@powerhousedao/switchboard 6.2.3-dev.22 → 6.2.3-dev.24

package/dist/utils-BBHt2kdo.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils-BBHt2kdo.mjs","sources":["../src/utils.mts"],"sourcesContent":["import type { IReactorClient } from \"@powerhousedao/reactor\";\nimport {\n  reactorDriveCreateDocument,\n  reactorDriveCreateState,\n} from \"@powerhousedao/reactor-drive\";\nimport {\n  driveCreateDocument,\n  driveCreateState,\n} from \"@powerhousedao/shared/document-drive\";\nimport type { DriveInput } from \"@powerhousedao/shared/document-drive\";\nimport {\n  withSignaturePolicy,\n  type PHDocument,\n} from \"@powerhousedao/shared/document-model\";\n\n/**\n * A configured id pins the drive, and only a legacy drive can take a chosen\n * id; otherwise the client's creation default applies.\n */\nasync function underCreatePolicy<TDocument extends PHDocument>(\n  client: IReactorClient,\n  document: TDocument,\n  id: string | undefined,\n): Promise<TDocument> {\n  return id\n    ? withSignaturePolicy(document, \"legacy\", { id })\n    : withSignaturePolicy(document, await client.getCreateSignaturePolicy());\n}\n\nexport async function addDefaultDrive(\n  client: IReactorClient,\n  drive: DriveInput,\n  serverPort: number,\n) {\n  let driveId = drive.id;\n  if (!driveId || driveId.length === 0) {\n    driveId = drive.slug;\n  }\n\n  if (!driveId || driveId.length === 0) {\n    throw new Error(\"Invalid Drive Id\");\n  }\n\n  // check if the drive already exists\n  let existingDrive;\n  try {\n    existingDrive = await client.get(driveId);\n  } catch {\n    //\n  }\n\n  // already exists, return the existing drive url\n  if (existingDrive) {\n    return `http://localhost:${serverPort}/d/${driveId}`;\n  }\n\n  const { global } = driveCreateState();\n  const created = driveCreateDocument({\n    global: {\n      ...global,\n      name: drive.global.name,\n      icon: drive.global.icon ?? global.icon,\n    },\n    local: {\n      availableOffline: drive.local?.availableOffline ?? false,\n      sharingType: drive.local?.sharingType ?? \"public\",\n      listeners: drive.local?.listeners ?? [],\n      triggers: drive.local?.triggers ?? [],\n    },\n  });\n\n  const document = await underCreatePolicy(client, created, drive.id);\n  if (drive.slug && drive.slug.length > 0) {\n    document.header.slug = drive.slug;\n  }\n  if (drive.global.name) {\n    document.header.name = drive.global.name;\n  }\n  if (drive.preferredEditor) {\n    document.header.meta = { preferredEditor: drive.preferredEditor };\n  }\n\n  try {\n    await client.create(document);\n  } catch (e) {\n    const errorMessage = e instanceof Error ? e.message : String(e);\n    if (!errorMessage.includes(\"already exists\")) {\n      throw e;\n    }\n  }\n\n  return `http://localhost:${serverPort}/d/${driveId}`;\n}\n\nexport async function addDefaultReactorDrive(\n  client: IReactorClient,\n  drive: DriveInput,\n  serverPort: number,\n) {\n  let driveId = drive.id;\n  if (!driveId || driveId.length === 0) {\n    driveId = drive.slug;\n  }\n\n  if (!driveId || driveId.length === 0) {\n    throw new Error(\"Invalid Drive Id\");\n  }\n\n  let existingDrive;\n  try {\n    existingDrive = await client.get(driveId);\n  } catch {\n    //\n  }\n\n  if (existingDrive) {\n    return `http://localhost:${serverPort}/d/${driveId}`;\n  }\n\n  const { global, local } = reactorDriveCreateState();\n  const created = reactorDriveCreateDocument({\n    global: {\n      ...global,\n      name: drive.global.name,\n      icon: drive.global.icon ?? global.icon,\n    },\n    local: {\n      ...local,\n      availableOffline: drive.local?.availableOffline ?? local.availableOffline,\n      sharingType: drive.local?.sharingType ?? local.sharingType,\n    },\n  });\n\n  const document = await underCreatePolicy(client, created, drive.id);\n  if (drive.slug && drive.slug.length > 0) {\n    document.header.slug = drive.slug;\n  }\n  if (drive.global.name) {\n    document.header.name = drive.global.name;\n  }\n  if (drive.preferredEditor) {\n    document.header.meta = { preferredEditor: drive.preferredEditor };\n  }\n\n  try {\n    await client.create(document);\n  } catch (e) {\n    const errorMessage = e instanceof Error ? e.message : String(e);\n    if (!errorMessage.includes(\"already exists\")) {\n      throw e;\n    }\n  }\n\n  return `http://localhost:${serverPort}/d/${driveId}`;\n}\n\nexport function isPostgresUrl(url: string) {\n  return url.startsWith(\"postgresql\") || url.startsWith(\"postgres\");\n}\n"],"names":[],"mappings":";;;;;;;;;;AAmBA,eAAe,kBACb,QACA,UACA,IACoB;AACpB,QAAO,KACH,oBAAoB,UAAU,UAAU,EAAE,IAAI,CAAC,GAC/C,oBAAoB,UAAU,MAAM,OAAO,0BAA0B,CAAC;;AAG5E,eAAsB,gBACpB,QACA,OACA,YACA;CACA,IAAI,UAAU,MAAM;AACpB,KAAI,CAAC,WAAW,QAAQ,WAAW,EACjC,WAAU,MAAM;AAGlB,KAAI,CAAC,WAAW,QAAQ,WAAW,EACjC,OAAM,IAAI,MAAM,mBAAmB;CAIrC,IAAI;AACJ,KAAI;AACF,kBAAgB,MAAM,OAAO,IAAI,QAAQ;SACnC;AAKR,KAAI,cACF,QAAO,oBAAoB,WAAW,KAAK;CAG7C,MAAM,EAAE,WAAW,kBAAkB;CAerC,MAAM,WAAW,MAAM,kBAAkB,QAdzB,oBAAoB;EAClC,QAAQ;GACN,GAAG;GACH,MAAM,MAAM,OAAO;GACnB,MAAM,MAAM,OAAO,QAAQ,OAAO;GACnC;EACD,OAAO;GACL,kBAAkB,MAAM,OAAO,oBAAoB;GACnD,aAAa,MAAM,OAAO,eAAe;GACzC,WAAW,MAAM,OAAO,aAAa,EAAE;GACvC,UAAU,MAAM,OAAO,YAAY,EAAE;GACtC;EACF,CAAC,EAEwD,MAAM,GAAG;AACnE,KAAI,MAAM,QAAQ,MAAM,KAAK,SAAS,EACpC,UAAS,OAAO,OAAO,MAAM;AAE/B,KAAI,MAAM,OAAO,KACf,UAAS,OAAO,OAAO,MAAM,OAAO;AAEtC,KAAI,MAAM,gBACR,UAAS,OAAO,OAAO,EAAE,iBAAiB,MAAM,iBAAiB;AAGnE,KAAI;AACF,QAAM,OAAO,OAAO,SAAS;UACtB,GAAG;AAEV,MAAI,EADiB,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,EAC7C,SAAS,iBAAiB,CAC1C,OAAM;;AAIV,QAAO,oBAAoB,WAAW,KAAK;;AAG7C,eAAsB,uBACpB,QACA,OACA,YACA;CACA,IAAI,UAAU,MAAM;AACpB,KAAI,CAAC,WAAW,QAAQ,WAAW,EACjC,WAAU,MAAM;AAGlB,KAAI,CAAC,WAAW,QAAQ,WAAW,EACjC,OAAM,IAAI,MAAM,mBAAmB;CAGrC,IAAI;AACJ,KAAI;AACF,kBAAgB,MAAM,OAAO,IAAI,QAAQ;SACnC;AAIR,KAAI,cACF,QAAO,oBAAoB,WAAW,KAAK;CAG7C,MAAM,EAAE,QAAQ,UAAU,yBAAyB;CAcnD,MAAM,WAAW,MAAM,kBAAkB,QAbzB,2BAA2B;EACzC,QAAQ;GACN,GAAG;GACH,MAAM,MAAM,OAAO;GACnB,MAAM,MAAM,OAAO,QAAQ,OAAO;GACnC;EACD,OAAO;GACL,GAAG;GACH,kBAAkB,MAAM,OAAO,oBAAoB,MAAM;GACzD,aAAa,MAAM,OAAO,eAAe,MAAM;GAChD;EACF,CAAC,EAEwD,MAAM,GAAG;AACnE,KAAI,MAAM,QAAQ,MAAM,KAAK,SAAS,EACpC,UAAS,OAAO,OAAO,MAAM;AAE/B,KAAI,MAAM,OAAO,KACf,UAAS,OAAO,OAAO,MAAM,OAAO;AAEtC,KAAI,MAAM,gBACR,UAAS,OAAO,OAAO,EAAE,iBAAiB,MAAM,iBAAiB;AAGnE,KAAI;AACF,QAAM,OAAO,OAAO,SAAS;UACtB,GAAG;AAEV,MAAI,EADiB,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,EAC7C,SAAS,iBAAiB,CAC1C,OAAM;;AAIV,QAAO,oBAAoB,WAAW,KAAK;;AAG7C,SAAgB,cAAc,KAAa;AACzC,QAAO,IAAI,WAAW,aAAa,IAAI,IAAI,WAAW,WAAW","debug_id":"a69847ec-becf-5c25-988b-cd47759b2c19"}

package/dist/utils.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.mts","names":[],"sources":["../src/utils.mts"],"mappings":";;;;iBAWsB,eAAA,CACpB,MAAA,EAAQ,cAAA,EACR,KAAA,EAAO,UAAA,EACP,UAAA,WAAkB,OAAA;AAAA,iBAgEE,sBAAA,CACpB,MAAA,EAAQ,cAAA,EACR,KAAA,EAAO,UAAA,EACP,UAAA,WAAkB,OAAA;AAAA,iBA6DJ,aAAA,CAAc,GAAA"}
+{"version":3,"file":"utils.d.mts","names":[],"sources":["../src/utils.mts"],"mappings":";;;;iBA6BsB,eAAA,CACpB,MAAA,EAAQ,cAAA,EACR,KAAA,EAAO,UAAA,EACP,UAAA,WAAkB,OAAA;AAAA,iBA8DE,sBAAA,CACpB,MAAA,EAAQ,cAAA,EACR,KAAA,EAAO,UAAA,EACP,UAAA,WAAkB,OAAA;AAAA,iBA2DJ,aAAA,CAAc,GAAA"}

package/dist/utils.mjs

@@ -1,4 +1,4 @@
-import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-Baw7rThP.mjs";
+import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-BBHt2kdo.mjs";
 export { addDefaultDrive, addDefaultReactorDrive, isPostgresUrl };
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8227e60f-e412-513a-b0cb-502740b7f818")}catch(e){}}();
-//# debugId=8227e60f-e412-513a-b0cb-502740b7f818
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4dfe0eb9-58d9-5240-969e-d37feaef290c")}catch(e){}}();
+//# debugId=4dfe0eb9-58d9-5240-969e-d37feaef290c

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@powerhousedao/switchboard",
   "type": "module",
-  "version": "6.2.3-dev.22",
+  "version": "6.2.3-dev.24",
   "main": "dist/index.mjs",
   "exports": {
     ".": {
@@ -41,7 +41,7 @@
     "@openfeature/core": "1.9.1",
     "@openfeature/env-var-provider": "0.3.1",
     "@openfeature/server-sdk": "1.19.0",
-    "@powerhousedao/config": "6.2.3-dev.22",
+    "@powerhousedao/config": "6.2.3-dev.24",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.218.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
@@ -55,22 +55,22 @@
     "@opentelemetry/sdk-node": "^0.218.0",
     "@opentelemetry/sdk-trace-base": "^2.7.1",
     "@opentelemetry/semantic-conventions": "^1.41.1",
-    "@powerhousedao/opentelemetry-instrumentation-reactor": "6.2.3-dev.22",
-    "@powerhousedao/reactor": "6.2.3-dev.22",
-    "@powerhousedao/shared": "6.2.3-dev.22",
-    "@powerhousedao/vetra": "6.2.3-dev.22",
-    "@powerhousedao/reactor-api": "6.2.3-dev.22",
-    "@powerhousedao/reactor-attachments": "6.2.3-dev.22",
-    "@powerhousedao/reactor-drive": "6.2.3-dev.22",
-    "@powerhousedao/reactor-group": "6.2.3-dev.22",
-    "@powerhousedao/reactor-workflow": "6.2.3-dev.22",
-    "@powerhousedao/workflow": "6.2.3-dev.22",
-    "@powerhousedao/pglite-fs": "6.2.3-dev.22",
+    "@powerhousedao/opentelemetry-instrumentation-reactor": "6.2.3-dev.24",
+    "@powerhousedao/reactor": "6.2.3-dev.24",
+    "@powerhousedao/shared": "6.2.3-dev.24",
+    "@powerhousedao/vetra": "6.2.3-dev.24",
+    "@powerhousedao/reactor-api": "6.2.3-dev.24",
+    "@powerhousedao/reactor-attachments": "6.2.3-dev.24",
+    "@powerhousedao/reactor-drive": "6.2.3-dev.24",
+    "@powerhousedao/reactor-group": "6.2.3-dev.24",
+    "@powerhousedao/reactor-workflow": "6.2.3-dev.24",
+    "@powerhousedao/workflow": "6.2.3-dev.24",
+    "@powerhousedao/pglite-fs": "6.2.3-dev.24",
     "@pyroscope/nodejs": "^0.4.5",
-    "@renown/sdk": "6.2.3-dev.22",
+    "@renown/sdk": "6.2.3-dev.24",
     "@sentry/node": "^10.53.1",
     "@sentry/opentelemetry": "^10.53.1",
-    "document-model": "6.2.3-dev.22",
+    "document-model": "6.2.3-dev.24",
     "dotenv": "^16.4.7",
     "express": "^4.21.2",
     "graphql": "^16",
@@ -96,7 +96,7 @@
   "scripts": {
     "tsc": "tsc",
     "test": "vitest run",
-    "lint": "eslint",
+    "lint": "cd ../.. && oxlint apps/switchboard",
     "build": "tsdown && pnpm run install-packages",
     "start": "node dist/index.mjs",
     "start:profile": "mkdir -p .prof && node --cpu-prof --cpu-prof-dir=.prof dist/index.mjs",

package/test/attachments/auth.test.ts

@@ -342,6 +342,91 @@ describe("requireAuth", () => {
     });
   });
 
+  /**
+   * The deployment-wide floor. These routes never pass the GraphQL fetch chain,
+   * so `REQUIRE_AUTHENTICATED_CALLER` reaches them through this option instead
+   * — including on the routes that opt into `allowAnonymous`, which says the
+   * handler can decide without identity, not that the server will serve callers
+   * it cannot name.
+   */
+  describe("requireAuthenticatedCaller", () => {
+    const anonymousUnderOpenPolicy = () =>
+      makeAuthService(() =>
+        Promise.resolve({ user: undefined, admins: [], auth_enabled: false }),
+      );
+
+    it("refuses a missing bearer even with auth disabled, where today it passes", async () => {
+      const { service } = anonymousUnderOpenPolicy();
+      const handler = vi.fn<NodeHandler>();
+      const wrapped = requireAuth(service, handler, {
+        requireAuthenticatedCaller: true,
+      });
+
+      const res = makeRes();
+      await wrapped(makeReq({ headers: {} }), res);
+
+      expect(res.statusCode).toBe(401);
+      expect(JSON.parse(res._body)).toEqual({
+        error: "Authentication required",
+      });
+      expect(handler).not.toHaveBeenCalled();
+    });
+
+    it("overrides allowAnonymous", async () => {
+      const { service } = anonymousUnderOpenPolicy();
+      const handler = vi.fn<NodeHandler>();
+      const wrapped = requireAuth(service, handler, {
+        allowAnonymous: true,
+        requireAuthenticatedCaller: true,
+      });
+
+      const res = makeRes();
+      await wrapped(makeReq({ headers: {} }), res);
+
+      expect(res.statusCode).toBe(401);
+      expect(handler).not.toHaveBeenCalled();
+    });
+
+    it("still serves a verified caller", async () => {
+      const { service } = makeAuthService(() =>
+        Promise.resolve({
+          user: { address: "0x123", chainId: 1, networkId: "mainnet" },
+          admins: [],
+          auth_enabled: false,
+        }),
+      );
+      const handler = vi.fn<NodeHandler>();
+      const wrapped = requireAuth(service, handler, {
+        allowAnonymous: true,
+        requireAuthenticatedCaller: true,
+      });
+
+      const req = makeReq({ headers: { authorization: "Bearer good-token" } });
+      const res = makeRes();
+      await wrapped(req, res);
+
+      expect(res.statusCode).toBe(200);
+      expect(handler).toHaveBeenCalledWith(req, res, undefined, {
+        user: { address: "0x123", chainId: 1, networkId: "mainnet" },
+        authEnabled: false,
+      });
+    });
+
+    it("leaves every route as it was when the deployment has not set it", async () => {
+      const { service } = anonymousUnderOpenPolicy();
+      const handler = vi.fn<NodeHandler>();
+      const wrapped = requireAuth(service, handler, {
+        requireAuthenticatedCaller: false,
+      });
+
+      const res = makeRes();
+      await wrapped(makeReq({ headers: {} }), res);
+
+      expect(res.statusCode).toBe(200);
+      expect(handler).toHaveBeenCalledTimes(1);
+    });
+  });
+
   it("calls verifyBearer with undefined when no authorization header is present", async () => {
     const { service, spy } = makeAuthService(() =>
       Promise.resolve({

package/test/attachments/index.test.ts

@@ -13,8 +13,16 @@ type Captured = {
   ) => void | Promise<void>;
 };
 
-function makeFakeApi(authService: AuthService | undefined): {
-  api: Pick<API, "httpAdapter" | "authService">;
+type FakeApi = Pick<
+  API,
+  "httpAdapter" | "authService" | "requireAuthenticatedCaller"
+>;
+
+function makeFakeApi(
+  authService: AuthService | undefined,
+  requireAuthenticatedCaller = false,
+): {
+  api: FakeApi;
   captured: Captured[];
 } {
   const captured: Captured[] = [];
@@ -29,7 +37,8 @@ function makeFakeApi(authService: AuthService | undefined): {
       },
     },
     authService,
-  } as unknown as Pick<API, "httpAdapter" | "authService">;
+    requireAuthenticatedCaller,
+  } as unknown as FakeApi;
   return { api, captured };
 }
 
@@ -138,6 +147,28 @@ describe("mountAuthenticatedNodeRoute", () => {
     });
   });
 
+  it("carries the deployment's authenticated-caller floor onto the route, over allowAnonymous", async () => {
+    // auth_enabled false is the shape a deployment running the document
+    // policies has: the boundary policy is OPEN, and this floor is what keeps
+    // an anonymous caller off the attachment routes.
+    const verifyBearer = vi.fn(() =>
+      Promise.resolve({ user: undefined, admins: [], auth_enabled: false }),
+    );
+    const authService = { verifyBearer } as unknown as AuthService;
+    const { api, captured } = makeFakeApi(authService, true);
+    const inner = vi.fn();
+
+    mountAuthenticatedNodeRoute(api, "GET", "/x", inner, {
+      allowAnonymous: true,
+    });
+
+    const res = makeRes();
+    await captured[0].handler(makeReq(), res);
+
+    expect(res.statusCode).toBe(401);
+    expect(inner).not.toHaveBeenCalled();
+  });
+
   it("mounts a wrapper that forwards the anonymous actor when authService is undefined", async () => {
     const { api, captured } = makeFakeApi(undefined);
     const inner = vi.fn();

package/test/attachments/routes-integration.test.ts

@@ -1,5 +1,6 @@
 import { PGlite } from "@electric-sql/pglite";
 import {
+  AttachmentAlreadyExists,
   AttachmentBuilder,
   S3AttachmentBackend,
   type AttachmentBuildResult,
@@ -101,6 +102,45 @@ describe("attachment routes through the real Express middleware stack", () => {
     }
     expect(new TextDecoder().decode(merged)).toBe(payload);
   });
+
+  it("HEAD and GET /attachments/:hash serve a file name above U+00FF", async () => {
+    const fileName = "opłata – 報告 📎.pdf";
+    const service = createRemoteAttachmentService({ remoteUrl: baseUrl });
+    const upload = await service.reserve({
+      mimeType: "application/pdf",
+      fileName,
+    });
+    const bytes = new TextEncoder().encode("%PDF-unicode-name");
+    const { hash } = await upload.send(
+      new ReadableStream<Uint8Array>({
+        start(controller) {
+          controller.enqueue(bytes);
+          controller.close();
+        },
+      }),
+    );
+
+    for (const method of ["HEAD", "GET"]) {
+      const res = await fetch(`${baseUrl}/attachments/${hash}`, { method });
+      expect(res.status).toBe(200);
+      const meta = JSON.parse(res.headers.get("attachment-metadata")!) as {
+        fileName: string;
+      };
+      expect(meta.fileName).toBe(fileName);
+      await res.arrayBuffer();
+    }
+
+    // A hash-first reserve of the same bytes is what the client sends on the
+    // next upload; it stats the hash first.
+    await expect(
+      service.reserve({
+        mimeType: "application/pdf",
+        fileName,
+        clientHash: hash,
+        sizeBytes: bytes.byteLength,
+      }),
+    ).rejects.toBeInstanceOf(AttachmentAlreadyExists);
+  });
 });
 
 describe("authenticated S3 reservation production path", () => {

package/test/attachments/routes.test.ts

@@ -6,13 +6,19 @@ import {
 import { Kysely } from "kysely";
 import { PGliteDialect } from "kysely-pglite-dialect";
 import { mkdtemp, rm } from "node:fs/promises";
-import type { IncomingMessage, ServerResponse } from "node:http";
+import {
+  validateHeaderValue,
+  type IncomingMessage,
+  type ServerResponse,
+} from "node:http";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { Readable, Writable } from "node:stream";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import {
   buildContentDisposition,
+  buildMetadataHeader,
+  buildPendingHeader,
   makeDeleteReservationHandler,
   makeDownloadHandler,
   makeGetReservationHandler,
@@ -70,6 +76,9 @@ function makeRes(): CapturedRes {
     statusCode: 200,
     _headers: headers,
     setHeader(name: string, value: string | number | readonly string[]) {
+      // Same check Node's ServerResponse applies, so a header value it would
+      // reject fails here instead of passing silently.
+      validateHeaderValue(name, String(value));
       headers[name.toLowerCase()] = String(value);
     },
     getHeader(name: string) {
@@ -899,6 +908,7 @@ describe("attachment routes", () => {
   describe("pending state: stat and download 202 responses", () => {
     async function createPendingReservation(
       content: string,
+      fileName = "pending.txt",
     ): Promise<{ hash: string }> {
       const { createHash } = await import("node:crypto");
       const hash = createHash("sha256").update(content, "utf8").digest("hex");
@@ -908,7 +918,7 @@ describe("attachment routes", () => {
         method: "POST",
         body: JSON.stringify({
           mimeType: "text/plain",
-          fileName: "pending.txt",
+          fileName,
           clientHash: hash,
           sizeBytes: Buffer.byteLength(content, "utf8"),
         }),
@@ -995,6 +1005,32 @@ describe("attachment routes", () => {
       expect(res.getHeader("attachment-metadata")).toBeFalsy();
     });
 
+    it.each(["opłata.pdf", "a – b’s.txt", "📎.png", "報告書.pdf"])(
+      "HEAD and GET 202 carry a parseable Attachment-Pending for %s",
+      async (fileName) => {
+        const { hash } = await createPendingReservation(
+          `pending ${fileName}`,
+          fileName,
+        );
+
+        for (const [method, handler] of [
+          ["HEAD", makeStatHandler(attachments)],
+          ["GET", makeDownloadHandler(attachments)],
+        ] as const) {
+          const req = makeReq({ method, params: { hash } });
+          const res = makeRes();
+          await handler(req, res);
+          await waitFor(res);
+
+          expect(res.statusCode).toBe(202);
+          const parsed = JSON.parse(
+            res.getHeader("attachment-pending") as string,
+          ) as { fileName: string };
+          expect(parsed.fileName).toBe(fileName);
+        }
+      },
+    );
+
     it("GET download 202 body is empty (not a zero-byte attachment)", async () => {
       const { hash } = await createPendingReservation("empty body assertion");
 
@@ -1215,6 +1251,54 @@ describe("attachment routes", () => {
       }
     });
 
+    const NON_LATIN1_NAMES = [
+      "opłata.pdf",
+      "a – b’s.txt",
+      "📎 notes.png",
+      "報告書.pdf",
+      "résumé.pdf",
+      'quote"back\\slash.txt',
+    ];
+
+    it.each(NON_LATIN1_NAMES)(
+      "buildMetadataHeader output is a valid header that parses back to %s",
+      (fileName) => {
+        const value = buildMetadataHeader({
+          mimeType: "application/pdf",
+          fileName,
+          sizeBytes: 1,
+          extension: null,
+          createdAtUtc: "2026-01-01T00:00:00.000Z",
+          lastAccessedAtUtc: "2026-01-01T00:00:00.000Z",
+        });
+        expect(() =>
+          validateHeaderValue("Attachment-Metadata", value),
+        ).not.toThrow();
+        expect(value).toMatch(/^[\x20-\x7e]*$/);
+        expect((JSON.parse(value) as { fileName: string }).fileName).toBe(
+          fileName,
+        );
+      },
+    );
+
+    it.each(NON_LATIN1_NAMES)(
+      "buildPendingHeader output is a valid header that parses back to %s",
+      (fileName) => {
+        const value = buildPendingHeader({
+          expiresAtUtc: "2026-01-01T00:00:00.000Z",
+          mimeType: "application/pdf",
+          fileName,
+          sizeBytes: 1,
+        });
+        expect(() =>
+          validateHeaderValue("Attachment-Pending", value),
+        ).not.toThrow();
+        expect((JSON.parse(value) as { fileName: string }).fileName).toBe(
+          fileName,
+        );
+      },
+    );
+
     it("buildContentDisposition encodes RFC-5987-reserved chars in the encoded form", () => {
       const value = buildContentDisposition("a'b(c)*!.txt");
       expect(value).toContain("filename*=UTF-8''a%27b%28c%29%2A%21.txt");
@@ -1281,5 +1365,45 @@ describe("attachment routes", () => {
       ) as { fileName: string };
       expect(meta.fileName).toBe("résumé.pdf");
     });
+
+    it("HEAD and GET answer 200 with a parseable Attachment-Metadata for a name above U+00FF", async () => {
+      const fileName = "opłata – 報告 📎.pdf";
+      const reserveReq = makeReq({
+        method: "POST",
+        body: JSON.stringify({ mimeType: "application/pdf", fileName }),
+      });
+      const reserveRes = makeRes();
+      await makeReserveHandler(attachments)(reserveReq, reserveRes);
+      await waitFor(reserveRes);
+      expect(reserveRes.statusCode).toBe(201);
+      const { reservationId } = JSON.parse(
+        reserveRes._body.toString("utf8"),
+      ) as { reservationId: string };
+
+      const uploadRes = makeRes();
+      await makeUploadHandler(attachments)(
+        makeReq({ method: "PUT", params: { reservationId }, body: "pdf" }),
+        uploadRes,
+      );
+      await waitFor(uploadRes);
+      expect(uploadRes.statusCode).toBe(200);
+      const { hash } = JSON.parse(uploadRes._body.toString("utf8")) as {
+        hash: string;
+      };
+
+      for (const [method, handler] of [
+        ["HEAD", makeStatHandler(attachments)],
+        ["GET", makeDownloadHandler(attachments)],
+      ] as const) {
+        const res = makeRes();
+        await handler(makeReq({ method, params: { hash } }), res);
+        await waitFor(res);
+        expect(res.statusCode).toBe(200);
+        const meta = JSON.parse(
+          res.getHeader("attachment-metadata") as string,
+        ) as { fileName: string };
+        expect(meta.fileName).toBe(fileName);
+      }
+    });
   });
 });

package/test/boot-create-signature-policy.test.ts

@@ -0,0 +1,108 @@
+import {
+  hasDerivedDocumentId,
+  isDerivedDocumentId,
+  signaturePolicyOf,
+} from "@powerhousedao/shared/document-model";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { ILogger } from "document-model";
+import { describe, expect, it, vi } from "vitest";
+import { startSwitchboard } from "../src/server.mjs";
+
+function stubLogger(): ILogger {
+  const logger = {
+    verbose: vi.fn(),
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    child: vi.fn(),
+  };
+  logger.child.mockReturnValue(logger);
+  return logger as unknown as ILogger;
+}
+
+async function withSwitchboard(
+  env: Record<string, string>,
+  run: (
+    switchboard: Awaited<ReturnType<typeof startSwitchboard>>,
+  ) => Promise<void>,
+): Promise<void> {
+  const tempRoot = await mkdtemp(join(tmpdir(), "switchboard-create-policy-"));
+  const names = ["PH_REACTOR_DATABASE_URL", ...Object.keys(env)];
+  const previous = names.map((name) => [name, process.env[name]] as const);
+  process.env.PH_REACTOR_DATABASE_URL = join(tempRoot, "reactor-storage");
+  Object.assign(process.env, env);
+  let switchboard: Awaited<ReturnType<typeof startSwitchboard>> | undefined;
+
+  try {
+    switchboard = await startSwitchboard({
+      workflows: { enabled: false },
+      dbPath: join(tempRoot, "read-model"),
+      port: 0,
+      mcp: false,
+      disableLocalPackages: true,
+      identity: { keypairPath: join(tempRoot, "identity.json") },
+      drive: {
+        slug: "default-drive",
+        global: { name: "Default Drive" },
+      },
+      logger: stubLogger(),
+    });
+    await run(switchboard);
+    await switchboard.shutdown();
+    switchboard = undefined;
+  } finally {
+    await switchboard?.shutdown();
+    for (const [name, value] of previous) {
+      if (value === undefined) {
+        delete process.env[name];
+      } else {
+        process.env[name] = value;
+      }
+    }
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+}
+
+describe("booting Switchboard", () => {
+  it("creates v2-required documents and drives by default", async () => {
+    await withSwitchboard({}, async ({ reactor }) => {
+      const document = await reactor.createEmpty("powerhouse/document-model");
+      expect(signaturePolicyOf(document.header)).toBe("v2-required");
+      expect(hasDerivedDocumentId(document.header)).toBe(true);
+
+      const drive = await reactor.drives.create({ global: { name: "Drive" } });
+      expect(signaturePolicyOf(drive.header)).toBe("v2-required");
+
+      const defaultDrive = await reactor.get("default-drive");
+      expect(signaturePolicyOf(defaultDrive.header)).toBe("v2-required");
+    });
+  }, 60_000);
+
+  it("creates legacy documents and drives under CREATE_SIGNATURE_POLICY=legacy", async () => {
+    await withSwitchboard(
+      { CREATE_SIGNATURE_POLICY: "legacy" },
+      async ({ reactor }) => {
+        const document = await reactor.createEmpty("powerhouse/document-model");
+        expect(signaturePolicyOf(document.header)).toBe("legacy");
+        expect(isDerivedDocumentId(document.header.id)).toBe(false);
+
+        const drive = await reactor.drives.create({
+          global: { name: "Drive" },
+        });
+        expect(signaturePolicyOf(drive.header)).toBe("legacy");
+        expect(isDerivedDocumentId(drive.header.id)).toBe(false);
+
+        const defaultDrive = await reactor.get("default-drive");
+        expect(signaturePolicyOf(defaultDrive.header)).toBe("legacy");
+
+        const asked = await reactor.createEmpty("powerhouse/document-model", {
+          signaturePolicy: "v2-required",
+        });
+        expect(hasDerivedDocumentId(asked.header)).toBe(true);
+      },
+    );
+  }, 60_000);
+});

package/test/boot-without-renown.test.ts

@@ -0,0 +1,81 @@
+import {
+  isDerivedDocumentId,
+  signaturePolicyOf,
+} from "@powerhousedao/shared/document-model";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { ILogger } from "document-model";
+import { describe, expect, it, vi } from "vitest";
+import type * as RenownModule from "../src/renown.js";
+import { startSwitchboard } from "../src/server.mjs";
+
+vi.mock("../src/renown.js", async (importOriginal) => ({
+  ...(await importOriginal<typeof RenownModule>()),
+  initRenown: vi.fn().mockRejectedValue(new Error("Renown is unreachable")),
+}));
+
+function stubLogger(): ILogger & { warn: ReturnType<typeof vi.fn> } {
+  const logger = {
+    verbose: vi.fn(),
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    child: vi.fn(),
+  };
+  logger.child.mockReturnValue(logger);
+  return logger as unknown as ILogger & { warn: ReturnType<typeof vi.fn> };
+}
+
+describe("booting Switchboard without Renown", () => {
+  it("warns and creates legacy documents, which it can write unsigned", async () => {
+    const tempRoot = await mkdtemp(join(tmpdir(), "switchboard-no-renown-"));
+    const previous = process.env.PH_REACTOR_DATABASE_URL;
+    process.env.PH_REACTOR_DATABASE_URL = join(tempRoot, "reactor-storage");
+    const logger = stubLogger();
+    let switchboard: Awaited<ReturnType<typeof startSwitchboard>> | undefined;
+
+    try {
+      switchboard = await startSwitchboard({
+        workflows: { enabled: false },
+        dbPath: join(tempRoot, "read-model"),
+        port: 0,
+        mcp: false,
+        disableLocalPackages: true,
+        logger,
+      });
+
+      expect(
+        logger.warn.mock.calls.some(
+          ([message]) =>
+            typeof message === "string" &&
+            message.includes("new documents are created legacy"),
+        ),
+      ).toBe(true);
+
+      const document = await switchboard.reactor.createEmpty(
+        "powerhouse/document-model",
+      );
+      expect(signaturePolicyOf(document.header)).toBe("legacy");
+      expect(isDerivedDocumentId(document.header.id)).toBe(false);
+
+      const renamed = await switchboard.reactor.rename(
+        document.header.id,
+        "Renamed",
+      );
+      expect(renamed.header.name).toBe("Renamed");
+
+      await switchboard.shutdown();
+      switchboard = undefined;
+    } finally {
+      await switchboard?.shutdown();
+      if (previous === undefined) {
+        delete process.env.PH_REACTOR_DATABASE_URL;
+      } else {
+        process.env.PH_REACTOR_DATABASE_URL = previous;
+      }
+      await rm(tempRoot, { recursive: true, force: true });
+    }
+  }, 60_000);
+});