@powerhousedao/switchboard 6.2.3-dev.23 → 6.2.3-dev.24

package/Auth.md

@@ -221,6 +221,47 @@ It requires a caller to be resolvable at all, so it refuses to boot without
 resolution off, no bearer is ever read and it would reject every caller,
 including authenticated ones.
 
+It also covers the attachment routes, which are mounted on the HTTP adapter and
+never pass the GraphQL fetch chain. Their own 401 keys on `AUTH_ENABLED`, so
+without this switch a deployment running `OPEN` serves them to anyone; with it,
+every attachment route refuses a caller it cannot name — `download-target`
+included, even though that route decides per document on its own.
+
+##### Serving one path anonymously
+
+Some products have a flow that runs *before* sign-in: previewing an invitation
+from the code in its e-mail, for instance, so the screen can say who the
+invitation is for. That flow has no caller by definition, and the floor above
+would answer it a `401`.
+
+```bash
+export REQUIRE_AUTHENTICATED_CALLER=true
+export REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS=/graphql/public
+```
+
+Comma-separated, so several paths are one variable:
+
+```bash
+export REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS=/graphql/public,/graphql/invites
+```
+
+Each entry is matched against the request's **pathname, in full** — never as a
+prefix, so `/graphql/public` does not also exempt `/graphql/public-admin`. A
+trailing slash on either side is ignored; a leading slash is required, and a
+path without one is refused at boot rather than left as an exemption that
+silently never applies. Configuring exemptions while the floor is off is
+refused too: it would describe a protection the server is not applying.
+
+The exempt paths are named in the boot log, because the one question worth
+asking about this floor is what is still open.
+
+Every entry is a hole in it. Only ever name a path that serves operations which
+are safe without a caller, and prefer a route mounted for exactly that purpose
+over exempting one that also serves something else. Note what this switch does
+**not** reach, in either configuration: routes registered directly on the HTTP
+adapter (`/health`, `/ready`, `/explorer`, `/d/:drive`) and package HTTP routes,
+which declare their own `auth` per route.
+
 #### Configuration File Method
 
 ```json

package/CHANGELOG.md

@@ -1,3 +1,23 @@
+## 6.2.3-dev.24 (2026-09-25)
+
+### 🚀 Features
+
+- **reactor-api:** exempt named paths from the authenticated-caller floor, and carry it to the attachment routes ([#3108](https://github.com/powerhouse-inc/powerhouse/pull/3108))
+- **reactor:** action signature integrity ([#3088](https://github.com/powerhouse-inc/powerhouse/pull/3088), [#2894](https://github.com/powerhouse-inc/powerhouse/issues/2894), [#7](https://github.com/powerhouse-inc/powerhouse/issues/7))
+- **reactor-workflow:** refuse the auth and trigger features the engine can't run ([7ce03d28f](https://github.com/powerhouse-inc/powerhouse/commit/7ce03d28f))
+- type-safe piece authoring, upstream connection hooks, and a ph build that typechecks first ([#3082](https://github.com/powerhouse-inc/powerhouse/pull/3082))
+
+### 🩹 Fixes
+
+- **workflow:** build after powerhouse-vetra-packages so their tsc --build runs never overlap ([#3101](https://github.com/powerhouse-inc/powerhouse/pull/3101))
+
+### ❤️ Thank You
+
+- acaldas
+- Benjamin Jordan
+- Claude Fable 5.1
+- Guillermo Puente Sandoval @gpuente
+
 ## 6.2.3-dev.23 (2026-09-24)
 
 ### 🩹 Fixes

package/README.md

@@ -186,6 +186,20 @@ exits non-zero instead of waiting out the init timeout.
 
 Programmatically: `startSwitchboard({ projectionWorker: { enabled, dbPoolSize } })`.
 
+### Creation Signature Policy
+
+| Variable                  | Description                                                  | Default       |
+| ------------------------- | ------------------------------------------------------------ | ------------- |
+| `CREATE_SIGNATURE_POLICY` | What new documents are created as: `legacy` or `v2-required` | `v2-required` |
+
+A v2-required document accepts only v2 action signatures and takes a
+content-addressed id. Set `legacy` while any reactor that syncs with this one
+predates v2-required documents. It only decides what new documents are born
+as; existing documents keep their policy, and it does not change what the
+switchboard accepts. Without a Renown identity the switchboard has no signer,
+so it creates legacy documents and logs a warning. A default drive configured
+with a fixed `id` is always created legacy.
+
 ### Reactor Enforcement Flags
 
 | Variable                       | Description                                                        | Default |

package/dist/index.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2ce93cee-94b7-54c2-9688-4127efd686af")}catch(e){}}();
-import { a as parseForcePgVersion, r as startSwitchboard } from "./server-DVotaGIp.mjs";
-import "./utils-Baw7rThP.mjs";
+import { a as parseForcePgVersion, r as startSwitchboard } from "./server-BFbus-at.mjs";
+import "./utils-BBHt2kdo.mjs";
 import { metrics } from "@opentelemetry/api";
 import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
 import { ExpressInstrumentation } from "@opentelemetry/instrumentation-express";

package/dist/{server-DVotaGIp.mjs → server-BFbus-at.mjs}

@@ -1,14 +1,14 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f230ad22-7960-58f9-8fa7-97e55fa64a8d")}catch(e){}}();
-import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-Baw7rThP.mjs";
-import { register } from "node:module";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="dd6695ea-7590-5100-84c4-edefa353d65e")}catch(e){}}();
+import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-BBHt2kdo.mjs";
+import { createRequire, register } from "node:module";
 import { ReactorInstrumentation } from "@powerhousedao/opentelemetry-instrumentation-reactor";
 import * as Sentry from "@sentry/node";
 import { childLogger, documentModelDocumentModelModule, setLogLevel } from "document-model";
 import dotenv from "dotenv";
 import { getConfig } from "@powerhousedao/config/node";
 import { existsSync, promises, realpathSync } from "node:fs";
-import path from "node:path";
+import path, { resolve } from "node:path";
 import { AtomicNodeFs } from "@powerhousedao/pglite-fs";
 import { ChannelScheme, DriveCollectionId, EventBus, REACTOR_SCHEMA, ReactorBuilder, ReactorClientBuilder, createHybridProjectionCoordinatorFactory, instrumentPgPool, parseDriveUrl, supportsLiveReadModelRegistration } from "@powerhousedao/reactor";
 import { AuthorizationPolicy, BaseSubgraph, ForbiddenError, HttpPackageLoader, ImportPackageLoader, PGLITE_UTC_PARSERS, PackageManagementService, PackagesSubgraph, createCanonicalDocumentIdResolver, getUniqueDocumentModels, initializeAndStartAPI, resolveRenownConfig } from "@powerhousedao/reactor-api";
@@ -16,7 +16,7 @@ import { httpsHooksPath } from "@powerhousedao/reactor-api/https-hooks";
 import { AttachmentAlreadyExists, AttachmentNotFound, AttachmentPending, AttachmentReferenceReadModel, AttachmentSchemaCompiler, HashMismatch, InvalidAttachmentRef, ReservationNotFound, SizeMismatch, UploadTooLarge, createRef, createRemoteAttachmentService, parseAttachmentDownloadTarget, parseRef } from "@powerhousedao/reactor-attachments";
 import { createAttachmentClient } from "@powerhousedao/reactor-attachments/client";
 import { DriveNodeView, NodeProcessor, ReactorDriveClient, createReactorDriveResolvers, reactorDriveDocumentModelModule, reactorDriveSubgraphTypeDefs } from "@powerhousedao/reactor-drive";
-import { DEFAULT_RENOWN_URL, NodeKeyStorage, RENOWN_READ_MODEL_SUBGRAPH, RenownBuilder, RenownCryptoBuilder, createLocalCredentialVerifier, createSignatureVerifier } from "@renown/sdk/node";
+import { DEFAULT_KEYPAIR_PATH, DEFAULT_RENOWN_URL, NodeKeyStorage, RENOWN_READ_MODEL_SUBGRAPH, RenownBuilder, RenownCryptoBuilder, createLocalCredentialVerifier, createRenownTrustPolicy, resolveSwitchboardEndpoint } from "@renown/sdk/node";
 import { Kysely, PostgresDialect } from "kysely";
 import net from "node:net";
 import path$1 from "path";
@@ -24,6 +24,7 @@ import { Pool } from "pg";
 import { Readable } from "node:stream";
 import { ReactorGroupV1 } from "@powerhousedao/reactor-group";
 import { driveDocumentModelModule } from "@powerhousedao/shared/document-drive";
+import { DEFAULT_SIGNATURE_POLICY, isSignaturePolicy } from "@powerhousedao/shared/document-model";
 import { readFile } from "node:fs/promises";
 import os from "node:os";
 import { fileURLToPath } from "node:url";
@@ -77,7 +78,15 @@ const ANONYMOUS_ACTOR = {
 * enabled, the request must carry a verifiable Bearer token. The handler always
 * receives an actor context: the verified bearer user when auth is enabled, or
 * the anonymous context when it is disabled. With `allowAnonymous`, a missing
-* bearer yields an anonymous actor with `authEnabled: true` instead of a 401.
+* bearer yields an anonymous actor with `authEnabled: true` instead of a 401 —
+* unless `requireAuthenticatedCaller` says the deployment refuses anonymous
+* callers outright, which overrides it.
+*
+* With no `authService` there is no bearer to read and every caller is
+* anonymous, so nothing is refused here. That combination cannot carry the
+* floor: `assertRequireAuthenticatedCallerAllowed` refuses to boot with
+* `REQUIRE_AUTHENTICATED_CALLER` set and no identity resolution, and identity
+* resolution is what builds the service.
 */
 function requireAuth(authService, handler, options) {
 	if (!authService) return (req, res, body) => handler(req, res, body, ANONYMOUS_ACTOR);
@@ -99,11 +108,13 @@ function requireAuth(authService, handler, options) {
 			res.end(body);
 			return;
 		}
-		if (result.auth_enabled && !result.user && !options?.allowAnonymous) {
-			res.statusCode = 401;
-			res.setHeader("Content-Type", "application/json");
-			res.end(JSON.stringify({ error: "Authentication required" }));
-			return;
+		if (!result.user) {
+			if (options?.requireAuthenticatedCaller === true || result.auth_enabled && !options?.allowAnonymous) {
+				res.statusCode = 401;
+				res.setHeader("Content-Type", "application/json");
+				res.end(JSON.stringify({ error: "Authentication required" }));
+				return;
+			}
 		}
 		await handler(req, res, body, {
 			user: result.user,
@@ -121,10 +132,18 @@ function requireAuth(authService, handler, options) {
 * wrapping you must call `api.httpAdapter.mountNodeRoute` directly.
 *
 * `allowAnonymous` is reserved for routes whose handlers make a per-document
-* authorization decision themselves; identity-only routes must not use it.
+* authorization decision themselves; identity-only routes must not use it. It
+* is also not the last word: a deployment that refuses anonymous callers
+* (`REQUIRE_AUTHENTICATED_CALLER`) refuses them here too, because these routes
+* are mounted on the HTTP adapter and never reach the fetch chain that carries
+* that floor for GraphQL. The flag is read from the API, so every route
+* mounted through here inherits it without each one remembering to.
 */
 function mountAuthenticatedNodeRoute(api, method, path, handler, options) {
-	api.httpAdapter.mountNodeRoute(method, path, requireAuth(api.authService, handler, options));
+	api.httpAdapter.mountNodeRoute(method, path, requireAuth(api.authService, handler, {
+		...options,
+		requireAuthenticatedCaller: api.requireAuthenticatedCaller
+	}));
 }
 //#endregion
 //#region src/attachments/routes.ts
@@ -663,7 +682,13 @@ function applySwitchboardReactorDefaults(reactorBuilder, clientBuilder, options
 	});
 	if (options.documentModelLoader) reactorBuilder.withDocumentModelLoader(options.documentModelLoader);
 	if (options.logger) reactorBuilder.withLogger(options.logger);
-	if (options.signer) clientBuilder.withSigner(options.signer);
+	if (options.signer) {
+		clientBuilder.withSigner(options.signer);
+		reactorBuilder.withSigner(options.signer.signer, options.signer.workerSigner);
+	}
+	if (options.createSignaturePolicy) clientBuilder.withCreateSignaturePolicy(options.createSignaturePolicy);
+	const trust = options.trustPolicy ?? options.signer;
+	if (trust?.trustPolicy) reactorBuilder.withTrustPolicy(trust.trustPolicy, trust.workerTrustPolicy);
 }
 //#endregion
 //#region src/worker-pool.mts
@@ -1100,8 +1125,10 @@ const schema = gql`
     description: String!
     "action | trigger"
     kind: String!
-    "Triggers only: POLLING | WEBHOOK | APP_WEBHOOK"
+    "Triggers only: POLLING | WEBHOOK | APP_WEBHOOK | MANUAL"
     strategy: String
+    "Why this block cannot run on this reactor; null when it can."
+    unsupported: String
   }
 
   type BlockSearchResult {
@@ -1133,6 +1160,10 @@ const schema = gql`
   type ConnectionCheckResult {
     ok: Boolean!
     detail: String
+    """
+    From auth.getConnectionIdentifier when the check passes; otherwise the
+    label the connection already holds.
+    """
     accountLabel: String
   }
 
@@ -1239,8 +1270,9 @@ const schema = gql`
     """
     deleteSecret(ref: String!): Boolean!
     """
-    Runs the piece's app.checkConnection against the connection's
-    credentials and records the outcome on the connection document.
+    Runs the piece's auth.validate against the connection's credentials,
+    then auth.getConnectionIdentifier for the account label, and records the
+    outcome on the connection document.
     """
     checkConnection(connectionId: String!): ConnectionCheckResult!
   }
@@ -1538,6 +1570,26 @@ function resolveReactorFeatureFlags(env) {
 	};
 }
 //#endregion
+//#region src/create-signature-policy.mts
+/**
+* What new documents are created as, from CREATE_SIGNATURE_POLICY. Without a
+* signer this switchboard cannot write to a v2-required document, so it falls
+* back to legacy and says so.
+*/
+function resolveCreateSignaturePolicy(env, options) {
+	const raw = env.CREATE_SIGNATURE_POLICY?.trim();
+	let policy = DEFAULT_SIGNATURE_POLICY;
+	if (raw) {
+		if (!isSignaturePolicy(raw)) throw new Error(`CREATE_SIGNATURE_POLICY must be "legacy" or "v2-required", got "${raw}"`);
+		policy = raw;
+	}
+	if (policy === "v2-required" && !options.hasSigner) {
+		options.logger?.warn("No signer is configured, so new documents are created legacy: a v2-required document refuses the unsigned operations this switchboard would write. Set up an identity (ph login) to create v2-required documents.");
+		return "legacy";
+	}
+	return policy;
+}
+//#endregion
 //#region src/renown.ts
 const logger = childLogger(["switchboard", "renown"]);
 /**
@@ -1560,12 +1612,94 @@ async function initRenown(options = {}) {
 * Get the signer config for the given renown instance.
 *
 * @param renown - The renown instance
-* @param requireSignature - If true, unsigned actions are rejected
+* @param keypairPath - Where `initRenown` loaded the key from
 */
-function getRenownSignerConfig(renown, requireSignature) {
+function getRenownSignerConfig(renown, keypairPath) {
 	return {
 		signer: renown.signer,
-		verifier: createSignatureVerifier(requireSignature)
+		workerSigner: getRenownWorkerSignerSpec(renown, keypairPath)
+	};
+}
+/**
+* What a pooled executor worker imports to sign as this switchboard: it
+* reloads the key `initRenown` stored, and takes the user known at boot.
+*/
+function getRenownWorkerSignerSpec(renown, keypairPath) {
+	const { signer } = renown;
+	const user = signer.user;
+	return {
+		module: {
+			filePath: createRequire(import.meta.url).resolve("@renown/sdk/node"),
+			exportName: "createNodeRenownSigner"
+		},
+		initArgs: {
+			appName: signer.app?.name ?? "switchboard",
+			keypairPath: resolve(keypairPath ?? DEFAULT_KEYPAIR_PATH),
+			...signer.app?.key ? { did: signer.app.key } : {},
+			...user ? { user: {
+				address: user.address,
+				networkId: user.networkId,
+				chainId: user.chainId
+			} } : {}
+		}
+	};
+}
+/**
+* Admits a key as a signer for an address a Renown credential binds it to; a
+* `self` source has no worker spec. In process, the switchboard's own key is
+* matched against its current user; the worker spec carries the user known now.
+*/
+async function getRenownTrustPolicyConfig(trustSource, renown) {
+	const ownSigner = renown?.signer;
+	if (trustSource.source === "self") return { trustPolicy: createRenownTrustPolicy({
+		switchboard: trustSource.request,
+		ownSigner
+	}) };
+	const switchboardUrl = await resolveSwitchboardEndpoint({
+		switchboardUrl: trustSource.switchboardUrl,
+		baseUrl: trustSource.renownUrl
+	});
+	const options = {
+		...switchboardUrl ? { switchboard: switchboardUrl } : {},
+		...trustSource.renownUrl ? { renownUrl: trustSource.renownUrl } : {}
+	};
+	const self = ownIdentity(renown);
+	return {
+		trustPolicy: createRenownTrustPolicy({
+			...options,
+			ownSigner
+		}),
+		workerTrustPolicy: {
+			module: {
+				filePath: createRequire(import.meta.url).resolve("@renown/sdk/node"),
+				exportName: "createRenownTrustPolicy"
+			},
+			initArgs: {
+				...options,
+				...self ? { self } : {}
+			}
+		}
+	};
+}
+/**
+* Fails the boot when pooled workers would refuse every signed write the
+* in-process executor accepts: a `self` Renown source gives workers no trust
+* policy spec, so under authEnforcement they apply the default.
+*/
+function assertWorkerTrustPolicy(config) {
+	if (config.workers > 0 && config.authEnforcement && config.renownSource === "self") throw new Error("The executor worker pool (REACTOR_WORKERS) cannot verify signers when REACTOR_AUTH_ENFORCEMENT is on and Renown credentials are read from this switchboard (\"self\" via auth.renown.source or RENOWN_SOURCE): pooled workers have no trust policy and would refuse every signed write. Set RENOWN_SOURCE=remote, or disable the worker pool (REACTOR_WORKERS=0).");
+}
+function ownIdentity(renown) {
+	const key = renown?.signer.app?.key;
+	if (!key) return;
+	const user = renown.signer.user;
+	return {
+		key,
+		user: {
+			address: user?.address ?? "",
+			networkId: user?.networkId ?? "",
+			chainId: user?.chainId ?? 0
+		}
 	};
 }
 //#endregion
@@ -1576,8 +1710,6 @@ setLogLevel(LogLevel);
 dotenv.config();
 const DOCUMENT_MODEL_SUBGRAPHS_ENABLED = "DOCUMENT_MODEL_SUBGRAPHS_ENABLED";
 const DOCUMENT_MODEL_SUBGRAPHS_ENABLED_DEFAULT = true;
-const REQUIRE_SIGNATURES = "REQUIRE_SIGNATURES";
-const REQUIRE_SIGNATURES_DEFAULT = false;
 const DEFAULT_PORT = process.env.PORT ? Number(process.env.PORT) : 4001;
 const PORT_FALLBACK_ATTEMPTS = 20;
 const PGLITE_FLUSH_INTERVAL_MS = (() => {
@@ -1731,6 +1863,11 @@ async function initServer(serverPort, options, renown, renownConfig) {
 	}
 	if (workerPool) {
 		if (dev) throw new Error("The executor worker pool (REACTOR_WORKERS) is not supported in dev mode: Vite-loaded document models cannot cross a worker-thread boundary");
+		assertWorkerTrustPolicy({
+			workers: workerPool.numWorkers,
+			authEnforcement: resolveReactorFeatureFlags(process.env).flags.authEnforcement === true,
+			renownSource: renownConfig.source
+		});
 		if (!reactorDbUrl || !isPostgresUrl(reactorDbUrl)) throw new Error("The executor worker pool (REACTOR_WORKERS) requires a Postgres reactor database — set PH_REACTOR_DATABASE_URL or PH_SWITCHBOARD_DATABASE_URL. PGlite cannot be shared across worker threads.");
 	}
 	let projectionWorker = resolveProjectionWorkerOptions(options.projectionWorker, process.env);
@@ -1772,6 +1909,7 @@ async function initServer(serverPort, options, renown, renownConfig) {
 		if (!packages.includes("@powerhousedao/workflow")) packages.push(WORKFLOW_PACKAGE_NAME);
 	}
 	let ownedReactorModule;
+	let localRenownRequest;
 	const initializeClient = async (documentModels, { attachmentReferenceWriter, upgradeManifests }) => {
 		if (options.reactor) {
 			const attachmentReferenceProjection = await registerAttachmentReferenceReadModelOnModule(options.reactor, attachmentReferenceWriter);
@@ -1811,7 +1949,19 @@ async function initServer(serverPort, options, renown, renownConfig) {
 			} : void 0,
 			documentModelLoader: httpLoader && dynamicModelLoading ? httpLoader.documentModelLoader : void 0,
 			logger: reactorLogger,
-			signer: renown ? getRenownSignerConfig(renown, options.identity?.requireSignatures) : void 0
+			signer: renown ? getRenownSignerConfig(renown, options.identity?.keypairPath) : void 0,
+			createSignaturePolicy: resolveCreateSignaturePolicy(process.env, {
+				hasSigner: renown !== null,
+				logger
+			}),
+			trustPolicy: reactorFeatureFlags.authEnforcement ? await getRenownTrustPolicyConfig(renownConfig.source === "self" ? {
+				source: "self",
+				request: (query, variables) => localRenownRequest ? localRenownRequest(query, variables) : Promise.reject(/* @__PURE__ */ new Error("The local renown read model is not bound yet"))
+			} : {
+				source: "remote",
+				renownUrl: renownConfig.url,
+				switchboardUrl: renownConfig.switchboardUrl
+			}, renown) : void 0
 		});
 		if (workerPool) {
 			if (!reactorDbUrl) throw new Error("unreachable: worker pool enabled without a reactor database URL");
@@ -1949,7 +2099,8 @@ async function initServer(serverPort, options, renown, renownConfig) {
 			await abortBoot(api);
 			throw new Error(`Renown credential verification is set to "self" (auth.renown.source or RENOWN_SOURCE) but no loaded package serves the "${RENOWN_READ_MODEL_SUBGRAPH}" subgraph. Install one (@powerhousedao/renown-package) or set RENOWN_SOURCE=remote.`);
 		}
-		localCredentialCheck = createLocalCredentialVerifier((query, variables) => manager.executeSubgraphQuery(RENOWN_READ_MODEL_SUBGRAPH, query, variables), { onError: (error) => logger.error("Renown read model query failed: @error", error) });
+		localRenownRequest = (query, variables) => manager.executeSubgraphQuery(RENOWN_READ_MODEL_SUBGRAPH, query, variables);
+		localCredentialCheck = createLocalCredentialVerifier(localRenownRequest, { onError: (error) => logger.error("Renown read model query failed: @error", error) });
 		logger.info("Renown credentials will be verified against this switchboard's own renown read model");
 	}
 	registerAttachmentRoutes(api);
@@ -2107,7 +2258,6 @@ const startSwitchboard = async (options = {}) => {
 	const featureFlags = await initFeatureFlags();
 	const enableDocumentModelSubgraphs = await featureFlags.getBooleanValue(DOCUMENT_MODEL_SUBGRAPHS_ENABLED, options.enableDocumentModelSubgraphs ?? DOCUMENT_MODEL_SUBGRAPHS_ENABLED_DEFAULT);
 	options.enableDocumentModelSubgraphs = enableDocumentModelSubgraphs;
-	const requireSignatures = options.identity?.requireSignatures ?? await featureFlags.getBooleanValue(REQUIRE_SIGNATURES, REQUIRE_SIGNATURES_DEFAULT);
 	const configPathForFlags = resolveConfigPath(options.configFile);
 	const workflowsEnabled = await resolveWorkflowsEnabled({
 		featureFlags,
@@ -2118,12 +2268,10 @@ const startSwitchboard = async (options = {}) => {
 	const renownConfig = resolveRenownConfig(getConfig(resolveConfigPath(options.configFile)).auth?.renown, process.env, logger);
 	options.identity = {
 		...options.identity,
-		requireSignatures,
 		baseUrl: options.identity?.baseUrl ?? renownConfig.url
 	};
 	logger.info("Feature flags: @flags", JSON.stringify({
 		DOCUMENT_MODEL_SUBGRAPHS_ENABLED: enableDocumentModelSubgraphs,
-		REQUIRE_SIGNATURES: requireSignatures,
 		PH_WORKFLOWS_ENABLED: workflowsEnabled
 	}, null, 2));
 	let renown = null;
@@ -2145,5 +2293,5 @@ if (import.meta.main) await startSwitchboard({ fatalErrorShutdown: true });
 //#endregion
 export { parseForcePgVersion as a, applySwitchboardReactorDefaults as i, isPortAvailable as n, startSwitchboard as r, deriveAttachmentServiceConfig as t };
 
-//# sourceMappingURL=server-DVotaGIp.mjs.map
-//# debugId=f230ad22-7960-58f9-8fa7-97e55fa64a8d
+//# sourceMappingURL=server-BFbus-at.mjs.map
+//# debugId=dd6695ea-7590-5100-84c4-edefa353d65e