@powerhousedao/switchboard 6.2.2-dev.4 → 6.2.2-dev.40

package/CHANGELOG.md

@@ -1,3 +1,228 @@
+## 6.2.2-dev.40 (2026-08-08)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.39 (2026-08-07)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.38 (2026-08-06)
+
+### 🚀 Features
+
+- added recipe e2e tests to the suite ([88cd1a55c](https://github.com/powerhouse-inc/powerhouse/commit/88cd1a55c))
+- auth phase 4 ([28aa9ad6a](https://github.com/powerhouse-inc/powerhouse/commit/28aa9ad6a))
+
+### 🩹 Fixes
+
+- stage llm files from pre-commit hook ([0af2ab705](https://github.com/powerhouse-inc/powerhouse/commit/0af2ab705))
+- **reactor:** point preflight:auth at a real store ([c1315a9f9](https://github.com/powerhouse-inc/powerhouse/commit/c1315a9f9))
+- **reactor:** filter initialState and keep auth in a scoped subscription read ([77fee70b4](https://github.com/powerhouse-inc/powerhouse/commit/77fee70b4))
+- **reactor:** degrade the poll query against a remote on the older schema ([0c3aefe65](https://github.com/powerhouse-inc/powerhouse/commit/0c3aefe65))
+- **shared:** stop a state snapshot from installing or replacing a policy ([f947e562e](https://github.com/powerhouse-inc/powerhouse/commit/f947e562e))
+- **shared:** make auth-administration retention a reachability rule ([3db42daac](https://github.com/powerhouse-inc/powerhouse/commit/3db42daac))
+
+### ❤️ Thank You
+
+- Benjamin Jordan
+- Claude Fable 5
+
+## 6.2.2-dev.37 (2026-08-05)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.36 (2026-08-04)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.35 (2026-08-03)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.34 (2026-08-02)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.33 (2026-08-01)
+
+### 🩹 Fixes
+
+- **reactor:** fixing a few defects with document scope reshuffle specifics ([7546b9ff2](https://github.com/powerhouse-inc/powerhouse/commit/7546b9ff2))
+
+### ❤️ Thank You
+
+- Benjamin Jordan
+
+## 6.2.2-dev.32 (2026-07-31)
+
+### 🚀 Features
+
+- **reactor:** feature flag guards and spec updates to make plan for guarded reshuffle edge cases ([20b0fd6be](https://github.com/powerhouse-inc/powerhouse/commit/20b0fd6be))
+
+### 🩹 Fixes
+
+- **reactor:** fix convergence in the case we deny an operation that has a skip ([21cbb3ecb](https://github.com/powerhouse-inc/powerhouse/commit/21cbb3ecb))
+- auth-scope spec updates, assert ordered streams, and fix some busted default protocol versions ([97c5a37b5](https://github.com/powerhouse-inc/powerhouse/commit/97c5a37b5))
+
+### ❤️ Thank You
+
+- Benjamin Jordan
+
+## 6.2.2-dev.31 (2026-07-31)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.30 (2026-07-31)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.29 (2026-07-31)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.28 (2026-07-30)
+
+### 🚀 Features
+
+- **reactor-browser:** add IReactorBrowserClient and a light GraphQL client ([#2893](https://github.com/powerhouse-inc/powerhouse/pull/2893))
+- **reactor:** plugging in the first decision model ([27e9b2772](https://github.com/powerhouse-inc/powerhouse/commit/27e9b2772))
+
+### ❤️ Thank You
+
+- Benjamin Jordan
+- Guillermo Puente Sandoval @gpuente
+
+## 6.2.2-dev.27 (2026-07-30)
+
+### 🩹 Fixes
+
+- **connect:** pin @privy-io/react-auth to 3.35.0 ([909352ce3](https://github.com/powerhouse-inc/powerhouse/commit/909352ce3))
+
+### ❤️ Thank You
+
+- acaldas
+
+## 6.2.2-dev.26 (2026-07-30)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.25 (2026-07-29)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.24 (2026-07-29)
+
+### 🩹 Fixes
+
+- **reactor:** fix an issue exacerbated by auth where snapshots were ordered by insertion not revision ([4aa32fe1b](https://github.com/powerhouse-inc/powerhouse/commit/4aa32fe1b))
+
+### ❤️ Thank You
+
+- Benjamin Jordan
+
+## 6.2.2-dev.23 (2026-07-28)
+
+### 🩹 Fixes
+
+- **deps:** pin qr to 0.5.5 so RainbowKit can render the WalletConnect QR ([5343f9178](https://github.com/powerhouse-inc/powerhouse/commit/5343f9178))
+
+### ❤️ Thank You
+
+- acaldas
+
+## 6.2.2-dev.22 (2026-07-28)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.21 (2026-07-27)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.20 (2026-07-27)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.19 (2026-07-27)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.18 (2026-07-27)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.17 (2026-07-26)
+
+### 🚀 Features
+
+- **attachments:** S3-compatible storage, direct transfers, and document-derived authorization ([#2884](https://github.com/powerhouse-inc/powerhouse/pull/2884))
+
+### ❤️ Thank You
+
+- Guillermo Puente Sandoval @gpuente
+
+## 6.2.2-dev.16 (2026-07-25)
+
+### 🩹 Fixes
+
+- code review fixes ([318cbefa9](https://github.com/powerhouse-inc/powerhouse/commit/318cbefa9))
+- version 0 is reserved and only 1 and on is available for setting ([193ac4c56](https://github.com/powerhouse-inc/powerhouse/commit/193ac4c56))
+- resolve a contradiction in group membership ([39845a65c](https://github.com/powerhouse-inc/powerhouse/commit/39845a65c))
+- grant evaluation needs to ignore features that do not exist yet ([0c1d06396](https://github.com/powerhouse-inc/powerhouse/commit/0c1d06396))
+
+### ❤️ Thank You
+
+- Benjamin Jordan
+
+## 6.2.2-dev.15 (2026-07-24)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.14 (2026-07-23)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.13 (2026-07-23)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.12 (2026-07-23)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.11 (2026-07-22)
+
+### 🚀 Features
+
+- **connect:** dynamic packages can contribute to the PWA configuration ([da867e21d](https://github.com/powerhouse-inc/powerhouse/commit/da867e21d))
+
+### ❤️ Thank You
+
+- Yasiel Cabrera @YasielCabrera
+
+## 6.2.2-dev.10 (2026-07-21)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.9 (2026-07-20)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.8 (2026-07-19)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.7 (2026-07-18)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.6 (2026-07-17)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.5 (2026-07-17)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
 ## 6.2.2-dev.4 (2026-07-17)
 
 ### 🚀 Features

package/dist/index.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5a65c537-fadb-5705-95c0-4cec44d7b4d2")}catch(e){}}();
-import { a as parseForcePgVersion, r as startSwitchboard } from "./server-Cgud_ONM.mjs";
+import { a as parseForcePgVersion, r as startSwitchboard } from "./server-BLXBKOSF.mjs";
 import "./utils-Baw7rThP.mjs";
 import { metrics } from "@opentelemetry/api";
 import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";

package/dist/{server-Cgud_ONM.mjs → server-BLXBKOSF.mjs}

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5eb0a978-689a-51dd-978a-cd3d7fe5df4b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ca6cb919-a51c-59fe-9716-c135c0b04465")}catch(e){}}();
 import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-Baw7rThP.mjs";
 import { register } from "node:module";
 import * as Sentry from "@sentry/node";
@@ -10,10 +10,10 @@ import { existsSync, promises, realpathSync } from "node:fs";
 import path from "node:path";
 import { ReactorInstrumentation } from "@powerhousedao/opentelemetry-instrumentation-reactor";
 import { AtomicNodeFs } from "@powerhousedao/pglite-fs";
-import { ChannelScheme, DriveCollectionId, EventBus, REACTOR_SCHEMA, ReactorBuilder, ReactorClientBuilder, parseDriveUrl } from "@powerhousedao/reactor";
+import { ChannelScheme, DriveCollectionId, EventBus, REACTOR_SCHEMA, ReactorBuilder, ReactorClientBuilder, parseDriveUrl, supportsLiveReadModelRegistration } from "@powerhousedao/reactor";
 import { HttpPackageLoader, ImportPackageLoader, PackageManagementService, PackagesSubgraph, getUniqueDocumentModels, initializeAndStartAPI } from "@powerhousedao/reactor-api";
 import { httpsHooksPath } from "@powerhousedao/reactor-api/https-hooks";
-import { AttachmentAlreadyExists, AttachmentNotFound, AttachmentPending, HashMismatch, InvalidAttachmentRef, ReservationNotFound, SizeMismatch, UploadTooLarge, createRemoteAttachmentService } from "@powerhousedao/reactor-attachments";
+import { AttachmentAlreadyExists, AttachmentNotFound, AttachmentPending, AttachmentReferenceReadModel, AttachmentSchemaCompiler, HashMismatch, InvalidAttachmentRef, ReservationNotFound, SizeMismatch, UploadTooLarge, createRef, createRemoteAttachmentService, parseAttachmentDownloadTarget } from "@powerhousedao/reactor-attachments";
 import { DriveNodeView, NodeProcessor, ReactorDriveClient, createReactorDriveResolvers, reactorDriveDocumentModelModule, reactorDriveSubgraphTypeDefs } from "@powerhousedao/reactor-drive";
 import { Kysely, PostgresDialect } from "kysely";
 import net from "node:net";
@@ -64,13 +64,20 @@ async function loadPgDump(major) {
 }
 //#endregion
 //#region src/attachments/auth.ts
+const ANONYMOUS_ACTOR = {
+	user: void 0,
+	authEnabled: false
+};
 /**
 * Wrap a Node-style handler so that, when `authService` is provided and auth is
-* enabled, the request must carry a verifiable Bearer token.
+* enabled, the request must carry a verifiable Bearer token. The handler always
+* receives an actor context: the verified bearer user when auth is enabled, or
+* the anonymous context when it is disabled. With `allowAnonymous`, a missing
+* bearer yields an anonymous actor with `authEnabled: true` instead of a 401.
 */
-function requireAuth(authService, handler) {
-	if (!authService) return handler;
-	return async (req, res) => {
+function requireAuth(authService, handler, options) {
+	if (!authService) return (req, res, body) => handler(req, res, body, ANONYMOUS_ACTOR);
+	return async (req, res, body) => {
 		let result;
 		try {
 			result = await authService.verifyBearer(req.headers.authorization);
@@ -88,25 +95,32 @@ function requireAuth(authService, handler) {
 			res.end(body);
 			return;
 		}
-		if (result.auth_enabled && !result.user) {
+		if (result.auth_enabled && !result.user && !options?.allowAnonymous) {
 			res.statusCode = 401;
 			res.setHeader("Content-Type", "application/json");
 			res.end(JSON.stringify({ error: "Authentication required" }));
 			return;
 		}
-		await handler(req, res);
+		await handler(req, res, body, {
+			user: result.user,
+			authEnabled: result.auth_enabled
+		});
 	};
 }
 //#endregion
 //#region src/attachments/mount-auth.ts
 /**
 * Mount a Node-style attachment route with `requireAuth` applied unconditionally.
-* When `api.authService` is undefined (auth disabled), `requireAuth` returns the
-* handler unchanged — that is the only way to opt out. To register a route
-* without auth wrapping you must call `api.httpAdapter.mountNodeRoute` directly.
+* When `api.authService` is undefined (auth disabled), the handler still runs
+* through `requireAuth` and receives the anonymous actor context — that is the
+* only way to opt out of bearer verification. To register a route without auth
+* wrapping you must call `api.httpAdapter.mountNodeRoute` directly.
+*
+* `allowAnonymous` is reserved for routes whose handlers make a per-document
+* authorization decision themselves; identity-only routes must not use it.
 */
-function mountAuthenticatedNodeRoute(api, method, path, handler) {
-	api.httpAdapter.mountNodeRoute(method, path, requireAuth(api.authService, handler));
+function mountAuthenticatedNodeRoute(api, method, path, handler, options) {
+	api.httpAdapter.mountNodeRoute(method, path, requireAuth(api.authService, handler, options));
 }
 //#endregion
 //#region src/attachments/routes.ts
@@ -216,7 +230,8 @@ function makeReserveHandler(attachments) {
 		sendJson(res, 201, {
 			reservationId: upload.reservationId,
 			ref: upload.ref,
-			expiresAtUtc: upload.expiresAtUtc
+			expiresAtUtc: upload.expiresAtUtc,
+			...upload.uploadTarget ? { uploadTarget: upload.uploadTarget } : {}
 		});
 	};
 }
@@ -227,6 +242,10 @@ function makeUploadHandler(attachments) {
 			sendError(res, 400, "Missing reservationId");
 			return;
 		}
+		if (attachments.backend?.kind === "s3") {
+			sendError(res, 405, "Use the reservation uploadTarget for S3 uploads");
+			return;
+		}
 		let reservation;
 		try {
 			reservation = await attachments.reservations.get(reservationId);
@@ -373,6 +392,144 @@ function makeDeleteReservationHandler(attachments) {
 function extractParam(req, name) {
 	return req.params?.[name];
 }
+const MAX_DOCUMENT_ID_LEN = 512;
+const ATTACHMENT_NOT_FOUND_BODY = { error: "Attachment not found" };
+const MAX_DOWNLOAD_TARGET_TTL_SECONDS = 10080 * 60;
+/**
+* Returns the single `documentId` query value, or null when it is missing,
+* duplicated, blank, or oversized. Validation happens before authorization so
+* malformed requests never reach the access service.
+*/
+function extractSingleDocumentId(req) {
+	if (!req.url) return null;
+	let url;
+	try {
+		url = new URL(req.url, "http://switchboard.invalid");
+	} catch {
+		return null;
+	}
+	const values = url.searchParams.getAll("documentId");
+	if (values.length !== 1) return null;
+	const value = values[0];
+	if (value.trim().length === 0 || value.length > MAX_DOCUMENT_ID_LEN) return null;
+	return value;
+}
+/**
+* Returns the requested target TTL in seconds: undefined when absent,
+* "invalid" when malformed (duplicated, non-integer, or non-positive), and
+* otherwise the value clamped to the presigning ceiling.
+*/
+function extractExpiresIn(req) {
+	if (!req.url) return void 0;
+	let url;
+	try {
+		url = new URL(req.url, "http://switchboard.invalid");
+	} catch {
+		return;
+	}
+	const values = url.searchParams.getAll("expiresIn");
+	if (values.length === 0) return void 0;
+	if (values.length > 1) return "invalid";
+	const parsed = Number(values[0]);
+	if (!Number.isInteger(parsed) || parsed <= 0) return "invalid";
+	return Math.min(parsed, MAX_DOWNLOAD_TARGET_TTL_SECONDS);
+}
+/**
+* Base URL of this Switchboard as seen by the caller, used to build
+* filesystem `switchboard` download targets that point back at the existing
+* authenticated byte route.
+*/
+function requestBaseUrl(req) {
+	const forwardedProto = req.headers["x-forwarded-proto"];
+	const proto = (Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto)?.split(",")[0]?.trim() || (req.socket.encrypted ? "https" : "http");
+	const forwardedHost = req.headers["x-forwarded-host"];
+	const host = (Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost) ?? req.headers.host;
+	if (!host) return null;
+	return `${proto}://${host}`;
+}
+function makeDownloadTargetHandler(attachments, attachmentAccess) {
+	return async (req, res, _body, actor) => {
+		res.setHeader("Cache-Control", "no-store");
+		const hash = extractParam(req, "hash");
+		if (!hash || !HASH_PATTERN.test(hash)) {
+			sendError(res, 400, "Invalid attachment hash");
+			return;
+		}
+		const documentId = extractSingleDocumentId(req);
+		if (documentId === null) {
+			sendError(res, 400, "documentId is required exactly once as a non-empty query parameter");
+			return;
+		}
+		const expiresIn = extractExpiresIn(req);
+		if (expiresIn === "invalid") {
+			sendError(res, 400, "expiresIn must be a single positive integer number of seconds");
+			return;
+		}
+		const canonicalHash = hash.toLowerCase();
+		let decision;
+		try {
+			decision = await attachmentAccess.canReadAttachment({
+				documentId,
+				attachmentRef: createRef(canonicalHash),
+				userAddress: actor?.user?.address
+			});
+		} catch (err) {
+			logger$1.error("Attachment access decision failed: @error", err);
+			sendError(res, 500, "Internal error");
+			return;
+		}
+		if (decision.kind === "projection-unavailable") {
+			sendError(res, 503, "Attachment downloads are temporarily unavailable");
+			return;
+		}
+		if (decision.kind === "denied") {
+			sendJson(res, 404, ATTACHMENT_NOT_FOUND_BODY);
+			return;
+		}
+		let header;
+		try {
+			header = await attachments.store.stat(canonicalHash);
+		} catch (err) {
+			if (err instanceof AttachmentNotFound) {
+				sendJson(res, 404, ATTACHMENT_NOT_FOUND_BODY);
+				return;
+			}
+			logger$1.error("Attachment metadata lookup failed: @error", err);
+			sendError(res, 500, "Internal error");
+			return;
+		}
+		if (header.status !== "available") {
+			sendJson(res, 404, ATTACHMENT_NOT_FOUND_BODY);
+			return;
+		}
+		let target;
+		if (attachments.backend && attachments.backend.kind !== "filesystem") try {
+			target = await attachments.backend.prepareDownloadTarget(canonicalHash, expiresIn);
+		} catch {
+			sendError(res, 502, "Attachment download target unavailable");
+			return;
+		}
+		else {
+			const base = requestBaseUrl(req);
+			if (!base) {
+				sendError(res, 500, "Internal error");
+				return;
+			}
+			try {
+				target = parseAttachmentDownloadTarget({
+					kind: "switchboard",
+					method: "GET",
+					url: `${base}/attachments/${canonicalHash}`,
+					headers: {}
+				});
+			} catch {
+				sendError(res, 500, "Internal error");
+				return;
+			}
+		}
+		sendJson(res, 200, target);
+	};
+}
 //#endregion
 //#region src/attachments/index.ts
 function registerAttachmentRoutes(api) {
@@ -382,9 +539,50 @@ function registerAttachmentRoutes(api) {
 	mountAuthenticatedNodeRoute(api, "DELETE", "/attachments/reservations/:reservationId", makeDeleteReservationHandler(attachments));
 	mountAuthenticatedNodeRoute(api, "PUT", "/attachments/reservations/:reservationId", makeUploadHandler(attachments));
 	mountAuthenticatedNodeRoute(api, "HEAD", "/attachments/:hash", makeStatHandler(attachments));
+	mountAuthenticatedNodeRoute(api, "GET", "/attachments/:hash/download-target", makeDownloadTargetHandler(attachments, api.attachmentAccess), { allowAnonymous: true });
 	mountAuthenticatedNodeRoute(api, "GET", "/attachments/:hash", makeDownloadHandler(attachments));
 }
 //#endregion
+//#region src/attachment-reference-read-model.mts
+const attachmentSchemaCompiler = new AttachmentSchemaCompiler();
+function createAttachmentReferenceReadModel(baseKysely, dependencies, attachmentReferenceWriter) {
+	return new AttachmentReferenceReadModel(baseKysely.withSchema(REACTOR_SCHEMA), dependencies.operationIndex, dependencies.writeCache, dependencies.processorManagerConsistencyTracker, dependencies.documentModelRegistry, attachmentSchemaCompiler, attachmentReferenceWriter);
+}
+function registerAttachmentReferenceReadModel(reactorBuilder, registration) {
+	reactorBuilder.withReadModelFactory(async ({ documentModelRegistry, operationIndex, writeCache, processorManagerConsistencyTracker }) => {
+		const readModel = createAttachmentReferenceReadModel(registration.baseKysely, {
+			operationIndex,
+			writeCache,
+			processorManagerConsistencyTracker,
+			documentModelRegistry
+		}, registration.attachmentReferenceWriter);
+		await readModel.init();
+		return readModel;
+	});
+}
+async function registerAttachmentReferenceReadModelOnModule(clientModule, attachmentReferenceWriter) {
+	const reactorModule = clientModule.reactorModule;
+	if (!reactorModule) return {
+		status: "unavailable",
+		reason: "in-process-reactor-module-unavailable"
+	};
+	const coordinator = reactorModule.readModelCoordinator;
+	if (!supportsLiveReadModelRegistration(coordinator)) return {
+		status: "unavailable",
+		reason: "live-read-model-registration-unsupported"
+	};
+	const readModel = createAttachmentReferenceReadModel(reactorModule.database, {
+		operationIndex: reactorModule.operationIndex,
+		writeCache: reactorModule.writeCache,
+		processorManagerConsistencyTracker: reactorModule.processorManagerConsistencyTracker,
+		documentModelRegistry: reactorModule.documentModelRegistry
+	}, attachmentReferenceWriter);
+	await readModel.init();
+	coordinator.addReadModel(readModel, "pre_ready");
+	await readModel.init();
+	return { status: "available" };
+}
+//#endregion
 //#region src/builder-defaults.mts
 /**
 * Apply switchboard's standard configuration to a reactor + client builder
@@ -410,7 +608,10 @@ function applySwitchboardReactorDefaults(reactorBuilder, clientBuilder, options
 	const scheme = options.channelScheme === void 0 ? ChannelScheme.SWITCHBOARD : options.channelScheme;
 	if (scheme !== false) reactorBuilder.withChannelScheme(scheme);
 	if (options.signalHandlers !== false) reactorBuilder.withSignalHandlers();
-	if (options.executorConfig?.maxSkipThreshold !== void 0) reactorBuilder.withExecutorConfig({ maxSkipThreshold: options.executorConfig.maxSkipThreshold });
+	if (options.executorConfig?.maxSkipThreshold !== void 0 || options.executorConfig?.featureFlags !== void 0) reactorBuilder.withExecutorConfig({
+		...options.executorConfig.maxSkipThreshold !== void 0 ? { maxSkipThreshold: options.executorConfig.maxSkipThreshold } : {},
+		...options.executorConfig.featureFlags !== void 0 ? { featureFlags: options.executorConfig.featureFlags } : {}
+	});
 	if (options.documentModelLoader) reactorBuilder.withDocumentModelLoader(options.documentModelLoader);
 	if (options.logger) reactorBuilder.withLogger(options.logger);
 	if (options.signer) clientBuilder.withSigner(options.signer);
@@ -911,13 +1112,17 @@ async function initServer(serverPort, options, renown) {
 		});
 	}
 	const reactorLogger = logger.child(["reactor"]);
-	const initializeClient = async (documentModels) => {
+	const initializeClient = async (documentModels, { attachmentReferenceWriter }) => {
 		if (options.reactor) {
+			const attachmentReferenceProjection = await registerAttachmentReferenceReadModelOnModule(options.reactor, attachmentReferenceWriter);
 			if (options.reactor.reactorModule) {
 				new ReactorInstrumentation(options.reactor.reactorModule).start();
 				reactorLogger.info("Reactor metrics instrumentation started (using caller-provided reactor)");
 			}
-			return { module: options.reactor };
+			return {
+				module: options.reactor,
+				attachmentReferenceProjection
+			};
 		}
 		const baseKysely = await createReactorKysely({
 			reactorDbUrl,
@@ -930,13 +1135,22 @@ async function initServer(serverPort, options, renown) {
 		const maxSkipThreshold = parseInt(process.env.MAX_SKIP_THRESHOLD ?? "", 10);
 		const hasSkipThreshold = !isNaN(maxSkipThreshold) && maxSkipThreshold > 0;
 		if (hasSkipThreshold) logger.info(`Reactor maxSkipThreshold set to ${maxSkipThreshold}`);
-		if (hasSkipThreshold && workerPool) logger.warn("MAX_SKIP_THRESHOLD is not forwarded to executor workers and has no effect in worker-pool mode");
+		const documentDecisions = process.env.REACTOR_DOCUMENT_DECISIONS === "true";
+		if (documentDecisions) logger.info("Reactor document decisions enabled");
+		const authEnforcement = process.env.REACTOR_AUTH_ENFORCEMENT === "true";
+		if (authEnforcement) logger.info("Reactor auth enforcement enabled");
 		const reactorBuilder = new ReactorBuilder().withEventBus(new EventBus()).withKysely(baseKysely);
 		const clientBuilder = new ReactorClientBuilder().withReactorBuilder(reactorBuilder);
 		const vetraDocumentModels = dev ? Object.values(await import("@powerhousedao/vetra/document-models")).filter((m) => typeof m === "object" && m !== null && "documentModel" in m && "reducer" in m) : [];
 		applySwitchboardReactorDefaults(reactorBuilder, clientBuilder, {
 			documentModels: [...documentModels, ...vetraDocumentModels],
-			executorConfig: hasSkipThreshold ? { maxSkipThreshold } : void 0,
+			executorConfig: hasSkipThreshold || documentDecisions || authEnforcement ? {
+				...hasSkipThreshold ? { maxSkipThreshold } : {},
+				...documentDecisions || authEnforcement ? { featureFlags: {
+					...documentDecisions ? { documentDecisions: true } : {},
+					...authEnforcement ? { authEnforcement: true } : {}
+				} } : {}
+			} : void 0,
 			documentModelLoader: httpLoader && dynamicModelLoading ? httpLoader.documentModelLoader : void 0,
 			logger: reactorLogger,
 			signer: renown ? getRenownSignerConfig(renown, options.identity?.requireSignatures) : void 0
@@ -955,6 +1169,10 @@ async function initServer(serverPort, options, renown) {
 			await nodeProcessor.init();
 			return nodeProcessor;
 		});
+		registerAttachmentReferenceReadModel(reactorBuilder, {
+			baseKysely,
+			attachmentReferenceWriter
+		});
 		reactorBuilder.withShutdownHook(async () => {
 			if (apiRef.current) await apiRef.current.dispose();
 		});
@@ -969,7 +1187,8 @@ async function initServer(serverPort, options, renown) {
 			reactorDriveClient: new ReactorDriveClient({
 				reactor: module.client,
 				readModel: driveNodeView
-			})
+			}),
+			attachmentReferenceProjection: { status: "available" }
 		};
 	};
 	let defaultDriveUrl = void 0;
@@ -1100,6 +1319,7 @@ async function initServer(serverPort, options, renown) {
 		api,
 		reactor: client,
 		attachmentService,
+		attachmentReferenceProjection: api.attachmentReferenceProjection,
 		renown,
 		port: serverPort,
 		shutdown: () => api.dispose()
@@ -1157,5 +1377,5 @@ if (import.meta.main) await startSwitchboard();
 //#endregion
 export { parseForcePgVersion as a, applySwitchboardReactorDefaults as i, isPortAvailable as n, startSwitchboard as r, deriveAttachmentServiceConfig as t };
 
-//# sourceMappingURL=server-Cgud_ONM.mjs.map
-//# debugId=5eb0a978-689a-51dd-978a-cd3d7fe5df4b
+//# sourceMappingURL=server-BLXBKOSF.mjs.map
+//# debugId=ca6cb919-a51c-59fe-9716-c135c0b04465