@powerhousedao/switchboard 6.2.3-dev.23 → 6.2.3-dev.24

package/dist/utils-BBHt2kdo.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils-BBHt2kdo.mjs","sources":["../src/utils.mts"],"sourcesContent":["import type { IReactorClient } from \"@powerhousedao/reactor\";\nimport {\n  reactorDriveCreateDocument,\n  reactorDriveCreateState,\n} from \"@powerhousedao/reactor-drive\";\nimport {\n  driveCreateDocument,\n  driveCreateState,\n} from \"@powerhousedao/shared/document-drive\";\nimport type { DriveInput } from \"@powerhousedao/shared/document-drive\";\nimport {\n  withSignaturePolicy,\n  type PHDocument,\n} from \"@powerhousedao/shared/document-model\";\n\n/**\n * A configured id pins the drive, and only a legacy drive can take a chosen\n * id; otherwise the client's creation default applies.\n */\nasync function underCreatePolicy<TDocument extends PHDocument>(\n  client: IReactorClient,\n  document: TDocument,\n  id: string | undefined,\n): Promise<TDocument> {\n  return id\n    ? withSignaturePolicy(document, \"legacy\", { id })\n    : withSignaturePolicy(document, await client.getCreateSignaturePolicy());\n}\n\nexport async function addDefaultDrive(\n  client: IReactorClient,\n  drive: DriveInput,\n  serverPort: number,\n) {\n  let driveId = drive.id;\n  if (!driveId || driveId.length === 0) {\n    driveId = drive.slug;\n  }\n\n  if (!driveId || driveId.length === 0) {\n    throw new Error(\"Invalid Drive Id\");\n  }\n\n  // check if the drive already exists\n  let existingDrive;\n  try {\n    existingDrive = await client.get(driveId);\n  } catch {\n    //\n  }\n\n  // already exists, return the existing drive url\n  if (existingDrive) {\n    return `http://localhost:${serverPort}/d/${driveId}`;\n  }\n\n  const { global } = driveCreateState();\n  const created = driveCreateDocument({\n    global: {\n      ...global,\n      name: drive.global.name,\n      icon: drive.global.icon ?? global.icon,\n    },\n    local: {\n      availableOffline: drive.local?.availableOffline ?? false,\n      sharingType: drive.local?.sharingType ?? \"public\",\n      listeners: drive.local?.listeners ?? [],\n      triggers: drive.local?.triggers ?? [],\n    },\n  });\n\n  const document = await underCreatePolicy(client, created, drive.id);\n  if (drive.slug && drive.slug.length > 0) {\n    document.header.slug = drive.slug;\n  }\n  if (drive.global.name) {\n    document.header.name = drive.global.name;\n  }\n  if (drive.preferredEditor) {\n    document.header.meta = { preferredEditor: drive.preferredEditor };\n  }\n\n  try {\n    await client.create(document);\n  } catch (e) {\n    const errorMessage = e instanceof Error ? e.message : String(e);\n    if (!errorMessage.includes(\"already exists\")) {\n      throw e;\n    }\n  }\n\n  return `http://localhost:${serverPort}/d/${driveId}`;\n}\n\nexport async function addDefaultReactorDrive(\n  client: IReactorClient,\n  drive: DriveInput,\n  serverPort: number,\n) {\n  let driveId = drive.id;\n  if (!driveId || driveId.length === 0) {\n    driveId = drive.slug;\n  }\n\n  if (!driveId || driveId.length === 0) {\n    throw new Error(\"Invalid Drive Id\");\n  }\n\n  let existingDrive;\n  try {\n    existingDrive = await client.get(driveId);\n  } catch {\n    //\n  }\n\n  if (existingDrive) {\n    return `http://localhost:${serverPort}/d/${driveId}`;\n  }\n\n  const { global, local } = reactorDriveCreateState();\n  const created = reactorDriveCreateDocument({\n    global: {\n      ...global,\n      name: drive.global.name,\n      icon: drive.global.icon ?? global.icon,\n    },\n    local: {\n      ...local,\n      availableOffline: drive.local?.availableOffline ?? local.availableOffline,\n      sharingType: drive.local?.sharingType ?? local.sharingType,\n    },\n  });\n\n  const document = await underCreatePolicy(client, created, drive.id);\n  if (drive.slug && drive.slug.length > 0) {\n    document.header.slug = drive.slug;\n  }\n  if (drive.global.name) {\n    document.header.name = drive.global.name;\n  }\n  if (drive.preferredEditor) {\n    document.header.meta = { preferredEditor: drive.preferredEditor };\n  }\n\n  try {\n    await client.create(document);\n  } catch (e) {\n    const errorMessage = e instanceof Error ? e.message : String(e);\n    if (!errorMessage.includes(\"already exists\")) {\n      throw e;\n    }\n  }\n\n  return `http://localhost:${serverPort}/d/${driveId}`;\n}\n\nexport function isPostgresUrl(url: string) {\n  return url.startsWith(\"postgresql\") || url.startsWith(\"postgres\");\n}\n"],"names":[],"mappings":";;;;;;;;;;AAmBA,eAAe,kBACb,QACA,UACA,IACoB;AACpB,QAAO,KACH,oBAAoB,UAAU,UAAU,EAAE,IAAI,CAAC,GAC/C,oBAAoB,UAAU,MAAM,OAAO,0BAA0B,CAAC;;AAG5E,eAAsB,gBACpB,QACA,OACA,YACA;CACA,IAAI,UAAU,MAAM;AACpB,KAAI,CAAC,WAAW,QAAQ,WAAW,EACjC,WAAU,MAAM;AAGlB,KAAI,CAAC,WAAW,QAAQ,WAAW,EACjC,OAAM,IAAI,MAAM,mBAAmB;CAIrC,IAAI;AACJ,KAAI;AACF,kBAAgB,MAAM,OAAO,IAAI,QAAQ;SACnC;AAKR,KAAI,cACF,QAAO,oBAAoB,WAAW,KAAK;CAG7C,MAAM,EAAE,WAAW,kBAAkB;CAerC,MAAM,WAAW,MAAM,kBAAkB,QAdzB,oBAAoB;EAClC,QAAQ;GACN,GAAG;GACH,MAAM,MAAM,OAAO;GACnB,MAAM,MAAM,OAAO,QAAQ,OAAO;GACnC;EACD,OAAO;GACL,kBAAkB,MAAM,OAAO,oBAAoB;GACnD,aAAa,MAAM,OAAO,eAAe;GACzC,WAAW,MAAM,OAAO,aAAa,EAAE;GACvC,UAAU,MAAM,OAAO,YAAY,EAAE;GACtC;EACF,CAAC,EAEwD,MAAM,GAAG;AACnE,KAAI,MAAM,QAAQ,MAAM,KAAK,SAAS,EACpC,UAAS,OAAO,OAAO,MAAM;AAE/B,KAAI,MAAM,OAAO,KACf,UAAS,OAAO,OAAO,MAAM,OAAO;AAEtC,KAAI,MAAM,gBACR,UAAS,OAAO,OAAO,EAAE,iBAAiB,MAAM,iBAAiB;AAGnE,KAAI;AACF,QAAM,OAAO,OAAO,SAAS;UACtB,GAAG;AAEV,MAAI,EADiB,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,EAC7C,SAAS,iBAAiB,CAC1C,OAAM;;AAIV,QAAO,oBAAoB,WAAW,KAAK;;AAG7C,eAAsB,uBACpB,QACA,OACA,YACA;CACA,IAAI,UAAU,MAAM;AACpB,KAAI,CAAC,WAAW,QAAQ,WAAW,EACjC,WAAU,MAAM;AAGlB,KAAI,CAAC,WAAW,QAAQ,WAAW,EACjC,OAAM,IAAI,MAAM,mBAAmB;CAGrC,IAAI;AACJ,KAAI;AACF,kBAAgB,MAAM,OAAO,IAAI,QAAQ;SACnC;AAIR,KAAI,cACF,QAAO,oBAAoB,WAAW,KAAK;CAG7C,MAAM,EAAE,QAAQ,UAAU,yBAAyB;CAcnD,MAAM,WAAW,MAAM,kBAAkB,QAbzB,2BAA2B;EACzC,QAAQ;GACN,GAAG;GACH,MAAM,MAAM,OAAO;GACnB,MAAM,MAAM,OAAO,QAAQ,OAAO;GACnC;EACD,OAAO;GACL,GAAG;GACH,kBAAkB,MAAM,OAAO,oBAAoB,MAAM;GACzD,aAAa,MAAM,OAAO,eAAe,MAAM;GAChD;EACF,CAAC,EAEwD,MAAM,GAAG;AACnE,KAAI,MAAM,QAAQ,MAAM,KAAK,SAAS,EACpC,UAAS,OAAO,OAAO,MAAM;AAE/B,KAAI,MAAM,OAAO,KACf,UAAS,OAAO,OAAO,MAAM,OAAO;AAEtC,KAAI,MAAM,gBACR,UAAS,OAAO,OAAO,EAAE,iBAAiB,MAAM,iBAAiB;AAGnE,KAAI;AACF,QAAM,OAAO,OAAO,SAAS;UACtB,GAAG;AAEV,MAAI,EADiB,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,EAC7C,SAAS,iBAAiB,CAC1C,OAAM;;AAIV,QAAO,oBAAoB,WAAW,KAAK;;AAG7C,SAAgB,cAAc,KAAa;AACzC,QAAO,IAAI,WAAW,aAAa,IAAI,IAAI,WAAW,WAAW","debug_id":"a69847ec-becf-5c25-988b-cd47759b2c19"}

package/dist/utils.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.mts","names":[],"sources":["../src/utils.mts"],"mappings":";;;;iBAWsB,eAAA,CACpB,MAAA,EAAQ,cAAA,EACR,KAAA,EAAO,UAAA,EACP,UAAA,WAAkB,OAAA;AAAA,iBAgEE,sBAAA,CACpB,MAAA,EAAQ,cAAA,EACR,KAAA,EAAO,UAAA,EACP,UAAA,WAAkB,OAAA;AAAA,iBA6DJ,aAAA,CAAc,GAAA"}
+{"version":3,"file":"utils.d.mts","names":[],"sources":["../src/utils.mts"],"mappings":";;;;iBA6BsB,eAAA,CACpB,MAAA,EAAQ,cAAA,EACR,KAAA,EAAO,UAAA,EACP,UAAA,WAAkB,OAAA;AAAA,iBA8DE,sBAAA,CACpB,MAAA,EAAQ,cAAA,EACR,KAAA,EAAO,UAAA,EACP,UAAA,WAAkB,OAAA;AAAA,iBA2DJ,aAAA,CAAc,GAAA"}

package/dist/utils.mjs

@@ -1,4 +1,4 @@
-import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-Baw7rThP.mjs";
+import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-BBHt2kdo.mjs";
 export { addDefaultDrive, addDefaultReactorDrive, isPostgresUrl };
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8227e60f-e412-513a-b0cb-502740b7f818")}catch(e){}}();
-//# debugId=8227e60f-e412-513a-b0cb-502740b7f818
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4dfe0eb9-58d9-5240-969e-d37feaef290c")}catch(e){}}();
+//# debugId=4dfe0eb9-58d9-5240-969e-d37feaef290c

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@powerhousedao/switchboard",
   "type": "module",
-  "version": "6.2.3-dev.23",
+  "version": "6.2.3-dev.24",
   "main": "dist/index.mjs",
   "exports": {
     ".": {
@@ -41,7 +41,7 @@
     "@openfeature/core": "1.9.1",
     "@openfeature/env-var-provider": "0.3.1",
     "@openfeature/server-sdk": "1.19.0",
-    "@powerhousedao/config": "6.2.3-dev.23",
+    "@powerhousedao/config": "6.2.3-dev.24",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.218.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
@@ -55,22 +55,22 @@
     "@opentelemetry/sdk-node": "^0.218.0",
     "@opentelemetry/sdk-trace-base": "^2.7.1",
     "@opentelemetry/semantic-conventions": "^1.41.1",
-    "@powerhousedao/opentelemetry-instrumentation-reactor": "6.2.3-dev.23",
-    "@powerhousedao/reactor": "6.2.3-dev.23",
-    "@powerhousedao/shared": "6.2.3-dev.23",
-    "@powerhousedao/vetra": "6.2.3-dev.23",
-    "@powerhousedao/reactor-api": "6.2.3-dev.23",
-    "@powerhousedao/reactor-attachments": "6.2.3-dev.23",
-    "@powerhousedao/reactor-drive": "6.2.3-dev.23",
-    "@powerhousedao/reactor-group": "6.2.3-dev.23",
-    "@powerhousedao/reactor-workflow": "6.2.3-dev.23",
-    "@powerhousedao/workflow": "6.2.3-dev.23",
-    "@powerhousedao/pglite-fs": "6.2.3-dev.23",
+    "@powerhousedao/opentelemetry-instrumentation-reactor": "6.2.3-dev.24",
+    "@powerhousedao/reactor": "6.2.3-dev.24",
+    "@powerhousedao/shared": "6.2.3-dev.24",
+    "@powerhousedao/vetra": "6.2.3-dev.24",
+    "@powerhousedao/reactor-api": "6.2.3-dev.24",
+    "@powerhousedao/reactor-attachments": "6.2.3-dev.24",
+    "@powerhousedao/reactor-drive": "6.2.3-dev.24",
+    "@powerhousedao/reactor-group": "6.2.3-dev.24",
+    "@powerhousedao/reactor-workflow": "6.2.3-dev.24",
+    "@powerhousedao/workflow": "6.2.3-dev.24",
+    "@powerhousedao/pglite-fs": "6.2.3-dev.24",
     "@pyroscope/nodejs": "^0.4.5",
-    "@renown/sdk": "6.2.3-dev.23",
+    "@renown/sdk": "6.2.3-dev.24",
     "@sentry/node": "^10.53.1",
     "@sentry/opentelemetry": "^10.53.1",
-    "document-model": "6.2.3-dev.23",
+    "document-model": "6.2.3-dev.24",
     "dotenv": "^16.4.7",
     "express": "^4.21.2",
     "graphql": "^16",
@@ -96,7 +96,7 @@
   "scripts": {
     "tsc": "tsc",
     "test": "vitest run",
-    "lint": "eslint",
+    "lint": "cd ../.. && oxlint apps/switchboard",
     "build": "tsdown && pnpm run install-packages",
     "start": "node dist/index.mjs",
     "start:profile": "mkdir -p .prof && node --cpu-prof --cpu-prof-dir=.prof dist/index.mjs",

package/test/attachments/auth.test.ts

@@ -342,6 +342,91 @@ describe("requireAuth", () => {
     });
   });
 
+  /**
+   * The deployment-wide floor. These routes never pass the GraphQL fetch chain,
+   * so `REQUIRE_AUTHENTICATED_CALLER` reaches them through this option instead
+   * — including on the routes that opt into `allowAnonymous`, which says the
+   * handler can decide without identity, not that the server will serve callers
+   * it cannot name.
+   */
+  describe("requireAuthenticatedCaller", () => {
+    const anonymousUnderOpenPolicy = () =>
+      makeAuthService(() =>
+        Promise.resolve({ user: undefined, admins: [], auth_enabled: false }),
+      );
+
+    it("refuses a missing bearer even with auth disabled, where today it passes", async () => {
+      const { service } = anonymousUnderOpenPolicy();
+      const handler = vi.fn<NodeHandler>();
+      const wrapped = requireAuth(service, handler, {
+        requireAuthenticatedCaller: true,
+      });
+
+      const res = makeRes();
+      await wrapped(makeReq({ headers: {} }), res);
+
+      expect(res.statusCode).toBe(401);
+      expect(JSON.parse(res._body)).toEqual({
+        error: "Authentication required",
+      });
+      expect(handler).not.toHaveBeenCalled();
+    });
+
+    it("overrides allowAnonymous", async () => {
+      const { service } = anonymousUnderOpenPolicy();
+      const handler = vi.fn<NodeHandler>();
+      const wrapped = requireAuth(service, handler, {
+        allowAnonymous: true,
+        requireAuthenticatedCaller: true,
+      });
+
+      const res = makeRes();
+      await wrapped(makeReq({ headers: {} }), res);
+
+      expect(res.statusCode).toBe(401);
+      expect(handler).not.toHaveBeenCalled();
+    });
+
+    it("still serves a verified caller", async () => {
+      const { service } = makeAuthService(() =>
+        Promise.resolve({
+          user: { address: "0x123", chainId: 1, networkId: "mainnet" },
+          admins: [],
+          auth_enabled: false,
+        }),
+      );
+      const handler = vi.fn<NodeHandler>();
+      const wrapped = requireAuth(service, handler, {
+        allowAnonymous: true,
+        requireAuthenticatedCaller: true,
+      });
+
+      const req = makeReq({ headers: { authorization: "Bearer good-token" } });
+      const res = makeRes();
+      await wrapped(req, res);
+
+      expect(res.statusCode).toBe(200);
+      expect(handler).toHaveBeenCalledWith(req, res, undefined, {
+        user: { address: "0x123", chainId: 1, networkId: "mainnet" },
+        authEnabled: false,
+      });
+    });
+
+    it("leaves every route as it was when the deployment has not set it", async () => {
+      const { service } = anonymousUnderOpenPolicy();
+      const handler = vi.fn<NodeHandler>();
+      const wrapped = requireAuth(service, handler, {
+        requireAuthenticatedCaller: false,
+      });
+
+      const res = makeRes();
+      await wrapped(makeReq({ headers: {} }), res);
+
+      expect(res.statusCode).toBe(200);
+      expect(handler).toHaveBeenCalledTimes(1);
+    });
+  });
+
   it("calls verifyBearer with undefined when no authorization header is present", async () => {
     const { service, spy } = makeAuthService(() =>
       Promise.resolve({

package/test/attachments/index.test.ts

@@ -13,8 +13,16 @@ type Captured = {
   ) => void | Promise<void>;
 };
 
-function makeFakeApi(authService: AuthService | undefined): {
-  api: Pick<API, "httpAdapter" | "authService">;
+type FakeApi = Pick<
+  API,
+  "httpAdapter" | "authService" | "requireAuthenticatedCaller"
+>;
+
+function makeFakeApi(
+  authService: AuthService | undefined,
+  requireAuthenticatedCaller = false,
+): {
+  api: FakeApi;
   captured: Captured[];
 } {
   const captured: Captured[] = [];
@@ -29,7 +37,8 @@ function makeFakeApi(authService: AuthService | undefined): {
       },
     },
     authService,
-  } as unknown as Pick<API, "httpAdapter" | "authService">;
+    requireAuthenticatedCaller,
+  } as unknown as FakeApi;
   return { api, captured };
 }
 
@@ -138,6 +147,28 @@ describe("mountAuthenticatedNodeRoute", () => {
     });
   });
 
+  it("carries the deployment's authenticated-caller floor onto the route, over allowAnonymous", async () => {
+    // auth_enabled false is the shape a deployment running the document
+    // policies has: the boundary policy is OPEN, and this floor is what keeps
+    // an anonymous caller off the attachment routes.
+    const verifyBearer = vi.fn(() =>
+      Promise.resolve({ user: undefined, admins: [], auth_enabled: false }),
+    );
+    const authService = { verifyBearer } as unknown as AuthService;
+    const { api, captured } = makeFakeApi(authService, true);
+    const inner = vi.fn();
+
+    mountAuthenticatedNodeRoute(api, "GET", "/x", inner, {
+      allowAnonymous: true,
+    });
+
+    const res = makeRes();
+    await captured[0].handler(makeReq(), res);
+
+    expect(res.statusCode).toBe(401);
+    expect(inner).not.toHaveBeenCalled();
+  });
+
   it("mounts a wrapper that forwards the anonymous actor when authService is undefined", async () => {
     const { api, captured } = makeFakeApi(undefined);
     const inner = vi.fn();

package/test/boot-create-signature-policy.test.ts

@@ -0,0 +1,108 @@
+import {
+  hasDerivedDocumentId,
+  isDerivedDocumentId,
+  signaturePolicyOf,
+} from "@powerhousedao/shared/document-model";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { ILogger } from "document-model";
+import { describe, expect, it, vi } from "vitest";
+import { startSwitchboard } from "../src/server.mjs";
+
+function stubLogger(): ILogger {
+  const logger = {
+    verbose: vi.fn(),
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    child: vi.fn(),
+  };
+  logger.child.mockReturnValue(logger);
+  return logger as unknown as ILogger;
+}
+
+async function withSwitchboard(
+  env: Record<string, string>,
+  run: (
+    switchboard: Awaited<ReturnType<typeof startSwitchboard>>,
+  ) => Promise<void>,
+): Promise<void> {
+  const tempRoot = await mkdtemp(join(tmpdir(), "switchboard-create-policy-"));
+  const names = ["PH_REACTOR_DATABASE_URL", ...Object.keys(env)];
+  const previous = names.map((name) => [name, process.env[name]] as const);
+  process.env.PH_REACTOR_DATABASE_URL = join(tempRoot, "reactor-storage");
+  Object.assign(process.env, env);
+  let switchboard: Awaited<ReturnType<typeof startSwitchboard>> | undefined;
+
+  try {
+    switchboard = await startSwitchboard({
+      workflows: { enabled: false },
+      dbPath: join(tempRoot, "read-model"),
+      port: 0,
+      mcp: false,
+      disableLocalPackages: true,
+      identity: { keypairPath: join(tempRoot, "identity.json") },
+      drive: {
+        slug: "default-drive",
+        global: { name: "Default Drive" },
+      },
+      logger: stubLogger(),
+    });
+    await run(switchboard);
+    await switchboard.shutdown();
+    switchboard = undefined;
+  } finally {
+    await switchboard?.shutdown();
+    for (const [name, value] of previous) {
+      if (value === undefined) {
+        delete process.env[name];
+      } else {
+        process.env[name] = value;
+      }
+    }
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+}
+
+describe("booting Switchboard", () => {
+  it("creates v2-required documents and drives by default", async () => {
+    await withSwitchboard({}, async ({ reactor }) => {
+      const document = await reactor.createEmpty("powerhouse/document-model");
+      expect(signaturePolicyOf(document.header)).toBe("v2-required");
+      expect(hasDerivedDocumentId(document.header)).toBe(true);
+
+      const drive = await reactor.drives.create({ global: { name: "Drive" } });
+      expect(signaturePolicyOf(drive.header)).toBe("v2-required");
+
+      const defaultDrive = await reactor.get("default-drive");
+      expect(signaturePolicyOf(defaultDrive.header)).toBe("v2-required");
+    });
+  }, 60_000);
+
+  it("creates legacy documents and drives under CREATE_SIGNATURE_POLICY=legacy", async () => {
+    await withSwitchboard(
+      { CREATE_SIGNATURE_POLICY: "legacy" },
+      async ({ reactor }) => {
+        const document = await reactor.createEmpty("powerhouse/document-model");
+        expect(signaturePolicyOf(document.header)).toBe("legacy");
+        expect(isDerivedDocumentId(document.header.id)).toBe(false);
+
+        const drive = await reactor.drives.create({
+          global: { name: "Drive" },
+        });
+        expect(signaturePolicyOf(drive.header)).toBe("legacy");
+        expect(isDerivedDocumentId(drive.header.id)).toBe(false);
+
+        const defaultDrive = await reactor.get("default-drive");
+        expect(signaturePolicyOf(defaultDrive.header)).toBe("legacy");
+
+        const asked = await reactor.createEmpty("powerhouse/document-model", {
+          signaturePolicy: "v2-required",
+        });
+        expect(hasDerivedDocumentId(asked.header)).toBe(true);
+      },
+    );
+  }, 60_000);
+});

package/test/boot-without-renown.test.ts

@@ -0,0 +1,81 @@
+import {
+  isDerivedDocumentId,
+  signaturePolicyOf,
+} from "@powerhousedao/shared/document-model";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { ILogger } from "document-model";
+import { describe, expect, it, vi } from "vitest";
+import type * as RenownModule from "../src/renown.js";
+import { startSwitchboard } from "../src/server.mjs";
+
+vi.mock("../src/renown.js", async (importOriginal) => ({
+  ...(await importOriginal<typeof RenownModule>()),
+  initRenown: vi.fn().mockRejectedValue(new Error("Renown is unreachable")),
+}));
+
+function stubLogger(): ILogger & { warn: ReturnType<typeof vi.fn> } {
+  const logger = {
+    verbose: vi.fn(),
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    child: vi.fn(),
+  };
+  logger.child.mockReturnValue(logger);
+  return logger as unknown as ILogger & { warn: ReturnType<typeof vi.fn> };
+}
+
+describe("booting Switchboard without Renown", () => {
+  it("warns and creates legacy documents, which it can write unsigned", async () => {
+    const tempRoot = await mkdtemp(join(tmpdir(), "switchboard-no-renown-"));
+    const previous = process.env.PH_REACTOR_DATABASE_URL;
+    process.env.PH_REACTOR_DATABASE_URL = join(tempRoot, "reactor-storage");
+    const logger = stubLogger();
+    let switchboard: Awaited<ReturnType<typeof startSwitchboard>> | undefined;
+
+    try {
+      switchboard = await startSwitchboard({
+        workflows: { enabled: false },
+        dbPath: join(tempRoot, "read-model"),
+        port: 0,
+        mcp: false,
+        disableLocalPackages: true,
+        logger,
+      });
+
+      expect(
+        logger.warn.mock.calls.some(
+          ([message]) =>
+            typeof message === "string" &&
+            message.includes("new documents are created legacy"),
+        ),
+      ).toBe(true);
+
+      const document = await switchboard.reactor.createEmpty(
+        "powerhouse/document-model",
+      );
+      expect(signaturePolicyOf(document.header)).toBe("legacy");
+      expect(isDerivedDocumentId(document.header.id)).toBe(false);
+
+      const renamed = await switchboard.reactor.rename(
+        document.header.id,
+        "Renamed",
+      );
+      expect(renamed.header.name).toBe("Renamed");
+
+      await switchboard.shutdown();
+      switchboard = undefined;
+    } finally {
+      await switchboard?.shutdown();
+      if (previous === undefined) {
+        delete process.env.PH_REACTOR_DATABASE_URL;
+      } else {
+        process.env.PH_REACTOR_DATABASE_URL = previous;
+      }
+      await rm(tempRoot, { recursive: true, force: true });
+    }
+  }, 60_000);
+});

package/test/boot-without-require-signatures.test.ts

@@ -0,0 +1,74 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { ILogger } from "document-model";
+import { describe, expect, it, vi } from "vitest";
+import { startSwitchboard } from "../src/server.mjs";
+
+function stubLogger(): ILogger & { info: ReturnType<typeof vi.fn> } {
+  const logger = {
+    verbose: vi.fn(),
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    child: vi.fn(),
+  };
+  logger.child.mockReturnValue(logger);
+  return logger as unknown as ILogger & { info: ReturnType<typeof vi.fn> };
+}
+
+describe("booting Switchboard", () => {
+  it("has no REQUIRE_SIGNATURES flag, and ignores the variable", async () => {
+    const tempRoot = await mkdtemp(join(tmpdir(), "switchboard-signatures-"));
+    const previous = {
+      reactorDb: process.env.PH_REACTOR_DATABASE_URL,
+      requireSignatures: process.env.REQUIRE_SIGNATURES,
+    };
+    process.env.PH_REACTOR_DATABASE_URL = join(tempRoot, "reactor-storage");
+    process.env.REQUIRE_SIGNATURES = "true";
+    const logger = stubLogger();
+    let switchboard: Awaited<ReturnType<typeof startSwitchboard>> | undefined;
+
+    try {
+      switchboard = await startSwitchboard({
+        workflows: { enabled: false },
+        dbPath: join(tempRoot, "read-model"),
+        port: 0,
+        mcp: false,
+        disableLocalPackages: true,
+        identity: { keypairPath: join(tempRoot, "identity.json") },
+        logger,
+      });
+
+      const flagLog = logger.info.mock.calls.find(
+        ([message]) => message === "Feature flags: @flags",
+      );
+      expect(flagLog).toBeDefined();
+      expect(JSON.parse(flagLog![1] as string)).not.toHaveProperty(
+        "REQUIRE_SIGNATURES",
+      );
+
+      const created = await switchboard.reactor.createEmpty(
+        "powerhouse/document-model",
+      );
+      expect(created.header.id).toBeTruthy();
+
+      await switchboard.shutdown();
+      switchboard = undefined;
+    } finally {
+      await switchboard?.shutdown();
+      for (const [name, value] of [
+        ["PH_REACTOR_DATABASE_URL", previous.reactorDb],
+        ["REQUIRE_SIGNATURES", previous.requireSignatures],
+      ] as const) {
+        if (value === undefined) {
+          delete process.env[name];
+        } else {
+          process.env[name] = value;
+        }
+      }
+      await rm(tempRoot, { recursive: true, force: true });
+    }
+  }, 60_000);
+});

package/test/boot-worker-trust-policy.test.ts

@@ -0,0 +1,90 @@
+import type { ILogger } from "document-model";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type * as RenownModule from "../src/renown.js";
+import { startSwitchboard } from "../src/server.mjs";
+
+vi.mock("../src/renown.js", async (importOriginal) => ({
+  ...(await importOriginal<typeof RenownModule>()),
+  initRenown: vi.fn().mockRejectedValue(new Error("Renown is unreachable")),
+}));
+
+const TRUST_FAILURE =
+  /REACTOR_WORKERS[\s\S]*REACTOR_AUTH_ENFORCEMENT[\s\S]*RENOWN_SOURCE/;
+const ENV_KEYS = [
+  "PH_REACTOR_DATABASE_URL",
+  "RENOWN_SOURCE",
+  "REACTOR_DOCUMENT_DECISIONS",
+  "REACTOR_AUTH_ENFORCEMENT",
+] as const;
+
+function stubLogger(): ILogger {
+  const logger = {
+    verbose: vi.fn(),
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    child: vi.fn(),
+  };
+  logger.child.mockReturnValue(logger);
+  return logger as unknown as ILogger;
+}
+
+describe("booting with pooled workers under authEnforcement", () => {
+  let tempRoot: string;
+  let previous: Partial<Record<(typeof ENV_KEYS)[number], string>>;
+
+  beforeEach(async () => {
+    tempRoot = await mkdtemp(join(tmpdir(), "switchboard-worker-trust-"));
+    previous = Object.fromEntries(ENV_KEYS.map((k) => [k, process.env[k]]));
+    process.env.PH_REACTOR_DATABASE_URL = join(tempRoot, "reactor-storage");
+    process.env.REACTOR_DOCUMENT_DECISIONS = "true";
+    process.env.REACTOR_AUTH_ENFORCEMENT = "true";
+  });
+
+  afterEach(async () => {
+    for (const key of ENV_KEYS) {
+      if (previous[key] === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = previous[key];
+      }
+    }
+    await rm(tempRoot, { recursive: true, force: true });
+  });
+
+  function boot(numWorkers: number) {
+    return startSwitchboard({
+      workflows: { enabled: false },
+      dbPath: join(tempRoot, "read-model"),
+      port: 0,
+      mcp: false,
+      disableLocalPackages: true,
+      logger: stubLogger(),
+      workerPool: { numWorkers },
+    });
+  }
+
+  it("fails with a self Renown source", async () => {
+    process.env.RENOWN_SOURCE = "self";
+
+    await expect(boot(2)).rejects.toThrow(TRUST_FAILURE);
+  });
+
+  // Postgres is the next requirement a pooled boot has; reaching it passes the check.
+  it("passes the check with a remote Renown source", async () => {
+    process.env.RENOWN_SOURCE = "remote";
+
+    await expect(boot(2)).rejects.toThrow(/requires a Postgres/);
+  });
+
+  // No loaded package serves the renown read model here; reaching that check passes this one.
+  it("passes the check without workers", async () => {
+    process.env.RENOWN_SOURCE = "self";
+
+    await expect(boot(0)).rejects.toThrow(/no loaded package serves/);
+  }, 60_000);
+});

package/test/builder-defaults.test.ts

@@ -0,0 +1,80 @@
+import type { ISigner } from "@powerhousedao/shared/document-model";
+import {
+  ReactorBuilder,
+  ReactorClientBuilder,
+  type FactorySpec,
+} from "@powerhousedao/reactor";
+import type { IRenown } from "@renown/sdk/node";
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { describe, expect, it, vi } from "vitest";
+import { applySwitchboardReactorDefaults } from "../src/builder-defaults.mjs";
+import {
+  getRenownSignerConfig,
+  getRenownWorkerSignerSpec,
+} from "../src/renown.js";
+
+const USER = { address: "0xswitchboard", networkId: "eip155", chainId: 1 };
+
+function stubRenown(user = USER): IRenown {
+  const signer = {
+    user,
+    app: { name: "switchboard", key: "did:key:zSwitchboard" },
+  } as unknown as ISigner;
+  return { signer } as unknown as IRenown;
+}
+
+describe("applySwitchboardReactorDefaults", () => {
+  it("gives the reactor the signer and its worker spec", () => {
+    const reactorBuilder = new ReactorBuilder();
+    const clientBuilder = new ReactorClientBuilder();
+    const reactorWithSigner = vi.spyOn(reactorBuilder, "withSigner");
+    const clientWithSigner = vi.spyOn(clientBuilder, "withSigner");
+    const signer = getRenownSignerConfig(stubRenown(), ".ph/key.json");
+
+    applySwitchboardReactorDefaults(reactorBuilder, clientBuilder, {
+      includeBaseModels: false,
+      signalHandlers: false,
+      signer,
+    });
+
+    expect(clientWithSigner).toHaveBeenCalledWith(signer);
+    expect(reactorWithSigner).toHaveBeenCalledWith(
+      signer.signer,
+      signer.workerSigner,
+    );
+    expect(reactorBuilder.hasSigner()).toBe(true);
+  });
+});
+
+describe("getRenownWorkerSignerSpec", () => {
+  it("points workers at createNodeRenownSigner over the stored key", () => {
+    const spec: FactorySpec = getRenownWorkerSignerSpec(
+      stubRenown(),
+      ".ph/key.json",
+    );
+
+    expect(spec.module.exportName).toBe("createNodeRenownSigner");
+    const filePath = "filePath" in spec.module ? spec.module.filePath : "";
+    expect(existsSync(filePath)).toBe(true);
+    expect(spec.initArgs).toEqual({
+      appName: "switchboard",
+      keypairPath: resolve(".ph/key.json"),
+      did: "did:key:zSwitchboard",
+      user: USER,
+    });
+  });
+
+  it("leaves the user out when none is logged in", () => {
+    const renown = stubRenown();
+    (renown.signer as { user?: unknown }).user = undefined;
+
+    const spec = getRenownWorkerSignerSpec(renown);
+
+    expect(spec.initArgs).toEqual({
+      appName: "switchboard",
+      keypairPath: resolve(".ph/.keypair.json"),
+      did: "did:key:zSwitchboard",
+    });
+  });
+});