@powerhousedao/switchboard 6.2.3-dev.5 → 6.2.3-dev.51

package/dist/server-J9fpd42v.mjs

@@ -0,0 +1,3549 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e3d937b6-2957-5fe0-8fc9-bf4fd0c18c93")}catch(e){}}();
+import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-uaBlzyjS.mjs";
+import { createRequire, register } from "node:module";
+import { metrics, trace } from "@opentelemetry/api";
+import { ReactorInstrumentation } from "@powerhousedao/opentelemetry-instrumentation-reactor";
+import * as Sentry from "@sentry/node";
+import { childLogger, documentModelDocumentModelModule, setLogLevel } from "document-model";
+import dotenv from "dotenv";
+import { getConfig } from "@powerhousedao/config/node";
+import { existsSync, promises, realpathSync } from "node:fs";
+import path, { resolve } from "node:path";
+import { createDurableNodeFs, preparePgliteDataDir, removeStalePgliteFiles, resolvePgliteFsync, syncTree } from "@powerhousedao/reactor-api/pglite-node";
+import { ChannelScheme, DriveCollectionId, EventBus, HardenedPGliteDialect, IN_MEMORY_PGLITE_STORAGE_FACTS, PGLITE_PATH_STORAGE_FACTS, POSTGRES_STORAGE_FACTS, REACTOR_SCHEMA, ReactorBuilder, ReactorClientBuilder, UnsupportedStoredProtocolError, createHybridProjectionCoordinatorFactory, instrumentPgPool, parseDriveUrl, supportsLiveReadModelRegistration } from "@powerhousedao/reactor";
+import { AuthorizationPolicy, BaseSubgraph, ForbiddenError, HttpPackageLoader, ImportPackageLoader, PGLITE_UTC_PARSERS, PackageManagementService, PackagesSubgraph, PrivacyPermissionAdapter, callerSubject, createCanonicalDocumentIdResolver, getUniqueDocumentModels, initializeAndStartAPI, resolveRenownConfig } from "@powerhousedao/reactor-api";
+import { httpsHooksPath } from "@powerhousedao/reactor-api/https-hooks";
+import { AttachmentAlreadyExists, AttachmentNotFound, AttachmentPending, AttachmentReferenceReadModel, AttachmentSchemaCompiler, HashMismatch, InvalidAttachmentMetadata, InvalidAttachmentRef, ReservationNotFound, SizeMismatch, UploadTooLarge, createRef, createRemoteAttachmentService, parseAttachmentDownloadTarget, parseRef, validateReserveMetadata } from "@powerhousedao/reactor-attachments";
+import { createAttachmentClient } from "@powerhousedao/reactor-attachments/client";
+import { DriveNodeView, NodeProcessor, ReactorDriveClient, createReactorDriveResolvers, reactorDriveDocumentModelModule, reactorDriveSubgraphTypeDefs } from "@powerhousedao/reactor-drive";
+import { DEFAULT_KEYPAIR_PATH, DEFAULT_RENOWN_URL, NodeKeyStorage, RENOWN_READ_MODEL_SUBGRAPH, RenownBuilder, RenownCryptoBuilder, createLocalCredentialVerifier, createRenownTrustPolicy, resolveSwitchboardEndpoint } from "@renown/sdk/node";
+import { Kysely, PostgresDialect } from "kysely";
+import net from "node:net";
+import path$1 from "path";
+import { Pool } from "pg";
+import { Readable } from "node:stream";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { DisclosureService, MIN_DEPLOYMENT_SECRET_BYTES, createModuleErasure, createPrivacySubgraph, registerSubjectDocumentsReadModel } from "@powerhousedao/reactor-privacy";
+import { ReactorGroupV1 } from "@powerhousedao/reactor-group";
+import { driveDocumentModelModule } from "@powerhousedao/shared/document-drive";
+import { DEFAULT_SIGNATURE_POLICY, isSignaturePolicy } from "@powerhousedao/shared/document-model";
+import { readFile } from "node:fs/promises";
+import os from "node:os";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { EnvVarProvider } from "@openfeature/env-var-provider";
+import { OpenFeature } from "@openfeature/server-sdk";
+import { GraphQLError, Kind } from "graphql";
+import { gql } from "graphql-tag";
+//#region src/pglite-version.ts
+const SUPPORTED_PG_MAJORS = [16, 17];
+async function readPgVersionFile(dataDir) {
+	try {
+		const raw = await promises.readFile(path.join(dataDir, "PG_VERSION"), "utf8");
+		const major = parseInt(raw.trim(), 10);
+		return Number.isFinite(major) ? major : null;
+	} catch {
+		return null;
+	}
+}
+function isSupportedMajor(major) {
+	return SUPPORTED_PG_MAJORS.includes(major);
+}
+/**
+* Parses the `PH_FORCE_PG_VERSION` env var. Returns the validated major, or
+* `null` when the var is unset/empty. Throws on any value that is not a
+* supported major — invalid configuration must fail before the server starts
+* touching disk.
+*/
+function parseForcePgVersion(raw) {
+	if (raw === void 0 || raw.trim() === "") return null;
+	const parsed = Number(raw);
+	if (Number.isInteger(parsed) && isSupportedMajor(parsed)) return parsed;
+	throw new Error(`PH_FORCE_PG_VERSION must be one of: ${SUPPORTED_PG_MAJORS.join(", ")} (got: ${raw})`);
+}
+async function loadPGliteModule(major) {
+	if (major === 16) return await import("pglite-legacy-02");
+	return import("@electric-sql/pglite");
+}
+/** The stock NodeFS class of the PGlite module that opens `major` dirs. */
+async function loadNodeFsClass(major) {
+	if (major === 16) return (await import("pglite-legacy-02/nodefs")).NodeFS;
+	return (await import("@electric-sql/pglite/nodefs")).NodeFS;
+}
+/** Opens a converted dir over stock NodeFS so the conversion can check it. */
+async function openForVerify(major, dataDir) {
+	if (!isSupportedMajor(major)) throw new Error(`Cannot verify PGlite data dir ${dataDir}: PG_VERSION=${major} is not supported (expected one of ${SUPPORTED_PG_MAJORS.join(", ")})`);
+	const [{ PGlite }, NodeFS] = await Promise.all([loadPGliteModule(major), loadNodeFsClass(major)]);
+	const pg = new PGlite({ fs: new NodeFS(dataDir) });
+	await pg.waitReady;
+	return pg;
+}
+async function loadPgDump(major) {
+	if (major === 16) return (await import("pglite-tools-legacy-02/pg_dump")).pgDump;
+	return (await import("@electric-sql/pglite-tools/pg_dump")).pgDump;
+}
+//#endregion
+//#region src/profiler.ts
+let started = false;
+async function initProfilerFromEnv(env) {
+	if (started || !env.PYROSCOPE_SERVER_ADDRESS) return;
+	started = true;
+	const { PYROSCOPE_SERVER_ADDRESS: serverAddress, PYROSCOPE_APPLICATION_NAME: appName, PYROSCOPE_USER: basicAuthUser, PYROSCOPE_PASSWORD: basicAuthPassword, PYROSCOPE_WALL_ENABLED: wallEnabled, PYROSCOPE_HEAP_ENABLED: heapEnabled } = env;
+	return initProfiler({
+		serverAddress,
+		appName,
+		basicAuthUser,
+		basicAuthPassword,
+		wall: {
+			samplingDurationMs: 1e4,
+			samplingIntervalMicros: 1e4,
+			collectCpuTime: true
+		},
+		heap: {
+			samplingIntervalBytes: 524288,
+			stackDepth: 64
+		}
+	}, {
+		wallEnabled: wallEnabled !== "false",
+		heapEnabled: heapEnabled === "true"
+	});
+}
+async function initProfiler(options, flags = {
+	wallEnabled: true,
+	heapEnabled: false
+}) {
+	console.log("Initializing Pyroscope profiler at:", options?.serverAddress);
+	console.log("  Wall profiling:", flags.wallEnabled ? "enabled" : "disabled");
+	console.log("  Heap profiling:", flags.heapEnabled ? "enabled" : "disabled");
+	const { default: Pyroscope } = await import("@pyroscope/nodejs");
+	Pyroscope.init(options);
+	if (flags.wallEnabled) Pyroscope.startWallProfiling();
+	Pyroscope.startCpuProfiling();
+	if (flags.heapEnabled) Pyroscope.startHeapProfiling();
+}
+//#endregion
+//#region src/attachments/auth.ts
+const ANONYMOUS_ACTOR = {
+	user: void 0,
+	authEnabled: false
+};
+/**
+* Wrap a Node-style handler so that, when `authService` is provided and auth is
+* enabled, the request must carry a verifiable Bearer token. The handler always
+* receives an actor context: the verified bearer user when auth is enabled, or
+* the anonymous context when it is disabled. With `allowAnonymous`, a missing
+* bearer yields an anonymous actor with `authEnabled: true` instead of a 401 —
+* unless `requireAuthenticatedCaller` says the deployment refuses anonymous
+* callers outright, which overrides it.
+*
+* With no `authService` there is no bearer to read and every caller is
+* anonymous, so nothing is refused here. That combination cannot carry the
+* floor: `assertRequireAuthenticatedCallerAllowed` refuses to boot with
+* `REQUIRE_AUTHENTICATED_CALLER` set and no identity resolution, and identity
+* resolution is what builds the service.
+*/
+function requireAuth(authService, handler, options) {
+	if (!authService) return (req, res, body) => handler(req, res, body, ANONYMOUS_ACTOR);
+	return async (req, res, body) => {
+		let result;
+		try {
+			result = await authService.verifyBearer(req.headers.authorization);
+		} catch {
+			res.statusCode = 500;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Internal authentication error" }));
+			return;
+		}
+		if (result instanceof Response) {
+			const body = await result.text();
+			res.statusCode = result.status;
+			const contentType = result.headers.get("content-type");
+			if (contentType) res.setHeader("Content-Type", contentType);
+			res.end(body);
+			return;
+		}
+		if (!result.user) {
+			if (options?.requireAuthenticatedCaller === true || result.auth_enabled && !options?.allowAnonymous) {
+				res.statusCode = 401;
+				res.setHeader("Content-Type", "application/json");
+				res.end(JSON.stringify({ error: "Authentication required" }));
+				return;
+			}
+		}
+		await handler(req, res, body, {
+			user: result.user,
+			authEnabled: result.auth_enabled
+		});
+	};
+}
+//#endregion
+//#region src/attachments/mount-auth.ts
+/**
+* Mount a Node-style attachment route with `requireAuth` applied unconditionally.
+* When `api.authService` is undefined (auth disabled), the handler still runs
+* through `requireAuth` and receives the anonymous actor context — that is the
+* only way to opt out of bearer verification. To register a route without auth
+* wrapping you must call `api.httpAdapter.mountNodeRoute` directly.
+*
+* `allowAnonymous` is reserved for routes whose handlers make a per-document
+* authorization decision themselves; identity-only routes must not use it. It
+* is also not the last word: a deployment that refuses anonymous callers
+* (`REQUIRE_AUTHENTICATED_CALLER`) refuses them here too, because these routes
+* are mounted on the HTTP adapter and never reach the fetch chain that carries
+* that floor for GraphQL. The flag is read from the API, so every route
+* mounted through here inherits it without each one remembering to.
+*/
+function mountAuthenticatedNodeRoute(api, method, path, handler, options) {
+	api.httpAdapter.mountNodeRoute(method, path, requireAuth(api.authService, handler, {
+		...options,
+		requireAuthenticatedCaller: api.requireAuthenticatedCaller
+	}));
+}
+//#endregion
+//#region src/attachments/routes.ts
+const logger$2 = childLogger(["switchboard", "attachments"]);
+const RETRY_AFTER_SECONDS = 5;
+const HASH_PATTERN = /^[a-f0-9]{64}$/i;
+function sendJson(res, status, body) {
+	res.statusCode = status;
+	res.setHeader("Content-Type", "application/json");
+	res.end(JSON.stringify(body));
+}
+function sendError(res, status, message) {
+	sendJson(res, status, { error: message });
+}
+function statusForError(err) {
+	if (err instanceof AttachmentNotFound) return 404;
+	if (err instanceof ReservationNotFound) return 404;
+	if (err instanceof InvalidAttachmentRef) return 400;
+	if (err instanceof UploadTooLarge) return 413;
+	return 500;
+}
+function sendErrorFromException(res, err) {
+	const status = statusForError(err);
+	if (status >= 500) {
+		logger$2.error("Attachment route error: @error", err);
+		sendError(res, status, "Internal error");
+		return;
+	}
+	sendError(res, status, err instanceof Error ? err.message : String(err));
+}
+async function readJsonBody(req, body) {
+	if (body !== void 0 && body !== null && typeof body === "object") return body;
+	const chunks = [];
+	for await (const chunk of req) chunks.push(chunk);
+	if (chunks.length === 0) return void 0;
+	const text = Buffer.concat(chunks).toString("utf8");
+	if (text.length === 0) return void 0;
+	return JSON.parse(text);
+}
+function parseReserveOptions(input) {
+	if (input === null || typeof input !== "object") return null;
+	const obj = input;
+	const { mimeType, fileName } = obj;
+	const extension = obj.extension ?? null;
+	try {
+		validateReserveMetadata({
+			mimeType,
+			fileName,
+			extension
+		});
+	} catch (err) {
+		if (err instanceof InvalidAttachmentMetadata) return null;
+		throw err;
+	}
+	if (typeof mimeType !== "string" || typeof fileName !== "string") return null;
+	if (extension !== null && typeof extension !== "string") return null;
+	if (obj.clientHash !== void 0) {
+		if (typeof obj.clientHash !== "string" || !HASH_PATTERN.test(obj.clientHash)) return null;
+		if (typeof obj.sizeBytes !== "number" || !Number.isInteger(obj.sizeBytes) || obj.sizeBytes <= 0 || !Number.isSafeInteger(obj.sizeBytes)) return null;
+		return {
+			mimeType,
+			fileName,
+			extension,
+			clientHash: obj.clientHash.toLowerCase(),
+			sizeBytes: obj.sizeBytes
+		};
+	}
+	return {
+		mimeType,
+		fileName,
+		extension
+	};
+}
+function quoteFilename(name) {
+	return `"${name.replace(/[\\"]/g, "\\$&")}"`;
+}
+function buildContentDisposition(fileName) {
+	const ascii = fileName.replace(/[^\x20-\x21\x23-\x5b\x5d-\x7e]/g, "_");
+	const encoded = encodeURIComponent(fileName).replace(/['()*!]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+	return `attachment; filename=${quoteFilename(ascii)}; filename*=UTF-8''${encoded}`;
+}
+function makeReserveHandler(attachments) {
+	return async (req, res, body) => {
+		let parsed;
+		try {
+			parsed = await readJsonBody(req, body);
+		} catch {
+			sendError(res, 400, "Invalid JSON body");
+			return;
+		}
+		const opts = parseReserveOptions(parsed);
+		if (!opts) {
+			sendError(res, 400, "Body must be { mimeType: string (type/subtype), fileName: string (no control characters, max 255 chars), extension?: string|null, clientHash?: string (64 hex chars), sizeBytes?: number (required with clientHash) }");
+			return;
+		}
+		let upload;
+		try {
+			upload = await attachments.service.reserve(opts);
+		} catch (err) {
+			if (err instanceof AttachmentAlreadyExists) {
+				sendJson(res, 409, {
+					error: "already_exists",
+					ref: err.ref
+				});
+				return;
+			}
+			sendErrorFromException(res, err);
+			return;
+		}
+		sendJson(res, 201, {
+			reservationId: upload.reservationId,
+			ref: upload.ref,
+			expiresAtUtc: upload.expiresAtUtc,
+			...upload.uploadTarget ? { uploadTarget: upload.uploadTarget } : {}
+		});
+	};
+}
+function makeUploadHandler(attachments) {
+	return async (req, res) => {
+		const reservationId = extractParam(req, "reservationId");
+		if (!reservationId) {
+			sendError(res, 400, "Missing reservationId");
+			return;
+		}
+		if (attachments.backend?.kind === "s3") {
+			sendError(res, 405, "Use the reservation uploadTarget for S3 uploads");
+			return;
+		}
+		let reservation;
+		try {
+			reservation = await attachments.reservations.get(reservationId);
+		} catch (err) {
+			sendErrorFromException(res, err);
+			return;
+		}
+		const upload = attachments.uploadFactory.createUpload(reservation);
+		const webStream = Readable.toWeb(req);
+		try {
+			sendJson(res, 200, await upload.send(webStream));
+		} catch (err) {
+			if (err instanceof HashMismatch) {
+				sendJson(res, 422, {
+					error: "hash_mismatch",
+					claimed: err.claimed,
+					actual: err.actual
+				});
+				return;
+			}
+			if (err instanceof SizeMismatch) {
+				sendJson(res, 422, {
+					error: "size_mismatch",
+					declared: err.declared,
+					actual: err.actual
+				});
+				return;
+			}
+			sendErrorFromException(res, err);
+		}
+	};
+}
+function makeDownloadHandler(attachments, attachmentAccess, urlSigner) {
+	return async (req, res, _body, actor) => {
+		const hash = extractParam(req, "hash");
+		if (!hash || !HASH_PATTERN.test(hash)) {
+			sendError(res, 400, "Invalid attachment hash");
+			return;
+		}
+		const canonicalHash = hash.toLowerCase();
+		const grant = await resolveByteGrant(req, canonicalHash, actor, attachmentAccess, urlSigner);
+		if (!admitGrant(res, grant)) return;
+		const controller = new AbortController();
+		req.once("close", () => controller.abort());
+		let response;
+		try {
+			response = await attachments.store.get(canonicalHash, controller.signal, grant.documentId);
+		} catch (err) {
+			if (err instanceof AttachmentPending) {
+				res.statusCode = 202;
+				res.setHeader("Cache-Control", "private");
+				res.setHeader("Retry-After", String(RETRY_AFTER_SECONDS));
+				res.setHeader("Attachment-Pending", buildPendingHeader({
+					expiresAtUtc: err.expiresAtUtc,
+					...err.metadata ?? {}
+				}));
+				res.end();
+				return;
+			}
+			sendErrorFromException(res, err);
+			return;
+		}
+		const { header, body } = response;
+		res.statusCode = 200;
+		res.setHeader("Cache-Control", "private");
+		res.setHeader("Content-Type", header.mimeType);
+		res.setHeader("Content-Length", String(header.sizeBytes));
+		res.setHeader("Content-Disposition", buildContentDisposition(header.fileName));
+		res.setHeader("Attachment-Metadata", buildMetadataHeader(header));
+		Readable.fromWeb(body).pipe(res);
+	};
+}
+function toAsciiJson(value) {
+	return JSON.stringify(value).replace(/[\u007f-\uffff]/g, (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function buildPendingHeader(pending) {
+	return toAsciiJson(pending);
+}
+function buildMetadataHeader(header) {
+	return toAsciiJson({
+		mimeType: header.mimeType,
+		fileName: header.fileName,
+		sizeBytes: header.sizeBytes,
+		extension: header.extension,
+		createdAtUtc: header.createdAtUtc,
+		lastAccessedAtUtc: header.lastAccessedAtUtc
+	});
+}
+function makeStatHandler(attachments, attachmentAccess, urlSigner) {
+	return async (req, res, _body, actor) => {
+		const hash = extractParam(req, "hash");
+		if (!hash || !HASH_PATTERN.test(hash)) {
+			sendError(res, 400, "Invalid attachment hash");
+			return;
+		}
+		const canonicalHash = hash.toLowerCase();
+		if (!admitGrant(res, await resolveByteGrant(req, canonicalHash, actor, attachmentAccess, urlSigner))) return;
+		let header;
+		try {
+			header = await attachments.store.stat(canonicalHash);
+		} catch (err) {
+			sendErrorFromException(res, err);
+			return;
+		}
+		res.setHeader("Cache-Control", "private");
+		if (header.status === "pending") {
+			res.statusCode = 202;
+			res.setHeader("Retry-After", String(RETRY_AFTER_SECONDS));
+			res.setHeader("Attachment-Pending", buildPendingHeader({
+				expiresAtUtc: header.expiresAtUtc,
+				mimeType: header.mimeType,
+				fileName: header.fileName,
+				sizeBytes: header.sizeBytes
+			}));
+			res.end();
+			return;
+		}
+		res.statusCode = 200;
+		res.setHeader("Content-Type", header.mimeType);
+		res.setHeader("Content-Length", String(header.sizeBytes));
+		res.setHeader("Content-Disposition", buildContentDisposition(header.fileName));
+		res.setHeader("Attachment-Metadata", buildMetadataHeader(header));
+		res.end();
+	};
+}
+function makeGetReservationHandler(attachments) {
+	return async (req, res) => {
+		const reservationId = extractParam(req, "reservationId");
+		if (!reservationId) {
+			sendError(res, 400, "Missing reservationId");
+			return;
+		}
+		try {
+			sendJson(res, 200, await attachments.reservations.get(reservationId));
+		} catch (err) {
+			sendErrorFromException(res, err);
+		}
+	};
+}
+function makeDeleteReservationHandler(attachments) {
+	return async (req, res) => {
+		const reservationId = extractParam(req, "reservationId");
+		if (!reservationId) {
+			sendError(res, 400, "Missing reservationId");
+			return;
+		}
+		try {
+			await attachments.reservations.delete(reservationId);
+			res.statusCode = 204;
+			res.end();
+		} catch (err) {
+			sendErrorFromException(res, err);
+		}
+	};
+}
+function extractParam(req, name) {
+	return req.params?.[name];
+}
+const MAX_DOCUMENT_ID_LEN = 512;
+const ATTACHMENT_NOT_FOUND_BODY = { error: "Attachment not found" };
+const MAX_DOWNLOAD_TARGET_TTL_SECONDS = 604800;
+/**
+* How long a download target may live, by default.
+*
+* The authorization behind a presigned URL is decided once, when it is issued,
+* and the URL keeps working until it expires however the document's policy
+* changes in between. A week of that is a revocation that does not revoke: an
+* account deactivated, a company reassigned or a group left, and the bytes stay
+* fetchable by anyone holding the link. Minutes are enough to open a file;
+* days are only enough to lose control of it.
+*
+* A deployment that needs longer sets ATTACHMENT_DOWNLOAD_TARGET_MAX_TTL_SECONDS,
+* still bounded by the signing ceiling above.
+*/
+const DEFAULT_DOWNLOAD_TARGET_TTL_SECONDS = 300;
+/**
+* The ceiling in force, read per call so a deployment can set it without the
+* value being frozen at import — which is also what lets a test cover it.
+* Anything unparseable falls back to the default rather than to the maximum:
+* a typo must not quietly widen the window it was meant to narrow.
+*/
+function downloadTargetTtlCapSeconds() {
+	const configured = process.env.ATTACHMENT_DOWNLOAD_TARGET_MAX_TTL_SECONDS;
+	if (configured === void 0) return DEFAULT_DOWNLOAD_TARGET_TTL_SECONDS;
+	const parsed = Number(configured);
+	if (!Number.isInteger(parsed) || parsed <= 0) {
+		logger$2.warn(`Ignoring invalid ATTACHMENT_DOWNLOAD_TARGET_MAX_TTL_SECONDS="${configured}" (expected a positive integer number of seconds) — using ${DEFAULT_DOWNLOAD_TARGET_TTL_SECONDS}`);
+		return DEFAULT_DOWNLOAD_TARGET_TTL_SECONDS;
+	}
+	return Math.min(parsed, MAX_DOWNLOAD_TARGET_TTL_SECONDS);
+}
+/**
+* Returns the single `documentId` query value, or null when it is missing,
+* duplicated, blank, or oversized. Validation happens before authorization so
+* malformed requests never reach the access service.
+*/
+function extractSingleDocumentId(req) {
+	if (!req.url) return null;
+	let url;
+	try {
+		url = new URL(req.url, "http://switchboard.invalid");
+	} catch {
+		return null;
+	}
+	const values = url.searchParams.getAll("documentId");
+	if (values.length !== 1) return null;
+	const value = values[0];
+	if (value.trim().length === 0 || value.length > MAX_DOCUMENT_ID_LEN) return null;
+	return value;
+}
+/**
+* Returns the target TTL in seconds, or "invalid" when the caller's own value
+* is malformed (duplicated, non-integer, or non-positive).
+*
+* The cap applies whether or not the caller asked for a lifetime: omitting
+* `expiresIn` used to fall through to whatever the storage backend was
+* configured with, which would make the ceiling something a client opts out of
+* by saying nothing.
+*/
+function extractExpiresIn(req) {
+	const cap = downloadTargetTtlCapSeconds();
+	if (!req.url) return cap;
+	let url;
+	try {
+		url = new URL(req.url, "http://switchboard.invalid");
+	} catch {
+		return cap;
+	}
+	const values = url.searchParams.getAll("expiresIn");
+	if (values.length === 0) return cap;
+	if (values.length > 1) return "invalid";
+	const parsed = Number(values[0]);
+	if (!Number.isInteger(parsed) || parsed <= 0) return "invalid";
+	return Math.min(parsed, cap);
+}
+function singleQueryValue(params, name) {
+	const values = params.getAll(name);
+	return values.length === 1 ? values[0] : null;
+}
+/**
+* Byte routes serve only under a grant: a signed URL minted by the
+* download-target route, or a documentId the caller may read the attachment
+* through. A signed request is judged by its signature alone.
+*/
+async function resolveByteGrant(req, hash, actor, attachmentAccess, urlSigner) {
+	let params;
+	try {
+		params = new URL(req.url ?? "", "http://switchboard.invalid").searchParams;
+	} catch {
+		return { kind: "denied" };
+	}
+	const documentId = extractSingleDocumentId(req);
+	if (documentId === null) return { kind: "denied" };
+	if (params.has("signature") || params.has("expires")) {
+		const signature = singleQueryValue(params, "signature");
+		const expires = singleQueryValue(params, "expires");
+		if (!urlSigner || signature === null || expires === null) return { kind: "denied" };
+		return urlSigner.verify(hash, documentId, expires, signature) ? {
+			kind: "granted",
+			documentId
+		} : { kind: "denied" };
+	}
+	let decision;
+	try {
+		decision = await attachmentAccess.canReadAttachment({
+			documentId,
+			attachmentRef: createRef(hash),
+			userAddress: actor?.user?.address,
+			appKey: actor?.user?.appKey
+		});
+	} catch (err) {
+		logger$2.error("Attachment access decision failed: @error", err);
+		return { kind: "error" };
+	}
+	if (decision.kind === "projection-unavailable") return { kind: "unavailable" };
+	if (decision.kind === "denied") return { kind: "denied" };
+	return {
+		kind: "granted",
+		documentId: decision.documentId
+	};
+}
+/** Answers a refused grant; true when the request may proceed. */
+function admitGrant(res, grant) {
+	switch (grant.kind) {
+		case "granted": return true;
+		case "denied":
+			sendJson(res, 404, ATTACHMENT_NOT_FOUND_BODY);
+			return false;
+		case "unavailable":
+			sendError(res, 503, "Attachment downloads are temporarily unavailable");
+			return false;
+		case "error":
+			sendError(res, 500, "Internal error");
+			return false;
+	}
+}
+/**
+* Base URL of this Switchboard as seen by the caller, used to build
+* filesystem `switchboard` download targets that point back at the signed
+* byte route.
+*/
+function requestBaseUrl(req) {
+	const forwardedProto = req.headers["x-forwarded-proto"];
+	const proto = (Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto)?.split(",")[0]?.trim() || (req.socket.encrypted ? "https" : "http");
+	const forwardedHost = req.headers["x-forwarded-host"];
+	const host = (Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost) ?? req.headers.host;
+	if (!host) return null;
+	return `${proto}://${host}`;
+}
+function makeDownloadTargetHandler(attachments, attachmentAccess, urlSigner) {
+	return async (req, res, _body, actor) => {
+		res.setHeader("Cache-Control", "no-store");
+		const hash = extractParam(req, "hash");
+		if (!hash || !HASH_PATTERN.test(hash)) {
+			sendError(res, 400, "Invalid attachment hash");
+			return;
+		}
+		const documentId = extractSingleDocumentId(req);
+		if (documentId === null) {
+			sendError(res, 400, "documentId is required exactly once as a non-empty query parameter");
+			return;
+		}
+		const expiresIn = extractExpiresIn(req);
+		if (expiresIn === "invalid") {
+			sendError(res, 400, "expiresIn must be a single positive integer number of seconds");
+			return;
+		}
+		const canonicalHash = hash.toLowerCase();
+		let decision;
+		try {
+			decision = await attachmentAccess.canReadAttachment({
+				documentId,
+				attachmentRef: createRef(canonicalHash),
+				userAddress: actor?.user?.address,
+				appKey: actor?.user?.appKey
+			});
+		} catch (err) {
+			logger$2.error("Attachment access decision failed: @error", err);
+			sendError(res, 500, "Internal error");
+			return;
+		}
+		if (decision.kind === "projection-unavailable") {
+			sendError(res, 503, "Attachment downloads are temporarily unavailable");
+			return;
+		}
+		if (decision.kind === "denied") {
+			sendJson(res, 404, ATTACHMENT_NOT_FOUND_BODY);
+			return;
+		}
+		let header;
+		try {
+			header = await attachments.store.stat(canonicalHash);
+		} catch (err) {
+			if (err instanceof AttachmentNotFound) {
+				sendJson(res, 404, ATTACHMENT_NOT_FOUND_BODY);
+				return;
+			}
+			logger$2.error("Attachment metadata lookup failed: @error", err);
+			sendError(res, 500, "Internal error");
+			return;
+		}
+		if (header.status !== "available") {
+			sendJson(res, 404, ATTACHMENT_NOT_FOUND_BODY);
+			return;
+		}
+		let target;
+		if (attachments.backend && attachments.backend.kind !== "filesystem") try {
+			target = await attachments.backend.prepareDownloadTarget(canonicalHash, expiresIn);
+		} catch {
+			sendError(res, 502, "Attachment download target unavailable");
+			return;
+		}
+		else {
+			if (!urlSigner) {
+				sendError(res, 503, "Attachment download signing is not configured");
+				return;
+			}
+			const base = requestBaseUrl(req);
+			if (!base) {
+				sendError(res, 500, "Internal error");
+				return;
+			}
+			const signed = urlSigner.sign(canonicalHash, decision.documentId, expiresIn);
+			try {
+				target = parseAttachmentDownloadTarget({
+					kind: "switchboard",
+					method: "GET",
+					url: `${base}/attachments/${canonicalHash}?${signed.query}`,
+					headers: {},
+					expiresAtUtc: signed.expiresAtUtc
+				});
+			} catch {
+				sendError(res, 500, "Internal error");
+				return;
+			}
+		}
+		sendJson(res, 200, target);
+	};
+}
+//#endregion
+//#region src/attachments/url-signer.ts
+const ATTACHMENT_URL_SIGNING_SECRET_ENV = "PH_ATTACHMENT_URL_SIGNING_SECRET";
+const MIN_SECRET_LENGTH = 32;
+const EXPIRES_PATTERN = /^[1-9]\d{0,15}$/;
+const SIGNATURE_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+var AttachmentUrlSigner = class {
+	secret;
+	now;
+	constructor(secret, now = Date.now) {
+		this.secret = secret;
+		this.now = now;
+	}
+	sign(hash, documentId, ttlSeconds) {
+		const expires = Math.floor(this.now() / 1e3) + ttlSeconds;
+		return {
+			query: new URLSearchParams({
+				documentId,
+				expires: String(expires),
+				signature: this.mac(hash, documentId, String(expires))
+			}).toString(),
+			expiresAtUtc: (/* @__PURE__ */ new Date(expires * 1e3)).toISOString()
+		};
+	}
+	verify(hash, documentId, expires, signature) {
+		if (!EXPIRES_PATTERN.test(expires) || !SIGNATURE_PATTERN.test(signature)) return false;
+		if (Number(expires) * 1e3 <= this.now()) return false;
+		const expected = Buffer.from(this.mac(hash, documentId, expires));
+		const presented = Buffer.from(signature);
+		return expected.length === presented.length && timingSafeEqual(expected, presented);
+	}
+	mac(hash, documentId, expires) {
+		return createHmac("sha256", this.secret).update(JSON.stringify([
+			"attachment-download/v1",
+			hash,
+			documentId,
+			expires
+		])).digest("base64url");
+	}
+};
+function resolveAttachmentUrlSigning(env = process.env) {
+	const secret = env[ATTACHMENT_URL_SIGNING_SECRET_ENV];
+	if (secret !== void 0) {
+		if (secret.trim() !== secret || secret.length < MIN_SECRET_LENGTH) throw new Error(`${ATTACHMENT_URL_SIGNING_SECRET_ENV} must be at least ${MIN_SECRET_LENGTH} characters with no leading or trailing whitespace`);
+		return {
+			status: "configured",
+			signer: new AttachmentUrlSigner(secret)
+		};
+	}
+	if (env.NODE_ENV === "production") return { status: "unconfigured" };
+	return {
+		status: "ephemeral",
+		signer: new AttachmentUrlSigner(randomBytes(32))
+	};
+}
+//#endregion
+//#region src/attachments/index.ts
+const logger$1 = childLogger(["switchboard", "attachments"]);
+function registerAttachmentRoutes(api, options = {}) {
+	const { attachments, attachmentAccess } = api;
+	const urlSigner = options.urlSigner === void 0 ? signerFromEnvironment(attachments.backend?.kind ?? "filesystem") : options.urlSigner;
+	mountAuthenticatedNodeRoute(api, "POST", "/attachments/reservations", makeReserveHandler(attachments));
+	mountAuthenticatedNodeRoute(api, "GET", "/attachments/reservations/:reservationId", makeGetReservationHandler(attachments));
+	mountAuthenticatedNodeRoute(api, "DELETE", "/attachments/reservations/:reservationId", makeDeleteReservationHandler(attachments));
+	mountAuthenticatedNodeRoute(api, "PUT", "/attachments/reservations/:reservationId", makeUploadHandler(attachments));
+	mountAuthenticatedNodeRoute(api, "HEAD", "/attachments/:hash", makeStatHandler(attachments, attachmentAccess, urlSigner), { allowAnonymous: true });
+	mountAuthenticatedNodeRoute(api, "GET", "/attachments/:hash/download-target", makeDownloadTargetHandler(attachments, attachmentAccess, urlSigner), { allowAnonymous: true });
+	mountAuthenticatedNodeRoute(api, "GET", "/attachments/:hash", makeDownloadHandler(attachments, attachmentAccess, urlSigner), { allowAnonymous: true });
+}
+function signerFromEnvironment(backend) {
+	const signing = resolveAttachmentUrlSigning();
+	if (signing.status === "unconfigured") {
+		if (backend === "filesystem") logger$1.error(`${ATTACHMENT_URL_SIGNING_SECRET_ENV} is not set: filesystem attachment download targets are refused until it is`);
+		return null;
+	}
+	if (signing.status === "ephemeral" && backend === "filesystem") logger$1.warn(`${ATTACHMENT_URL_SIGNING_SECRET_ENV} is not set: signing attachment download URLs with a per-process secret`);
+	return signing.signer;
+}
+//#endregion
+//#region src/attachment-reference-read-model.mts
+const attachmentSchemaCompiler = new AttachmentSchemaCompiler();
+function createAttachmentReferenceReadModel(baseKysely, dependencies, attachmentReferenceWriter) {
+	return new AttachmentReferenceReadModel(baseKysely.withSchema(REACTOR_SCHEMA), dependencies.operationIndex, dependencies.writeCache, dependencies.processorManagerConsistencyTracker, dependencies.documentModelRegistry, attachmentSchemaCompiler, attachmentReferenceWriter);
+}
+function registerAttachmentReferenceReadModel(reactorBuilder, registration) {
+	reactorBuilder.withReadModelFactory(async ({ documentModelRegistry, operationIndex, writeCache, processorManagerConsistencyTracker }) => {
+		const readModel = createAttachmentReferenceReadModel(registration.baseKysely, {
+			operationIndex,
+			writeCache,
+			processorManagerConsistencyTracker,
+			documentModelRegistry
+		}, registration.attachmentReferenceWriter);
+		await readModel.init();
+		return readModel;
+	});
+}
+async function registerAttachmentReferenceReadModelOnModule(clientModule, attachmentReferenceWriter) {
+	const reactorModule = clientModule.reactorModule;
+	if (!reactorModule) return {
+		status: "unavailable",
+		reason: "in-process-reactor-module-unavailable"
+	};
+	const coordinator = reactorModule.readModelCoordinator;
+	if (!supportsLiveReadModelRegistration(coordinator)) return {
+		status: "unavailable",
+		reason: "live-read-model-registration-unsupported"
+	};
+	const readModel = createAttachmentReferenceReadModel(reactorModule.database, {
+		operationIndex: reactorModule.operationIndex,
+		writeCache: reactorModule.writeCache,
+		processorManagerConsistencyTracker: reactorModule.processorManagerConsistencyTracker,
+		documentModelRegistry: reactorModule.documentModelRegistry
+	}, attachmentReferenceWriter);
+	await readModel.init();
+	coordinator.addReadModel(readModel, "pre_ready");
+	await readModel.init();
+	return { status: "available" };
+}
+//#endregion
+//#region src/fatal-shutdown.mts
+const FORCED_EXIT_MS = 15e3;
+const fatalHandlers = /* @__PURE__ */ new WeakMap();
+/**
+* Sends an uncaught exception or unhandled rejection through the SIGTERM
+* shutdown that `withSignalHandlers()` installs, so the reactor and read-model
+* PGlite stores close with a shutdown checkpoint before the process exits
+* with code 1. Node's default is to exit at once, which leaves both stores
+* to WAL recovery on the next open. A store whose wasm runtime aborted
+* (ENOSPC) rejects its close; the builder logs that and still exits. A
+* shutdown that hangs is cut off after FORCED_EXIT_MS.
+*
+* A rejection is fatal only when this is its sole listener: Node exits on an
+* unhandled rejection only when nothing listens for it, and Sentry's
+* listener deliberately keeps the process running.
+*/
+function installFatalErrorShutdown(logger, proc = process) {
+	if (fatalHandlers.has(proc)) return;
+	const realExit = proc.exit.bind(proc);
+	let shuttingDown = false;
+	/**
+	* Logs without ever throwing. onFatal runs inside the uncaughtException
+	* handler, so a logger whose transport is gone (EPIPE on a closed stdout)
+	* would otherwise throw from the handler that reports throws, killing the
+	* process before the shutdown it is supposed to run. A logging failure is
+	* swallowed: there is nowhere left to report it.
+	*/
+	const logFatal = (message, err) => {
+		try {
+			if (err === void 0) logger.error(message);
+			else logger.error(message, err);
+		} catch {}
+	};
+	const onFatal = (kind, err) => {
+		logFatal(`${kind}: @error`, err);
+		if (shuttingDown) return;
+		shuttingDown = true;
+		proc.exitCode = 1;
+		setTimeout(() => {
+			logFatal("Shutdown after fatal error timed out; exiting");
+			realExit(1);
+		}, FORCED_EXIT_MS).unref();
+		proc.kill(proc.pid, "SIGTERM");
+	};
+	fatalHandlers.set(proc, onFatal);
+	proc.on("uncaughtException", (err) => onFatal("Uncaught exception", err));
+	proc.on("unhandledRejection", (reason) => {
+		if (proc.listenerCount("unhandledRejection") > 1) return;
+		onFatal("Unhandled rejection", reason);
+	});
+}
+/**
+* Routes a fatal condition the caller detected through the same shutdown as an
+* uncaught error. Returns false, and does nothing, when
+* `installFatalErrorShutdown` has not run for `proc`.
+*/
+function triggerFatalShutdown(kind, err, proc = process) {
+	const onFatal = fatalHandlers.get(proc);
+	if (!onFatal) return false;
+	onFatal(kind, err);
+	return true;
+}
+//#endregion
+//#region src/privacy.mts
+const DAY_MS = 864e5;
+/** Enabling privacy on a switchboard that cannot run it safely. */
+var PrivacyBootError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "PrivacyBootError";
+	}
+};
+function positive(env, name, unitMs) {
+	const raw = env[name];
+	if (raw === void 0 || raw.trim() === "") return void 0;
+	const value = Number(raw);
+	if (!Number.isFinite(value) || value <= 0) throw new PrivacyBootError(`${name} must be a positive number, got "${raw}"`);
+	return value * unitMs;
+}
+function resolvePrivacy(options, env) {
+	if (!(options?.enabled ?? env.PH_PRIVACY_ENABLED === "true")) return { enabled: false };
+	const deploymentSecret = options?.deploymentSecret ?? env.PH_PRIVACY_DEPLOYMENT_SECRET;
+	if (!deploymentSecret || Buffer.byteLength(deploymentSecret, "utf8") < MIN_DEPLOYMENT_SECRET_BYTES) throw new PrivacyBootError(`PH_PRIVACY_ENABLED needs PH_PRIVACY_DEPLOYMENT_SECRET of at least ${MIN_DEPLOYMENT_SECRET_BYTES} bytes`);
+	return {
+		enabled: true,
+		deploymentSecret,
+		intervalMs: positive(env, "PH_PRIVACY_INTERVAL_MS", 1),
+		deadlineMs: positive(env, "PH_PRIVACY_DEADLINE_DAYS", DAY_MS),
+		markerGraceMs: positive(env, "PH_PRIVACY_MARKER_GRACE_DAYS", DAY_MS),
+		purgeTimeoutMs: positive(env, "PH_PRIVACY_PURGE_TIMEOUT_MINUTES", 6e4)
+	};
+}
+/** Subject index, erasure scheduler and admin subgraph on a built reactor. */
+async function startPrivacy(deps) {
+	const { config, reactorModule, authorizationService } = deps;
+	if (authorizationService.config.policy === AuthorizationPolicy.OPEN) throw new PrivacyBootError("PH_PRIVACY_ENABLED is refused under the OPEN authorization policy: every caller, anonymous included, would administer erasure. Enable authentication (AUTH_ENABLED=true with ADMINS) first.");
+	if (!reactorModule) throw new PrivacyBootError("PH_PRIVACY_ENABLED needs an in-process reactor module");
+	if (!deps.signer?.app?.key) throw new PrivacyBootError("PH_PRIVACY_ENABLED needs a reactor signer (a Renown identity): every receiver refuses an unsigned purge marker");
+	const permissions = deps.documentPermissionService ? new PrivacyPermissionAdapter(deps.documentPermissionService) : void 0;
+	const { service, scheduler } = createModuleErasure(reactorModule, {
+		deploymentSecret: config.deploymentSecret,
+		signer: deps.signer,
+		permissions,
+		intervalMs: config.intervalMs,
+		deadlineMs: config.deadlineMs,
+		markerGraceMs: config.markerGraceMs,
+		purgeTimeoutMs: config.purgeTimeoutMs,
+		logger: deps.logger
+	});
+	const disclosure = new DisclosureService(reactorModule.database, config.deploymentSecret, permissions);
+	let subgraph;
+	try {
+		subgraph = createPrivacySubgraph({
+			authorizationService,
+			erasure: service,
+			disclosure
+		});
+	} catch (error) {
+		throw new PrivacyBootError(error instanceof Error ? error.message : String(error));
+	}
+	await registerSubjectDocumentsReadModel(reactorModule, { deploymentSecret: config.deploymentSecret });
+	await deps.graphqlManager.registerSubgraphInstance({
+		...subgraph,
+		path: deps.graphqlManager.getBasePath(),
+		reactorClient: deps.reactorClient,
+		relationalDb: void 0
+	}, "graphql", false);
+	scheduler.start();
+	deps.logger.info("Privacy add-on started: subject index, erasure scheduler");
+	return {
+		erasure: service,
+		scheduler,
+		stop: () => scheduler.stop()
+	};
+}
+//#endregion
+//#region src/builder-defaults.mts
+/**
+* Apply switchboard's standard configuration to a reactor + client builder
+* pair. Each piece is opt-out via the options object; defaults mirror what
+* `startSwitchboard` does when building a reactor itself. Mutates both
+* builders in place.
+*
+* Does NOT touch kysely or read models — callers wire those themselves
+* (see `withKysely` / `withReadModelFactory` on the reactor builder).
+*/
+/** The models switchboard always registers alongside package models. */
+function switchboardBaseDocumentModels() {
+	return [
+		documentModelDocumentModelModule,
+		driveDocumentModelModule,
+		reactorDriveDocumentModelModule,
+		ReactorGroupV1
+	];
+}
+function applySwitchboardReactorDefaults(reactorBuilder, clientBuilder, options = {}) {
+	const baseModels = options.includeBaseModels !== false ? switchboardBaseDocumentModels() : [];
+	const extra = options.documentModels ?? [];
+	if (baseModels.length || extra.length) reactorBuilder.withDocumentModelSources(getUniqueDocumentModels(baseModels, extra));
+	if (options.upgradeManifests?.length) reactorBuilder.withUpgradeManifests(options.upgradeManifests);
+	const scheme = options.channelScheme === void 0 ? ChannelScheme.SWITCHBOARD : options.channelScheme;
+	if (scheme !== false) reactorBuilder.withChannelScheme(scheme);
+	if (options.signalHandlers !== false) reactorBuilder.withSignalHandlers();
+	if (options.executorConfig?.maxSkipThreshold !== void 0 || options.executorConfig?.featureFlags !== void 0) reactorBuilder.withExecutorConfig({
+		...options.executorConfig.maxSkipThreshold !== void 0 ? { maxSkipThreshold: options.executorConfig.maxSkipThreshold } : {},
+		...options.executorConfig.featureFlags !== void 0 ? { featureFlags: options.executorConfig.featureFlags } : {}
+	});
+	if (options.documentModelLoader) reactorBuilder.withDocumentModelLoader(options.documentModelLoader);
+	if (options.logger) reactorBuilder.withLogger(options.logger);
+	if (options.signer) {
+		clientBuilder.withSigner(options.signer);
+		reactorBuilder.withSigner(options.signer.signer, options.signer.workerSigner);
+	}
+	if (options.createSignaturePolicy) clientBuilder.withCreateSignaturePolicy(options.createSignaturePolicy);
+	const trust = options.trustPolicy ?? options.signer;
+	if (trust?.trustPolicy) reactorBuilder.withTrustPolicy(trust.trustPolicy, trust.workerTrustPolicy);
+}
+//#endregion
+//#region src/worker-pool.mts
+const DEFAULT_DB_POOL_SIZE_PER_WORKER = 2;
+const DEFAULT_ACQUIRE_TIMEOUT_MS = 5e3;
+const DEFAULT_DB_POOL_SIZE_HOST = 16;
+const AUTO_RESERVED_CORES = 2;
+const AUTO_WORKER_CAP = 8;
+/** Worker count for "auto": always at least 1 — auto sizes the pool, it does not turn worker mode off. */
+function autoWorkerCount(availableCores) {
+	return Math.max(1, Math.min(AUTO_WORKER_CAP, availableCores - AUTO_RESERVED_CORES));
+}
+/**
+* Effective worker-pool config from programmatic options (which win) and the
+* REACTOR_* env vars; null when disabled (numWorkers 0, the default).
+* `"auto"` sizes the pool from the machine's available cores.
+*/
+function resolveWorkerPoolOptions(input, env, availableCores = os.availableParallelism()) {
+	const requested = input?.numWorkers ?? parseWorkerCount(env.REACTOR_WORKERS) ?? 0;
+	const mode = requested === "auto" ? "auto" : "explicit";
+	const numWorkers = requested === "auto" ? autoWorkerCount(availableCores) : requested;
+	if (!Number.isInteger(numWorkers) || numWorkers < 0) throw new Error(`workerPool.numWorkers must be "auto" or a non-negative integer, got ${numWorkers}`);
+	if (numWorkers === 0) return null;
+	return {
+		numWorkers,
+		mode,
+		dbPoolSizePerWorker: input?.dbPoolSizePerWorker ?? parseNonNegativeInt(env.REACTOR_DB_POOL_SIZE_WORKER, "REACTOR_DB_POOL_SIZE_WORKER") ?? DEFAULT_DB_POOL_SIZE_PER_WORKER,
+		acquireTimeoutMs: input?.acquireTimeoutMs ?? parseNonNegativeInt(env.REACTOR_DB_ACQUIRE_TIMEOUT_MS, "REACTOR_DB_ACQUIRE_TIMEOUT_MS") ?? DEFAULT_ACQUIRE_TIMEOUT_MS
+	};
+}
+/**
+* Size of the reactor's own (host) Postgres pool. Unlike the worker pool there
+* is no "disabled" state — the host pool is the only Postgres pool in the
+* server path, backing both reactor storage and the read models that reach it
+* via `withSchema` — so 0 is rejected rather than read as "off".
+*
+* The acquire timeout is deliberately not configurable here: the host pool
+* waits indefinitely today, and making it finite converts saturation from a
+* latency problem into a thrown error on the read-model path. That is a
+* behavior change worth making separately, once the retry semantics of a
+* rejected `pool.connect()` inside the read-model coordinator are settled.
+*/
+function resolveHostPoolSize(env) {
+	const poolSize = parseNonNegativeInt(env.REACTOR_DB_POOL_SIZE_HOST, "REACTOR_DB_POOL_SIZE_HOST") ?? DEFAULT_DB_POOL_SIZE_HOST;
+	if (poolSize < 1) throw new Error("REACTOR_DB_POOL_SIZE_HOST must be at least 1; the host pool cannot be disabled");
+	return poolSize;
+}
+/**
+* DbConfig for each worker's own pool, parsed from a postgres:// URL.
+* Explicit host, database, and user are required — no pg-side defaults.
+*/
+function buildWorkerDbConfig(postgresUrl, options) {
+	let parsed;
+	try {
+		parsed = new URL(postgresUrl);
+	} catch {
+		throw new Error(`Worker pool requires a valid postgres:// URL for the reactor database, got "${postgresUrl}"`);
+	}
+	const database = decodeURIComponent(parsed.pathname.replace(/^\//, ""));
+	if (!parsed.hostname || !database) throw new Error(`Worker pool requires a postgres URL with a host and database name, got "${postgresUrl}"`);
+	if (!parsed.username) throw new Error(`Worker pool requires explicit credentials in the postgres URL (workers open their own connections), got "${postgresUrl}"`);
+	const sslmode = parsed.searchParams.get("sslmode");
+	const ssl = parsed.searchParams.get("ssl") === "true" || sslmode !== null && sslmode !== "disable";
+	return {
+		host: parsed.hostname,
+		port: parsed.port ? Number(parsed.port) : 5432,
+		database,
+		user: decodeURIComponent(parsed.username),
+		password: decodeURIComponent(parsed.password),
+		ssl,
+		applicationName: "switchboard-worker",
+		poolSize: options.dbPoolSizePerWorker,
+		connectionTimeoutMillis: options.acquireTimeoutMs
+	};
+}
+/** Specifiers of the base models switchboard always registers. */
+const BASE_MODEL_SPECIFIERS = [
+	"document-model",
+	"@powerhousedao/shared/document-drive",
+	"@powerhousedao/reactor-drive",
+	"@powerhousedao/reactor-group/document-models"
+];
+function isModelModule(value) {
+	const candidate = value;
+	return typeof candidate?.reducer === "function" && typeof candidate.documentModel?.global?.id === "string";
+}
+async function keepImportableSources(sources, logger) {
+	const kept = [];
+	for (const source of sources) try {
+		const exports = await import(pathToFileURL(source.filePath).href);
+		if (Object.values(exports).some(isModelModule)) kept.push(source);
+	} catch (error) {
+		logger.warn(`Worker model sources: "${source.filePath}" does not import, so workflow pieces will not see its models: ${String(error)}`);
+	}
+	return kept;
+}
+/**
+* Resolves base models and configured package identifiers to `{ filePath }`
+* sources for the reactor builder. Resolution to absolute paths happens here
+* because workers (and the builder) resolve bare specifiers from the reactor
+* package's own dependency context, which cannot see switchboard or project
+* packages. Unresolvable identifiers are skipped with a warning; the builder
+* fails the boot if a registered model ends up without an importable source.
+*/
+async function resolveWorkerModelSources(packages, logger, options = {}) {
+	const sources = [];
+	for (const identifier of [...BASE_MODEL_SPECIFIERS, ...packages]) {
+		const filePath = await resolveModelModuleFile(identifier) ?? await resolveRemoteSafely(identifier, options.resolveRemote, logger);
+		if (!filePath) {
+			logger.warn(`Worker model sources: no importable document-models entry for "${identifier}", skipping`);
+			continue;
+		}
+		sources.push({ filePath });
+	}
+	return sources;
+}
+async function resolveRemoteSafely(identifier, resolveRemote, logger) {
+	if (!resolveRemote) return null;
+	try {
+		return await resolveRemote(identifier);
+	} catch (error) {
+		logger.warn(`Worker model sources: could not cache "${identifier}" from the registry: ${String(error)}`);
+		return null;
+	}
+}
+/**
+* Absolute file path of a source's models barrel. Mirrors reactor-api's
+* import-resolver: import.meta.resolve, then the project's node_modules via
+* the package.json exports map / dist layout.
+*/
+async function resolveModelModuleFile(source) {
+	if (isFsPath(source)) return resolveFromPackageDir(source, "./document-models");
+	const specifier = BASE_MODEL_SPECIFIERS.includes(source) ? source : `${source}/document-models`;
+	try {
+		const resolved = import.meta.resolve(specifier);
+		if (resolved.startsWith("file:")) return fileURLToPath(resolved);
+	} catch {}
+	const { packageName, subpath } = splitSpecifier(specifier);
+	const packageDir = path.join(process.cwd(), "node_modules", packageName);
+	if (!existsSync(packageDir)) return null;
+	let realDir;
+	try {
+		realDir = realpathSync(packageDir);
+	} catch {
+		return null;
+	}
+	return resolveFromPackageDir(realDir, subpath);
+}
+function splitSpecifier(specifier) {
+	const parts = specifier.split("/");
+	const packageSegments = specifier.startsWith("@") ? 2 : 1;
+	const packageName = parts.slice(0, packageSegments).join("/");
+	const rest = parts.slice(packageSegments).join("/");
+	return {
+		packageName,
+		subpath: rest ? `./${rest}` : "."
+	};
+}
+/** Exports-map lookup (import condition), then conventional dist paths. */
+async function resolveFromPackageDir(packageDir, subpath) {
+	const fromManifest = await resolveViaManifest(packageDir, subpath);
+	if (fromManifest) return fromManifest;
+	const candidates = subpath === "." ? [path.join(packageDir, "dist", "index.js")] : [
+		path.join(packageDir, "dist", subpath.slice(2), "index.js"),
+		path.join(packageDir, "dist", `${subpath.slice(2)}.js`),
+		path.join(packageDir, subpath.slice(2), "index.js")
+	];
+	for (const candidate of candidates) if (existsSync(candidate)) return candidate;
+	return null;
+}
+async function resolveViaManifest(packageDir, subpath) {
+	let raw;
+	try {
+		raw = await readFile(path.join(packageDir, "package.json"), "utf8");
+	} catch {
+		return null;
+	}
+	let manifest;
+	try {
+		manifest = JSON.parse(raw);
+	} catch {
+		return null;
+	}
+	let entry;
+	const exportsField = manifest.exports;
+	if (exportsField !== null && typeof exportsField === "object" && !Array.isArray(exportsField)) {
+		const map = exportsField;
+		entry = Object.keys(map).some((key) => key.startsWith(".")) ? map[subpath] : subpath === "." ? map : void 0;
+	} else if (typeof exportsField === "string" && subpath === ".") entry = exportsField;
+	let target = pickImportTarget(entry);
+	if (!target && subpath === "." && typeof manifest.main === "string") target = manifest.main;
+	if (!target) return null;
+	const resolved = path.join(packageDir, target);
+	return existsSync(resolved) ? resolved : null;
+}
+function pickImportTarget(entry) {
+	if (typeof entry === "string") return entry;
+	if (typeof entry !== "object" || entry === null) return null;
+	const conditions = entry;
+	for (const condition of [
+		"import",
+		"node",
+		"default"
+	]) {
+		const value = conditions[condition];
+		if (typeof value === "string") return value;
+	}
+	return null;
+}
+function isFsPath(identifier) {
+	return path.isAbsolute(identifier) || identifier.startsWith("./") || identifier.startsWith("../");
+}
+function parseWorkerCount(raw) {
+	if (raw === void 0 || raw.trim() === "") return;
+	if (raw.trim().toLowerCase() === "auto") return "auto";
+	const value = Number.parseInt(raw, 10);
+	if (!Number.isInteger(value) || value < 0 || String(value) !== raw.trim()) throw new Error(`REACTOR_WORKERS must be "auto" or a non-negative integer, got "${raw}"`);
+	return value;
+}
+function parseNonNegativeInt(raw, name) {
+	if (raw === void 0 || raw.trim() === "") return;
+	const value = Number.parseInt(raw, 10);
+	if (!Number.isInteger(value) || value < 0 || String(value) !== raw.trim()) throw new Error(`${name} must be a non-negative integer, got "${raw}"`);
+	return value;
+}
+//#endregion
+//#region src/projection-worker.mts
+const DEFAULT_DB_POOL_SIZE_PROJECTION = 8;
+const ON_TOKENS = [
+	"1",
+	"true",
+	"on",
+	"yes"
+];
+const OFF_TOKENS = [
+	"0",
+	"false",
+	"off",
+	"no"
+];
+/**
+* Enabled by REACTOR_PROJECTION_WORKER (1/true/on/yes, case-insensitive) or
+* `input.enabled`, which wins when defined; null when off (the default).
+*/
+function resolveProjectionWorkerOptions(input, env) {
+	if (!(input?.enabled ?? parseOnOff(env.REACTOR_PROJECTION_WORKER) ?? false)) return null;
+	const dbPoolSize = input?.dbPoolSize ?? parseNonNegativeInt(env.REACTOR_DB_POOL_SIZE_PROJECTION, "REACTOR_DB_POOL_SIZE_PROJECTION") ?? DEFAULT_DB_POOL_SIZE_PROJECTION;
+	if (dbPoolSize < 1) throw new Error("REACTOR_DB_POOL_SIZE_PROJECTION must be at least 1; the projection worker cannot run without a pool");
+	return { dbPoolSize };
+}
+/** Same preconditions as the executor worker pool; message shape mirrors server.mts. */
+function assertProjectionWorkerSupported(args) {
+	if (args.dev) throw new Error("The projection worker (REACTOR_PROJECTION_WORKER) is not supported in dev mode: Vite-loaded document models cannot cross a worker-thread boundary");
+	if (!args.reactorDbUrl || !isPostgresUrl(args.reactorDbUrl)) throw new Error("The projection worker (REACTOR_PROJECTION_WORKER) requires a Postgres reactor database — set PH_REACTOR_DATABASE_URL or PH_SWITCHBOARD_DATABASE_URL. PGlite cannot be shared across worker threads.");
+}
+function parseOnOff(raw) {
+	if (raw === void 0 || raw.trim() === "") return;
+	const token = raw.trim().toLowerCase();
+	if (ON_TOKENS.includes(token)) return true;
+	if (OFF_TOKENS.includes(token)) return false;
+	throw new Error(`REACTOR_PROJECTION_WORKER must be one of 1, true, on, yes, 0, false, off, no, got "${raw}"`);
+}
+//#endregion
+//#region src/feature-flags.ts
+async function initFeatureFlags() {
+	const provider = new EnvVarProvider();
+	await OpenFeature.setProviderAndWait(provider);
+	return OpenFeature.getClient();
+}
+//#endregion
+//#region src/mcp-flag.mts
+/** The env var and OpenFeature flag key that can keep the MCP server unmounted. */
+const MCP_ENABLED = "MCP_ENABLED";
+/** Whether to mount the MCP server at `/mcp`. On unless the host passes
+* `mcp: false` or MCP_ENABLED is "false": the env var can turn a host's MCP
+* off, never on, so a deployment that serves no MCP client can close the
+* endpoint without the bin growing a flag of its own. */
+async function resolveMcpEnabled({ featureFlags, option }) {
+	if (option === false) return false;
+	return featureFlags.getBooleanValue(MCP_ENABLED, true);
+}
+//#endregion
+//#region src/workflow/oauth-callback.ts
+const OAUTH_CALLBACK_PATH = "oauth/callback";
+function escapeHtml(text) {
+	return text.replace(/[&<>"']/g, (char) => ({
+		"&": "&amp;",
+		"<": "&lt;",
+		">": "&gt;",
+		"\"": "&quot;",
+		"'": "&#39;"
+	})[char]);
+}
+function resultPage(ok, detail) {
+	const title = ok ? "Connected" : "Sign-in failed";
+	return `<!doctype html>
+<html><head><meta charset="utf-8"><title>${title}</title>
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<style>body{font:15px system-ui,sans-serif;margin:0;display:grid;place-items:center;min-height:100vh;background:#fafafa;color:#222}main{max-width:28rem;padding:1.5rem;text-align:center}h1{font-size:1.1rem}</style>
+</head><body><main><h1>${title}</h1><p>${ok ? "You can close this window." : escapeHtml(detail ?? "The sign-in did not finish.")}</p></main>
+${ok ? "<script>setTimeout(function(){window.close()},600)<\/script>" : ""}
+</body></html>`;
+}
+function registerOAuthCallback(http, runtime) {
+	return http.get(OAUTH_CALLBACK_PATH, { auth: "public" }, async (request) => {
+		const params = new URL(request.url).searchParams;
+		const state = params.get("state");
+		const result = state ? await runtime.completeOAuth({
+			state,
+			code: params.get("code") ?? void 0,
+			error: params.get("error") ?? void 0,
+			errorDescription: params.get("error_description") ?? void 0
+		}) : {
+			ok: false,
+			detail: "The provider sent no state",
+			returnUrl: null
+		};
+		if (result.returnUrl && state) {
+			const back = new URL(result.returnUrl);
+			back.searchParams.set("ph_oauth", state);
+			return new Response(null, {
+				status: 303,
+				headers: {
+					location: back.href,
+					"cache-control": "no-store"
+				}
+			});
+		}
+		return new Response(resultPage(result.ok, result.detail), {
+			status: result.ok ? 200 : 400,
+			headers: {
+				"content-type": "text/html; charset=utf-8",
+				"cache-control": "no-store",
+				"referrer-policy": "no-referrer"
+			}
+		});
+	});
+}
+function callbackUrlOf(http) {
+	return `${http.baseUrl.replace(/\/+$/, "")}/${OAUTH_CALLBACK_PATH}`;
+}
+//#endregion
+//#region src/workflow/resolvers.ts
+const PIECE_SOURCES = [
+	"local",
+	"registry",
+	"activepieces"
+];
+function isPieceSource(value) {
+	return PIECE_SOURCES.includes(value);
+}
+function blockRef(input) {
+	if (input.kind !== "action" && input.kind !== "trigger") throw new GraphQLError(`A block's kind is "action" or "trigger", got "${input.kind}"`);
+	return {
+		pieceName: input.pieceName,
+		pieceVersion: input.pieceVersion,
+		name: input.name,
+		kind: input.kind
+	};
+}
+async function cursorAware(call) {
+	try {
+		return await call();
+	} catch (error) {
+		if (error instanceof Error && error.name === "InvalidRunCursorError") throw new GraphQLError(error.message, { extensions: { code: "BAD_USER_INPUT" } });
+		throw error;
+	}
+}
+function selectsStepData(selections, path) {
+	let level = selections;
+	for (const name of [...path, "steps"]) {
+		const next = [];
+		for (const set of level) for (const selection of set.selections) {
+			if (selection.kind !== Kind.FIELD) return true;
+			if (selection.name.value === name && selection.selectionSet) next.push(selection.selectionSet);
+		}
+		if (next.length === 0) return false;
+		level = next;
+	}
+	return level.some((set) => set.selections.some((selection) => selection.kind !== Kind.FIELD || selection.name.value === "input" || selection.name.value === "output"));
+}
+function readsStepData(info, path) {
+	if (!info) return true;
+	return selectsStepData(info.fieldNodes.flatMap((node) => node.selectionSet ? [node.selectionSet] : []), path);
+}
+function requireAdmin(authorizationService, ctx) {
+	if (!authorizationService.isSupremeAdmin(ctx.user?.address)) throw new GraphQLError("Admin access required");
+}
+async function syncAware(call) {
+	try {
+		return await call();
+	} catch (error) {
+		if (error instanceof Error && error.name === "WorkflowSyncingError") throw new GraphQLError(error.message, { extensions: {
+			code: "WORKFLOW_SYNCING",
+			retryable: true
+		} });
+		throw error;
+	}
+}
+function parseJson(value) {
+	if (value === null) return null;
+	try {
+		return JSON.parse(value);
+	} catch {
+		return value;
+	}
+}
+function toStepRecord(row) {
+	return {
+		stepId: row.step_id,
+		stepKey: row.step_key,
+		pieceName: row.piece_name,
+		blockName: row.block_name,
+		status: row.status,
+		input: parseJson(row.input),
+		output: parseJson(row.output),
+		port: row.port,
+		error: row.error,
+		errorName: row.error_name,
+		startedAt: row.started_at,
+		endedAt: row.ended_at,
+		pieceVersion: row.piece_version,
+		pieceSource: row.piece_source,
+		versionMatch: row.version_match,
+		versionNote: row.version_note
+	};
+}
+function toRunRecord(row, steps) {
+	return {
+		id: row.id,
+		workflowId: row.workflow_id,
+		workflowName: row.workflow_name,
+		workflowVersion: row.workflow_version,
+		triggerKind: row.trigger_kind,
+		triggerPayload: parseJson(row.trigger_payload),
+		status: row.status,
+		error: row.error,
+		errorName: row.error_name,
+		startedAt: row.started_at,
+		endedAt: row.ended_at,
+		rerunOf: row.rerun_of,
+		warnings: row.warnings,
+		warningNotes: parseJson(row.warning_notes) ?? [],
+		steps: steps.map(toStepRecord)
+	};
+}
+const UNKNOWN_ACCESS = {
+	authEnforcement: true,
+	authConditions: false,
+	identity: null
+};
+function signedIn(ctx) {
+	return Boolean(ctx.user?.address);
+}
+function isAbsolute(url) {
+	return /^https?:\/\//i.test(url);
+}
+function redirectUriFor(routing, requested) {
+	if (!routing) throw new GraphQLError("This host serves no OAuth2 callback");
+	if (isAbsolute(routing.callbackUrl)) return routing.callbackUrl;
+	if (!requested) throw new GraphQLError("This host does not know its public URL; pass redirectUri");
+	let url;
+	try {
+		url = new URL(requested);
+	} catch {
+		throw new GraphQLError(`"${requested}" is not a URL`);
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:" || url.pathname !== routing.callbackUrl || url.search !== "" || url.hash !== "") throw new GraphQLError(`redirectUri must be this host's ${routing.callbackUrl}`);
+	return url.href;
+}
+function returnUrlFor(requested, ctx) {
+	if (!requested) return void 0;
+	const origin = ctx.headers.origin;
+	let url;
+	try {
+		url = new URL(requested);
+	} catch {
+		url = void 0;
+	}
+	if (!url || !origin || url.origin !== origin) throw new GraphQLError("returnUrl must be on the requesting page's origin");
+	return url.href;
+}
+const getResolvers = (runtime, authorizationService, oauth, access = UNKNOWN_ACCESS, assertCanRead) => {
+	return {
+		Query: { workflowRuntime: () => ({}) },
+		WorkflowRuntimeQueries: {
+			health: () => "ok",
+			authEnforcement: () => access.authEnforcement,
+			reactorIdentity: (_parent, _args, ctx) => signedIn(ctx) ? access.identity : null,
+			authConditions: (_parent, _args, ctx) => signedIn(ctx) ? access.authConditions : null,
+			reactorAccessDenial: async (_parent, args, ctx) => {
+				if (!assertCanRead) throw new GraphQLError("No read check configured");
+				await assertCanRead(args.workflowId, ctx);
+				return runtime.reactorAccessDenial(args.workflowId) ?? null;
+			},
+			blockDescriptor: (_parent, args) => runtime.blockDescriptor(blockRef(args.block)),
+			blockOptions: (_parent, args, ctx) => runtime.blockOptions(blockRef(args.block), args.propName, args.input, args.connectionId ?? void 0, ctx, args.searchValue ?? void 0, args.reactorConnectionId ?? void 0),
+			pieceCatalog: () => runtime.pieceCatalog(),
+			pieceActions: (_parent, args) => runtime.pieceActions(args.packageName, args.version ?? void 0),
+			pieceTriggers: (_parent, args) => runtime.pieceTriggers(args.packageName, args.version ?? void 0),
+			blockOutputTree: (_parent, args) => runtime.blockOutputTree(blockRef(args.block), args.config),
+			stepOutputTree: (_parent, args, ctx) => runtime.stepOutputTree(args.workflowId, args.stepId, ctx),
+			blockResolutions: (_parent, args, ctx) => runtime.blockResolutions(args.workflowId, ctx),
+			pieceDetail: (_parent, args) => runtime.pieceDetail(args.packageName, args.version ?? void 0),
+			searchPieces: (_parent, args) => {
+				if (args.kind !== "action" && args.kind !== "trigger") throw new GraphQLError(`A search's kind is "action" or "trigger", got "${args.kind}"`);
+				const unknown = (args.sources ?? []).filter((source) => !isPieceSource(source));
+				if (unknown.length > 0) throw new GraphQLError(`A search's sources are ${PIECE_SOURCES.join(", ")}, got ${unknown.join(", ")}`);
+				return runtime.searchPieces(args.query, {
+					kind: args.kind,
+					sources: (args.sources ?? []).filter(isPieceSource),
+					categories: args.categories ?? void 0,
+					limit: args.limit ?? void 0
+				});
+			},
+			connections: (_parent, _args, ctx) => runtime.connections(ctx),
+			webhookEndpoint: (_parent, args, ctx) => syncAware(() => runtime.webhookEndpoint(args.workflowId, ctx, { driveId: args.driveId ?? void 0 })),
+			secret: async (_parent, args) => {
+				try {
+					return await (await runtime.secrets()).stat(args.ref);
+				} catch {
+					return null;
+				}
+			},
+			secrets: async () => (await runtime.secrets()).list(),
+			oauthRedirectUri: () => oauth?.callbackUrl ?? null,
+			oauthAttempt: (_parent, args, ctx) => runtime.oauthAttempt(args.state, ctx),
+			triggerStates: async (_parent, _args, ctx) => (await runtime.triggerStates(ctx)).map((row) => ({
+				workflowId: row.workflow_id,
+				pieceName: row.piece_name,
+				triggerName: row.trigger_name,
+				status: row.status,
+				intervalMs: row.interval_ms,
+				nextPollAt: row.next_poll_at,
+				lastPollAt: row.last_poll_at,
+				lastError: row.last_error,
+				consecutiveFailures: row.consecutive_failures,
+				nextRenewAt: row.next_renew_at,
+				renewError: row.renew_error,
+				renewFailures: row.renew_failures,
+				pieceVersion: row.piece_version,
+				pieceSource: row.piece_source,
+				versionMatch: row.version_match,
+				versionNote: row.version_note
+			})),
+			runs: async (_parent, args, ctx, info) => (await runtime.runs({
+				...args,
+				withStepData: readsStepData(info, [])
+			}, ctx)).map((record) => toRunRecord(record.row, record.steps)),
+			runsPage: async (_parent, args, ctx, info) => {
+				const { paging, ...scope } = args;
+				const page = await cursorAware(() => runtime.runsPage({
+					...scope,
+					limit: paging?.limit ?? void 0,
+					cursor: paging?.cursor ?? null,
+					withStepData: readsStepData(info, ["items"])
+				}, ctx));
+				return {
+					items: page.records.map((record) => toRunRecord(record.row, record.steps)),
+					hasNextPage: page.hasNextPage,
+					hasPreviousPage: Boolean(paging?.cursor),
+					cursor: page.cursor
+				};
+			},
+			run: async (_parent, args, ctx) => {
+				const record = await runtime.run(args.id, ctx);
+				return record ? toRunRecord(record.row, record.steps) : null;
+			}
+		},
+		Mutation: { workflowRuntime: () => ({}) },
+		WorkflowRuntimeMutations: {
+			fire: (_parent, args, ctx) => runtime.fire(args.workflowId, args.payload, "manual", void 0, ctx),
+			testTrigger: (_parent, args, ctx) => syncAware(() => runtime.testTrigger(args.workflowId, ctx, {
+				...args.payload !== void 0 ? { payload: args.payload } : {},
+				...typeof args.timeoutSeconds === "number" ? { timeoutMs: args.timeoutSeconds * 1e3 } : {},
+				driveId: args.driveId ?? void 0
+			})),
+			cancelTriggerTest: (_parent, args, ctx) => runtime.cancelTriggerTestFor(args.workflowId, ctx),
+			testStep: (_parent, args, ctx) => syncAware(() => runtime.testStep(args.workflowId, args.stepId, ctx, { driveId: args.driveId ?? void 0 })),
+			rerun: (_parent, args, ctx) => runtime.rerun(args.runId, ctx),
+			createSecret: async (_parent, args, ctx) => {
+				requireAdmin(authorizationService, ctx);
+				return (await runtime.secrets()).create({
+					value: args.value,
+					label: args.label ?? void 0
+				});
+			},
+			rotateSecret: async (_parent, args, ctx) => {
+				requireAdmin(authorizationService, ctx);
+				return (await runtime.secrets()).rotate(args.ref, args.value);
+			},
+			deleteSecret: async (_parent, args, ctx) => {
+				requireAdmin(authorizationService, ctx);
+				await (await runtime.secrets()).delete(args.ref);
+				return true;
+			},
+			checkConnection: (_parent, args, ctx) => runtime.checkConnection(args.connectionId, ctx),
+			startOAuth: (_parent, args, ctx) => {
+				requireAdmin(authorizationService, ctx);
+				const returnUrl = returnUrlFor(args.returnUrl, ctx);
+				return runtime.startOAuth(args.connectionId, ctx, {
+					redirectUri: redirectUriFor(oauth, args.redirectUri),
+					...returnUrl ? { returnUrl } : {}
+				});
+			}
+		}
+	};
+};
+//#endregion
+//#region src/workflow/schema.ts
+const schema = gql`
+  """
+  WorkflowRuntime Queries
+  """
+  type WorkflowRuntimeQueries {
+    health: String!
+    """
+    Whether this reactor enforces document auth (REACTOR_AUTH_ENFORCEMENT).
+    On, a workflow needs a signed publish, and the host grants, to reach
+    documents. Answered to any caller.
+    """
+    authEnforcement: Boolean!
+    """
+    Who this host signs as: grant it on each document a step writes. Null for
+    a caller who is not signed in, or a host with no signer.
+    """
+    reactorIdentity: ReactorIdentity
+    """
+    REACTOR_AUTH_CONDITIONS. True: grant the host by key, with
+    { match: subject.key == key }; false: by address. Null for a caller who
+    is not signed in.
+    """
+    authConditions: Boolean
+    """
+    Why the workflow's last publish or enable got no reactor access, naming
+    the publisher and the connection; null when the check passed.
+    """
+    reactorAccessDenial(workflowId: String!): String
+    """
+    Persisted runs, newest first. Scope them to one workflow, or to every
+    workflow a drive holds; workflowId wins when both are given.
+    """
+    runs(
+      workflowId: String
+      driveId: String
+      limit: Int
+      "Trigger kinds to leave out, e.g. test."
+      excludeTriggerKinds: [String!]
+    ): [WorkflowRunRecord!]!
+    """
+    The same listing a page at a time, newest journaled first. Pass a page's
+    cursor back in paging to read the next; a page is short only when
+    hasNextPage is false, or when the caller could read none of a long
+    stretch of runs. A run that starts between pages keeps its place.
+    """
+    runsPage(
+      workflowId: String
+      driveId: String
+      excludeTriggerKinds: [String!]
+      paging: WorkflowRunsPagingInput
+    ): WorkflowRunResultPage!
+    run(id: String!): WorkflowRunRecord
+    """
+    The descriptor (props, auth, ports) of one action or trigger, as the
+    version that runs it describes it; triggers come back under "trigger".
+    """
+    blockDescriptor(block: BlockInput!): Unknown
+    """
+    Resolves a dynamic prop against the current config values: a DROPDOWN
+    yields { options, placeholder, disabled }, a DYNAMIC prop yields the
+    resolved sub-property descriptor list.
+    """
+    blockOptions(
+      block: BlockInput!
+      propName: String!
+      input: Unknown
+      connectionId: String
+      "What the author typed, for a DROPDOWN declared with refreshOnSearch."
+      searchValue: String
+      "The step's reactor connection; its filter narrows what the resolver reads."
+      reactorConnectionId: String
+    ): Unknown
+    """
+    Every piece this reactor offers: the core piece, its package pieces, and
+    the pieces the registry and Activepieces publish.
+    """
+    pieceCatalog: Unknown
+    """
+    A piece's actions at one version; pin a step to that version.
+    """
+    pieceActions(
+      packageName: String!
+      "That version; the installed or latest one when omitted."
+      version: String
+    ): Unknown
+    """
+    A piece's triggers at one version; pin a trigger to that version.
+    """
+    pieceTriggers(
+      packageName: String!
+      "That version; the installed or latest one when omitted."
+      version: String
+    ): Unknown
+    """
+    Full piece detail (PieceMetadataModel-shaped), verbatim from the cloud API.
+    """
+    pieceDetail(
+      packageName: String!
+      "That version; the installed or latest one when omitted."
+      version: String
+    ): Unknown
+    """
+    Piece and block search across the catalog, grouped by piece. The index
+    builds lazily on first use; poll while status is "indexing".
+    """
+    searchPieces(
+      query: String!
+      "action | trigger"
+      kind: String!
+      "local | registry | activepieces; all when omitted."
+      sources: [String!]
+      "Category ids, any of; all when omitted."
+      categories: [String!]
+      "Pieces returned."
+      limit: Int
+    ): PieceSearchResult!
+    """
+    Health of every registered piece trigger (poll schedule, errors).
+    """
+    triggerStates: [TriggerStateRecord!]!
+    """
+    Authored output shape of a block (SDL / outputSchema / sampleData).
+    """
+    blockOutputTree(block: BlockInput!, config: Unknown): Unknown
+    """
+    Output shape of a draft step or trigger: its latest test output
+    (source "test", with sample and testedAt) when tested, else as blockOutputTree.
+    """
+    stepOutputTree(workflowId: String!, stepId: String!): Unknown
+    """
+    Every block of the draft (trigger first) as this reactor resolves it:
+    which piece version runs, from where, and how it matches the pin.
+    """
+    blockResolutions(workflowId: String!): [BlockResolutionRecord!]!
+    """
+    Every powerhouse/connection document, for connection pickers.
+    """
+    connections: [ConnectionRecord!]!
+    """
+    The webhook endpoint for a workflow: the URL to hand the provider. Minted
+    on first ask, whether or not the workflow is armed — an author needs the
+    URL before enabling, and the armed field carries that difference. Null
+    only when the host has no webhook service. With driveId, a workflow not
+    synced here yet is waited for briefly, then fails as WORKFLOW_SYNCING.
+    """
+    webhookEndpoint(workflowId: String!, driveId: String): WebhookEndpointRecord
+    """
+    Secret metadata (label, version, status). Never the value.
+    """
+    secret(ref: String!): SecretRecord
+    secrets: [SecretRecord!]!
+    """
+    The URL an OAuth2 app must register as its redirect. A bare path when
+    this host does not know its public origin; resolve it against the URL
+    this API is reached at. Null when the host serves no HTTP routes.
+    """
+    oauthRedirectUri: String
+    """
+    How an OAuth2 sign-in opened by startOAuth stands; null when unknown.
+    """
+    oauthAttempt(state: String!): OAuthAttempt
+  }
+
+  type OAuthAttempt {
+    connectionId: String!
+    "PENDING | EXCHANGING | OK | ERROR"
+    status: String!
+    error: String
+  }
+
+  type OAuthStart {
+    state: String!
+    "Where to send the user to sign in."
+    authorizationUrl: String!
+    redirectUri: String!
+    expiresAt: String!
+  }
+
+  """
+  One action or trigger of a piece, as a workflow pins it. The engine's own
+  blocks are the piece @powerhousedao/piece-core.
+  """
+  input BlockInput {
+    pieceName: String!
+    "Exact semver."
+    pieceVersion: String!
+    "The action or trigger name."
+    name: String!
+    "action | trigger"
+    kind: String!
+  }
+
+  type BlockSearchHit {
+    pieceName: String!
+    "The version the hit is listed at; pin to it when picking the block."
+    pieceVersion: String!
+    "The action or trigger name."
+    name: String!
+    pieceDisplayName: String!
+    logoUrl: String!
+    displayName: String!
+    description: String!
+    "action | trigger"
+    kind: String!
+    "Triggers only: POLLING | WEBHOOK | APP_WEBHOOK | MANUAL"
+    strategy: String
+    "Why this block cannot run on this reactor; null when it can."
+    unsupported: String
+  }
+
+  type BlockResolutionRecord {
+    "The trigger's or step's id."
+    stepId: String!
+    pieceName: String!
+    "The version the block pins."
+    pieceVersion: String!
+    "The action or trigger name."
+    name: String!
+    "action | trigger"
+    kind: String!
+    "The version that runs; null when nothing resolves."
+    resolvedVersion: String
+    "local | registry | activepieces | npm; null when nothing resolves."
+    source: String
+    "exact | compatible | fallback | installed | missing"
+    match: String!
+    "Why the version that runs differs from the pin, or why nothing resolves."
+    note: String
+    "The newest version any source offers."
+    latestVersion: String
+  }
+
+  type PieceSearchMatch {
+    pieceName: String!
+    pieceVersion: String!
+    displayName: String!
+    description: String!
+    logoUrl: String!
+    categories: [String!]!
+    "local | registry | activepieces"
+    source: String!
+    deprecated: Boolean
+    "Why no block of the piece can run on this reactor."
+    unsupported: String
+    "Every query token matched the piece's own name."
+    namedPiece: Boolean!
+    "Matching blocks of the kind asked for, best first."
+    blocks: [BlockSearchHit!]!
+  }
+
+  type PieceSearchResult {
+    "ready | indexing | error"
+    status: String!
+    pieces: [PieceSearchMatch!]!
+    indexedPieces: Int!
+    error: String
+  }
+
+  type SecretRecord {
+    ref: String!
+    label: String
+    version: Int!
+    status: String!
+    createdAt: String!
+    updatedAt: String!
+  }
+
+  type ConnectionRecord {
+    id: String!
+    name: String!
+    connectorId: String!
+    authType: String!
+    status: String!
+    accountLabel: String
+  }
+
+  type ReactorIdentity {
+    "The address the host signs as; null without a signed-in identity."
+    address: String
+    "The did:key that signs the host's operations."
+    key: String!
+  }
+
+  type ConnectionCheckResult {
+    ok: Boolean!
+    detail: String
+    """
+    From auth.getConnectionIdentifier when the check passes; otherwise the
+    label the connection already holds.
+    """
+    accountLabel: String
+  }
+
+  type WebhookEndpointRecord {
+    workflowId: String!
+    url: String!
+    """
+    False when the host gave the webhook service no public origin, so the url
+    above is a bare path. Switchboard always gives one, falling back to
+    http://localhost:<port> when PUBLIC_URL is unset.
+    """
+    absoluteUrl: Boolean!
+    "True while the workflow is ENABLED with a valid webhook trigger"
+    armed: Boolean!
+    createdAt: String!
+  }
+
+  type TriggerStateRecord {
+    workflowId: String!
+    pieceName: String!
+    triggerName: String!
+    status: String!
+    intervalMs: Int!
+    nextPollAt: String
+    lastPollAt: String
+    lastError: String
+    consecutiveFailures: Int!
+    "When a webhook trigger next renews its subscription; null if it never does."
+    nextRenewAt: String
+    "The last failed renewal, kept apart from lastError, the poll's."
+    renewError: String
+    renewFailures: Int!
+    "The piece version the trigger armed with; null for a host-fed trigger."
+    pieceVersion: String
+    pieceSource: String
+    versionMatch: String
+    versionNote: String
+  }
+
+  type Query {
+    workflowRuntime: WorkflowRuntimeQueries!
+  }
+
+  type WorkflowStepRunRecord {
+    stepId: String!
+    stepKey: String!
+    pieceName: String!
+    "The action the step ran, or the trigger a trigger test sampled."
+    blockName: String!
+    status: String!
+    input: Unknown
+    output: Unknown
+    port: String
+    error: String
+    "The thrown error's name, e.g. ReactorAccessDeniedError."
+    errorName: String
+    startedAt: String
+    endedAt: String
+    "The piece version that ran; null for an unresolved block."
+    pieceVersion: String
+    "local | registry | activepieces | npm"
+    pieceSource: String
+    "exact | compatible | fallback | installed | missing"
+    versionMatch: String
+    "Why the version that ran differs from the pin."
+    versionNote: String
+  }
+
+  type WorkflowRunRecord {
+    id: String!
+    workflowId: String!
+    workflowName: String!
+    workflowVersion: Int!
+    triggerKind: String!
+    triggerPayload: Unknown
+    status: String!
+    error: String
+    errorName: String
+    "When the run began executing; a PENDING run's is when it was journaled."
+    startedAt: String!
+    endedAt: String
+    rerunOf: String
+    "How many warningNotes the run has; a run with any is not a plain success."
+    warnings: Int!
+    "Steps that ran a fallback piece version, edges on ports nothing emits."
+    warningNotes: [String!]!
+    steps: [WorkflowStepRunRecord!]!
+  }
+
+  input WorkflowRunsPagingInput {
+    "Page size; default 25, at most 100."
+    limit: Int
+    "The cursor of the previous page."
+    cursor: String
+  }
+
+  type WorkflowRunResultPage {
+    items: [WorkflowRunRecord!]!
+    hasNextPage: Boolean!
+    "True when the page was read after a cursor."
+    hasPreviousPage: Boolean!
+    "Resumes after this page's last run; null for an empty page."
+    cursor: String
+  }
+
+  type WorkflowStepRun {
+    stepId: String!
+    key: String!
+    pieceName: String!
+    blockName: String!
+    status: String!
+    input: Unknown
+    output: Unknown
+    port: String
+    error: String
+    errorName: String
+  }
+
+  type WorkflowRunPayload {
+    runId: String
+    status: String!
+    error: String
+    errorName: String
+    steps: [WorkflowStepRun!]!
+  }
+
+  type WorkflowStepTestResult {
+    "Null when the test never started, e.g. an upstream block is untested."
+    runId: String
+    """
+    SUCCEEDED | FAILED | INDETERMINATE. INDETERMINATE is neither: a host call
+    the block made timed out, so a write it asked for may well have landed.
+    Show it distinctly - it is not a confirmed pass.
+    """
+    status: String!
+    output: Unknown
+    error: String
+    errorName: String
+    durationMs: Int!
+  }
+
+  """
+  WorkflowRuntime Mutations
+  """
+  type WorkflowRuntimeMutations {
+    """
+    Fires a workflow's manual trigger (the core piece's) and runs it to completion.
+    """
+    fire(workflowId: String!, payload: Unknown): WorkflowRunPayload!
+    """
+    Samples the draft trigger and saves it as the trigger's last test. A piece
+    trigger runs its test hook (no cursor changes). Of the core piece's
+    triggers, manual takes payload, schedule samples a fire now, and webhook
+    waits for the next delivery to the workflow's endpoint, up to
+    timeoutSeconds (default and cap 300), and that delivery runs nothing.
+    """
+    testTrigger(
+      workflowId: String!
+      payload: Unknown
+      timeoutSeconds: Int
+      driveId: String
+    ): Unknown
+    """
+    Stops a webhook trigger test that is waiting; false when none was.
+    """
+    cancelTriggerTest(workflowId: String!): Boolean!
+    """
+    Runs one draft step against the latest test outputs of the blocks it
+    reads, journaled as a "test" run and noted as the step's lastTest.
+    driveId waits for an unsynced workflow, as for webhookEndpoint.
+    """
+    testStep(
+      workflowId: String!
+      stepId: String!
+      driveId: String
+    ): WorkflowStepTestResult!
+    """
+    Resumes a FAILED run: succeeded steps replay from the journal,
+    execution restarts at the failure. Produces a new run.
+    """
+    rerun(runId: String!): WorkflowRunPayload!
+    """
+    Mints a managed secret and returns its ref; the value is stored
+    encrypted and is never readable back over any API.
+    """
+    createSecret(value: String!, label: String): SecretRecord!
+    """
+    Replaces the value behind an existing ref; documents stay untouched.
+    """
+    rotateSecret(ref: String!, value: String!): SecretRecord!
+    """
+    Tombstones a secret; its value becomes unrecoverable.
+    """
+    deleteSecret(ref: String!): Boolean!
+    """
+    Runs the piece's auth.validate against the connection's credentials,
+    then auth.getConnectionIdentifier for the account label, and records the
+    outcome on the connection document.
+    """
+    checkConnection(connectionId: String!): ConnectionCheckResult!
+    """
+    Opens an OAuth2 sign-in with the connection's own app (client_id in its
+    config, client_secret in its secretRefs). redirectUri is needed only when
+    oauthRedirectUri is a bare path. With returnUrl, which must be on the
+    caller's origin, the callback sends the browser back there with
+    ?ph_oauth=<state> instead of closing the window.
+    """
+    startOAuth(
+      connectionId: String!
+      redirectUri: String
+      returnUrl: String
+    ): OAuthStart!
+  }
+
+  type Mutation {
+    workflowRuntime: WorkflowRuntimeMutations!
+  }
+`;
+//#endregion
+//#region src/workflow/subgraph.ts
+/** The runtime's read/write surface. The runtime itself is composed by the
+* host, so the subgraph only serves what it is handed. */
+function createWorkflowRuntimeSubgraph(runtime, oauth, access) {
+	return class WorkflowRuntimeSubgraph extends BaseSubgraph {
+		name = "workflow-runtime";
+		typeDefs = schema;
+		resolvers = getResolvers(runtime, this.authorizationService, oauth, access, (documentId, ctx) => this.assertCanRead(documentId, ctx));
+		additionalContextFields = {};
+	};
+}
+//#endregion
+//#region src/workflow-runtime.mts
+/** The npm name the workflow package owns: its HTTP namespace and its models. */
+const WORKFLOW_PACKAGE_NAME = "@powerhousedao/workflow";
+const WORKFLOW_TELEMETRY_SCOPE = "@powerhousedao/reactor-workflow";
+/** The env var and OpenFeature flag key that turns workflows on. */
+const PH_WORKFLOWS_ENABLED = "PH_WORKFLOWS_ENABLED";
+const SINGLETON_LOST = {
+	status: "unavailable",
+	reason: "workflow-singleton-lost"
+};
+/** Precedence, unchanged from the reactor-api resolver this replaces: the
+* host's option, then PH_WORKFLOWS_ENABLED, then the config file, then off. */
+async function resolveWorkflowsEnabled({ featureFlags, override, configEnabled = false, env = process.env }) {
+	if (override !== void 0) return override;
+	const raw = env[PH_WORKFLOWS_ENABLED]?.trim();
+	if (raw === "1") return true;
+	if (raw === "0") return false;
+	return featureFlags.getBooleanValue(PH_WORKFLOWS_ENABLED, configEnabled);
+}
+async function assertWorkflowPackageLoadable(load = () => import("@powerhousedao/workflow/document-models")) {
+	try {
+		await load();
+	} catch (error) {
+		throw new Error(`Workflows are enabled but ${WORKFLOW_PACKAGE_NAME} could not be loaded`, { cause: error });
+	}
+}
+/**
+* Whether a composition failure was the workflow singleton refusing this
+* process, rather than something that should take the boot down.
+*
+* Matched by NAME: the engine loads lazily, and importing it here for the
+* constructor would defeat that. The fields the engine's error carries are
+* typed optional for the same reason.
+*/
+function isWorkflowSingletonConflict(error) {
+	return error instanceof Error && error.name === "WorkflowSingletonConflictError";
+}
+/**
+* Retries the singleton claim for a host that booted without it, and hands
+* the runtime over once a claim succeeds.
+*
+* Without it a rolling deploy whose slots have different owner names ends
+* with nobody running workflows: the new pod is refused while the old one
+* still holds the lease, and nothing retries once the old pod releases it.
+* Only for a host that never composed; one that lost the lease after
+* composing stays without workflows until it restarts.
+*/
+function retryWorkflowSingleton(options) {
+	const intervalMs = options.intervalMs ?? 2e4;
+	let stopped = false;
+	let timer;
+	let attempt;
+	const run = async () => {
+		let workflows;
+		try {
+			workflows = await options.compose();
+		} catch (error) {
+			if (!isWorkflowSingletonConflict(error)) options.logger.error("Composing the workflow runtime after the singleton came free failed: @error", error);
+			schedule();
+			return;
+		}
+		if (stopped) {
+			await workflows.stop();
+			return;
+		}
+		options.logger.info("Claimed the workflow singleton after boot; starting the workflow runtime");
+		await options.onComposed(workflows);
+	};
+	const schedule = () => {
+		if (stopped) return;
+		timer = setTimeout(() => {
+			timer = void 0;
+			attempt = run().finally(() => {
+				attempt = void 0;
+			});
+		}, intervalMs);
+		timer.unref();
+	};
+	schedule();
+	return { async stop() {
+		stopped = true;
+		if (timer) clearTimeout(timer);
+		timer = void 0;
+		await attempt?.catch(() => void 0);
+	} };
+}
+/**
+* What a host does once its composed runtime has shut down for losing the
+* workflow singleton.
+*
+* Taken over by another claim: that process runs workflows now, so this one
+* stays without them until it restarts. Unrenewable with no takeover seen (a
+* database blip): nothing else runs them, so the process goes down through
+* the fatal shutdown and its supervisor restarts it, which re-claims at boot.
+* A host with no fatal shutdown installed (embedded) stays without workflows
+* and says a restart is needed.
+*/
+function workflowSingletonLossHandler(logger, fatal = triggerFatalShutdown) {
+	return (loss) => {
+		if (loss.reason === "taken") {
+			logger.error(`Another process ("${loss.heldBy ?? "unknown"}") took the workflow singleton. This Switchboard has stopped its workflow runtime and runs no workflows until it is restarted; everything else serves normally.`);
+			return;
+		}
+		const error = /* @__PURE__ */ new Error(`The workflow singleton lease could not be renewed for ${Math.round(loss.silentMs)}ms; no other process was seen taking it over`);
+		if (fatal("Workflow singleton lease unrenewable", error)) return;
+		logger.error(`${error.message}. This Switchboard has stopped its workflow runtime and runs no workflows until it is restarted.`);
+	};
+}
+function modelManifestSource(builder) {
+	return {
+		modelManifest: () => builder.getResolvedModelManifest() ?? [],
+		modelEntries: (documentType) => builder.getImportableEntries(documentType)
+	};
+}
+function readAssertion(authorizationService, reactorClient) {
+	const resolveCanonical = createCanonicalDocumentIdResolver(reactorClient);
+	const hostCanRead = async (identifier, ctx) => {
+		if (authorizationService.isSupremeAdmin(ctx.user?.address)) return;
+		if (authorizationService.config.policy !== AuthorizationPolicy.DOCUMENT_PERMISSIONS) throw new ForbiddenError();
+		let documentId;
+		try {
+			documentId = await resolveCanonical(identifier);
+		} catch {
+			throw new ForbiddenError();
+		}
+		if (!await authorizationService.canRead(documentId, ctx.user?.address)) throw new ForbiddenError("to read this document");
+	};
+	return async (identifier, caller) => {
+		const ctx = caller;
+		await hostCanRead(identifier, ctx);
+		let served;
+		try {
+			served = await reactorClient.isServed(identifier, { subject: callerSubject(ctx.user) });
+		} catch {
+			throw new ForbiddenError();
+		}
+		if (!served) throw new ForbiddenError("to read this document");
+	};
+}
+/** The same, for a design-time call that writes what it names. */
+function writeAssertion(authorizationService, reactorClient) {
+	const resolveCanonical = createCanonicalDocumentIdResolver(reactorClient);
+	return async (identifier, caller) => {
+		const ctx = caller;
+		if (authorizationService.isSupremeAdmin(ctx.user?.address)) return;
+		if (authorizationService.config.policy !== AuthorizationPolicy.DOCUMENT_PERMISSIONS) throw new ForbiddenError();
+		let documentId;
+		try {
+			documentId = await resolveCanonical(identifier);
+		} catch {
+			throw new ForbiddenError();
+		}
+		if (!await authorizationService.canWrite(documentId, ctx.user?.address)) throw new ForbiddenError("to write this document");
+	};
+}
+/** What the reactor enforces and who it signs as; unknown counts as enforced. */
+function reactorAccessOf(clientModule) {
+	const flags = clientModule?.reactorModule?.featureFlags;
+	const signer = clientModule?.signer;
+	const key = signer?.app?.key;
+	const identity = key ? {
+		address: signer.user?.address ?? null,
+		key
+	} : null;
+	return {
+		authEnforcement: flags ? flags.authEnforcement : true,
+		authConditions: flags?.authConditions === true,
+		identity
+	};
+}
+/** Whom a run's created documents also grant: the host, as §8 grants it. */
+function hostPrincipalOf(access) {
+	const identity = access.identity;
+	if (!identity) return void 0;
+	if (access.authConditions) return { match: { eq: [{ attr: "subject.key" }, { lit: identity.key }] } };
+	return identity.address ? { address: identity.address } : void 0;
+}
+/** Who the host signs as, so a publish it signs makes no run user. */
+function hostIdentityOf(access) {
+	const identity = access.identity;
+	if (!identity) return void 0;
+	return identity.address ? {
+		address: identity.address,
+		key: identity.key
+	} : { key: identity.key };
+}
+const REFERENCE_INDEX_RETRIES = 8;
+const REFERENCE_INDEX_RETRY_MS = 250;
+/** A step reads an attachment the way the download route serves one: when the
+* run's user may read a document that references it. The candidates are the
+* documents the run was handed; the reference index can trail the operation
+* that fired the trigger, so a denial is retried briefly. */
+function attachmentReadPolicy(access, retryMs = REFERENCE_INDEX_RETRY_MS) {
+	return async (request) => {
+		try {
+			if (parseRef(request.ref).version !== 1) return false;
+		} catch {
+			return false;
+		}
+		if (!access || request.documentIds.length === 0) return false;
+		const subject = request.runUser?.subject;
+		const caller = {
+			...subject?.address ? { userAddress: subject.address } : {},
+			...subject?.key ? { appKey: subject.key } : {}
+		};
+		for (let attempt = 0; attempt <= REFERENCE_INDEX_RETRIES; attempt++) {
+			for (const documentId of request.documentIds) if ((await access.canReadAttachment({
+				documentId,
+				attachmentRef: request.ref,
+				...caller
+			})).kind === "allowed") return true;
+			if (attempt < REFERENCE_INDEX_RETRIES) await new Promise((resolve) => setTimeout(resolve, retryMs));
+		}
+		return false;
+	};
+}
+async function registerWorkflowTriggersReadModel(engine, runtime, clientModule, registration) {
+	const reactorModule = clientModule?.reactorModule;
+	if (!reactorModule) return {
+		status: "unavailable",
+		reason: "in-process-reactor-module-unavailable"
+	};
+	const coordinator = reactorModule.readModelCoordinator;
+	if (!supportsLiveReadModelRegistration(coordinator)) return {
+		status: "unavailable",
+		reason: "live-read-model-registration-unsupported"
+	};
+	const readModel = new engine.WorkflowTriggersReadModel(reactorModule.database.withSchema(REACTOR_SCHEMA), reactorModule.operationIndex, reactorModule.writeCache, reactorModule.processorManagerConsistencyTracker, runtime);
+	await readModel.init();
+	if (registration.tornDown) return SINGLETON_LOST;
+	coordinator.addReadModel(readModel, engine.WORKFLOW_TRIGGERS_READ_MODEL_STAGE);
+	registration.detach = () => coordinator.removeReadModel(readModel);
+	return { status: "available" };
+}
+function bindPackagePieces(registry, source) {
+	const apply = (byPackage) => {
+		registry.setPieces([...byPackage.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).flatMap(([, pieces]) => pieces));
+	};
+	apply(source.getPieces());
+	source.onPiecesChange(apply);
+}
+async function composeWorkflowRuntime(deps) {
+	const load = deps.load ?? (() => import("@powerhousedao/reactor-workflow"));
+	let engine;
+	try {
+		engine = await load();
+	} catch (error) {
+		throw new Error("Workflows are enabled but @powerhousedao/reactor-workflow could not be loaded", { cause: error });
+	}
+	const loss = { lost: false };
+	const lease = deps.singletonLease === false ? void 0 : await engine.acquireWorkflowSingletonLease({
+		relationalDb: deps.relationalDb,
+		logger: deps.logger,
+		...deps.storageId ? { storageId: deps.storageId } : {},
+		selfFence: deps.exclusiveJournal !== true,
+		onLost: (lost) => {
+			loss.lost = true;
+			if (lost.reason === "taken") loss.heldBy = lost.heldBy;
+			loss.tearDown?.();
+			if (loss.composed) deps.onSingletonLost?.(lost);
+		}
+	});
+	try {
+		const composed = await composeClaimed(engine, deps, lease, loss);
+		if (loss.lost) throw singletonLostError(engine, loss, lease);
+		loss.composed = true;
+		return composed;
+	} catch (error) {
+		loss.tearDown?.();
+		await lease?.release();
+		throw error;
+	}
+}
+function singletonLostError(engine, loss, lease) {
+	return new engine.WorkflowSingletonConflictError(loss.heldBy ?? "unknown", "unknown", lease?.owner ?? "unknown");
+}
+async function composeClaimed(engine, deps, lease, loss) {
+	engine.setPieceRegistryUrl(deps.pieceRegistryUrl);
+	if (deps.pieces) bindPackagePieces(engine.packagePieces, deps.pieces);
+	if (loss.lost) throw singletonLostError(engine, loss, lease);
+	const access = reactorAccessOf(deps.clientModule);
+	const models = deps.models;
+	const runtime = engine.createWorkflowRuntime({
+		relationalDb: deps.relationalDb,
+		secretsKeyFile: deps.secretsKeyFile,
+		reactorClient: deps.reactorClient,
+		assertCanRead: readAssertion(deps.authorizationService, deps.reactorClient),
+		subjectOf: (caller) => callerSubject(caller.user),
+		assertCanWrite: writeAssertion(deps.authorizationService, deps.reactorClient),
+		...deps.clientModule?.reactorModule ? { authEnforcement: access.authEnforcement } : {},
+		hostPrincipal: hostPrincipalOf(access),
+		hostIdentity: hostIdentityOf(access),
+		...models ? {
+			modelManifest: () => models.modelManifest(),
+			modelEntries: (documentType) => models.modelEntries(documentType)
+		} : {},
+		webhooks: deps.webhooks,
+		attachments: deps.attachments,
+		canReadAttachmentRef: attachmentReadPolicy(deps.attachmentAccess),
+		logger: deps.logger,
+		...deps.telemetry ? { telemetry: deps.telemetry } : {}
+	});
+	const routes = {};
+	const registration = { tornDown: false };
+	const tearDown = () => {
+		if (registration.tornDown) return;
+		registration.tornDown = true;
+		routes.oauthCallback?.dispose();
+		runtime.shutdown();
+		registration.detach?.();
+	};
+	loss.tearDown = tearDown;
+	const triggers = await registerWorkflowTriggersReadModel(engine, runtime, deps.clientModule, registration);
+	if (registration.tornDown) throw singletonLostError(engine, loss, lease);
+	if (triggers.status === "available") deps.logger.info(`Workflow trigger read model registered (${engine.WORKFLOW_TRIGGERS_READ_MODEL}, ${engine.WORKFLOW_TRIGGERS_READ_MODEL_STAGE})`);
+	else deps.logger.error("Workflow document triggers are NOT armed (@reason): this reactor's read-model coordinator takes no live registration, so no document operation reaches the runtime. Webhook and schedule triggers are unaffected.", triggers.reason);
+	let stopped = false;
+	if (deps.http) routes.oauthCallback = registerOAuthCallback(deps.http, runtime);
+	return {
+		subgraph: createWorkflowRuntimeSubgraph(runtime, deps.http ? { callbackUrl: callbackUrlOf(deps.http) } : void 0, access),
+		get triggers() {
+			return loss.lost ? SINGLETON_LOST : triggers;
+		},
+		...lease ? { singletonOwner: lease.owner } : {},
+		async start() {
+			if (registration.tornDown) return;
+			await runtime.registerWebhookEndpoint();
+			if (loss.lost || stopped) return;
+			runtime.startTriggerSupervisor();
+			runtime.warmPieceSearch();
+		},
+		async stop() {
+			if (stopped) return;
+			stopped = true;
+			tearDown();
+			await lease?.release();
+		}
+	};
+}
+//#endregion
+//#region src/pglite-dialect.ts
+/** A poisoned store cannot recover in process, so it takes the fatal shutdown and a supervisor restart. */
+function reactorPgliteDialectOptions(logger, proc) {
+	return {
+		onDiagnostic: (message, error) => logger.error(`[pglite-dialect] ${message}: @error`, error),
+		onPoisoned: (cause) => {
+			if (!triggerFatalShutdown("PGlite session poisoned", cause, proc)) logger.error("PGlite session poisoned: @error", cause);
+		}
+	};
+}
+var ClosablePGliteDialect = class {
+	#inner;
+	#pglite;
+	constructor(pglite, options = {}) {
+		this.#pglite = pglite;
+		this.#inner = new HardenedPGliteDialect(pglite, options);
+	}
+	createAdapter() {
+		return this.#inner.createAdapter();
+	}
+	createDriver() {
+		const driver = this.#inner.createDriver();
+		const pglite = this.#pglite;
+		const innerDestroy = driver.destroy.bind(driver);
+		driver.destroy = async () => {
+			await innerDestroy();
+			if (pglite.closed) return;
+			try {
+				await pglite.close();
+			} catch (err) {
+				if (!/PGlite aborted/.test(String(err))) throw err;
+			}
+		};
+		return driver;
+	}
+	createQueryCompiler() {
+		return this.#inner.createQueryCompiler();
+	}
+	createIntrospector(db) {
+		return this.#inner.createIntrospector(db);
+	}
+};
+//#endregion
+//#region src/pglite-migration.ts
+function backupPath(dataDir, major) {
+	return `${dataDir}.backup-pg${major}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+}
+async function pathExists(p) {
+	try {
+		await promises.stat(p);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function logRestoreFailure(dataDir, sql, err, logger) {
+	const errObj = err;
+	const position = typeof errObj.position === "string" ? parseInt(errObj.position, 10) : typeof errObj.position === "number" ? errObj.position : NaN;
+	logger.error(`[pglite-migration] Restore failed for ${dataDir}: code=${errObj.code ?? ""} severity=${errObj.severity ?? ""} message=${errObj.message ?? ""} sqlLength=${sql.length}`);
+	if (Number.isFinite(position) && position > 0) {
+		const zeroBased = position - 1;
+		const start = Math.max(0, zeroBased - 200);
+		const end = Math.min(sql.length, zeroBased + 200);
+		const before = sql.slice(start, zeroBased);
+		const at = sql.slice(zeroBased, zeroBased + 1);
+		const after = sql.slice(zeroBased + 1, end);
+		logger.error(`[pglite-migration] SQL context around position ${position}:\n${before}»${at}«${after}`);
+	} else logger.error(`[pglite-migration] No position info. First 2000 chars of dump:\n${sql.slice(0, 2e3)}`);
+}
+/**
+* Migrate a filesystem PGLite data directory from a legacy PG major to the
+* current one. Renames the existing dir to a timestamped backup, dumps via the
+* matching legacy `pg_dump`, restores into a fresh current-version PGLite at
+* the original path. On failure, the original dir is restored from the backup.
+*
+* No-op when the dir is missing or already at the current major.
+*/
+async function migratePgliteDir(dataDir, logger) {
+	const major = await readPgVersionFile(dataDir);
+	if (major === null) {
+		logger.info(`[pglite-migration] No PG_VERSION at ${dataDir}; skipping migration`);
+		return;
+	}
+	if (major === 17) return;
+	if (!isSupportedMajor(major)) throw new Error(`Unsupported legacy PGlite data dir: PG_VERSION=${major} for ${dataDir}`);
+	const backupDir = backupPath(dataDir, major);
+	logger.info(`[pglite-migration] Migrating ${dataDir} from PG${major} to PG17; backup: ${backupDir}`);
+	await promises.rename(dataDir, backupDir);
+	let sql;
+	try {
+		const [legacyMod, pgDump] = await Promise.all([loadPGliteModule(major), loadPgDump(major)]);
+		const LegacyPGlite = legacyMod.PGlite;
+		const onDisk = new LegacyPGlite(backupDir);
+		let tar;
+		try {
+			await onDisk.waitReady;
+			tar = await onDisk.dumpDataDir("none");
+		} finally {
+			await onDisk.close();
+		}
+		const pg = new LegacyPGlite({ loadDataDir: tar });
+		try {
+			await pg.waitReady;
+			sql = await (await pgDump({ pg })).text();
+		} finally {
+			await pg.close();
+		}
+	} catch (err) {
+		await rollback(dataDir, backupDir, err, logger);
+		throw err;
+	}
+	try {
+		const CurrentPGlite = (await loadPGliteModule(17)).PGlite;
+		const pg = new CurrentPGlite(dataDir, { relaxedDurability: false });
+		try {
+			await pg.waitReady;
+			try {
+				await pg.exec("SET standard_conforming_strings = off;");
+			} catch (gucErr) {
+				logger.warn(`[pglite-migration] Could not force standard_conforming_strings=off: ${String(gucErr)}`);
+			}
+			try {
+				await pg.exec(sql);
+			} catch (execErr) {
+				logRestoreFailure(dataDir, sql, execErr, logger);
+				throw execErr;
+			}
+		} finally {
+			await pg.close();
+		}
+		syncTree(dataDir);
+	} catch (err) {
+		await rollback(dataDir, backupDir, err, logger);
+		throw err;
+	}
+	logger.info(`[pglite-migration] Migration of ${dataDir} complete. Backup retained at ${backupDir}; remove it manually once you have verified the upgrade.`);
+}
+async function rollback(dataDir, backupDir, originalError, logger) {
+	try {
+		if (await pathExists(dataDir)) await promises.rm(dataDir, {
+			recursive: true,
+			force: true
+		});
+		if (await pathExists(backupDir)) await promises.rename(backupDir, dataDir);
+	} catch (rollbackErr) {
+		logger.error(`[pglite-migration] Migration AND rollback failed for ${dataDir}. Original error: ${String(originalError)}; rollback error: ${String(rollbackErr)}; backup may still exist at ${backupDir}.`);
+		return;
+	}
+	logger.error(`[pglite-migration] Migration failed for ${dataDir}; rolled back from ${backupDir}. Original error: ${String(originalError)}`);
+}
+//#endregion
+//#region src/pglite-preflight.ts
+const RM_OPTIONS = {
+	recursive: true,
+	force: true,
+	maxRetries: 10,
+	retryDelay: 100
+};
+/**
+* Prepares every local PGlite dir before the first open and returns the
+* PG major detected on disk per dir. Conversion of an AtomicNodeFs snapshot
+* runs for every dir, before the major is read, so a pure-snapshot PG16 dir
+* is converted and then migrated.
+*/
+async function runPglitePreflight(options) {
+	const { dirs, logger } = options;
+	const detectedMajors = /* @__PURE__ */ new Map();
+	if (options.inMemory || dirs.length === 0) return detectedMajors;
+	if (options.forcePgVersion !== void 0) {
+		if (options.migratePglite) logger.warn("PH_FORCE_PG_VERSION is set; ignoring --migrate-pglite/PH_MIGRATE_PGLITE because the data dirs will be wiped.");
+		logger.warn(`PH_FORCE_PG_VERSION=${options.forcePgVersion} set; wiping PGLite data dirs and re-initializing at PG${options.forcePgVersion}.`);
+		for (const dir of dirs) {
+			for (const p of [
+				dir,
+				`${dir}.converting`,
+				`${dir}.old`
+			]) await promises.rm(p, RM_OPTIONS);
+			logger.info(`Wiped PGLite data dir ${dir}`);
+		}
+		return detectedMajors;
+	}
+	const deps = {
+		openForVerify: options.openForVerify ?? openForVerify,
+		logger
+	};
+	for (const dir of dirs) {
+		await preparePgliteDataDir(dir, deps);
+		const major = await readPgVersionFile(dir);
+		if (major !== null) detectedMajors.set(dir, major);
+	}
+	if (options.migratePglite) for (const [dir, major] of detectedMajors) {
+		if (major === 17) continue;
+		await migratePgliteDir(dir, logger);
+		await removeStalePgliteFiles(dir, logger);
+		const after = await readPgVersionFile(dir);
+		if (after !== null) detectedMajors.set(dir, after);
+	}
+	else for (const [dir, major] of detectedMajors) {
+		if (major === 17) continue;
+		logger.warn(`PGLite data dir at ${dir} was created with PG${major} but Switchboard ships PG17. Running on legacy PGLite. Re-start with --migrate-pglite (or PH_MIGRATE_PGLITE=true) to upgrade.`);
+	}
+	return detectedMajors;
+}
+//#endregion
+//#region src/reactor-feature-flags.mts
+/**
+* Enforcement flags from the REACTOR_* env vars. Each flag requires the ones
+* before it; the reactor rejects an inconsistent set rather than enforcing less
+* than the operator asked for, so this reports what was asked without
+* correcting it.
+*/
+function resolveReactorFeatureFlags(env) {
+	const flags = {
+		documentDecisions: env.REACTOR_DOCUMENT_DECISIONS === "true",
+		authEnforcement: env.REACTOR_AUTH_ENFORCEMENT === "true",
+		authGroups: env.REACTOR_AUTH_GROUPS === "true",
+		authConditions: env.REACTOR_AUTH_CONDITIONS === "true"
+	};
+	return {
+		flags,
+		enabled: Object.entries(flags).filter(([, isEnabled]) => isEnabled).map(([name]) => name)
+	};
+}
+//#endregion
+//#region src/create-signature-policy.mts
+/**
+* What new documents are created as, from CREATE_SIGNATURE_POLICY. Without a
+* signer this switchboard cannot write to a v2-required document, so it falls
+* back to legacy and says so.
+*/
+function resolveCreateSignaturePolicy(env, options) {
+	const raw = env.CREATE_SIGNATURE_POLICY?.trim();
+	let policy = DEFAULT_SIGNATURE_POLICY;
+	if (raw) {
+		if (!isSignaturePolicy(raw)) throw new Error(`CREATE_SIGNATURE_POLICY must be "legacy" or "v2-required", got "${raw}"`);
+		policy = raw;
+	}
+	if (policy === "v2-required" && !options.hasSigner) {
+		options.logger?.warn("No signer is configured, so new documents are created legacy: a v2-required document refuses the unsigned operations this switchboard would write. Set up an identity (ph login) to create v2-required documents.");
+		return "legacy";
+	}
+	return policy;
+}
+//#endregion
+//#region src/renown.ts
+const logger = childLogger(["switchboard", "renown"]);
+/**
+* Initialize Renown for the Switchboard instance.
+* This allows Switchboard to authenticate with remote services
+* using the same identity established during `ph login`.
+*/
+async function initRenown(options = {}) {
+	const { keypairPath, requireExisting = false, baseUrl = DEFAULT_RENOWN_URL } = options;
+	const keyStorage = new NodeKeyStorage(keypairPath, { logger });
+	const existingKeyPair = await keyStorage.loadKeyPair();
+	if (!existingKeyPair && requireExisting) throw new Error("No existing keypair found and requireExisting is true. Run \"ph login\" to create one.");
+	if (!existingKeyPair) logger.info("No existing keypair found. A new one will be generated.");
+	const renownCrypto = await new RenownCryptoBuilder().withKeyPairStorage(keyStorage).build();
+	const renown = await new RenownBuilder("switchboard", {}).withCrypto(renownCrypto).withBaseUrl(baseUrl).build();
+	logger.info("Switchboard identity initialized: @did", renownCrypto.did);
+	return renown;
+}
+/**
+* Get the signer config for the given renown instance.
+*
+* @param renown - The renown instance
+* @param keypairPath - Where `initRenown` loaded the key from
+*/
+function getRenownSignerConfig(renown, keypairPath) {
+	return {
+		signer: renown.signer,
+		workerSigner: getRenownWorkerSignerSpec(renown, keypairPath)
+	};
+}
+/**
+* What a pooled executor worker imports to sign as this switchboard: it
+* reloads the key `initRenown` stored, and takes the user known at boot.
+*/
+function getRenownWorkerSignerSpec(renown, keypairPath) {
+	const { signer } = renown;
+	const user = signer.user;
+	return {
+		module: {
+			filePath: createRequire(import.meta.url).resolve("@renown/sdk/node"),
+			exportName: "createNodeRenownSigner"
+		},
+		initArgs: {
+			appName: signer.app?.name ?? "switchboard",
+			keypairPath: resolve(keypairPath ?? DEFAULT_KEYPAIR_PATH),
+			...signer.app?.key ? { did: signer.app.key } : {},
+			...user ? { user: {
+				address: user.address,
+				networkId: user.networkId,
+				chainId: user.chainId
+			} } : {}
+		}
+	};
+}
+/**
+* Admits a key as a signer for an address a Renown credential binds it to; a
+* `self` source has no worker spec. In process, the switchboard's own key is
+* matched against its current user; the worker spec carries the user known now.
+*/
+async function getRenownTrustPolicyConfig(trustSource, renown) {
+	const ownSigner = renown?.signer;
+	if (trustSource.source === "self") return { trustPolicy: createRenownTrustPolicy({
+		switchboard: trustSource.request,
+		ownSigner
+	}) };
+	const switchboardUrl = await resolveSwitchboardEndpoint({
+		switchboardUrl: trustSource.switchboardUrl,
+		baseUrl: trustSource.renownUrl
+	});
+	const options = {
+		...switchboardUrl ? { switchboard: switchboardUrl } : {},
+		...trustSource.renownUrl ? { renownUrl: trustSource.renownUrl } : {}
+	};
+	const self = ownIdentity(renown);
+	return {
+		trustPolicy: createRenownTrustPolicy({
+			...options,
+			ownSigner
+		}),
+		workerTrustPolicy: {
+			module: {
+				filePath: createRequire(import.meta.url).resolve("@renown/sdk/node"),
+				exportName: "createRenownTrustPolicy"
+			},
+			initArgs: {
+				...options,
+				...self ? { self } : {}
+			}
+		}
+	};
+}
+/**
+* Fails the boot when pooled workers would refuse every signed write the
+* in-process executor accepts: a `self` Renown source gives workers no trust
+* policy spec, so under authEnforcement they apply the default.
+*/
+function assertWorkerTrustPolicy(config) {
+	if (config.workers > 0 && config.authEnforcement && config.renownSource === "self") throw new Error("The executor worker pool (REACTOR_WORKERS) cannot verify signers when REACTOR_AUTH_ENFORCEMENT is on and Renown credentials are read from this switchboard (\"self\" via auth.renown.source or RENOWN_SOURCE): pooled workers have no trust policy and would refuse every signed write. Set RENOWN_SOURCE=remote, or disable the worker pool (REACTOR_WORKERS=0).");
+}
+function ownIdentity(renown) {
+	const key = renown?.signer.app?.key;
+	if (!key) return;
+	const user = renown.signer.user;
+	return {
+		key,
+		user: {
+			address: user?.address ?? "",
+			networkId: user?.networkId ?? "",
+			chainId: user?.chainId ?? 0
+		}
+	};
+}
+//#endregion
+//#region src/unsupported-stored-documents.mts
+const MODES = ["refuse", "read-only"];
+/** From REACTOR_UNSUPPORTED_STORED_DOCUMENTS; `input` wins when defined. */
+function resolveUnsupportedStoredDocuments(input, env) {
+	if (input !== void 0) return input;
+	const raw = env.REACTOR_UNSUPPORTED_STORED_DOCUMENTS?.trim();
+	if (!raw) return "refuse";
+	if (!MODES.includes(raw)) throw new Error(`REACTOR_UNSUPPORTED_STORED_DOCUMENTS must be "refuse" or "read-only", got "${raw}"`);
+	return raw;
+}
+/** The reactor refused to start over documents this build does not run. */
+var StoredDocumentsRefusedError = class extends Error {
+	versions;
+	documents;
+	constructor(cause) {
+		const named = cause.versions.map(({ protocol, version }) => `${protocol} ${version}`).join(", ");
+		super(`Refusing to start: ${cause.documents} stored document(s) require ${named}, which this switchboard does not run. Either start a switchboard build that runs ${named}, or set REACTOR_UNSUPPORTED_STORED_DOCUMENTS=read-only to start with those documents read-only.`, { cause });
+		this.name = "StoredDocumentsRefusedError";
+		this.versions = cause.versions;
+		this.documents = cause.documents;
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "StoredDocumentsRefusedError";
+	}
+};
+//#endregion
+//#region src/server.mts
+const defaultLogger = childLogger(["switchboard"]);
+const LogLevel = process.env.LOG_LEVEL || "info";
+setLogLevel(LogLevel);
+dotenv.config();
+const DOCUMENT_MODEL_SUBGRAPHS_ENABLED = "DOCUMENT_MODEL_SUBGRAPHS_ENABLED";
+const DOCUMENT_MODEL_SUBGRAPHS_ENABLED_DEFAULT = true;
+const DEFAULT_PORT = process.env.PORT ? Number(process.env.PORT) : 4001;
+const PORT_FALLBACK_ATTEMPTS = 20;
+let flushIntervalWarned = false;
+function warnIgnoredFlushInterval(logger) {
+	if (flushIntervalWarned) return;
+	if (process.env.PGLITE_FLUSH_INTERVAL_MS === void 0) return;
+	flushIntervalWarned = true;
+	logger.warn("PGLITE_FLUSH_INTERVAL_MS is set but ignored: PGlite stores no longer snapshot on a timer.");
+}
+function onPgliteAbort(logger, what) {
+	if (!triggerFatalShutdown("PGlite aborted", what)) logger.error("PGlite aborted: @error", what);
+}
+function pgliteFsyncFor(major, dir, logger) {
+	const wanted = resolvePgliteFsync(process.env);
+	if (wanted && major === 16) logger.warn(`PGlite data dir ${dir} is PG16 on pglite-legacy-02, which does not sync commits to disk; only checkpoints are synced until --migrate-pglite upgrades it.`);
+	return wanted;
+}
+/** Preloads the module's NodeFS so the returned factory can be synchronous. */
+async function loadDurableFsFactory(major, logger) {
+	const NodeFS = await loadNodeFsClass(major);
+	return (dir) => createDurableNodeFs(NodeFS, dir, {
+		fsync: pgliteFsyncFor(major, dir, logger),
+		logger,
+		onAbort: (what) => onPgliteAbort(logger, what)
+	});
+}
+const PGLITE_IN_MEMORY = process.env.PH_PGLITE_IN_MEMORY === "1";
+/**
+* Attempt to bind a throwaway TCP server to the given port. Resolves true if
+* the port is free, false if the OS reports it in use. Any other error is
+* surfaced so we don't silently mask real issues (permissions, bad host, …).
+*/
+function isPortAvailable(port) {
+	return new Promise((resolve, reject) => {
+		const tester = net.createServer();
+		tester.once("error", (err) => {
+			if (err.code === "EADDRINUSE" || err.code === "EACCES") resolve(false);
+			else reject(err);
+		});
+		tester.once("listening", () => {
+			tester.close(() => resolve(true));
+		});
+		tester.listen({
+			port,
+			host: "::"
+		});
+	});
+}
+/** The powerhouse.config.json this run reads, defaulting to the cwd copy. */
+function resolveConfigPath(configFile) {
+	return configFile ?? path$1.join(process.cwd(), "powerhouse.config.json");
+}
+function readConfigWorkflowsEnabled(configPath) {
+	try {
+		return getConfig(configPath).workflows?.enabled ?? false;
+	} catch {
+		return false;
+	}
+}
+async function resolveServerPort(requested, strictPort, logger) {
+	if (strictPort) return requested;
+	for (let i = 0; i < PORT_FALLBACK_ATTEMPTS; i++) {
+		const candidate = requested + i;
+		if (await isPortAvailable(candidate)) {
+			if (candidate !== requested) logger.info(`Port ${requested} is in use. Falling back to port ${candidate}.`);
+			return candidate;
+		}
+	}
+	return requested;
+}
+async function createReactorKysely(opts) {
+	const { reactorDbUrl, reactorPgliteDir, reactorPgliteMajor, inMemory, hostPoolSize, logger } = opts;
+	if (reactorDbUrl && isPostgresUrl(reactorDbUrl)) {
+		const connectionString = reactorDbUrl.includes("?") ? reactorDbUrl : `${reactorDbUrl}?sslmode=disable`;
+		const poolSize = hostPoolSize();
+		const pool = new Pool({
+			connectionString,
+			max: poolSize
+		});
+		const poolInstrumentation = instrumentPgPool(pool, "reactor-host");
+		logger.info(`Using PostgreSQL for reactor storage (host pool max ${poolSize})`);
+		return {
+			kysely: new Kysely({ dialect: new PostgresDialect({ pool }) }),
+			poolInstrumentation,
+			storageFacts: POSTGRES_STORAGE_FACTS
+		};
+	}
+	if (!reactorPgliteDir || reactorPgliteMajor === null) throw new Error("Reactor PGLite directory not resolved");
+	const { PGlite } = await loadPGliteModule(reactorPgliteMajor);
+	const pglite = inMemory ? new PGlite() : new PGlite({ fs: (await loadDurableFsFactory(reactorPgliteMajor, logger))(reactorPgliteDir) });
+	logger.info(inMemory ? `Using in-memory PGlite (PG${reactorPgliteMajor}) for reactor storage [PH_PGLITE_IN_MEMORY=1]` : `Using PGlite (PG${reactorPgliteMajor}) for reactor storage at ${reactorPgliteDir}`);
+	return {
+		kysely: new Kysely({ dialect: new ClosablePGliteDialect(pglite, reactorPgliteDialectOptions(logger)) }),
+		poolInstrumentation: void 0,
+		storageFacts: inMemory ? IN_MEMORY_PGLITE_STORAGE_FACTS : PGLITE_PATH_STORAGE_FACTS
+	};
+}
+/** Derive the remote attachment service config for switchboard's own `/attachments/*` API. */
+function deriveAttachmentServiceConfig(options, serverPort, renown) {
+	const protocol = options.https ? "https" : "http";
+	return {
+		remoteUrl: options.attachmentServiceUrl ?? process.env.PH_SWITCHBOARD_PUBLIC_URL ?? `${protocol}://localhost:${serverPort}`,
+		jwtHandler: renown ? async (url) => renown.user ? renown.getBearerToken({
+			expiresIn: 10,
+			aud: url
+		}) : void 0 : void 0
+	};
+}
+async function initServer(serverPort, options, renown, renownConfig) {
+	const { dev, packages = [], remoteDrives = [], logger = defaultLogger } = options;
+	logger.level = LogLevel;
+	const dbPath = options.dbPath ?? process.env.DATABASE_URL ?? process.env.PH_SWITCHBOARD_DATABASE_URL;
+	const readModelPath = dbPath || ".ph/read-storage";
+	const reactorDbUrl = options.dbPath ?? process.env.PH_REACTOR_DATABASE_URL ?? process.env.PH_SWITCHBOARD_DATABASE_URL;
+	const reactorPath = reactorDbUrl || "./.ph/reactor-storage";
+	const reactorPgliteDir = options.reactor ? null : !reactorDbUrl || !isPostgresUrl(reactorDbUrl) ? reactorPath : null;
+	const readModelPgliteDir = !dbPath || !isPostgresUrl(dbPath) ? readModelPath : null;
+	const pgliteDirs = [reactorPgliteDir, readModelPgliteDir].filter((d) => d !== null);
+	warnIgnoredFlushInterval(logger);
+	const detectedMajors = await runPglitePreflight({
+		dirs: pgliteDirs,
+		forcePgVersion: options.forcePgVersion,
+		migratePglite: options.migratePglite,
+		inMemory: PGLITE_IN_MEMORY,
+		logger
+	});
+	function resolvePgliteMajorForDir(dir) {
+		if (options.forcePgVersion !== void 0) return options.forcePgVersion;
+		const detected = detectedMajors.get(dir);
+		if (detected === void 0) return 17;
+		if (!isSupportedMajor(detected)) throw new Error(`Unsupported PGLite data dir at ${dir}: PG_VERSION=${detected}`);
+		return detected;
+	}
+	const reactorPgliteMajor = reactorPgliteDir ? resolvePgliteMajorForDir(reactorPgliteDir) : null;
+	const readModelPgliteMajor = readModelPgliteDir ? resolvePgliteMajorForDir(readModelPgliteDir) : null;
+	let workerPool = resolveWorkerPoolOptions(options.workerPool, process.env);
+	if (workerPool && options.reactor) {
+		logger.warn("Worker pool configuration ignored: the caller-provided reactor owns its own executor");
+		workerPool = null;
+	}
+	if (workerPool) {
+		if (dev) throw new Error("The executor worker pool (REACTOR_WORKERS) is not supported in dev mode: Vite-loaded document models cannot cross a worker-thread boundary");
+		assertWorkerTrustPolicy({
+			workers: workerPool.numWorkers,
+			authEnforcement: resolveReactorFeatureFlags(process.env).flags.authEnforcement === true,
+			renownSource: renownConfig.source
+		});
+		if (!reactorDbUrl || !isPostgresUrl(reactorDbUrl)) throw new Error("The executor worker pool (REACTOR_WORKERS) requires a Postgres reactor database — set PH_REACTOR_DATABASE_URL or PH_SWITCHBOARD_DATABASE_URL. PGlite cannot be shared across worker threads.");
+	}
+	const unsupportedStoredDocuments = resolveUnsupportedStoredDocuments(options.unsupportedStoredDocuments, process.env);
+	let projectionWorker = resolveProjectionWorkerOptions(options.projectionWorker, process.env);
+	if (projectionWorker && options.reactor) {
+		logger.warn("Projection worker configuration ignored: the caller-provided reactor owns its own read-model coordinator");
+		projectionWorker = null;
+	}
+	if (projectionWorker) assertProjectionWorkerSupported({
+		dev: dev === true,
+		reactorDbUrl
+	});
+	const apiRef = { current: void 0 };
+	let driveNodeView;
+	const configPath = resolveConfigPath(options.configFile);
+	const config = getConfig(configPath);
+	const registryUrl = options.registryUrl ?? process.env.PH_REGISTRY_URL ?? config.packageRegistryUrl;
+	const registryPackages = process.env.PH_REGISTRY_PACKAGES;
+	const dynamicModelLoading = options.dynamicModelLoading ?? process.env.DYNAMIC_MODEL_LOADING === "true";
+	let httpLoader;
+	if (registryUrl) {
+		register(httpsHooksPath, import.meta.url);
+		httpLoader = new HttpPackageLoader({ registryUrl });
+		registryPackages?.split(",").forEach((p) => {
+			const name = p.trim();
+			if (!packages.includes(name)) packages.push(name);
+		});
+	}
+	const registryPackageNames = new Set((registryPackages ?? "").split(",").map((p) => p.trim()).filter(Boolean));
+	const resolveRegistryModels = async (identifier) => httpLoader && registryPackageNames.has(identifier) ? (await httpLoader.cachePackage(identifier)).entries.documentModels ?? null : null;
+	const reactorLogger = logger.child(["reactor"]);
+	let projectionWorkerFatalFired = false;
+	const onProjectionWorkerFatal = (shardId, reason) => {
+		if (projectionWorkerFatalFired) return;
+		projectionWorkerFatalFired = true;
+		reactorLogger.error(`Projection worker ${shardId} died; shutting down so the supervisor restarts a healthy process`, reason);
+		process.kill(process.pid, "SIGTERM");
+	};
+	const workflowsEnabled = options.workflows?.enabled === true;
+	const privacyConfig = resolvePrivacy(options.privacy, process.env);
+	if (workflowsEnabled) {
+		await assertWorkflowPackageLoadable();
+		if (!packages.includes("@powerhousedao/workflow")) packages.push(WORKFLOW_PACKAGE_NAME);
+	}
+	let ownedReactorModule;
+	let workerModels;
+	let localRenownRequest;
+	const initializeClient = async (documentModels, { attachmentReferenceWriter, upgradeManifests }) => {
+		if (options.reactor) {
+			const attachmentReferenceProjection = await registerAttachmentReferenceReadModelOnModule(options.reactor, attachmentReferenceWriter);
+			if (options.reactor.reactorModule) {
+				new ReactorInstrumentation(options.reactor.reactorModule).start();
+				reactorLogger.info("Reactor metrics instrumentation started (using caller-provided reactor)");
+			}
+			return {
+				module: options.reactor,
+				attachmentReferenceProjection
+			};
+		}
+		const { kysely: baseKysely, poolInstrumentation, storageFacts } = await createReactorKysely({
+			reactorDbUrl,
+			reactorPgliteDir,
+			reactorPgliteMajor,
+			inMemory: PGLITE_IN_MEMORY,
+			hostPoolSize: () => resolveHostPoolSize(process.env),
+			logger
+		});
+		const maxSkipThreshold = parseInt(process.env.MAX_SKIP_THRESHOLD ?? "", 10);
+		const hasSkipThreshold = !isNaN(maxSkipThreshold) && maxSkipThreshold > 0;
+		if (hasSkipThreshold) logger.info(`Reactor maxSkipThreshold set to ${maxSkipThreshold}`);
+		const { flags: reactorFeatureFlags, enabled: enabledFeatureFlags } = resolveReactorFeatureFlags(process.env);
+		if (enabledFeatureFlags.length > 0) logger.info(`Reactor feature flags enabled: ${enabledFeatureFlags.join(", ")}`);
+		const reactorBuilder = new ReactorBuilder().withEventBus(new EventBus()).withKysely(baseKysely).withStorageFacts(storageFacts).withFeatures({ legacyProcessorIds: process.env.REACTOR_LEGACY_PROCESSOR_IDS !== "false" }).withUnsupportedStoredDocuments(unsupportedStoredDocuments);
+		if (poolInstrumentation) reactorBuilder.withInstrumentedPool(poolInstrumentation);
+		const clientBuilder = new ReactorClientBuilder().withReactorBuilder(reactorBuilder);
+		const vetraDocumentModels = dev ? Object.values(await import("@powerhousedao/vetra/document-models")).filter((m) => typeof m === "object" && m !== null && "documentModel" in m && "reducer" in m) : [];
+		applySwitchboardReactorDefaults(reactorBuilder, clientBuilder, {
+			documentModels: [...documentModels, ...vetraDocumentModels],
+			upgradeManifests,
+			executorConfig: hasSkipThreshold || enabledFeatureFlags.length > 0 ? {
+				...hasSkipThreshold ? { maxSkipThreshold } : {},
+				...enabledFeatureFlags.length > 0 ? { featureFlags: reactorFeatureFlags } : {}
+			} : void 0,
+			documentModelLoader: httpLoader && dynamicModelLoading ? httpLoader.documentModelLoader : void 0,
+			logger: reactorLogger,
+			signer: renown ? getRenownSignerConfig(renown, options.identity?.keypairPath) : void 0,
+			createSignaturePolicy: resolveCreateSignaturePolicy(process.env, {
+				hasSigner: renown !== null,
+				logger
+			}),
+			trustPolicy: reactorFeatureFlags.authEnforcement ? await getRenownTrustPolicyConfig(renownConfig.source === "self" ? {
+				source: "self",
+				request: (query, variables) => localRenownRequest ? localRenownRequest(query, variables) : Promise.reject(/* @__PURE__ */ new Error("The local renown read model is not bound yet"))
+			} : {
+				source: "remote",
+				renownUrl: renownConfig.url,
+				switchboardUrl: renownConfig.switchboardUrl
+			}, renown) : void 0
+		});
+		if (workerPool || projectionWorker || workflowsEnabled) {
+			const sources = await resolveWorkerModelSources(packages, reactorLogger, { resolveRemote: resolveRegistryModels });
+			reactorBuilder.withDocumentModelSources(workerPool || projectionWorker ? sources : await keepImportableSources(sources, reactorLogger));
+		}
+		workerModels = modelManifestSource(reactorBuilder);
+		if (workerPool) {
+			if (!reactorDbUrl) throw new Error("unreachable: worker pool enabled without a reactor database URL");
+			reactorBuilder.withWorkerPool({
+				numWorkers: workerPool.numWorkers,
+				db: buildWorkerDbConfig(reactorDbUrl, workerPool)
+			});
+			reactorLogger.info(`Executor worker pool enabled: ${workerPool.numWorkers} worker threads${workerPool.mode === "auto" ? " (auto-sized from cores)" : ""}`);
+		}
+		reactorBuilder.withReadModelFactory(async ({ operationIndex, writeCache, processorManagerConsistencyTracker }) => {
+			const nodeProcessor = new NodeProcessor(baseKysely, REACTOR_SCHEMA, operationIndex, writeCache, processorManagerConsistencyTracker);
+			await nodeProcessor.init();
+			return nodeProcessor;
+		});
+		registerAttachmentReferenceReadModel(reactorBuilder, {
+			baseKysely,
+			attachmentReferenceWriter
+		});
+		if (projectionWorker) {
+			if (!reactorDbUrl) throw new Error("unreachable: projection worker enabled without a reactor database URL");
+			const db = {
+				...buildWorkerDbConfig(reactorDbUrl, {
+					dbPoolSizePerWorker: projectionWorker.dbPoolSize,
+					acquireTimeoutMs: workerPool?.acquireTimeoutMs ?? 5e3
+				}),
+				applicationName: "switchboard-projection"
+			};
+			reactorBuilder.withReadModelCoordinatorFactory(createHybridProjectionCoordinatorFactory({
+				shardCount: 1,
+				poolSize: projectionWorker.dbPoolSize,
+				db,
+				onFatal: onProjectionWorkerFatal
+			}));
+			reactorLogger.info(`Projection worker enabled: 1 worker thread, pool size ${projectionWorker.dbPoolSize}`);
+		}
+		reactorBuilder.withShutdownHook(async () => {
+			if (apiRef.current) await apiRef.current.dispose();
+		});
+		let module;
+		try {
+			module = await clientBuilder.buildModule();
+		} catch (error) {
+			try {
+				await baseKysely.destroy();
+			} catch (destroyError) {
+				logger.error("Aborting boot: reactor database destroy failed: @error", destroyError);
+			}
+			if (UnsupportedStoredProtocolError.isError(error)) throw new StoredDocumentsRefusedError(error);
+			throw error;
+		}
+		if (module.reactorModule) {
+			new ReactorInstrumentation(module.reactorModule).start();
+			reactorLogger.info("Reactor metrics instrumentation started");
+		}
+		const reactorDriveSchemaDb = baseKysely.withSchema(REACTOR_SCHEMA);
+		driveNodeView = new DriveNodeView(reactorDriveSchemaDb);
+		const reactorDriveClient = new ReactorDriveClient({
+			reactor: module.client,
+			readModel: driveNodeView
+		});
+		ownedReactorModule = module;
+		if (options.fatalErrorShutdown) installFatalErrorShutdown(logger);
+		return {
+			module,
+			reactorDriveClient,
+			attachmentReferenceProjection: { status: "available" }
+		};
+	};
+	const abortBoot = async (api) => {
+		const owned = ownedReactorModule;
+		if (owned) try {
+			await owned.reactor.kill().completed;
+		} catch (error) {
+			logger.error("Aborting boot: reactor shutdown failed: @error", error);
+		}
+		try {
+			await api.dispose();
+		} catch (error) {
+			logger.error("Aborting boot: api dispose failed: @error", error);
+		}
+		if (owned?.reactorModule) try {
+			await owned.reactorModule.database.destroy();
+		} catch (error) {
+			logger.error("Aborting boot: database destroy failed: @error", error);
+		}
+	};
+	let localCredentialCheck;
+	const verifyCredential = renownConfig.source === "self" ? (params) => localCredentialCheck ? localCredentialCheck(params) : Promise.reject(/* @__PURE__ */ new Error("The local renown read model is not bound yet")) : void 0;
+	let defaultDriveUrl = void 0;
+	const basePath = process.cwd();
+	let vite;
+	let viteLoader;
+	if (dev) {
+		const { VitePackageLoader, createViteLogger, startViteServer } = await import("@powerhousedao/reactor-api/vite");
+		vite = await startViteServer(process.cwd(), createViteLogger(logger));
+		viteLoader = VitePackageLoader.build(vite, { resolveFrom: [import.meta.url] });
+	}
+	const vetraProcessorFactory = dev ? (await import("@powerhousedao/vetra/processors")).processorFactory : void 0;
+	if (!options.disableLocalPackages) packages.push(basePath);
+	const packageLoaders = [];
+	if (viteLoader) packageLoaders.push(viteLoader);
+	else packageLoaders.push(new ImportPackageLoader());
+	if (httpLoader) {
+		packageLoaders.push(httpLoader);
+		registryPackages?.split(",").forEach((p) => {
+			const name = p.trim();
+			if (!packages.includes(name)) packages.push(name);
+		});
+	}
+	const apiLogger = logger.child(["reactor-api"]);
+	let pgliteFactory;
+	if (readModelPgliteDir && readModelPgliteMajor !== null) {
+		const { PGlite: ReadModelPGlite } = await loadPGliteModule(readModelPgliteMajor);
+		const durableFs = await loadDurableFsFactory(readModelPgliteMajor, logger);
+		pgliteFactory = PGLITE_IN_MEMORY ? () => new ReadModelPGlite({ parsers: PGLITE_UTC_PARSERS }) : (connectionString) => new ReadModelPGlite({
+			fs: durableFs(connectionString ?? readModelPgliteDir),
+			parsers: PGLITE_UTC_PARSERS
+		});
+	}
+	const api = await initializeAndStartAPI(initializeClient, {
+		port: serverPort,
+		dbPath: readModelPath,
+		pgliteFactory,
+		https: options.https,
+		packageLoaders: packageLoaders.length > 0 ? packageLoaders : void 0,
+		packages,
+		processorConfig: options.processorConfig,
+		processors: vetraProcessorFactory ? { "@powerhousedao/vetra": [vetraProcessorFactory] } : {},
+		configFile: configPath,
+		mcp: options.mcp ?? true,
+		logger: apiLogger,
+		enableDocumentModelSubgraphs: options.enableDocumentModelSubgraphs,
+		renown: renownConfig,
+		verifyCredential
+	}, "switchboard");
+	apiRef.current = api;
+	if (renownConfig.source === "self") {
+		const { graphqlManager: manager } = api;
+		if (!manager.hasSubgraphHandler(RENOWN_READ_MODEL_SUBGRAPH)) {
+			await abortBoot(api);
+			throw new Error(`Renown credential verification is set to "self" (auth.renown.source or RENOWN_SOURCE) but no loaded package serves the "${RENOWN_READ_MODEL_SUBGRAPH}" subgraph. Install one (@powerhousedao/renown-package) or set RENOWN_SOURCE=remote.`);
+		}
+		localRenownRequest = (query, variables) => manager.executeSubgraphQuery(RENOWN_READ_MODEL_SUBGRAPH, query, variables);
+		localCredentialCheck = createLocalCredentialVerifier(localRenownRequest, { onError: (error) => logger.error("Renown read model query failed: @error", error) });
+		logger.info("Renown credentials will be verified against this switchboard's own renown read model");
+	}
+	registerAttachmentRoutes(api);
+	const attachmentService = createRemoteAttachmentService(deriveAttachmentServiceConfig(options, serverPort, renown));
+	if (process.env.SENTRY_DSN) api.httpAdapter.setupSentryErrorHandler(Sentry);
+	const { client, graphqlManager, documentModelRegistry } = api;
+	const lateSubgraphs = [];
+	let workflows;
+	let workflowsRetry;
+	const composeWorkflows = () => composeWorkflowRuntime({
+		reactorClient: client,
+		clientModule: options.reactor ?? ownedReactorModule,
+		relationalDb: api.relationalDb,
+		secretsKeyFile: readModelPgliteDir === null ? false : void 0,
+		storageId: readModelPgliteDir === null ? readModelPath : path$1.resolve(readModelPath),
+		attachments: createAttachmentClient(api.attachments.service),
+		attachmentAccess: api.attachmentAccess,
+		webhooks: api.httpRoutes.scopeFor(WORKFLOW_PACKAGE_NAME).webhooks,
+		http: api.httpRoutes.scopeFor(WORKFLOW_PACKAGE_NAME),
+		authorizationService: api.authorizationService,
+		pieces: api.packageManager,
+		pieceRegistryUrl: registryUrl,
+		models: workerModels,
+		logger: logger.child(["workflow-runtime"]),
+		exclusiveJournal: readModelPgliteDir !== null,
+		onSingletonLost: workflowSingletonLossHandler(logger),
+		telemetry: {
+			tracer: trace.getTracer(WORKFLOW_TELEMETRY_SCOPE),
+			meter: metrics.getMeter(WORKFLOW_TELEMETRY_SCOPE)
+		}
+	});
+	const registerWorkflowSubgraph = (composed) => {
+		const WorkflowRuntimeSubgraph = composed.subgraph;
+		const workflowSubgraph = new WorkflowRuntimeSubgraph({
+			reactorClient: client,
+			http: graphqlManager.scopeForPackage(WORKFLOW_PACKAGE_NAME),
+			relationalDb: api.relationalDb,
+			analyticsStore: void 0,
+			graphqlManager,
+			syncManager: api.syncManager,
+			authorizationService: graphqlManager.getAuthorizationService(),
+			path: graphqlManager.getBasePath(),
+			attachments: api.attachmentClientProvider
+		});
+		return graphqlManager.registerSubgraphInstance(workflowSubgraph, "graphql", false).catch((error) => {
+			logger.error("Failed to register workflow-runtime subgraph: @error", error);
+		});
+	};
+	if (workflowsEnabled) try {
+		workflows = await composeWorkflows();
+	} catch (error) {
+		if (!isWorkflowSingletonConflict(error)) throw error;
+		logger.warn(`Workflows are enabled but another live process ("${error.owner ?? "unknown"}") holds the workflow singleton until ${error.expiresAt ?? "unknown"}. This Switchboard has booted WITHOUT the workflow runtime: no trigger of any kind fires here, and the workflow GraphQL face is absent. Everything else serves normally. Stop the other owner, or set PH_WORKFLOWS_SINGLETON_OWNER to the same stable name on the slot that owns workflows. This Switchboard retries the claim and starts workflows once the lease comes free.`);
+		workflowsRetry = retryWorkflowSingleton({
+			compose: composeWorkflows,
+			onComposed: async (composed) => {
+				workflows = composed;
+				await registerWorkflowSubgraph(composed);
+				try {
+					await graphqlManager.updateRouter();
+				} catch (error) {
+					logger.error("Mounting the late workflow-runtime subgraph failed: @error", error);
+				}
+				await composed.start();
+				logger.info("Workflow runtime started");
+			},
+			logger
+		});
+	}
+	if (workflows) {
+		lateSubgraphs.push(registerWorkflowSubgraph(workflows));
+		await workflows.start();
+		logger.info("Workflow runtime started");
+		api.inspection?.facts.setWorkflows(true);
+	}
+	let privacy;
+	if (privacyConfig.enabled) {
+		const signer = options.reactor ? options.privacy?.signer : options.privacy?.signer ?? renown?.signer;
+		try {
+			privacy = await startPrivacy({
+				config: privacyConfig,
+				reactorModule: (options.reactor ?? ownedReactorModule)?.reactorModule,
+				signer,
+				authorizationService: api.authorizationService,
+				documentPermissionService: api.documentPermissionService,
+				graphqlManager,
+				reactorClient: client,
+				logger: logger.child(["privacy"])
+			});
+		} catch (error) {
+			await workflowsRetry?.stop();
+			await workflows?.stop();
+			await abortBoot(api);
+			throw error;
+		}
+	}
+	const shutdown = async () => {
+		await privacy?.stop();
+		await workflowsRetry?.stop();
+		await workflows?.stop();
+		await api.dispose();
+	};
+	apiRef.current = { dispose: shutdown };
+	if (httpLoader) {
+		const packageManagementService = new PackageManagementService({
+			defaultRegistryUrl: registryUrl,
+			httpLoader,
+			documentModelRegistry,
+			packageManager: api.packageManager
+		});
+		packageManagementService.setOnModelsChanged(() => {
+			graphqlManager.regenerateDocumentModelSubgraphs().catch((error) => {
+				logger.error("Failed to regenerate document model subgraphs: @error", error);
+			});
+		});
+		const packagesSubgraph = new PackagesSubgraph({
+			relationalDb: void 0,
+			analyticsStore: void 0,
+			reactorClient: client,
+			graphqlManager,
+			syncManager: api.syncManager,
+			path: graphqlManager.getBasePath(),
+			authorizationService: graphqlManager.getAuthorizationService(),
+			packageManagementService,
+			http: graphqlManager.scopeForPackage("@powerhousedao/switchboard"),
+			attachments: api.attachmentClientProvider
+		});
+		lateSubgraphs.push(graphqlManager.registerSubgraphInstance(packagesSubgraph, "graphql", false).catch((error) => {
+			logger.error("Failed to register packages subgraph: @error", error);
+		}));
+	}
+	if (driveNodeView) {
+		graphqlManager.setAdditionalContextFields({ readModel: driveNodeView });
+		const authorizationService = graphqlManager.getAuthorizationService();
+		const reactorDriveSubgraph = {
+			name: "reactor-drive",
+			path: graphqlManager.getBasePath(),
+			resolvers: createReactorDriveResolvers({
+				reactorClient: client,
+				readModel: driveNodeView,
+				hostCanRead: (documentId, address) => authorizationService.canRead(documentId, address)
+			}),
+			typeDefs: reactorDriveSubgraphTypeDefs,
+			reactorClient: client,
+			relationalDb: void 0
+		};
+		lateSubgraphs.push(graphqlManager.registerSubgraphInstance(reactorDriveSubgraph, "graphql", false).catch((error) => {
+			logger.error("Failed to register reactor-drive subgraph: @error", error);
+		}));
+	}
+	(async () => {
+		await Promise.all(lateSubgraphs);
+		try {
+			await graphqlManager.updateRouter(true);
+		} catch (error) {
+			logger.error("Final router update before readiness failed: @error", error);
+		}
+		api.readiness.markReady();
+	})();
+	if (options.drive) {
+		if (!renown) throw new Error("Cannot create default drive without Renown identity");
+		if ((options.drive.documentType ?? "powerhouse/document-drive") === "powerhouse/reactor-drive") defaultDriveUrl = await addDefaultReactorDrive(client, options.drive, serverPort);
+		else defaultDriveUrl = await addDefaultDrive(client, options.drive, serverPort);
+	}
+	if (vite) api.httpAdapter.mountRawMiddleware(vite.middlewares);
+	if (remoteDrives.length > 0) for (const remoteDriveUrl of remoteDrives) {
+		let driveId;
+		try {
+			const { syncManager } = api;
+			const parsed = parseDriveUrl(remoteDriveUrl);
+			driveId = parsed.driveId;
+			const remoteName = `remote-drive-${driveId}-${crypto.randomUUID()}`;
+			await syncManager.add(remoteName, DriveCollectionId.forDrive(driveId), {
+				type: "gql",
+				parameters: { url: parsed.graphqlEndpoint }
+			});
+			logger.debug("Remote drive @remoteDriveUrl synced", remoteDriveUrl);
+		} catch (error) {
+			if (error instanceof Error && error.message.includes("already exists")) {
+				logger.debug("Remote drive already added: @remoteDriveUrl", remoteDriveUrl);
+				driveId = remoteDriveUrl.split("/").pop();
+			} else logger.error("Failed to connect to remote drive @remoteDriveUrl: @error", remoteDriveUrl, error);
+		} finally {
+			if (!defaultDriveUrl && driveId) defaultDriveUrl = `${options.https ? "https" : "http"}://localhost:${serverPort}/d/${driveId}`;
+		}
+	}
+	return {
+		defaultDriveUrl,
+		api,
+		reactor: client,
+		attachmentService,
+		attachmentReferenceProjection: api.attachmentReferenceProjection,
+		get workflowTriggers() {
+			return workflows?.triggers;
+		},
+		workflowsEnabled,
+		modelManifest: () => workerModels?.modelManifest() ?? [],
+		privacy: privacy ? { erasure: privacy.erasure } : void 0,
+		mcpEnabled: options.mcp !== false,
+		renown,
+		port: serverPort,
+		shutdown
+	};
+}
+/**
+* Boot the switchboard HTTP/GraphQL/MCP stack on top of a reactor.
+*
+* If `options.reactor` is provided, the switchboard reuses it instead of
+* building its own — the caller then owns the reactor's lifecycle and is
+* responsible for invoking `SwitchboardReactor.shutdown()` from their own
+* teardown / SIGINT path. The switchboard will not reach into the caller's
+* reactor; killing the reactor alone leaves the api/GraphQL/MCP resources
+* dangling until the process exits.
+*
+* When `options.reactor` is omitted, the switchboard builds and owns the
+* reactor. `shutdown()` on the returned handle only drains the api (HTTP
+* server, GraphQL, MCP, attachments); the reactor itself is torn down by
+* its own signal handlers (`withSignalHandlers`), which call `kill()` and
+* trigger the `withShutdownHook` chain that disposes the api. Programmatic
+* full teardown isn't currently exposed — wire it via SIGINT/SIGTERM.
+*/
+const startSwitchboard = async (options = {}) => {
+	const requestedPort = options.port ?? DEFAULT_PORT;
+	const logger = options.logger ?? defaultLogger;
+	if (process.env.PYROSCOPE_SERVER_ADDRESS) await initProfilerFromEnv(process.env).catch((error) => logger.error("Error starting profiler: @error", error));
+	const serverPort = await resolveServerPort(requestedPort, options.strictPort ?? false, logger);
+	const featureFlags = await initFeatureFlags();
+	const enableDocumentModelSubgraphs = await featureFlags.getBooleanValue(DOCUMENT_MODEL_SUBGRAPHS_ENABLED, options.enableDocumentModelSubgraphs ?? DOCUMENT_MODEL_SUBGRAPHS_ENABLED_DEFAULT);
+	options.enableDocumentModelSubgraphs = enableDocumentModelSubgraphs;
+	options.mcp = await resolveMcpEnabled({
+		featureFlags,
+		option: options.mcp
+	});
+	const configPathForFlags = resolveConfigPath(options.configFile);
+	const workflowsEnabled = await resolveWorkflowsEnabled({
+		featureFlags,
+		override: options.workflows?.enabled,
+		configEnabled: readConfigWorkflowsEnabled(configPathForFlags)
+	});
+	options.workflows = { enabled: workflowsEnabled };
+	const renownConfig = resolveRenownConfig(getConfig(resolveConfigPath(options.configFile)).auth?.renown, process.env, logger);
+	options.identity = {
+		...options.identity,
+		baseUrl: options.identity?.baseUrl ?? renownConfig.url
+	};
+	logger.info("Feature flags: @flags", JSON.stringify({
+		DOCUMENT_MODEL_SUBGRAPHS_ENABLED: enableDocumentModelSubgraphs,
+		MCP_ENABLED: options.mcp,
+		PH_WORKFLOWS_ENABLED: workflowsEnabled
+	}, null, 2));
+	let renown = null;
+	try {
+		renown = await initRenown(options.identity);
+	} catch (e) {
+		logger.warn("Failed to initialize ConnectCrypto: @error", e);
+		if (options.identity.requireExisting) throw new Error("Identity required but failed to initialize. Run \"ph login\" first.", { cause: e });
+	}
+	try {
+		return await initServer(serverPort, options, renown, renownConfig);
+	} catch (e) {
+		Sentry.captureException(e);
+		if (StoredDocumentsRefusedError.isError(e)) logger.error(e.message);
+		else logger.error("App crashed: @error", e);
+		throw e;
+	}
+};
+if (import.meta.main) await startSwitchboard({ fatalErrorShutdown: true });
+//#endregion
+export { StoredDocumentsRefusedError as a, initProfilerFromEnv as c, startSwitchboard as i, parseForcePgVersion as l, deriveAttachmentServiceConfig as n, resolveUnsupportedStoredDocuments as o, isPortAvailable as r, applySwitchboardReactorDefaults as s, createReactorKysely as t };
+
+//# sourceMappingURL=server-J9fpd42v.mjs.map
+//# debugId=e3d937b6-2957-5fe0-8fc9-bf4fd0c18c93