@powerhousedao/switchboard 6.2.2-dev.9 → 6.2.2-staging.0

package/dist/{server-Cgud_ONM.mjs → server-DYraD11D.mjs}

@@ -1,25 +1,27 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5eb0a978-689a-51dd-978a-cd3d7fe5df4b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="65ab8387-7c36-5ebd-b971-913ce2e772b3")}catch(e){}}();
 import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-Baw7rThP.mjs";
 import { register } from "node:module";
+import { ReactorInstrumentation } from "@powerhousedao/opentelemetry-instrumentation-reactor";
 import * as Sentry from "@sentry/node";
 import { childLogger, documentModelDocumentModelModule, setLogLevel } from "document-model";
 import dotenv from "dotenv";
 import { getConfig } from "@powerhousedao/config/node";
 import { existsSync, promises, realpathSync } from "node:fs";
 import path from "node:path";
-import { ReactorInstrumentation } from "@powerhousedao/opentelemetry-instrumentation-reactor";
 import { AtomicNodeFs } from "@powerhousedao/pglite-fs";
-import { ChannelScheme, DriveCollectionId, EventBus, REACTOR_SCHEMA, ReactorBuilder, ReactorClientBuilder, parseDriveUrl } from "@powerhousedao/reactor";
-import { HttpPackageLoader, ImportPackageLoader, PackageManagementService, PackagesSubgraph, getUniqueDocumentModels, initializeAndStartAPI } from "@powerhousedao/reactor-api";
+import { ChannelScheme, DriveCollectionId, EventBus, REACTOR_SCHEMA, ReactorBuilder, ReactorClientBuilder, instrumentPgPool, parseDriveUrl, supportsLiveReadModelRegistration } from "@powerhousedao/reactor";
+import { HttpPackageLoader, ImportPackageLoader, PGLITE_UTC_PARSERS, PackageManagementService, PackagesSubgraph, getUniqueDocumentModels, initializeAndStartAPI, resolveRenownConfig } from "@powerhousedao/reactor-api";
 import { httpsHooksPath } from "@powerhousedao/reactor-api/https-hooks";
-import { AttachmentAlreadyExists, AttachmentNotFound, AttachmentPending, HashMismatch, InvalidAttachmentRef, ReservationNotFound, SizeMismatch, UploadTooLarge, createRemoteAttachmentService } from "@powerhousedao/reactor-attachments";
+import { AttachmentAlreadyExists, AttachmentNotFound, AttachmentPending, AttachmentReferenceReadModel, AttachmentSchemaCompiler, HashMismatch, InvalidAttachmentRef, ReservationNotFound, SizeMismatch, UploadTooLarge, createRef, createRemoteAttachmentService, parseAttachmentDownloadTarget } from "@powerhousedao/reactor-attachments";
 import { DriveNodeView, NodeProcessor, ReactorDriveClient, createReactorDriveResolvers, reactorDriveDocumentModelModule, reactorDriveSubgraphTypeDefs } from "@powerhousedao/reactor-drive";
+import { DEFAULT_RENOWN_URL, NodeKeyStorage, RENOWN_READ_MODEL_SUBGRAPH, RenownBuilder, RenownCryptoBuilder, createLocalCredentialVerifier, createSignatureVerifier } from "@renown/sdk/node";
 import { Kysely, PostgresDialect } from "kysely";
 import net from "node:net";
 import path$1 from "path";
 import { Pool } from "pg";
 import { Readable } from "node:stream";
+import { ReactorGroupV1 } from "@powerhousedao/reactor-group";
 import { driveDocumentModelModule } from "@powerhousedao/shared/document-drive";
 import { readFile } from "node:fs/promises";
 import os from "node:os";
@@ -27,7 +29,6 @@ import { fileURLToPath } from "node:url";
 import { EnvVarProvider } from "@openfeature/env-var-provider";
 import { OpenFeature } from "@openfeature/server-sdk";
 import { PGliteDialect } from "kysely-pglite-dialect";
-import { DEFAULT_RENOWN_URL, NodeKeyStorage, RenownBuilder, RenownCryptoBuilder, createSignatureVerifier } from "@renown/sdk/node";
 //#region src/pglite-version.ts
 const SUPPORTED_PG_MAJORS = [16, 17];
 async function readPgVersionFile(dataDir) {
@@ -64,13 +65,20 @@ async function loadPgDump(major) {
 }
 //#endregion
 //#region src/attachments/auth.ts
+const ANONYMOUS_ACTOR = {
+	user: void 0,
+	authEnabled: false
+};
 /**
 * Wrap a Node-style handler so that, when `authService` is provided and auth is
-* enabled, the request must carry a verifiable Bearer token.
+* enabled, the request must carry a verifiable Bearer token. The handler always
+* receives an actor context: the verified bearer user when auth is enabled, or
+* the anonymous context when it is disabled. With `allowAnonymous`, a missing
+* bearer yields an anonymous actor with `authEnabled: true` instead of a 401.
 */
-function requireAuth(authService, handler) {
-	if (!authService) return handler;
-	return async (req, res) => {
+function requireAuth(authService, handler, options) {
+	if (!authService) return (req, res, body) => handler(req, res, body, ANONYMOUS_ACTOR);
+	return async (req, res, body) => {
 		let result;
 		try {
 			result = await authService.verifyBearer(req.headers.authorization);
@@ -88,25 +96,32 @@ function requireAuth(authService, handler) {
 			res.end(body);
 			return;
 		}
-		if (result.auth_enabled && !result.user) {
+		if (result.auth_enabled && !result.user && !options?.allowAnonymous) {
 			res.statusCode = 401;
 			res.setHeader("Content-Type", "application/json");
 			res.end(JSON.stringify({ error: "Authentication required" }));
 			return;
 		}
-		await handler(req, res);
+		await handler(req, res, body, {
+			user: result.user,
+			authEnabled: result.auth_enabled
+		});
 	};
 }
 //#endregion
 //#region src/attachments/mount-auth.ts
 /**
 * Mount a Node-style attachment route with `requireAuth` applied unconditionally.
-* When `api.authService` is undefined (auth disabled), `requireAuth` returns the
-* handler unchanged — that is the only way to opt out. To register a route
-* without auth wrapping you must call `api.httpAdapter.mountNodeRoute` directly.
+* When `api.authService` is undefined (auth disabled), the handler still runs
+* through `requireAuth` and receives the anonymous actor context — that is the
+* only way to opt out of bearer verification. To register a route without auth
+* wrapping you must call `api.httpAdapter.mountNodeRoute` directly.
+*
+* `allowAnonymous` is reserved for routes whose handlers make a per-document
+* authorization decision themselves; identity-only routes must not use it.
 */
-function mountAuthenticatedNodeRoute(api, method, path, handler) {
-	api.httpAdapter.mountNodeRoute(method, path, requireAuth(api.authService, handler));
+function mountAuthenticatedNodeRoute(api, method, path, handler, options) {
+	api.httpAdapter.mountNodeRoute(method, path, requireAuth(api.authService, handler, options));
 }
 //#endregion
 //#region src/attachments/routes.ts
@@ -216,7 +231,8 @@ function makeReserveHandler(attachments) {
 		sendJson(res, 201, {
 			reservationId: upload.reservationId,
 			ref: upload.ref,
-			expiresAtUtc: upload.expiresAtUtc
+			expiresAtUtc: upload.expiresAtUtc,
+			...upload.uploadTarget ? { uploadTarget: upload.uploadTarget } : {}
 		});
 	};
 }
@@ -227,6 +243,10 @@ function makeUploadHandler(attachments) {
 			sendError(res, 400, "Missing reservationId");
 			return;
 		}
+		if (attachments.backend?.kind === "s3") {
+			sendError(res, 405, "Use the reservation uploadTarget for S3 uploads");
+			return;
+		}
 		let reservation;
 		try {
 			reservation = await attachments.reservations.get(reservationId);
@@ -373,6 +393,144 @@ function makeDeleteReservationHandler(attachments) {
 function extractParam(req, name) {
 	return req.params?.[name];
 }
+const MAX_DOCUMENT_ID_LEN = 512;
+const ATTACHMENT_NOT_FOUND_BODY = { error: "Attachment not found" };
+const MAX_DOWNLOAD_TARGET_TTL_SECONDS = 10080 * 60;
+/**
+* Returns the single `documentId` query value, or null when it is missing,
+* duplicated, blank, or oversized. Validation happens before authorization so
+* malformed requests never reach the access service.
+*/
+function extractSingleDocumentId(req) {
+	if (!req.url) return null;
+	let url;
+	try {
+		url = new URL(req.url, "http://switchboard.invalid");
+	} catch {
+		return null;
+	}
+	const values = url.searchParams.getAll("documentId");
+	if (values.length !== 1) return null;
+	const value = values[0];
+	if (value.trim().length === 0 || value.length > MAX_DOCUMENT_ID_LEN) return null;
+	return value;
+}
+/**
+* Returns the requested target TTL in seconds: undefined when absent,
+* "invalid" when malformed (duplicated, non-integer, or non-positive), and
+* otherwise the value clamped to the presigning ceiling.
+*/
+function extractExpiresIn(req) {
+	if (!req.url) return void 0;
+	let url;
+	try {
+		url = new URL(req.url, "http://switchboard.invalid");
+	} catch {
+		return;
+	}
+	const values = url.searchParams.getAll("expiresIn");
+	if (values.length === 0) return void 0;
+	if (values.length > 1) return "invalid";
+	const parsed = Number(values[0]);
+	if (!Number.isInteger(parsed) || parsed <= 0) return "invalid";
+	return Math.min(parsed, MAX_DOWNLOAD_TARGET_TTL_SECONDS);
+}
+/**
+* Base URL of this Switchboard as seen by the caller, used to build
+* filesystem `switchboard` download targets that point back at the existing
+* authenticated byte route.
+*/
+function requestBaseUrl(req) {
+	const forwardedProto = req.headers["x-forwarded-proto"];
+	const proto = (Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto)?.split(",")[0]?.trim() || (req.socket.encrypted ? "https" : "http");
+	const forwardedHost = req.headers["x-forwarded-host"];
+	const host = (Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost) ?? req.headers.host;
+	if (!host) return null;
+	return `${proto}://${host}`;
+}
+function makeDownloadTargetHandler(attachments, attachmentAccess) {
+	return async (req, res, _body, actor) => {
+		res.setHeader("Cache-Control", "no-store");
+		const hash = extractParam(req, "hash");
+		if (!hash || !HASH_PATTERN.test(hash)) {
+			sendError(res, 400, "Invalid attachment hash");
+			return;
+		}
+		const documentId = extractSingleDocumentId(req);
+		if (documentId === null) {
+			sendError(res, 400, "documentId is required exactly once as a non-empty query parameter");
+			return;
+		}
+		const expiresIn = extractExpiresIn(req);
+		if (expiresIn === "invalid") {
+			sendError(res, 400, "expiresIn must be a single positive integer number of seconds");
+			return;
+		}
+		const canonicalHash = hash.toLowerCase();
+		let decision;
+		try {
+			decision = await attachmentAccess.canReadAttachment({
+				documentId,
+				attachmentRef: createRef(canonicalHash),
+				userAddress: actor?.user?.address
+			});
+		} catch (err) {
+			logger$1.error("Attachment access decision failed: @error", err);
+			sendError(res, 500, "Internal error");
+			return;
+		}
+		if (decision.kind === "projection-unavailable") {
+			sendError(res, 503, "Attachment downloads are temporarily unavailable");
+			return;
+		}
+		if (decision.kind === "denied") {
+			sendJson(res, 404, ATTACHMENT_NOT_FOUND_BODY);
+			return;
+		}
+		let header;
+		try {
+			header = await attachments.store.stat(canonicalHash);
+		} catch (err) {
+			if (err instanceof AttachmentNotFound) {
+				sendJson(res, 404, ATTACHMENT_NOT_FOUND_BODY);
+				return;
+			}
+			logger$1.error("Attachment metadata lookup failed: @error", err);
+			sendError(res, 500, "Internal error");
+			return;
+		}
+		if (header.status !== "available") {
+			sendJson(res, 404, ATTACHMENT_NOT_FOUND_BODY);
+			return;
+		}
+		let target;
+		if (attachments.backend && attachments.backend.kind !== "filesystem") try {
+			target = await attachments.backend.prepareDownloadTarget(canonicalHash, expiresIn);
+		} catch {
+			sendError(res, 502, "Attachment download target unavailable");
+			return;
+		}
+		else {
+			const base = requestBaseUrl(req);
+			if (!base) {
+				sendError(res, 500, "Internal error");
+				return;
+			}
+			try {
+				target = parseAttachmentDownloadTarget({
+					kind: "switchboard",
+					method: "GET",
+					url: `${base}/attachments/${canonicalHash}`,
+					headers: {}
+				});
+			} catch {
+				sendError(res, 500, "Internal error");
+				return;
+			}
+		}
+		sendJson(res, 200, target);
+	};
+}
 //#endregion
 //#region src/attachments/index.ts
 function registerAttachmentRoutes(api) {
@@ -382,9 +540,50 @@ function registerAttachmentRoutes(api) {
 	mountAuthenticatedNodeRoute(api, "DELETE", "/attachments/reservations/:reservationId", makeDeleteReservationHandler(attachments));
 	mountAuthenticatedNodeRoute(api, "PUT", "/attachments/reservations/:reservationId", makeUploadHandler(attachments));
 	mountAuthenticatedNodeRoute(api, "HEAD", "/attachments/:hash", makeStatHandler(attachments));
+	mountAuthenticatedNodeRoute(api, "GET", "/attachments/:hash/download-target", makeDownloadTargetHandler(attachments, api.attachmentAccess), { allowAnonymous: true });
 	mountAuthenticatedNodeRoute(api, "GET", "/attachments/:hash", makeDownloadHandler(attachments));
 }
 //#endregion
+//#region src/attachment-reference-read-model.mts
+const attachmentSchemaCompiler = new AttachmentSchemaCompiler();
+function createAttachmentReferenceReadModel(baseKysely, dependencies, attachmentReferenceWriter) {
+	return new AttachmentReferenceReadModel(baseKysely.withSchema(REACTOR_SCHEMA), dependencies.operationIndex, dependencies.writeCache, dependencies.processorManagerConsistencyTracker, dependencies.documentModelRegistry, attachmentSchemaCompiler, attachmentReferenceWriter);
+}
+function registerAttachmentReferenceReadModel(reactorBuilder, registration) {
+	reactorBuilder.withReadModelFactory(async ({ documentModelRegistry, operationIndex, writeCache, processorManagerConsistencyTracker }) => {
+		const readModel = createAttachmentReferenceReadModel(registration.baseKysely, {
+			operationIndex,
+			writeCache,
+			processorManagerConsistencyTracker,
+			documentModelRegistry
+		}, registration.attachmentReferenceWriter);
+		await readModel.init();
+		return readModel;
+	});
+}
+async function registerAttachmentReferenceReadModelOnModule(clientModule, attachmentReferenceWriter) {
+	const reactorModule = clientModule.reactorModule;
+	if (!reactorModule) return {
+		status: "unavailable",
+		reason: "in-process-reactor-module-unavailable"
+	};
+	const coordinator = reactorModule.readModelCoordinator;
+	if (!supportsLiveReadModelRegistration(coordinator)) return {
+		status: "unavailable",
+		reason: "live-read-model-registration-unsupported"
+	};
+	const readModel = createAttachmentReferenceReadModel(reactorModule.database, {
+		operationIndex: reactorModule.operationIndex,
+		writeCache: reactorModule.writeCache,
+		processorManagerConsistencyTracker: reactorModule.processorManagerConsistencyTracker,
+		documentModelRegistry: reactorModule.documentModelRegistry
+	}, attachmentReferenceWriter);
+	await readModel.init();
+	coordinator.addReadModel(readModel, "pre_ready");
+	await readModel.init();
+	return { status: "available" };
+}
+//#endregion
 //#region src/builder-defaults.mts
 /**
 * Apply switchboard's standard configuration to a reactor + client builder
@@ -400,17 +599,22 @@ function switchboardBaseDocumentModels() {
 	return [
 		documentModelDocumentModelModule,
 		driveDocumentModelModule,
-		reactorDriveDocumentModelModule
+		reactorDriveDocumentModelModule,
+		ReactorGroupV1
 	];
 }
 function applySwitchboardReactorDefaults(reactorBuilder, clientBuilder, options = {}) {
 	const baseModels = options.includeBaseModels !== false ? switchboardBaseDocumentModels() : [];
 	const extra = options.documentModels ?? [];
 	if (baseModels.length || extra.length) reactorBuilder.withDocumentModelSources(getUniqueDocumentModels(baseModels, extra));
+	if (options.upgradeManifests?.length) reactorBuilder.withUpgradeManifests(options.upgradeManifests);
 	const scheme = options.channelScheme === void 0 ? ChannelScheme.SWITCHBOARD : options.channelScheme;
 	if (scheme !== false) reactorBuilder.withChannelScheme(scheme);
 	if (options.signalHandlers !== false) reactorBuilder.withSignalHandlers();
-	if (options.executorConfig?.maxSkipThreshold !== void 0) reactorBuilder.withExecutorConfig({ maxSkipThreshold: options.executorConfig.maxSkipThreshold });
+	if (options.executorConfig?.maxSkipThreshold !== void 0 || options.executorConfig?.featureFlags !== void 0) reactorBuilder.withExecutorConfig({
+		...options.executorConfig.maxSkipThreshold !== void 0 ? { maxSkipThreshold: options.executorConfig.maxSkipThreshold } : {},
+		...options.executorConfig.featureFlags !== void 0 ? { featureFlags: options.executorConfig.featureFlags } : {}
+	});
 	if (options.documentModelLoader) reactorBuilder.withDocumentModelLoader(options.documentModelLoader);
 	if (options.logger) reactorBuilder.withLogger(options.logger);
 	if (options.signer) clientBuilder.withSigner(options.signer);
@@ -419,6 +623,7 @@ function applySwitchboardReactorDefaults(reactorBuilder, clientBuilder, options
 //#region src/worker-pool.mts
 const DEFAULT_DB_POOL_SIZE_PER_WORKER = 2;
 const DEFAULT_ACQUIRE_TIMEOUT_MS = 5e3;
+const DEFAULT_DB_POOL_SIZE_HOST = 16;
 const AUTO_RESERVED_CORES = 2;
 const AUTO_WORKER_CAP = 8;
 /** Worker count for "auto": always at least 1 — auto sizes the pool, it does not turn worker mode off. */
@@ -444,6 +649,23 @@ function resolveWorkerPoolOptions(input, env, availableCores = os.availableParal
 	};
 }
 /**
+* Size of the reactor's own (host) Postgres pool. Unlike the worker pool there
+* is no "disabled" state — the host pool is the only Postgres pool in the
+* server path, backing both reactor storage and the read models that reach it
+* via `withSchema` — so 0 is rejected rather than read as "off".
+*
+* The acquire timeout is deliberately not configurable here: the host pool
+* waits indefinitely today, and making it finite converts saturation from a
+* latency problem into a thrown error on the read-model path. That is a
+* behavior change worth making separately, once the retry semantics of a
+* rejected `pool.connect()` inside the read-model coordinator are settled.
+*/
+function resolveHostPoolSize(env) {
+	const poolSize = parseNonNegativeInt(env.REACTOR_DB_POOL_SIZE_HOST, "REACTOR_DB_POOL_SIZE_HOST") ?? DEFAULT_DB_POOL_SIZE_HOST;
+	if (poolSize < 1) throw new Error("REACTOR_DB_POOL_SIZE_HOST must be at least 1; the host pool cannot be disabled");
+	return poolSize;
+}
+/**
 * DbConfig for each worker's own pool, parsed from a postgres:// URL.
 * Explicit host, database, and user are required — no pg-side defaults.
 */
@@ -723,6 +945,26 @@ async function rollback(dataDir, backupDir, originalError, logger) {
 	logger.error(`[pglite-migration] Migration failed for ${dataDir}; rolled back from ${backupDir}. Original error: ${String(originalError)}`);
 }
 //#endregion
+//#region src/reactor-feature-flags.mts
+/**
+* Enforcement flags from the REACTOR_* env vars. Each flag requires the ones
+* before it; the reactor rejects an inconsistent set rather than enforcing less
+* than the operator asked for, so this reports what was asked without
+* correcting it.
+*/
+function resolveReactorFeatureFlags(env) {
+	const flags = {
+		documentDecisions: env.REACTOR_DOCUMENT_DECISIONS === "true",
+		authEnforcement: env.REACTOR_AUTH_ENFORCEMENT === "true",
+		authGroups: env.REACTOR_AUTH_GROUPS === "true",
+		authConditions: env.REACTOR_AUTH_CONDITIONS === "true"
+	};
+	return {
+		flags,
+		enabled: Object.entries(flags).filter(([, isEnabled]) => isEnabled).map(([name]) => name)
+	};
+}
+//#endregion
 //#region src/renown.ts
 const logger = childLogger(["switchboard", "renown"]);
 /**
@@ -793,6 +1035,10 @@ function isPortAvailable(port) {
 		});
 	});
 }
+/** The powerhouse.config.json this run reads, defaulting to the cwd copy. */
+function resolveConfigPath(configFile) {
+	return configFile ?? path$1.join(process.cwd(), "powerhouse.config.json");
+}
 async function resolveServerPort(requested, strictPort, logger) {
 	if (strictPort) return requested;
 	for (let i = 0; i < PORT_FALLBACK_ATTEMPTS; i++) {
@@ -805,11 +1051,20 @@ async function resolveServerPort(requested, strictPort, logger) {
 	return requested;
 }
 async function createReactorKysely(opts) {
-	const { reactorDbUrl, reactorPgliteDir, reactorPgliteMajor, inMemory, flushIntervalMs, logger } = opts;
+	const { reactorDbUrl, reactorPgliteDir, reactorPgliteMajor, inMemory, flushIntervalMs, hostPoolSize, logger } = opts;
 	if (reactorDbUrl && isPostgresUrl(reactorDbUrl)) {
-		const pool = new Pool({ connectionString: reactorDbUrl.includes("?") ? reactorDbUrl : `${reactorDbUrl}?sslmode=disable` });
-		logger.info("Using PostgreSQL for reactor storage");
-		return new Kysely({ dialect: new PostgresDialect({ pool }) });
+		const connectionString = reactorDbUrl.includes("?") ? reactorDbUrl : `${reactorDbUrl}?sslmode=disable`;
+		const poolSize = hostPoolSize();
+		const pool = new Pool({
+			connectionString,
+			max: poolSize
+		});
+		const poolInstrumentation = instrumentPgPool(pool, "reactor-host");
+		logger.info(`Using PostgreSQL for reactor storage (host pool max ${poolSize})`);
+		return {
+			kysely: new Kysely({ dialect: new PostgresDialect({ pool }) }),
+			poolInstrumentation
+		};
 	}
 	if (!reactorPgliteDir || reactorPgliteMajor === null) throw new Error("Reactor PGLite directory not resolved");
 	const { PGlite } = await loadPGliteModule(reactorPgliteMajor);
@@ -818,7 +1073,10 @@ async function createReactorKysely(opts) {
 		flushIntervalMs
 	}) });
 	logger.info(inMemory ? `Using in-memory PGlite (PG${reactorPgliteMajor}) for reactor storage [PH_PGLITE_IN_MEMORY=1]` : `Using PGlite (PG${reactorPgliteMajor}) for reactor storage at ${reactorPgliteDir}`);
-	return new Kysely({ dialect: new ClosablePGliteDialect(pglite) });
+	return {
+		kysely: new Kysely({ dialect: new ClosablePGliteDialect(pglite) }),
+		poolInstrumentation: void 0
+	};
 }
 /** Derive the remote attachment service config for switchboard's own `/attachments/*` API. */
 function deriveAttachmentServiceConfig(options, serverPort, renown) {
@@ -831,7 +1089,7 @@ function deriveAttachmentServiceConfig(options, serverPort, renown) {
 		}) : void 0 : void 0
 	};
 }
-async function initServer(serverPort, options, renown) {
+async function initServer(serverPort, options, renown, renownConfig) {
 	const { dev, packages = [], remoteDrives = [], logger = defaultLogger } = options;
 	logger.level = LogLevel;
 	const dbPath = options.dbPath ?? process.env.DATABASE_URL ?? process.env.PH_SWITCHBOARD_DATABASE_URL;
@@ -897,7 +1155,8 @@ async function initServer(serverPort, options, renown) {
 	}
 	const apiRef = { current: void 0 };
 	let driveNodeView;
-	const config = getConfig(options.configFile ?? path$1.join(process.cwd(), "powerhouse.config.json"));
+	const configPath = resolveConfigPath(options.configFile);
+	const config = getConfig(configPath);
 	const registryUrl = options.registryUrl ?? process.env.PH_REGISTRY_URL ?? config.packageRegistryUrl;
 	const registryPackages = process.env.PH_REGISTRY_PACKAGES;
 	const dynamicModelLoading = options.dynamicModelLoading ?? process.env.DYNAMIC_MODEL_LOADING === "true";
@@ -911,32 +1170,44 @@ async function initServer(serverPort, options, renown) {
 		});
 	}
 	const reactorLogger = logger.child(["reactor"]);
-	const initializeClient = async (documentModels) => {
+	let ownedReactorModule;
+	const initializeClient = async (documentModels, { attachmentReferenceWriter, upgradeManifests }) => {
 		if (options.reactor) {
+			const attachmentReferenceProjection = await registerAttachmentReferenceReadModelOnModule(options.reactor, attachmentReferenceWriter);
 			if (options.reactor.reactorModule) {
 				new ReactorInstrumentation(options.reactor.reactorModule).start();
 				reactorLogger.info("Reactor metrics instrumentation started (using caller-provided reactor)");
 			}
-			return { module: options.reactor };
+			return {
+				module: options.reactor,
+				attachmentReferenceProjection
+			};
 		}
-		const baseKysely = await createReactorKysely({
+		const { kysely: baseKysely, poolInstrumentation } = await createReactorKysely({
 			reactorDbUrl,
 			reactorPgliteDir,
 			reactorPgliteMajor,
 			inMemory: PGLITE_IN_MEMORY,
 			flushIntervalMs: PGLITE_FLUSH_INTERVAL_MS,
+			hostPoolSize: () => resolveHostPoolSize(process.env),
 			logger
 		});
 		const maxSkipThreshold = parseInt(process.env.MAX_SKIP_THRESHOLD ?? "", 10);
 		const hasSkipThreshold = !isNaN(maxSkipThreshold) && maxSkipThreshold > 0;
 		if (hasSkipThreshold) logger.info(`Reactor maxSkipThreshold set to ${maxSkipThreshold}`);
-		if (hasSkipThreshold && workerPool) logger.warn("MAX_SKIP_THRESHOLD is not forwarded to executor workers and has no effect in worker-pool mode");
-		const reactorBuilder = new ReactorBuilder().withEventBus(new EventBus()).withKysely(baseKysely);
+		const { flags: reactorFeatureFlags, enabled: enabledFeatureFlags } = resolveReactorFeatureFlags(process.env);
+		if (enabledFeatureFlags.length > 0) logger.info(`Reactor feature flags enabled: ${enabledFeatureFlags.join(", ")}`);
+		const reactorBuilder = new ReactorBuilder().withEventBus(new EventBus()).withKysely(baseKysely).withFeatures({ legacyProcessorIds: process.env.REACTOR_LEGACY_PROCESSOR_IDS !== "false" });
+		if (poolInstrumentation) reactorBuilder.withInstrumentedPool(poolInstrumentation);
 		const clientBuilder = new ReactorClientBuilder().withReactorBuilder(reactorBuilder);
 		const vetraDocumentModels = dev ? Object.values(await import("@powerhousedao/vetra/document-models")).filter((m) => typeof m === "object" && m !== null && "documentModel" in m && "reducer" in m) : [];
 		applySwitchboardReactorDefaults(reactorBuilder, clientBuilder, {
 			documentModels: [...documentModels, ...vetraDocumentModels],
-			executorConfig: hasSkipThreshold ? { maxSkipThreshold } : void 0,
+			upgradeManifests,
+			executorConfig: hasSkipThreshold || enabledFeatureFlags.length > 0 ? {
+				...hasSkipThreshold ? { maxSkipThreshold } : {},
+				...enabledFeatureFlags.length > 0 ? { featureFlags: reactorFeatureFlags } : {}
+			} : void 0,
 			documentModelLoader: httpLoader && dynamicModelLoading ? httpLoader.documentModelLoader : void 0,
 			logger: reactorLogger,
 			signer: renown ? getRenownSignerConfig(renown, options.identity?.requireSignatures) : void 0
@@ -955,6 +1226,10 @@ async function initServer(serverPort, options, renown) {
 			await nodeProcessor.init();
 			return nodeProcessor;
 		});
+		registerAttachmentReferenceReadModel(reactorBuilder, {
+			baseKysely,
+			attachmentReferenceWriter
+		});
 		reactorBuilder.withShutdownHook(async () => {
 			if (apiRef.current) await apiRef.current.dispose();
 		});
@@ -964,14 +1239,37 @@ async function initServer(serverPort, options, renown) {
 			reactorLogger.info("Reactor metrics instrumentation started");
 		}
 		driveNodeView = new DriveNodeView(baseKysely.withSchema(REACTOR_SCHEMA));
+		const reactorDriveClient = new ReactorDriveClient({
+			reactor: module.client,
+			readModel: driveNodeView
+		});
+		ownedReactorModule = module;
 		return {
 			module,
-			reactorDriveClient: new ReactorDriveClient({
-				reactor: module.client,
-				readModel: driveNodeView
-			})
+			reactorDriveClient,
+			attachmentReferenceProjection: { status: "available" }
 		};
 	};
+	const abortBoot = async (api) => {
+		const owned = ownedReactorModule;
+		if (owned) try {
+			await owned.reactor.kill().completed;
+		} catch (error) {
+			logger.error("Aborting boot: reactor shutdown failed: @error", error);
+		}
+		try {
+			await api.dispose();
+		} catch (error) {
+			logger.error("Aborting boot: api dispose failed: @error", error);
+		}
+		if (owned?.reactorModule) try {
+			await owned.reactorModule.database.destroy();
+		} catch (error) {
+			logger.error("Aborting boot: database destroy failed: @error", error);
+		}
+	};
+	let localCredentialCheck;
+	const verifyCredential = renownConfig.source === "self" ? (params) => localCredentialCheck ? localCredentialCheck(params) : Promise.reject(/* @__PURE__ */ new Error("The local renown read model is not bound yet")) : void 0;
 	let defaultDriveUrl = void 0;
 	const basePath = process.cwd();
 	let vite;
@@ -997,10 +1295,13 @@ async function initServer(serverPort, options, renown) {
 	let pgliteFactory;
 	if (readModelPgliteDir && readModelPgliteMajor !== null) {
 		const { PGlite: ReadModelPGlite } = await loadPGliteModule(readModelPgliteMajor);
-		pgliteFactory = PGLITE_IN_MEMORY ? () => new ReadModelPGlite() : (connectionString) => new ReadModelPGlite({ fs: new AtomicNodeFs(connectionString ?? readModelPgliteDir, {
-			logger,
-			flushIntervalMs: PGLITE_FLUSH_INTERVAL_MS
-		}) });
+		pgliteFactory = PGLITE_IN_MEMORY ? () => new ReadModelPGlite({ parsers: PGLITE_UTC_PARSERS }) : (connectionString) => new ReadModelPGlite({
+			fs: new AtomicNodeFs(connectionString ?? readModelPgliteDir, {
+				logger,
+				flushIntervalMs: PGLITE_FLUSH_INTERVAL_MS
+			}),
+			parsers: PGLITE_UTC_PARSERS
+		});
 	}
 	const api = await initializeAndStartAPI(initializeClient, {
 		port: serverPort,
@@ -1011,12 +1312,23 @@ async function initServer(serverPort, options, renown) {
 		packages,
 		processorConfig: options.processorConfig,
 		processors: vetraProcessorFactory ? { "@powerhousedao/vetra": [vetraProcessorFactory] } : {},
-		configFile: options.configFile ?? path$1.join(process.cwd(), "powerhouse.config.json"),
+		configFile: configPath,
 		mcp: options.mcp ?? true,
 		logger: apiLogger,
-		enableDocumentModelSubgraphs: options.enableDocumentModelSubgraphs
+		enableDocumentModelSubgraphs: options.enableDocumentModelSubgraphs,
+		renown: renownConfig,
+		verifyCredential
 	}, "switchboard");
 	apiRef.current = api;
+	if (renownConfig.source === "self") {
+		const { graphqlManager: manager } = api;
+		if (!manager.hasSubgraphHandler(RENOWN_READ_MODEL_SUBGRAPH)) {
+			await abortBoot(api);
+			throw new Error(`Renown credential verification is set to "self" (auth.renown.source or RENOWN_SOURCE) but no loaded package serves the "${RENOWN_READ_MODEL_SUBGRAPH}" subgraph. Install one (@powerhousedao/renown-package) or set RENOWN_SOURCE=remote.`);
+		}
+		localCredentialCheck = createLocalCredentialVerifier((query, variables) => manager.executeSubgraphQuery(RENOWN_READ_MODEL_SUBGRAPH, query, variables), { onError: (error) => logger.error("Renown read model query failed: @error", error) });
+		logger.info("Renown credentials will be verified against this switchboard's own renown read model");
+	}
 	registerAttachmentRoutes(api);
 	const attachmentService = createRemoteAttachmentService(deriveAttachmentServiceConfig(options, serverPort, renown));
 	if (process.env.SENTRY_DSN) api.httpAdapter.setupSentryErrorHandler(Sentry);
@@ -1026,7 +1338,8 @@ async function initServer(serverPort, options, renown) {
 		const packageManagementService = new PackageManagementService({
 			defaultRegistryUrl: registryUrl,
 			httpLoader,
-			documentModelRegistry
+			documentModelRegistry,
+			packageManager: api.packageManager
 		});
 		packageManagementService.setOnModelsChanged(() => {
 			graphqlManager.regenerateDocumentModelSubgraphs().catch(logger.error);
@@ -1100,6 +1413,7 @@ async function initServer(serverPort, options, renown) {
 		api,
 		reactor: client,
 		attachmentService,
+		attachmentReferenceProjection: api.attachmentReferenceProjection,
 		renown,
 		port: serverPort,
 		shutdown: () => api.dispose()
@@ -1130,9 +1444,11 @@ const startSwitchboard = async (options = {}) => {
 	const enableDocumentModelSubgraphs = await featureFlags.getBooleanValue(DOCUMENT_MODEL_SUBGRAPHS_ENABLED, options.enableDocumentModelSubgraphs ?? DOCUMENT_MODEL_SUBGRAPHS_ENABLED_DEFAULT);
 	options.enableDocumentModelSubgraphs = enableDocumentModelSubgraphs;
 	const requireSignatures = options.identity?.requireSignatures ?? await featureFlags.getBooleanValue(REQUIRE_SIGNATURES, REQUIRE_SIGNATURES_DEFAULT);
+	const renownConfig = resolveRenownConfig(getConfig(resolveConfigPath(options.configFile)).auth?.renown, process.env, logger);
 	options.identity = {
 		...options.identity,
-		requireSignatures
+		requireSignatures,
+		baseUrl: options.identity?.baseUrl ?? renownConfig.url
 	};
 	logger.info("Feature flags: @flags", JSON.stringify({
 		DOCUMENT_MODEL_SUBGRAPHS_ENABLED: enableDocumentModelSubgraphs,
@@ -1146,7 +1462,7 @@ const startSwitchboard = async (options = {}) => {
 		if (options.identity.requireExisting) throw new Error("Identity required but failed to initialize. Run \"ph login\" first.", { cause: e });
 	}
 	try {
-		return await initServer(serverPort, options, renown);
+		return await initServer(serverPort, options, renown, renownConfig);
 	} catch (e) {
 		Sentry.captureException(e);
 		logger.error("App crashed: @error", e);
@@ -1157,5 +1473,5 @@ if (import.meta.main) await startSwitchboard();
 //#endregion
 export { parseForcePgVersion as a, applySwitchboardReactorDefaults as i, isPortAvailable as n, startSwitchboard as r, deriveAttachmentServiceConfig as t };
 
-//# sourceMappingURL=server-Cgud_ONM.mjs.map
-//# debugId=5eb0a978-689a-51dd-978a-cd3d7fe5df4b
+//# sourceMappingURL=server-DYraD11D.mjs.map
+//# debugId=65ab8387-7c36-5ebd-b971-913ce2e772b3