if (options.reactor) {
@@ -2632,7 +2826,6 @@ async function initServer(serverPort, options, renown, renownConfig) {
 			reactorPgliteDir,
 			reactorPgliteMajor,
 			inMemory: PGLITE_IN_MEMORY,
-			flushIntervalMs: PGLITE_FLUSH_INTERVAL_MS,
 			hostPoolSize: () => resolveHostPoolSize(process.env),
 			logger
 		});
@@ -2668,10 +2861,14 @@ async function initServer(serverPort, options, renown, renownConfig) {
 				switchboardUrl: renownConfig.switchboardUrl
 			}, renown) : void 0
 		});
+		if (workerPool || projectionWorker || workflowsEnabled) {
+			const sources = await resolveWorkerModelSources(packages, reactorLogger, { resolveRemote: resolveRegistryModels });
+			reactorBuilder.withDocumentModelSources(workerPool || projectionWorker ? sources : await keepImportableSources(sources, reactorLogger));
+		}
+		workerModels = modelManifestSource(reactorBuilder);
 		if (workerPool) {
 			if (!reactorDbUrl) throw new Error("unreachable: worker pool enabled without a reactor database URL");
-			const workerSources = await resolveWorkerModelSources(packages, reactorLogger, { resolveRemote: resolveRegistryModels });
-			reactorBuilder.withDocumentModelSources(workerSources).withWorkerPool({
+			reactorBuilder.withWorkerPool({
 				numWorkers: workerPool.numWorkers,
 				db: buildWorkerDbConfig(reactorDbUrl, workerPool)
 			});
@@ -2688,10 +2885,6 @@ async function initServer(serverPort, options, renown, renownConfig) {
 		});
 		if (projectionWorker) {
 			if (!reactorDbUrl) throw new Error("unreachable: projection worker enabled without a reactor database URL");
-			if (!workerPool) {
-				const workerSources = await resolveWorkerModelSources(packages, reactorLogger, { resolveRemote: resolveRegistryModels });
-				reactorBuilder.withDocumentModelSources(workerSources);
-			}
 			const db = {
 				...buildWorkerDbConfig(reactorDbUrl, {
 					dbPoolSizePerWorker: projectionWorker.dbPoolSize,
@@ -2785,12 +2978,9 @@ async function initServer(serverPort, options, renown, renownConfig) {
 	let pgliteFactory;
 	if (readModelPgliteDir && readModelPgliteMajor !== null) {
 		const { PGlite: ReadModelPGlite } = await loadPGliteModule(readModelPgliteMajor);
+		const durableFs = await loadDurableFsFactory(readModelPgliteMajor, logger);
 		pgliteFactory = PGLITE_IN_MEMORY ? () => new ReadModelPGlite({ parsers: PGLITE_UTC_PARSERS }) : (connectionString) => new ReadModelPGlite({
-			fs: new AtomicNodeFs(connectionString ?? readModelPgliteDir, {
-				logger,
-				flushIntervalMs: PGLITE_FLUSH_INTERVAL_MS,
-				onFlushError: onPgliteFlushError
-			}),
+			fs: durableFs(connectionString ?? readModelPgliteDir),
 			parsers: PGLITE_UTC_PARSERS
 		});
 	}
@@ -2839,6 +3029,7 @@ async function initServer(serverPort, options, renown, renownConfig) {
 			authorizationService: api.authorizationService,
 			pieces: api.packageManager,
 			pieceRegistryUrl: registryUrl,
+			models: workerModels,
 			logger: logger.child(["workflow-runtime"])
 		});
 		const WorkflowRuntimeSubgraph = workflows.subgraph;
@@ -2976,6 +3167,7 @@ async function initServer(serverPort, options, renown, renownConfig) {
 		attachmentReferenceProjection: api.attachmentReferenceProjection,
 		workflowTriggers: workflows?.triggers,
 		workflowsEnabled,
+		modelManifest: () => workerModels?.modelManifest() ?? [],
 		privacy: privacy ? { erasure: privacy.erasure } : void 0,
 		mcpEnabled: options.mcp !== false,
 		renown,
@@ -3048,5 +3240,5 @@ if (import.meta.main) await startSwitchboard({ fatalErrorShutdown: true });
 //#endregion
 export { resolveUnsupportedStoredDocuments as a, StoredDocumentsRefusedError as i, isPortAvailable as n, applySwitchboardReactorDefaults as o, startSwitchboard as r, parseForcePgVersion as s, deriveAttachmentServiceConfig as t };
 
-//# sourceMappingURL=server-CMAxYG6D.mjs.map
-//# debugId=e04a905d-8b84-5d81-aff7-5e3f6387cda0
+//# sourceMappingURL=server-Dvw8_NeM.mjs.map
+//# debugId=b9c02424-1406-5d63-abbd-6c32caa53205