@powerhousedao/switchboard 6.2.3-dev.23 → 6.2.3-dev.25

package/dist/server.d.mts

@@ -4,9 +4,10 @@ import { AttachmentReferenceProjectionCapability } from "@powerhousedao/reactor-
 import { IAttachmentService } from "@powerhousedao/reactor-attachments";
 import { IRenown } from "@renown/sdk/node";
 import { DriveInput } from "@powerhousedao/shared/document-drive";
+import { DocumentModelModule, SignaturePolicy, UpgradeManifest } from "@powerhousedao/shared/document-model";
+import "@powerhousedao/reactor-workflow";
+import "@powerhousedao/shared/processors";
 import { IRenown as IRenown$1 } from "@renown/sdk";
-import { DocumentModelModule, UpgradeManifest } from "@powerhousedao/shared/document-model";
-
 //#region src/workflow-runtime.d.mts
 /** Whether the operation intake is indexing. Same shape as the attachment
  * reference projection, because it is the same limitation. */
@@ -24,27 +25,28 @@ type WorkflowTriggersCapability = {
  * `powerhouse/reactor-drive` is wired through `addDefaultReactorDrive` and
  * uses the relationship-based child graph.
  */
-type SwitchboardDriveDocumentType = "powerhouse/document-drive" | "powerhouse/reactor-drive";
+export type SwitchboardDriveDocumentType = "powerhouse/document-drive" | "powerhouse/reactor-drive";
 /** A {@link DriveInput} extended with the optional drive-container type. */
-type SwitchboardDriveInput = DriveInput & {
+export type SwitchboardDriveInput = DriveInput & {
   documentType?: SwitchboardDriveDocumentType;
 };
-type StorageOptions = {
+export type StorageOptions = {
   type: "filesystem" | "memory" | "postgres" | "browser";
   filesystemPath?: string;
   postgresUrl?: string;
 };
-type IdentityOptions = {
-  /** Path to the keypair file. Defaults to ~/.ph/keypair.json */keypairPath?: string;
+export type IdentityOptions = {
+  /** Path to the keypair file. Defaults to ~/.ph/keypair.json */
+  keypairPath?: string;
   /**
    * If true, won't start without an existing keypair.
    * Use this to ensure the switchboard only runs with an authenticated identity.
    */
-  requireExisting?: boolean; /** Base url of the Renown instance to use */
-  baseUrl?: string; /** If true, unsigned actions will be rejected */
-  requireSignatures?: boolean;
+  requireExisting?: boolean;
+  /** Base url of the Renown instance to use */
+  baseUrl?: string;
 };
-type StartServerOptions = {
+export type StartServerOptions = {
   /**
    * Pre-built ReactorClientModule (typically from
    * `@powerhousedao/reactor#ReactorClientBuilder.buildModule`). When set, the
@@ -103,7 +105,8 @@ type StartServerOptions = {
    * When configured, the switchboard will load the keypair from `ph login`
    * and can authenticate with remote services on behalf of the user.
    */
-  identity?: IdentityOptions; /** Base URL for the attachment service; defaults to `PH_SWITCHBOARD_PUBLIC_URL` then `http(s)://localhost:${port}`. */
+  identity?: IdentityOptions;
+  /** Base URL for the attachment service; defaults to `PH_SWITCHBOARD_PUBLIC_URL` then `http(s)://localhost:${port}`. */
   attachmentServiceUrl?: string;
   mcp?: boolean;
   /** Powerhouse workflows: the runtime, its subgraph, its webhooks and its
@@ -168,14 +171,17 @@ type StartServerOptions = {
     dbPoolSize?: number;
   };
 };
-type SwitchboardReactor = {
+export type SwitchboardReactor = {
   defaultDriveUrl: string | undefined;
-  reactor: IReactorClient; /** Switchboard-backed remote attachment service over its own `/attachments/*` API, for downstream consumers. */
-  attachmentService: IAttachmentService; /** Whether the authoritative attachment-reference projection is active. */
+  reactor: IReactorClient;
+  /** Switchboard-backed remote attachment service over its own `/attachments/*` API, for downstream consumers. */
+  attachmentService: IAttachmentService;
+  /** Whether the authoritative attachment-reference projection is active. */
   attachmentReferenceProjection: AttachmentReferenceProjectionCapability;
   /** Whether the workflow runtime's operation intake is indexing. Undefined
    * when workflows are off; unavailable means no document trigger fires. */
-  workflowTriggers?: WorkflowTriggersCapability; /** The Renown instance if identity was initialized */
+  workflowTriggers?: WorkflowTriggersCapability;
+  /** The Renown instance if identity was initialized */
   renown: IRenown$1 | null;
   /**
    * Port the HTTP server actually bound to. May differ from the requested
@@ -199,29 +205,42 @@ type SwitchboardReactor = {
 //#endregion
 //#region src/builder-defaults.d.mts
 type SwitchboardReactorDefaultsOptions = {
-  documentModels?: DocumentModelModule[]; /** Upgrade manifests for versioned models, one per document type. */
-  upgradeManifests?: UpgradeManifest<readonly number[]>[]; /** Default true. */
+  documentModels?: DocumentModelModule[];
+  /** Upgrade manifests for versioned models, one per document type. */
+  upgradeManifests?: UpgradeManifest<readonly number[]>[];
+  /** Default true. */
   includeBaseModels?: boolean;
   /**
    * Channel scheme. Defaults to `ChannelScheme.SWITCHBOARD`, which populates
    * `reactorModule.syncModule.syncManager` — required by reactor-api. Set
    * to `false` only if the caller will configure a scheme themselves.
    */
-  channelScheme?: ChannelScheme | false; /** Defaults to true. Set false when the caller owns SIGINT handling. */
-  signalHandlers?: boolean; /** Executor tuning. Omit to use the reactor's own defaults. */
+  channelScheme?: ChannelScheme | false;
+  /** Defaults to true. Set false when the caller owns SIGINT handling. */
+  signalHandlers?: boolean;
+  /** Executor tuning. Omit to use the reactor's own defaults. */
   executorConfig?: {
     maxSkipThreshold?: number;
     featureFlags?: Partial<ReactorFeatureFlags>;
-  }; /** Wire dynamic document-model loading via HTTP. */
+  };
+  /** Wire dynamic document-model loading via HTTP. */
   documentModelLoader?: IDocumentModelLoader;
   logger?: ILogger;
   /**
-   * Identity signer (typically from `getRenownSignerConfig`). Applied to the
-   * `ReactorClientBuilder`; omit for unsigned operation.
+   * Identity signer (typically from `getRenownSignerConfig`). Signs client
+   * writes and the operations the executor synthesizes, in pooled workers
+   * through `workerSigner`; omit for unsigned operation.
    */
   signer?: SignerConfig;
+  /**
+   * Which keys may sign as which users (typically from
+   * `getRenownTrustPolicyConfig`); wins over one carried by `signer`.
+   */
+  trustPolicy?: Pick<SignerConfig, "trustPolicy" | "workerTrustPolicy">;
+  /** What the client creates new documents as; see `resolveCreateSignaturePolicy`. */
+  createSignaturePolicy?: SignaturePolicy;
 };
-declare function applySwitchboardReactorDefaults(reactorBuilder: ReactorBuilder, clientBuilder: ReactorClientBuilder, options?: SwitchboardReactorDefaultsOptions): void;
+export declare function applySwitchboardReactorDefaults(reactorBuilder: ReactorBuilder, clientBuilder: ReactorClientBuilder, options?: SwitchboardReactorDefaultsOptions): void;
 //#endregion
 //#region src/server.d.mts
 /**
@@ -229,9 +248,9 @@ declare function applySwitchboardReactorDefaults(reactorBuilder: ReactorBuilder,
  * the port is free, false if the OS reports it in use. Any other error is
  * surfaced so we don't silently mask real issues (permissions, bad host, …).
  */
-declare function isPortAvailable(port: number): Promise<boolean>;
+export declare function isPortAvailable(port: number): Promise<boolean>;
 /** Derive the remote attachment service config for switchboard's own `/attachments/*` API. */
-declare function deriveAttachmentServiceConfig(options: Pick<StartServerOptions, "attachmentServiceUrl" | "https">, serverPort: number, renown: IRenown | null): {
+export declare function deriveAttachmentServiceConfig(options: Pick<StartServerOptions, "attachmentServiceUrl" | "https">, serverPort: number, renown: IRenown | null): {
   remoteUrl: string;
   jwtHandler: JwtHandler | undefined;
 };
@@ -252,7 +271,8 @@ declare function deriveAttachmentServiceConfig(options: Pick<StartServerOptions,
  * trigger the `withShutdownHook` chain that disposes the api. Programmatic
  * full teardown isn't currently exposed — wire it via SIGINT/SIGTERM.
  */
-declare const startSwitchboard: (options?: StartServerOptions) => Promise<SwitchboardReactor>;
+export declare const startSwitchboard: (options?: StartServerOptions) => Promise<SwitchboardReactor>;
 //#endregion
-export { IdentityOptions, StartServerOptions, StorageOptions, SwitchboardDriveDocumentType, SwitchboardDriveInput, SwitchboardReactor, type SwitchboardReactorDefaultsOptions, type WorkflowTriggersCapability, applySwitchboardReactorDefaults, deriveAttachmentServiceConfig, isPortAvailable, startSwitchboard };
+export type { SwitchboardReactorDefaultsOptions, WorkflowTriggersCapability };
+export {};
 //# sourceMappingURL=server.d.mts.map

package/dist/server.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.mts","names":[],"sources":["../src/workflow-runtime.mts","../src/types.ts","../src/builder-defaults.mts","../src/server.mts"],"mappings":";;;;;;;;;;AAmDA;;AAAA,KAAY,0BAAA;EACN,MAAA;AAAA;EAEA,MAAA;EACA,MAAA;AAAA;;;;;;;AAJN;;KCjCY,4BAAA;;KAKA,qBAAA,GAAwB,UAAA;EAClC,YAAA,GAAe,4BAAA;AAAA;AAAA,KAGL,cAAA;EACV,IAAA;EACA,cAAA;EACA,WAAA;AAAA;AAAA,KAGU,eAAA;EAf4B,+DAiBtC,WAAA;EAjBsC;;AAKxC;;EAiBE,eAAA,YAhB2C;EAmB3C,OAAA,WAnBA;EAsBA,iBAAA;AAAA;AAAA,KAGU,kBAAA;EAtBA;;;;;;;;;AAMZ;;;;;;;;;;AAgBA;EAqBE,OAAA,GAAU,4BAAA;;;;;;;;EAQV,kBAAA;EARA;;;;;;EAeA,WAAA;EACA,UAAA;EACA,IAAA;EASA;;;;;EAHA,UAAA;EACA,GAAA;EACA,MAAA;EACA,KAAA,GAAQ,qBAAA;EACR,QAAA;EACA,YAAA;EACA,KAAA;IAEM,OAAA;IACA,QAAA;EAAA;EAmBN;;;;;EAVA,QAAA,GAAW,eAAA,EAsCX;EApCA,oBAAA;EACA,GAAA;EA8CE;;EA3CF,SAAA;IACE,OAAA;EAAA;EAEF,eAAA,GAAkB,GAAA;EAClB,oBAAA;EACA,4BAAA;EAwD4B;;;;;EAlD5B,mBAAA;EACA,MAAA,GAAS,OAAA;EA8EO;;;;;;;;;EApEhB,aAAA;EAgDA;;;;;;;;;EAtCA,cAAA;;;ACjIF;;;;;;ED0IE,UAAA;IACE,UAAA;IACA,mBAAA;IACA,gBAAA;EAAA;EChHmB;;;;;;;;;ED2HrB,gBAAA;IACE,OAAA;IACA,UAAA;EAAA;AAAA;AAAA,KAIQ,kBAAA;EACV,eAAA;EACA,OAAA,EAAS,cAAA,ECxIT;ED0IA,iBAAA,EAAmB,kBAAA,ECrInB;EDuIA,6BAAA,EAA+B,uCAAA;ECvIV;;ED0IrB,gBAAA,GAAmB,0BAAA,ECpH0B;EDsH7C,MAAA,EAAQ,SAAA;ECrHQ;;;;ED0HhB,IAAA;EC1HgB;;;;;;;;;;;ACkElB;EFqEE,QAAA,QAAgB,OAAA;AAAA;;;KC3LN,iCAAA;EAIV,cAAA,GAAiB,mBAAA;EAEjB,gBAAA,GAAmB,eAAA;EAEnB,iBAAA;;;AFuBF;;;EEjBE,aAAA,GAAgB,aAAA,UFkBZ;EEhBJ,cAAA,YFmBI;EEjBJ,cAAA;IACE,gBAAA;IACA,YAAA,GAAe,OAAA,CAAQ,mBAAA;EAAA;EAGzB,mBAAA,GAAsB,oBAAA;EACtB,MAAA,GAAS,OAAA;;;;ADrBX;EC0BE,MAAA,GAAS,YAAA;AAAA;AAAA,iBAsBK,+BAAA,CACd,cAAA,EAAgB,cAAA,EAChB,aAAA,EAAe,oBAAA,EACf,OAAA,GAAS,iCAAA;;;;;;;;iBCgEK,eAAA,CAAgB,IAAA,WAAe,OAAA;;iBAoI/B,6BAAA,CACd,OAAA,EAAS,IAAA,CAAK,kBAAA,qCACd,UAAA,UACA,MAAA,EAAQ,OAAA;EACL,SAAA;EAAmB,UAAA,EAAY,UAAA;AAAA;;;;;;;;;;AFhQpC;;;;;AAKA;;;cEqmCa,gBAAA,GACX,OAAA,GAAS,kBAAA,KACR,OAAA,CAAQ,kBAAA"}
+{"version":3,"file":"server.d.mts","names":[],"sources":["../src/workflow-runtime.mts","../src/types.ts","../src/builder-defaults.mts","../src/server.mts"],"mappings":";;;;;;;;;;;;;KAmDY;EACN;;EAEA;EACA;;;;;;;;;;YCrCM;;YAKA,wBAAwB;EAClC,eAAe;;YAGL;EACV;EACA;EACA;;YAGU;;EAEV;;;;;EAKA;;EAGA;;YAGU;;;;;;;;;;;;;;;;;;;;;EAqBV,UAAU;;;;;;;;EAQV;;;;;;;EAOA;EACA;EACA;;;;;;EAMA;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA;IAEM;IACA;;;;;;;EASN,WAAW;;EAEX;EACA;;;EAGA;IACE;;EAEF,kBAAkB;EAClB;EACA;;;;;;EAMA;EACA,SAAS;;;;;;;;;;EAUT;;;;;;;;;;EAUA;;;;;;;;;EASA;IACE;IACA;IACA;;;;;;;;;;;EAWF;IACE;IACA;;;YAIQ;EACV;EACA,SAAS;;EAET,mBAAmB;;EAEnB,+BAA+B;;;EAG/B,mBAAmB;;EAEnB,QAAQ;;;;;EAKR;;;;;;;;;;;;;EAaA,gBAAgB;;;;KCvLN;EAIV,iBAAiB;;EAEjB,mBAAmB;;EAEnB;;;;;;EAMA,gBAAgB;;EAEhB;;EAEA;IACE;IACA,eAAe,QAAQ;;;EAGzB,sBAAsB;EACtB,SAAS;;;;;;EAMT,SAAS;;;;;EAKT,cAAc,KAAK;;EAEnB,wBAAwB;;wBAsBV,gCACd,gBAAgB,gBAChB,eAAe,sBACf,UAAS;;;;;;;;wBC4DK,gBAAgB,eAAe;;wBAoI/B,8BACd,SAAS,KAAK,uDACd,oBACA,QAAQ;EACL;EAAmB,YAAY;;;;;;;;;;;;;;;;;;;qBA04BvB,mBAAgB,UAClB,uBACR,QAAQ"}

package/dist/server.mjs

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
-import { i as applySwitchboardReactorDefaults, n as isPortAvailable, r as startSwitchboard, t as deriveAttachmentServiceConfig } from "./server-DVotaGIp.mjs";
-import "./utils-Baw7rThP.mjs";
+import { i as applySwitchboardReactorDefaults, n as isPortAvailable, r as startSwitchboard, t as deriveAttachmentServiceConfig } from "./server-C3WaP3kE.mjs";
 export { applySwitchboardReactorDefaults, deriveAttachmentServiceConfig, isPortAvailable, startSwitchboard };
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d3c1a3db-c204-531d-a263-2712fcafce00")}catch(e){}}();
-//# debugId=d3c1a3db-c204-531d-a263-2712fcafce00
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1217c4fa-83a6-5775-a7ff-15c675d58ff3")}catch(e){}}();
+//# debugId=1217c4fa-83a6-5775-a7ff-15c675d58ff3

package/dist/{utils-Baw7rThP.mjs → utils-uaBlzyjS.mjs}

@@ -1,8 +1,16 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="686dcce6-c280-5558-89dd-a18a7e514cdf")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5ece528d-aafb-5305-a04d-e0c45c8c30a3")}catch(e){}}();
 import { reactorDriveCreateDocument, reactorDriveCreateState } from "@powerhousedao/reactor-drive";
 import { driveCreateDocument, driveCreateState } from "@powerhousedao/shared/document-drive";
+import { withSignaturePolicy } from "@powerhousedao/shared/document-model";
 //#region src/utils.mts
+/**
+* A configured id pins the drive, and only a legacy drive can take a chosen
+* id; otherwise the client's creation default applies.
+*/
+async function underCreatePolicy(client, document, id) {
+	return id ? withSignaturePolicy(document, "legacy", { id }) : withSignaturePolicy(document, await client.getCreateSignaturePolicy());
+}
 async function addDefaultDrive(client, drive, serverPort) {
 	let driveId = drive.id;
 	if (!driveId || driveId.length === 0) driveId = drive.slug;
@@ -13,7 +21,7 @@ async function addDefaultDrive(client, drive, serverPort) {
 	} catch {}
 	if (existingDrive) return `http://localhost:${serverPort}/d/${driveId}`;
 	const { global } = driveCreateState();
-	const document = driveCreateDocument({
+	const document = await underCreatePolicy(client, driveCreateDocument({
 		global: {
 			...global,
 			name: drive.global.name,
@@ -25,8 +33,7 @@ async function addDefaultDrive(client, drive, serverPort) {
 			listeners: drive.local?.listeners ?? [],
 			triggers: drive.local?.triggers ?? []
 		}
-	});
-	if (drive.id && drive.id.length > 0) document.header.id = drive.id;
+	}), drive.id);
 	if (drive.slug && drive.slug.length > 0) document.header.slug = drive.slug;
 	if (drive.global.name) document.header.name = drive.global.name;
 	if (drive.preferredEditor) document.header.meta = { preferredEditor: drive.preferredEditor };
@@ -47,7 +54,7 @@ async function addDefaultReactorDrive(client, drive, serverPort) {
 	} catch {}
 	if (existingDrive) return `http://localhost:${serverPort}/d/${driveId}`;
 	const { global, local } = reactorDriveCreateState();
-	const document = reactorDriveCreateDocument({
+	const document = await underCreatePolicy(client, reactorDriveCreateDocument({
 		global: {
 			...global,
 			name: drive.global.name,
@@ -58,8 +65,7 @@ async function addDefaultReactorDrive(client, drive, serverPort) {
 			availableOffline: drive.local?.availableOffline ?? local.availableOffline,
 			sharingType: drive.local?.sharingType ?? local.sharingType
 		}
-	});
-	if (drive.id && drive.id.length > 0) document.header.id = drive.id;
+	}), drive.id);
 	if (drive.slug && drive.slug.length > 0) document.header.slug = drive.slug;
 	if (drive.global.name) document.header.name = drive.global.name;
 	if (drive.preferredEditor) document.header.meta = { preferredEditor: drive.preferredEditor };
@@ -76,5 +82,5 @@ function isPostgresUrl(url) {
 //#endregion
 export { addDefaultReactorDrive as n, isPostgresUrl as r, addDefaultDrive as t };
 
-//# sourceMappingURL=utils-Baw7rThP.mjs.map
-//# debugId=686dcce6-c280-5558-89dd-a18a7e514cdf
+//# sourceMappingURL=utils-uaBlzyjS.mjs.map
+//# debugId=5ece528d-aafb-5305-a04d-e0c45c8c30a3

package/dist/utils-uaBlzyjS.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils-uaBlzyjS.mjs","sources":["../src/utils.mts"],"sourcesContent":["import type { IReactorClient } from \"@powerhousedao/reactor\";\nimport {\n  reactorDriveCreateDocument,\n  reactorDriveCreateState,\n} from \"@powerhousedao/reactor-drive\";\nimport {\n  driveCreateDocument,\n  driveCreateState,\n} from \"@powerhousedao/shared/document-drive\";\nimport type { DriveInput } from \"@powerhousedao/shared/document-drive\";\nimport {\n  withSignaturePolicy,\n  type PHDocument,\n} from \"@powerhousedao/shared/document-model\";\n\n/**\n * A configured id pins the drive, and only a legacy drive can take a chosen\n * id; otherwise the client's creation default applies.\n */\nasync function underCreatePolicy<TDocument extends PHDocument>(\n  client: IReactorClient,\n  document: TDocument,\n  id: string | undefined,\n): Promise<TDocument> {\n  return id\n    ? withSignaturePolicy(document, \"legacy\", { id })\n    : withSignaturePolicy(document, await client.getCreateSignaturePolicy());\n}\n\nexport async function addDefaultDrive(\n  client: IReactorClient,\n  drive: DriveInput,\n  serverPort: number,\n) {\n  let driveId = drive.id;\n  if (!driveId || driveId.length === 0) {\n    driveId = drive.slug;\n  }\n\n  if (!driveId || driveId.length === 0) {\n    throw new Error(\"Invalid Drive Id\");\n  }\n\n  // check if the drive already exists\n  let existingDrive;\n  try {\n    existingDrive = await client.get(driveId);\n  } catch {\n    //\n  }\n\n  // already exists, return the existing drive url\n  if (existingDrive) {\n    return `http://localhost:${serverPort}/d/${driveId}`;\n  }\n\n  const { global } = driveCreateState();\n  const created = driveCreateDocument({\n    global: {\n      ...global,\n      name: drive.global.name,\n      icon: drive.global.icon ?? global.icon,\n    },\n    local: {\n      availableOffline: drive.local?.availableOffline ?? false,\n      sharingType: drive.local?.sharingType ?? \"public\",\n      listeners: drive.local?.listeners ?? [],\n      triggers: drive.local?.triggers ?? [],\n    },\n  });\n\n  const document = await underCreatePolicy(client, created, drive.id);\n  if (drive.slug && drive.slug.length > 0) {\n    document.header.slug = drive.slug;\n  }\n  if (drive.global.name) {\n    document.header.name = drive.global.name;\n  }\n  if (drive.preferredEditor) {\n    document.header.meta = { preferredEditor: drive.preferredEditor };\n  }\n\n  try {\n    await client.create(document);\n  } catch (e) {\n    const errorMessage = e instanceof Error ? e.message : String(e);\n    if (!errorMessage.includes(\"already exists\")) {\n      throw e;\n    }\n  }\n\n  return `http://localhost:${serverPort}/d/${driveId}`;\n}\n\nexport async function addDefaultReactorDrive(\n  client: IReactorClient,\n  drive: DriveInput,\n  serverPort: number,\n) {\n  let driveId = drive.id;\n  if (!driveId || driveId.length === 0) {\n    driveId = drive.slug;\n  }\n\n  if (!driveId || driveId.length === 0) {\n    throw new Error(\"Invalid Drive Id\");\n  }\n\n  let existingDrive;\n  try {\n    existingDrive = await client.get(driveId);\n  } catch {\n    //\n  }\n\n  if (existingDrive) {\n    return `http://localhost:${serverPort}/d/${driveId}`;\n  }\n\n  const { global, local } = reactorDriveCreateState();\n  const created = reactorDriveCreateDocument({\n    global: {\n      ...global,\n      name: drive.global.name,\n      icon: drive.global.icon ?? global.icon,\n    },\n    local: {\n      ...local,\n      availableOffline: drive.local?.availableOffline ?? local.availableOffline,\n      sharingType: drive.local?.sharingType ?? local.sharingType,\n    },\n  });\n\n  const document = await underCreatePolicy(client, created, drive.id);\n  if (drive.slug && drive.slug.length > 0) {\n    document.header.slug = drive.slug;\n  }\n  if (drive.global.name) {\n    document.header.name = drive.global.name;\n  }\n  if (drive.preferredEditor) {\n    document.header.meta = { preferredEditor: drive.preferredEditor };\n  }\n\n  try {\n    await client.create(document);\n  } catch (e) {\n    const errorMessage = e instanceof Error ? e.message : String(e);\n    if (!errorMessage.includes(\"already exists\")) {\n      throw e;\n    }\n  }\n\n  return `http://localhost:${serverPort}/d/${driveId}`;\n}\n\nexport function isPostgresUrl(url: string) {\n  return url.startsWith(\"postgresql\") || url.startsWith(\"postgres\");\n}\n"],"names":[],"mappings":";;;;;;;;;;AAmBA,eAAe,kBACb,QACA,UACA,IACoB;CACpB,OAAO,KACH,oBAAoB,UAAU,UAAU,EAAE,GAAG,CAAC,IAC9C,oBAAoB,UAAU,MAAM,OAAO,yBAAyB,CAAC;AAC3E;AAEA,eAAsB,gBACpB,QACA,OACA,YACA;CACA,IAAI,UAAU,MAAM;CACpB,IAAI,CAAC,WAAW,QAAQ,WAAW,GACjC,UAAU,MAAM;CAGlB,IAAI,CAAC,WAAW,QAAQ,WAAW,GACjC,MAAM,IAAI,MAAM,kBAAkB;CAIpC,IAAI;CACJ,IAAI;EACF,gBAAgB,MAAM,OAAO,IAAI,OAAO;CAC1C,QAAQ,CAER;CAGA,IAAI,eACF,OAAO,oBAAoB,WAAW,KAAK;CAG7C,MAAM,EAAE,WAAW,iBAAiB;CAepC,MAAM,WAAW,MAAM,kBAAkB,QAdzB,oBAAoB;EAClC,QAAQ;GACN,GAAG;GACH,MAAM,MAAM,OAAO;GACnB,MAAM,MAAM,OAAO,QAAQ,OAAO;EACpC;EACA,OAAO;GACL,kBAAkB,MAAM,OAAO,oBAAoB;GACnD,aAAa,MAAM,OAAO,eAAe;GACzC,WAAW,MAAM,OAAO,aAAa,CAAC;GACtC,UAAU,MAAM,OAAO,YAAY,CAAC;EACtC;CACF,CAEuD,GAAG,MAAM,EAAE;CAClE,IAAI,MAAM,QAAQ,MAAM,KAAK,SAAS,GACpC,SAAS,OAAO,OAAO,MAAM;CAE/B,IAAI,MAAM,OAAO,MACf,SAAS,OAAO,OAAO,MAAM,OAAO;CAEtC,IAAI,MAAM,iBACR,SAAS,OAAO,OAAO,EAAE,iBAAiB,MAAM,gBAAgB;CAGlE,IAAI;EACF,MAAM,OAAO,OAAO,QAAQ;CAC9B,SAAS,GAAG;EAEV,IAAI,EADiB,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAA,CAC5C,SAAS,gBAAgB,GACzC,MAAM;CAEV;CAEA,OAAO,oBAAoB,WAAW,KAAK;AAC7C;AAEA,eAAsB,uBACpB,QACA,OACA,YACA;CACA,IAAI,UAAU,MAAM;CACpB,IAAI,CAAC,WAAW,QAAQ,WAAW,GACjC,UAAU,MAAM;CAGlB,IAAI,CAAC,WAAW,QAAQ,WAAW,GACjC,MAAM,IAAI,MAAM,kBAAkB;CAGpC,IAAI;CACJ,IAAI;EACF,gBAAgB,MAAM,OAAO,IAAI,OAAO;CAC1C,QAAQ,CAER;CAEA,IAAI,eACF,OAAO,oBAAoB,WAAW,KAAK;CAG7C,MAAM,EAAE,QAAQ,UAAU,wBAAwB;CAclD,MAAM,WAAW,MAAM,kBAAkB,QAbzB,2BAA2B;EACzC,QAAQ;GACN,GAAG;GACH,MAAM,MAAM,OAAO;GACnB,MAAM,MAAM,OAAO,QAAQ,OAAO;EACpC;EACA,OAAO;GACL,GAAG;GACH,kBAAkB,MAAM,OAAO,oBAAoB,MAAM;GACzD,aAAa,MAAM,OAAO,eAAe,MAAM;EACjD;CACF,CAEuD,GAAG,MAAM,EAAE;CAClE,IAAI,MAAM,QAAQ,MAAM,KAAK,SAAS,GACpC,SAAS,OAAO,OAAO,MAAM;CAE/B,IAAI,MAAM,OAAO,MACf,SAAS,OAAO,OAAO,MAAM,OAAO;CAEtC,IAAI,MAAM,iBACR,SAAS,OAAO,OAAO,EAAE,iBAAiB,MAAM,gBAAgB;CAGlE,IAAI;EACF,MAAM,OAAO,OAAO,QAAQ;CAC9B,SAAS,GAAG;EAEV,IAAI,EADiB,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAA,CAC5C,SAAS,gBAAgB,GACzC,MAAM;CAEV;CAEA,OAAO,oBAAoB,WAAW,KAAK;AAC7C;AAEA,SAAgB,cAAc,KAAa;CACzC,OAAO,IAAI,WAAW,YAAY,KAAK,IAAI,WAAW,UAAU;AAClE","debug_id":"5ece528d-aafb-5305-a04d-e0c45c8c30a3"}

package/dist/utils.d.mts

@@ -1,10 +1,9 @@
 import { IReactorClient } from "@powerhousedao/reactor";
 import { DriveInput } from "@powerhousedao/shared/document-drive";
-
 //#region src/utils.d.mts
-declare function addDefaultDrive(client: IReactorClient, drive: DriveInput, serverPort: number): Promise<string>;
-declare function addDefaultReactorDrive(client: IReactorClient, drive: DriveInput, serverPort: number): Promise<string>;
-declare function isPostgresUrl(url: string): boolean;
+export declare function addDefaultDrive(client: IReactorClient, drive: DriveInput, serverPort: number): Promise<string>;
+export declare function addDefaultReactorDrive(client: IReactorClient, drive: DriveInput, serverPort: number): Promise<string>;
+export declare function isPostgresUrl(url: string): boolean;
 //#endregion
-export { addDefaultDrive, addDefaultReactorDrive, isPostgresUrl };
+export {};
 //# sourceMappingURL=utils.d.mts.map

package/dist/utils.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.mts","names":[],"sources":["../src/utils.mts"],"mappings":";;;;iBAWsB,eAAA,CACpB,MAAA,EAAQ,cAAA,EACR,KAAA,EAAO,UAAA,EACP,UAAA,WAAkB,OAAA;AAAA,iBAgEE,sBAAA,CACpB,MAAA,EAAQ,cAAA,EACR,KAAA,EAAO,UAAA,EACP,UAAA,WAAkB,OAAA;AAAA,iBA6DJ,aAAA,CAAc,GAAA"}
+{"version":3,"file":"utils.d.mts","names":[],"sources":["../src/utils.mts"],"mappings":";;;wBA6BsB,gBACpB,QAAQ,gBACR,OAAO,YACP,qBAAkB;wBA8DE,uBACpB,QAAQ,gBACR,OAAO,YACP,qBAAkB;wBA2DJ,cAAc"}

package/dist/utils.mjs

@@ -1,4 +1,4 @@
-import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-Baw7rThP.mjs";
+import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-uaBlzyjS.mjs";
 export { addDefaultDrive, addDefaultReactorDrive, isPostgresUrl };
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8227e60f-e412-513a-b0cb-502740b7f818")}catch(e){}}();
-//# debugId=8227e60f-e412-513a-b0cb-502740b7f818
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e030fa72-327e-52e2-9ac0-68feb4ef300a")}catch(e){}}();
+//# debugId=e030fa72-327e-52e2-9ac0-68feb4ef300a

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@powerhousedao/switchboard",
   "type": "module",
-  "version": "6.2.3-dev.23",
+  "version": "6.2.3-dev.25",
   "main": "dist/index.mjs",
   "exports": {
     ".": {
@@ -41,7 +41,7 @@
     "@openfeature/core": "1.9.1",
     "@openfeature/env-var-provider": "0.3.1",
     "@openfeature/server-sdk": "1.19.0",
-    "@powerhousedao/config": "6.2.3-dev.23",
+    "@powerhousedao/config": "6.2.3-dev.25",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.218.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
@@ -55,22 +55,22 @@
     "@opentelemetry/sdk-node": "^0.218.0",
     "@opentelemetry/sdk-trace-base": "^2.7.1",
     "@opentelemetry/semantic-conventions": "^1.41.1",
-    "@powerhousedao/opentelemetry-instrumentation-reactor": "6.2.3-dev.23",
-    "@powerhousedao/reactor": "6.2.3-dev.23",
-    "@powerhousedao/shared": "6.2.3-dev.23",
-    "@powerhousedao/vetra": "6.2.3-dev.23",
-    "@powerhousedao/reactor-api": "6.2.3-dev.23",
-    "@powerhousedao/reactor-attachments": "6.2.3-dev.23",
-    "@powerhousedao/reactor-drive": "6.2.3-dev.23",
-    "@powerhousedao/reactor-group": "6.2.3-dev.23",
-    "@powerhousedao/reactor-workflow": "6.2.3-dev.23",
-    "@powerhousedao/workflow": "6.2.3-dev.23",
-    "@powerhousedao/pglite-fs": "6.2.3-dev.23",
+    "@powerhousedao/opentelemetry-instrumentation-reactor": "6.2.3-dev.25",
+    "@powerhousedao/reactor": "6.2.3-dev.25",
+    "@powerhousedao/shared": "6.2.3-dev.25",
+    "@powerhousedao/vetra": "6.2.3-dev.25",
+    "@powerhousedao/reactor-api": "6.2.3-dev.25",
+    "@powerhousedao/reactor-attachments": "6.2.3-dev.25",
+    "@powerhousedao/reactor-drive": "6.2.3-dev.25",
+    "@powerhousedao/reactor-group": "6.2.3-dev.25",
+    "@powerhousedao/reactor-workflow": "6.2.3-dev.25",
+    "@powerhousedao/workflow": "6.2.3-dev.25",
+    "@powerhousedao/pglite-fs": "6.2.3-dev.25",
     "@pyroscope/nodejs": "^0.4.5",
-    "@renown/sdk": "6.2.3-dev.23",
+    "@renown/sdk": "6.2.3-dev.25",
     "@sentry/node": "^10.53.1",
     "@sentry/opentelemetry": "^10.53.1",
-    "document-model": "6.2.3-dev.23",
+    "document-model": "6.2.3-dev.25",
     "dotenv": "^16.4.7",
     "express": "^4.21.2",
     "graphql": "^16",
@@ -84,7 +84,7 @@
     "@types/express": "^4.17.25",
     "@types/node": "25.2.3",
     "@types/pg": "8.16.0",
-    "tsdown": "0.21.1",
+    "tsdown": "0.23.0",
     "concurrently": "9.2.1",
     "nodemon": "3.1.11",
     "react": "19.2.6",
@@ -96,7 +96,7 @@
   "scripts": {
     "tsc": "tsc",
     "test": "vitest run",
-    "lint": "eslint",
+    "lint": "cd ../.. && oxlint apps/switchboard",
     "build": "tsdown && pnpm run install-packages",
     "start": "node dist/index.mjs",
     "start:profile": "mkdir -p .prof && node --cpu-prof --cpu-prof-dir=.prof dist/index.mjs",

package/test/attachments/auth.test.ts

@@ -342,6 +342,91 @@ describe("requireAuth", () => {
     });
   });
 
+  /**
+   * The deployment-wide floor. These routes never pass the GraphQL fetch chain,
+   * so `REQUIRE_AUTHENTICATED_CALLER` reaches them through this option instead
+   * — including on the routes that opt into `allowAnonymous`, which says the
+   * handler can decide without identity, not that the server will serve callers
+   * it cannot name.
+   */
+  describe("requireAuthenticatedCaller", () => {
+    const anonymousUnderOpenPolicy = () =>
+      makeAuthService(() =>
+        Promise.resolve({ user: undefined, admins: [], auth_enabled: false }),
+      );
+
+    it("refuses a missing bearer even with auth disabled, where today it passes", async () => {
+      const { service } = anonymousUnderOpenPolicy();
+      const handler = vi.fn<NodeHandler>();
+      const wrapped = requireAuth(service, handler, {
+        requireAuthenticatedCaller: true,
+      });
+
+      const res = makeRes();
+      await wrapped(makeReq({ headers: {} }), res);
+
+      expect(res.statusCode).toBe(401);
+      expect(JSON.parse(res._body)).toEqual({
+        error: "Authentication required",
+      });
+      expect(handler).not.toHaveBeenCalled();
+    });
+
+    it("overrides allowAnonymous", async () => {
+      const { service } = anonymousUnderOpenPolicy();
+      const handler = vi.fn<NodeHandler>();
+      const wrapped = requireAuth(service, handler, {
+        allowAnonymous: true,
+        requireAuthenticatedCaller: true,
+      });
+
+      const res = makeRes();
+      await wrapped(makeReq({ headers: {} }), res);
+
+      expect(res.statusCode).toBe(401);
+      expect(handler).not.toHaveBeenCalled();
+    });
+
+    it("still serves a verified caller", async () => {
+      const { service } = makeAuthService(() =>
+        Promise.resolve({
+          user: { address: "0x123", chainId: 1, networkId: "mainnet" },
+          admins: [],
+          auth_enabled: false,
+        }),
+      );
+      const handler = vi.fn<NodeHandler>();
+      const wrapped = requireAuth(service, handler, {
+        allowAnonymous: true,
+        requireAuthenticatedCaller: true,
+      });
+
+      const req = makeReq({ headers: { authorization: "Bearer good-token" } });
+      const res = makeRes();
+      await wrapped(req, res);
+
+      expect(res.statusCode).toBe(200);
+      expect(handler).toHaveBeenCalledWith(req, res, undefined, {
+        user: { address: "0x123", chainId: 1, networkId: "mainnet" },
+        authEnabled: false,
+      });
+    });
+
+    it("leaves every route as it was when the deployment has not set it", async () => {
+      const { service } = anonymousUnderOpenPolicy();
+      const handler = vi.fn<NodeHandler>();
+      const wrapped = requireAuth(service, handler, {
+        requireAuthenticatedCaller: false,
+      });
+
+      const res = makeRes();
+      await wrapped(makeReq({ headers: {} }), res);
+
+      expect(res.statusCode).toBe(200);
+      expect(handler).toHaveBeenCalledTimes(1);
+    });
+  });
+
   it("calls verifyBearer with undefined when no authorization header is present", async () => {
     const { service, spy } = makeAuthService(() =>
       Promise.resolve({

package/test/attachments/download-target.test.ts

@@ -9,7 +9,7 @@ import type {
   IAttachmentAccessService,
 } from "@powerhousedao/reactor-api";
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import type { AttachmentActorContext } from "../../src/attachments/auth.js";
 import { registerAttachmentRoutes } from "../../src/attachments/index.js";
 import { makeDownloadTargetHandler } from "../../src/attachments/routes.js";
@@ -126,6 +126,7 @@ describe("makeDownloadTargetHandler", () => {
       documentId: DOC_ID,
       attachmentRef: REF,
       userAddress: "0xverified",
+      appKey: "did:key:zAppTest",
     });
   });
 
@@ -148,7 +149,7 @@ describe("makeDownloadTargetHandler", () => {
 
     expect(res.statusCode).toBe(200);
     expect(JSON.parse(res._body)).toMatchObject({ kind: "presigned-get" });
-    expect(prepareDownloadTarget).toHaveBeenCalledWith(HASH, undefined);
+    expect(prepareDownloadTarget).toHaveBeenCalledWith(HASH, 300);
   });
 
   it("passes a requested expiresIn through to the backend presigner", async () => {
@@ -168,7 +169,7 @@ describe("makeDownloadTargetHandler", () => {
 
     await handler(
       makeReq({
-        url: `/attachments/${HASH}/download-target?documentId=${DOC_ID}&expiresIn=3600`,
+        url: `/attachments/${HASH}/download-target?documentId=${DOC_ID}&expiresIn=60`,
       }),
       res,
       undefined,
@@ -176,10 +177,10 @@ describe("makeDownloadTargetHandler", () => {
     );
 
     expect(res.statusCode).toBe(200);
-    expect(prepareDownloadTarget).toHaveBeenCalledWith(HASH, 3600);
+    expect(prepareDownloadTarget).toHaveBeenCalledWith(HASH, 60);
   });
 
-  it("clamps expiresIn to the 7-day presigning ceiling", async () => {
+  it("clamps a requested expiresIn to the ceiling", async () => {
     const { access } = makeAccess(ALLOWED);
     const prepareDownloadTarget = vi.fn().mockResolvedValue({
       kind: "presigned-get",
@@ -203,10 +204,10 @@ describe("makeDownloadTargetHandler", () => {
       ACTOR,
     );
 
-    expect(prepareDownloadTarget).toHaveBeenCalledWith(HASH, 604800);
+    expect(prepareDownloadTarget).toHaveBeenCalledWith(HASH, 300);
   });
 
-  it("omits the TTL override when expiresIn is absent", async () => {
+  it("applies the ceiling when expiresIn is absent, rather than the backend default", async () => {
     const { access } = makeAccess(ALLOWED);
     const prepareDownloadTarget = vi.fn().mockResolvedValue({
       kind: "presigned-get",
@@ -222,7 +223,69 @@ describe("makeDownloadTargetHandler", () => {
 
     await handler(makeReq({}), makeRes(), undefined, ACTOR);
 
-    expect(prepareDownloadTarget).toHaveBeenCalledWith(HASH, undefined);
+    expect(prepareDownloadTarget).toHaveBeenCalledWith(HASH, 300);
+  });
+
+  describe("ATTACHMENT_DOWNLOAD_TARGET_MAX_TTL_SECONDS", () => {
+    const ORIGINAL = process.env.ATTACHMENT_DOWNLOAD_TARGET_MAX_TTL_SECONDS;
+
+    afterEach(() => {
+      if (ORIGINAL === undefined) {
+        delete process.env.ATTACHMENT_DOWNLOAD_TARGET_MAX_TTL_SECONDS;
+      } else {
+        process.env.ATTACHMENT_DOWNLOAD_TARGET_MAX_TTL_SECONDS = ORIGINAL;
+      }
+    });
+
+    async function ttlFor(configured: string | undefined, query = "") {
+      if (configured === undefined) {
+        delete process.env.ATTACHMENT_DOWNLOAD_TARGET_MAX_TTL_SECONDS;
+      } else {
+        process.env.ATTACHMENT_DOWNLOAD_TARGET_MAX_TTL_SECONDS = configured;
+      }
+      const { access } = makeAccess(ALLOWED);
+      const prepareDownloadTarget = vi.fn().mockResolvedValue({
+        kind: "presigned-get",
+        method: "GET",
+        url: "https://bucket.example.com/attachments/aa?sig=1",
+        headers: {},
+        expiresAtUtc: EXPIRES,
+      });
+      const attachments = makeAttachments({
+        backend: { kind: "s3", prepareDownloadTarget } as never,
+      });
+      const handler = makeDownloadTargetHandler(attachments, access);
+      await handler(
+        makeReq({
+          url: `/attachments/${HASH}/download-target?documentId=${DOC_ID}${query}`,
+        }),
+        makeRes(),
+        undefined,
+        ACTOR,
+      );
+      return (prepareDownloadTarget.mock.calls[0] as unknown[])[1];
+    }
+
+    it("raises the ceiling when a deployment configures one", async () => {
+      await expect(ttlFor("1800")).resolves.toBe(1800);
+    });
+
+    it("never lets a configured ceiling exceed the signing maximum", async () => {
+      await expect(ttlFor("99999999")).resolves.toBe(604800);
+    });
+
+    it.each(["not-a-number", "0", "-5", "12.5"])(
+      "falls back to the default, not the maximum, on %s",
+      async (configured) => {
+        // A typo must narrow nothing and widen nothing: falling back to the
+        // signing ceiling would turn a misconfiguration into a week-long URL.
+        await expect(ttlFor(configured)).resolves.toBe(300);
+      },
+    );
+
+    it("still clamps a caller's request to the configured ceiling", async () => {
+      await expect(ttlFor("1800", "&expiresIn=99999")).resolves.toBe(1800);
+    });
   });
 
   it.each([

package/test/attachments/index.test.ts

@@ -13,8 +13,16 @@ type Captured = {
   ) => void | Promise<void>;
 };
 
-function makeFakeApi(authService: AuthService | undefined): {
-  api: Pick<API, "httpAdapter" | "authService">;
+type FakeApi = Pick<
+  API,
+  "httpAdapter" | "authService" | "requireAuthenticatedCaller"
+>;
+
+function makeFakeApi(
+  authService: AuthService | undefined,
+  requireAuthenticatedCaller = false,
+): {
+  api: FakeApi;
   captured: Captured[];
 } {
   const captured: Captured[] = [];
@@ -29,7 +37,8 @@ function makeFakeApi(authService: AuthService | undefined): {
       },
     },
     authService,
-  } as unknown as Pick<API, "httpAdapter" | "authService">;
+    requireAuthenticatedCaller,
+  } as unknown as FakeApi;
   return { api, captured };
 }
 
@@ -138,6 +147,28 @@ describe("mountAuthenticatedNodeRoute", () => {
     });
   });
 
+  it("carries the deployment's authenticated-caller floor onto the route, over allowAnonymous", async () => {
+    // auth_enabled false is the shape a deployment running the document
+    // policies has: the boundary policy is OPEN, and this floor is what keeps
+    // an anonymous caller off the attachment routes.
+    const verifyBearer = vi.fn(() =>
+      Promise.resolve({ user: undefined, admins: [], auth_enabled: false }),
+    );
+    const authService = { verifyBearer } as unknown as AuthService;
+    const { api, captured } = makeFakeApi(authService, true);
+    const inner = vi.fn();
+
+    mountAuthenticatedNodeRoute(api, "GET", "/x", inner, {
+      allowAnonymous: true,
+    });
+
+    const res = makeRes();
+    await captured[0].handler(makeReq(), res);
+
+    expect(res.statusCode).toBe(401);
+    expect(inner).not.toHaveBeenCalled();
+  });
+
   it("mounts a wrapper that forwards the anonymous actor when authService is undefined", async () => {
     const { api, captured } = makeFakeApi(undefined);
     const inner = vi.fn();