@powerhousedao/switchboard 6.2.2-dev.7 → 6.2.2-dev.71

package/Auth.md

@@ -112,7 +112,7 @@ interface VerifiableCredential {
 1. **Token Decoding**: Extract credential information from JWT
 2. **Credential Validation**: Verify against W3C standards
 3. **Issuer Verification**: Check credential issuer authenticity
-4. **Renown API Check**: Validate credential still exists and is valid
+4. **Credential Existence Check**: Validate credential still exists and is valid — against a remote Renown/Switchboard or this switchboard's own read model (see [Which Renown Instance Is Used](#which-renown-instance-is-used))
 5. **User Extraction**: Create user object from verified credentials
 
 ### 5. **Authorization**
@@ -184,6 +184,64 @@ export ADMINS="0x111,0x222,0x333"
 }
 ```
 
+#### Which Renown Instance Is Used
+
+Step 4 of the verification process re-checks that the signer's Renown credential
+still exists. `auth.renown` says which instance answers that question:
+
+```json
+{
+  "auth": {
+    "enabled": true,
+    "admins": ["0x111"],
+    "renown": {
+      "source": "remote",
+      "url": "https://renown.acme.io",
+      "switchboardUrl": "https://sb.acme.io/graphql"
+    }
+  }
+}
+```
+
+| Field | Env override | Meaning |
+| --- | --- | --- |
+| `source` | `RENOWN_SOURCE` | `remote` (default) queries another instance; `self` reads this switchboard's own `renown-read-model` subgraph in-process. |
+| `url` | `RENOWN_URL` | Renown base URL, used for discovery and the REST fallback. Defaults to `https://www.renown.id`. |
+| `switchboardUrl` | `SWITCHBOARD_URL` | A switchboard's GraphQL endpoint to read credentials from directly, skipping discovery. |
+
+Env vars win over the config file field by field; a blank value counts as unset.
+With `source: "remote"` the order is `switchboardUrl`, then discovery via `url`,
+then the Renown REST API at `url`. With `source: "self"` both URLs are ignored
+for verification — but `url` still applies to this switchboard's own identity
+(below).
+
+Either way the credential's EIP-712 proof is re-verified and expiry and
+delegation binding are re-checked, so a locally stored credential is held to the
+same standard as a remote one. Successful checks are cached per identity for
+`CREDENTIAL_VERIFICATION_CACHE_TTL_MS` (60s default) in both modes, so
+revocation still lags by up to that TTL.
+
+`self` requires a loaded package that provides the `renown-read-model` subgraph
+(`@powerhousedao/renown-package`). Startup fails if none does, rather than booting
+a switchboard that rejects every authenticated request.
+
+Where the pieces live: `@renown/sdk` owns the read-model contract
+(`RENOWN_READ_MODEL_SUBGRAPH`, `createLocalCredentialVerifier`), this app wires
+it to the running reactor after the API is up, and `reactor-api` only supplies
+the generic `GraphQLManager.executeSubgraphQuery` plus an injectable
+`verifyCredential` — core has no knowledge of the renown package. A host that
+sets `source: "self"` without injecting a verifier is refused at boot rather
+than silently verified against a remote Renown.
+
+#### The Switchboard's Own Identity
+
+Separately from verifying incoming credentials, a switchboard has its own
+identity — the `ph login` keypair it uses to authenticate *outbound* to remote
+drives and services. It authenticates against `auth.renown.url` too, so one
+setting covers both directions. Pass `identity.baseUrl` when starting the server
+to point it somewhere else; unset everywhere, it falls back to
+`https://www.renown.id`.
+
 ### 2. **Frontend Integration**
 
 #### Using the useAuth Hook

package/CHANGELOG.md

@@ -1,3 +1,429 @@
+## 6.2.2-dev.71 (2026-09-01)
+
+### 🚀 Features
+
+- agent-managed Vetra with per-project ports ([#2946](https://github.com/powerhouse-inc/powerhouse/pull/2946))
+
+### 🩹 Fixes
+
+- **reactor-api:** hold @apollo/subgraph below 2.15 and use its array form ([ec6d19da0](https://github.com/powerhouse-inc/powerhouse/commit/ec6d19da0))
+
+### ❤️ Thank You
+
+- Benjamin Jordan
+- Claude Opus 5
+- Frank @froid1911
+
+## 6.2.2-dev.70 (2026-09-01)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.69 (2026-08-31)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.68 (2026-08-31)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.67 (2026-08-31)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.66 (2026-08-30)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.65 (2026-08-29)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.64 (2026-08-28)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.63 (2026-08-27)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.62 (2026-08-27)
+
+### 🩹 Fixes
+
+- **ci:** build before typecheck in simulate-ci-workflow ([2ecd03e81](https://github.com/powerhouse-inc/powerhouse/commit/2ecd03e81))
+- **windows:** spawn package managers through cross-spawn ([ff4140072](https://github.com/powerhouse-inc/powerhouse/commit/ff4140072))
+- **windows:** make package scripts runnable under cmd.exe ([987022ed9](https://github.com/powerhouse-inc/powerhouse/commit/987022ed9))
+
+### ❤️ Thank You
+
+- Claude Opus 5 (1M context)
+- Wouter Kampmann
+
+## 6.2.2-dev.61 (2026-08-26)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.60 (2026-08-26)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.59 (2026-08-25)
+
+### 🩹 Fixes
+
+- **reactor:** stable processor cursor ids behind legacyProcessorIds flag ([ee82e90b4](https://github.com/powerhouse-inc/powerhouse/commit/ee82e90b4))
+
+### ❤️ Thank You
+
+- acaldas
+
+## 6.2.2-dev.58 (2026-08-25)
+
+### 🚀 Features
+
+- **docker:** per-channel compose files on cr.vetra.io with fixed ports ([7d8f51b57](https://github.com/powerhouse-inc/powerhouse/commit/7d8f51b57))
+
+### 🩹 Fixes
+
+- **docker:** connect image HEALTHCHECK uses 127.0.0.1 ([4c80c5759](https://github.com/powerhouse-inc/powerhouse/commit/4c80c5759))
+- **docker:** healthcheck 127.0.0.1 instead of localhost in compose files ([e15bb8c9d](https://github.com/powerhouse-inc/powerhouse/commit/e15bb8c9d))
+
+### ❤️ Thank You
+
+- froid1911
+
+## 6.2.2-dev.57 (2026-08-24)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.56 (2026-08-23)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.55 (2026-08-22)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.54 (2026-08-21)
+
+### 🚀 Features
+
+- ⚠️  **reactor-api:** type the actions mutateDocument accepts ([1b9adbe2a](https://github.com/powerhouse-inc/powerhouse/commit/1b9adbe2a))
+
+### ⚠️  Breaking Changes
+
+- **reactor-api:** type the actions mutateDocument accepts  ([1b9adbe2a](https://github.com/powerhouse-inc/powerhouse/commit/1b9adbe2a))
+
+### ❤️ Thank You
+
+- Benjamin Jordan
+- Claude Fable 5
+
+## 6.2.2-dev.53 (2026-08-20)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.52 (2026-08-19)
+
+### 🚀 Features
+
+- **switchboard:** verify renown credentials against the reactor's own read model ([9e7efe532](https://github.com/powerhouse-inc/powerhouse/commit/9e7efe532))
+
+### 🩹 Fixes
+
+- **reactor-api,switchboard:** parse PGlite read-model timestamps as UTC ([e6e25758b](https://github.com/powerhouse-inc/powerhouse/commit/e6e25758b))
+
+### ❤️ Thank You
+
+- acaldas
+
+## 6.2.2-dev.51 (2026-08-19)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.50 (2026-08-18)
+
+### 🚀 Features
+
+- **switchboard:** read the group and condition enforcement flags ([e3d72b0a8](https://github.com/powerhouse-inc/powerhouse/commit/e3d72b0a8))
+
+### 🩹 Fixes
+
+- **ci:** install chromium from the package that owns playwright ([653349ee0](https://github.com/powerhouse-inc/powerhouse/commit/653349ee0))
+- **connect:** stage the CSP rewrite instead of sed -i ([ab5cd1d8f](https://github.com/powerhouse-inc/powerhouse/commit/ab5cd1d8f))
+
+### ❤️ Thank You
+
+- Benjamin Jordan
+- Claude Opus 5 (1M context)
+
+## 6.2.2-dev.49 (2026-08-17)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.48 (2026-08-15)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.47 (2026-08-14)
+
+### 🩹 Fixes
+
+- **connect:** sync CSP registry origin to runtime packageRegistryUrl ([418652419](https://github.com/powerhouse-inc/powerhouse/commit/418652419))
+
+### ❤️ Thank You
+
+- Frank Pfeift
+
+## 6.2.2-dev.46 (2026-08-14)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.45 (2026-08-13)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.44 (2026-08-12)
+
+### 🚀 Features
+
+- **reactor-api,codegen:** register upgrade manifests on the switchboard ([85383aa0f](https://github.com/powerhouse-inc/powerhouse/commit/85383aa0f))
+- **reactor-group:** ship the PHGroup document model as @powerhousedao/reactor-group ([d5a323016](https://github.com/powerhouse-inc/powerhouse/commit/d5a323016))
+
+### 🩹 Fixes
+
+- **shared:** harden the condition evaluator per review ([eea3fb475](https://github.com/powerhouse-inc/powerhouse/commit/eea3fb475))
+
+### ❤️ Thank You
+
+- Benjamin Jordan
+- Claude Fable 5
+
+## 6.2.2-dev.43 (2026-08-11)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.42 (2026-08-10)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.41 (2026-08-09)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.40 (2026-08-08)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.39 (2026-08-07)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.38 (2026-08-06)
+
+### 🚀 Features
+
+- added recipe e2e tests to the suite ([88cd1a55c](https://github.com/powerhouse-inc/powerhouse/commit/88cd1a55c))
+- auth phase 4 ([28aa9ad6a](https://github.com/powerhouse-inc/powerhouse/commit/28aa9ad6a))
+
+### 🩹 Fixes
+
+- stage llm files from pre-commit hook ([0af2ab705](https://github.com/powerhouse-inc/powerhouse/commit/0af2ab705))
+- **reactor:** point preflight:auth at a real store ([c1315a9f9](https://github.com/powerhouse-inc/powerhouse/commit/c1315a9f9))
+- **reactor:** filter initialState and keep auth in a scoped subscription read ([77fee70b4](https://github.com/powerhouse-inc/powerhouse/commit/77fee70b4))
+- **reactor:** degrade the poll query against a remote on the older schema ([0c3aefe65](https://github.com/powerhouse-inc/powerhouse/commit/0c3aefe65))
+- **shared:** stop a state snapshot from installing or replacing a policy ([f947e562e](https://github.com/powerhouse-inc/powerhouse/commit/f947e562e))
+- **shared:** make auth-administration retention a reachability rule ([3db42daac](https://github.com/powerhouse-inc/powerhouse/commit/3db42daac))
+
+### ❤️ Thank You
+
+- Benjamin Jordan
+- Claude Fable 5
+
+## 6.2.2-dev.37 (2026-08-05)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.36 (2026-08-04)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.35 (2026-08-03)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.34 (2026-08-02)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.33 (2026-08-01)
+
+### 🩹 Fixes
+
+- **reactor:** fixing a few defects with document scope reshuffle specifics ([7546b9ff2](https://github.com/powerhouse-inc/powerhouse/commit/7546b9ff2))
+
+### ❤️ Thank You
+
+- Benjamin Jordan
+
+## 6.2.2-dev.32 (2026-07-31)
+
+### 🚀 Features
+
+- **reactor:** feature flag guards and spec updates to make plan for guarded reshuffle edge cases ([20b0fd6be](https://github.com/powerhouse-inc/powerhouse/commit/20b0fd6be))
+
+### 🩹 Fixes
+
+- **reactor:** fix convergence in the case we deny an operation that has a skip ([21cbb3ecb](https://github.com/powerhouse-inc/powerhouse/commit/21cbb3ecb))
+- auth-scope spec updates, assert ordered streams, and fix some busted default protocol versions ([97c5a37b5](https://github.com/powerhouse-inc/powerhouse/commit/97c5a37b5))
+
+### ❤️ Thank You
+
+- Benjamin Jordan
+
+## 6.2.2-dev.31 (2026-07-31)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.30 (2026-07-31)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.29 (2026-07-31)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.28 (2026-07-30)
+
+### 🚀 Features
+
+- **reactor-browser:** add IReactorBrowserClient and a light GraphQL client ([#2893](https://github.com/powerhouse-inc/powerhouse/pull/2893))
+- **reactor:** plugging in the first decision model ([27e9b2772](https://github.com/powerhouse-inc/powerhouse/commit/27e9b2772))
+
+### ❤️ Thank You
+
+- Benjamin Jordan
+- Guillermo Puente Sandoval @gpuente
+
+## 6.2.2-dev.27 (2026-07-30)
+
+### 🩹 Fixes
+
+- **connect:** pin @privy-io/react-auth to 3.35.0 ([909352ce3](https://github.com/powerhouse-inc/powerhouse/commit/909352ce3))
+
+### ❤️ Thank You
+
+- acaldas
+
+## 6.2.2-dev.26 (2026-07-30)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.25 (2026-07-29)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.24 (2026-07-29)
+
+### 🩹 Fixes
+
+- **reactor:** fix an issue exacerbated by auth where snapshots were ordered by insertion not revision ([4aa32fe1b](https://github.com/powerhouse-inc/powerhouse/commit/4aa32fe1b))
+
+### ❤️ Thank You
+
+- Benjamin Jordan
+
+## 6.2.2-dev.23 (2026-07-28)
+
+### 🩹 Fixes
+
+- **deps:** pin qr to 0.5.5 so RainbowKit can render the WalletConnect QR ([5343f9178](https://github.com/powerhouse-inc/powerhouse/commit/5343f9178))
+
+### ❤️ Thank You
+
+- acaldas
+
+## 6.2.2-dev.22 (2026-07-28)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.21 (2026-07-27)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.20 (2026-07-27)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.19 (2026-07-27)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.18 (2026-07-27)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.17 (2026-07-26)
+
+### 🚀 Features
+
+- **attachments:** S3-compatible storage, direct transfers, and document-derived authorization ([#2884](https://github.com/powerhouse-inc/powerhouse/pull/2884))
+
+### ❤️ Thank You
+
+- Guillermo Puente Sandoval @gpuente
+
+## 6.2.2-dev.16 (2026-07-25)
+
+### 🩹 Fixes
+
+- code review fixes ([318cbefa9](https://github.com/powerhouse-inc/powerhouse/commit/318cbefa9))
+- version 0 is reserved and only 1 and on is available for setting ([193ac4c56](https://github.com/powerhouse-inc/powerhouse/commit/193ac4c56))
+- resolve a contradiction in group membership ([39845a65c](https://github.com/powerhouse-inc/powerhouse/commit/39845a65c))
+- grant evaluation needs to ignore features that do not exist yet ([0c1d06396](https://github.com/powerhouse-inc/powerhouse/commit/0c1d06396))
+
+### ❤️ Thank You
+
+- Benjamin Jordan
+
+## 6.2.2-dev.15 (2026-07-24)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.14 (2026-07-23)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.13 (2026-07-23)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.12 (2026-07-23)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.11 (2026-07-22)
+
+### 🚀 Features
+
+- **connect:** dynamic packages can contribute to the PWA configuration ([da867e21d](https://github.com/powerhouse-inc/powerhouse/commit/da867e21d))
+
+### ❤️ Thank You
+
+- Yasiel Cabrera @YasielCabrera
+
+## 6.2.2-dev.10 (2026-07-21)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.9 (2026-07-20)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.2-dev.8 (2026-07-19)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
 ## 6.2.2-dev.7 (2026-07-18)
 
 This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.

package/README.md

@@ -156,6 +156,43 @@ The same settings are available programmatically via
 `startSwitchboard({ workerPool: { numWorkers, dbPoolSizePerWorker, acquireTimeoutMs } })`,
 which takes precedence over the environment variables.
 
+### Reactor Enforcement Flags
+
+| Variable                       | Description                                                        | Default |
+| ------------------------------ | ------------------------------------------------------------------ | ------- |
+| `REACTOR_DOCUMENT_DECISIONS`   | Decide writes from the document stream, not the meta cache         | `false` |
+| `REACTOR_AUTH_ENFORCEMENT`     | Enforce the auth scope's policy at admission, replay and read      | `false` |
+| `REACTOR_AUTH_GROUPS`          | Let `{ group }` principals match against group-document rosters    | `false` |
+| `REACTOR_AUTH_CONDITIONS`      | Evaluate `where` / `match` conditions on grants                    | `false` |
+
+Set each to the literal `true` to enable. Each flag requires the one above it,
+and switchboard refuses to start on a set that skips one — a partially enforcing
+reactor would apply less than the operator asked for.
+
+These change replay outcomes, which are consensus outcomes, so **a flag flips
+for a whole document-sharing fleet, never per node**. Two nodes that share
+documents and disagree on the flags diverge, exactly as two nodes on
+incompatible versions would. Connect carries the same flags in
+`connect.reactor.featureFlags` (see `apps/connect/RUNTIME-CONFIG.md`); a fleet
+that includes browser replicas has to set them there too.
+
+Sweep the store before enabling either auth flag — neither unsafe condition is
+repairable after the fact, because the auth stream is never reshuffled:
+
+```bash
+cd packages/reactor && pnpm preflight:auth --pg <connection-string>
+```
+
+Exit `0` is clean for both; `1` means streams unsafe for `authEnforcement`, `2`
+means documents unsafe for `authConditions`, `3` both, and `68` means the run
+died having checked nothing. Gate on the whole code, not on a bit.
+
+One expectation worth stating: turning enforcement on protects nothing that
+already exists. The host's permission tables still own sync serving and the
+GraphQL boundary, and every document that predates the auth scope carries an
+uninitialized policy, which allows everything. Enforcement bites only on
+documents that have emitted `INITIALIZE_AUTH`.
+
 ### Authentication Configuration
 
 ```typescript

package/dist/index.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5a65c537-fadb-5705-95c0-4cec44d7b4d2")}catch(e){}}();
-import { a as parseForcePgVersion, r as startSwitchboard } from "./server-Cgud_ONM.mjs";
+import { a as parseForcePgVersion, r as startSwitchboard } from "./server-CQKVIxsA.mjs";
 import "./utils-Baw7rThP.mjs";
 import { metrics } from "@opentelemetry/api";
 import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";