@powerhousedao/switchboard 6.2.3-dev.3 → 6.2.3-dev.30

package/dist/{server-B2r6AQ4Q.mjs → server-Cf0DB8sW.mjs}

@@ -1,33 +1,38 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0a17ca6d-016f-53aa-9705-cef103da6f09")}catch(e){}}();
-import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-Baw7rThP.mjs";
-import { register } from "node:module";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="49b28650-fe00-57f4-844b-978a35d80e91")}catch(e){}}();
+import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-uaBlzyjS.mjs";
+import { createRequire, register } from "node:module";
 import { ReactorInstrumentation } from "@powerhousedao/opentelemetry-instrumentation-reactor";
 import * as Sentry from "@sentry/node";
 import { childLogger, documentModelDocumentModelModule, setLogLevel } from "document-model";
 import dotenv from "dotenv";
 import { getConfig } from "@powerhousedao/config/node";
 import { existsSync, promises, realpathSync } from "node:fs";
-import path from "node:path";
+import path, { resolve } from "node:path";
 import { AtomicNodeFs } from "@powerhousedao/pglite-fs";
 import { ChannelScheme, DriveCollectionId, EventBus, REACTOR_SCHEMA, ReactorBuilder, ReactorClientBuilder, createHybridProjectionCoordinatorFactory, instrumentPgPool, parseDriveUrl, supportsLiveReadModelRegistration } from "@powerhousedao/reactor";
-import { HttpPackageLoader, ImportPackageLoader, PGLITE_UTC_PARSERS, PackageManagementService, PackagesSubgraph, getUniqueDocumentModels, initializeAndStartAPI, resolveRenownConfig } from "@powerhousedao/reactor-api";
+import { AuthorizationPolicy, BaseSubgraph, ForbiddenError, HttpPackageLoader, ImportPackageLoader, PGLITE_UTC_PARSERS, PackageManagementService, PackagesSubgraph, callerSubject, createCanonicalDocumentIdResolver, getUniqueDocumentModels, initializeAndStartAPI, resolveRenownConfig } from "@powerhousedao/reactor-api";
 import { httpsHooksPath } from "@powerhousedao/reactor-api/https-hooks";
-import { AttachmentAlreadyExists, AttachmentNotFound, AttachmentPending, AttachmentReferenceReadModel, AttachmentSchemaCompiler, HashMismatch, InvalidAttachmentRef, ReservationNotFound, SizeMismatch, UploadTooLarge, createRef, createRemoteAttachmentService, parseAttachmentDownloadTarget } from "@powerhousedao/reactor-attachments";
+import { AttachmentAlreadyExists, AttachmentNotFound, AttachmentPending, AttachmentReferenceReadModel, AttachmentSchemaCompiler, HashMismatch, InvalidAttachmentRef, ReservationNotFound, SizeMismatch, UploadTooLarge, createRef, createRemoteAttachmentService, parseAttachmentDownloadTarget, parseRef } from "@powerhousedao/reactor-attachments";
+import { createAttachmentClient } from "@powerhousedao/reactor-attachments/client";
 import { DriveNodeView, NodeProcessor, ReactorDriveClient, createReactorDriveResolvers, reactorDriveDocumentModelModule, reactorDriveSubgraphTypeDefs } from "@powerhousedao/reactor-drive";
-import { DEFAULT_RENOWN_URL, NodeKeyStorage, RENOWN_READ_MODEL_SUBGRAPH, RenownBuilder, RenownCryptoBuilder, createLocalCredentialVerifier, createSignatureVerifier } from "@renown/sdk/node";
+import { DEFAULT_KEYPAIR_PATH, DEFAULT_RENOWN_URL, NodeKeyStorage, RENOWN_READ_MODEL_SUBGRAPH, RenownBuilder, RenownCryptoBuilder, createLocalCredentialVerifier, createRenownTrustPolicy, resolveSwitchboardEndpoint } from "@renown/sdk/node";
 import { Kysely, PostgresDialect } from "kysely";
 import net from "node:net";
 import path$1 from "path";
 import { Pool } from "pg";
 import { Readable } from "node:stream";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { ReactorGroupV1 } from "@powerhousedao/reactor-group";
 import { driveDocumentModelModule } from "@powerhousedao/shared/document-drive";
+import { DEFAULT_SIGNATURE_POLICY, isSignaturePolicy } from "@powerhousedao/shared/document-model";
 import { readFile } from "node:fs/promises";
 import os from "node:os";
 import { fileURLToPath } from "node:url";
 import { EnvVarProvider } from "@openfeature/env-var-provider";
 import { OpenFeature } from "@openfeature/server-sdk";
+import { GraphQLError } from "graphql";
+import { gql } from "graphql-tag";
 import { PGliteDialect } from "kysely-pglite-dialect";
 //#region src/pglite-version.ts
 const SUPPORTED_PG_MAJORS = [16, 17];
@@ -74,7 +79,15 @@ const ANONYMOUS_ACTOR = {
 * enabled, the request must carry a verifiable Bearer token. The handler always
 * receives an actor context: the verified bearer user when auth is enabled, or
 * the anonymous context when it is disabled. With `allowAnonymous`, a missing
-* bearer yields an anonymous actor with `authEnabled: true` instead of a 401.
+* bearer yields an anonymous actor with `authEnabled: true` instead of a 401 —
+* unless `requireAuthenticatedCaller` says the deployment refuses anonymous
+* callers outright, which overrides it.
+*
+* With no `authService` there is no bearer to read and every caller is
+* anonymous, so nothing is refused here. That combination cannot carry the
+* floor: `assertRequireAuthenticatedCallerAllowed` refuses to boot with
+* `REQUIRE_AUTHENTICATED_CALLER` set and no identity resolution, and identity
+* resolution is what builds the service.
 */
 function requireAuth(authService, handler, options) {
 	if (!authService) return (req, res, body) => handler(req, res, body, ANONYMOUS_ACTOR);
@@ -96,11 +109,13 @@ function requireAuth(authService, handler, options) {
 			res.end(body);
 			return;
 		}
-		if (result.auth_enabled && !result.user && !options?.allowAnonymous) {
-			res.statusCode = 401;
-			res.setHeader("Content-Type", "application/json");
-			res.end(JSON.stringify({ error: "Authentication required" }));
-			return;
+		if (!result.user) {
+			if (options?.requireAuthenticatedCaller === true || result.auth_enabled && !options?.allowAnonymous) {
+				res.statusCode = 401;
+				res.setHeader("Content-Type", "application/json");
+				res.end(JSON.stringify({ error: "Authentication required" }));
+				return;
+			}
 		}
 		await handler(req, res, body, {
 			user: result.user,
@@ -118,14 +133,22 @@ function requireAuth(authService, handler, options) {
 * wrapping you must call `api.httpAdapter.mountNodeRoute` directly.
 *
 * `allowAnonymous` is reserved for routes whose handlers make a per-document
-* authorization decision themselves; identity-only routes must not use it.
+* authorization decision themselves; identity-only routes must not use it. It
+* is also not the last word: a deployment that refuses anonymous callers
+* (`REQUIRE_AUTHENTICATED_CALLER`) refuses them here too, because these routes
+* are mounted on the HTTP adapter and never reach the fetch chain that carries
+* that floor for GraphQL. The flag is read from the API, so every route
+* mounted through here inherits it without each one remembering to.
 */
 function mountAuthenticatedNodeRoute(api, method, path, handler, options) {
-	api.httpAdapter.mountNodeRoute(method, path, requireAuth(api.authService, handler, options));
+	api.httpAdapter.mountNodeRoute(method, path, requireAuth(api.authService, handler, {
+		...options,
+		requireAuthenticatedCaller: api.requireAuthenticatedCaller
+	}));
 }
 //#endregion
 //#region src/attachments/routes.ts
-const logger$1 = childLogger(["switchboard", "attachments"]);
+const logger$2 = childLogger(["switchboard", "attachments"]);
 const RETRY_AFTER_SECONDS = 5;
 const HASH_PATTERN = /^[a-f0-9]{64}$/i;
 const CONTROL_CHARS = /[\x00-\x1f\x7f]/;
@@ -150,7 +173,7 @@ function statusForError(err) {
 function sendErrorFromException(res, err) {
 	const status = statusForError(err);
 	if (status >= 500) {
-		logger$1.error("Attachment route error: @error", err);
+		logger$2.error("Attachment route error: @error", err);
 		sendError(res, status, "Internal error");
 		return;
 	}
@@ -279,24 +302,27 @@ function makeUploadHandler(attachments) {
 		}
 	};
 }
-function makeDownloadHandler(attachments) {
-	return async (req, res) => {
+function makeDownloadHandler(attachments, attachmentAccess, urlSigner) {
+	return async (req, res, _body, actor) => {
 		const hash = extractParam(req, "hash");
 		if (!hash || !HASH_PATTERN.test(hash)) {
 			sendError(res, 400, "Invalid attachment hash");
 			return;
 		}
+		const canonicalHash = hash.toLowerCase();
+		const grant = await resolveByteGrant(req, canonicalHash, actor, attachmentAccess, urlSigner);
+		if (!admitGrant(res, grant)) return;
 		const controller = new AbortController();
 		req.once("close", () => controller.abort());
-		const canonicalHash = hash.toLowerCase();
 		let response;
 		try {
-			response = await attachments.store.get(canonicalHash, controller.signal);
+			response = await attachments.store.get(canonicalHash, controller.signal, grant.documentId);
 		} catch (err) {
 			if (err instanceof AttachmentPending) {
 				res.statusCode = 202;
+				res.setHeader("Cache-Control", "private");
 				res.setHeader("Retry-After", String(RETRY_AFTER_SECONDS));
-				res.setHeader("Attachment-Pending", JSON.stringify({
+				res.setHeader("Attachment-Pending", buildPendingHeader({
 					expiresAtUtc: err.expiresAtUtc,
 					...err.metadata ?? {}
 				}));
@@ -308,6 +334,7 @@ function makeDownloadHandler(attachments) {
 		}
 		const { header, body } = response;
 		res.statusCode = 200;
+		res.setHeader("Cache-Control", "private");
 		res.setHeader("Content-Type", header.mimeType);
 		res.setHeader("Content-Length", String(header.sizeBytes));
 		res.setHeader("Content-Disposition", buildContentDisposition(header.fileName));
@@ -315,8 +342,14 @@ function makeDownloadHandler(attachments) {
 		Readable.fromWeb(body).pipe(res);
 	};
 }
+function toAsciiJson(value) {
+	return JSON.stringify(value).replace(/[\u007f-\uffff]/g, (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function buildPendingHeader(pending) {
+	return toAsciiJson(pending);
+}
 function buildMetadataHeader(header) {
-	return JSON.stringify({
+	return toAsciiJson({
 		mimeType: header.mimeType,
 		fileName: header.fileName,
 		sizeBytes: header.sizeBytes,
@@ -325,14 +358,15 @@ function buildMetadataHeader(header) {
 		lastAccessedAtUtc: header.lastAccessedAtUtc
 	});
 }
-function makeStatHandler(attachments) {
-	return async (req, res) => {
+function makeStatHandler(attachments, attachmentAccess, urlSigner) {
+	return async (req, res, _body, actor) => {
 		const hash = extractParam(req, "hash");
 		if (!hash || !HASH_PATTERN.test(hash)) {
 			sendError(res, 400, "Invalid attachment hash");
 			return;
 		}
 		const canonicalHash = hash.toLowerCase();
+		if (!admitGrant(res, await resolveByteGrant(req, canonicalHash, actor, attachmentAccess, urlSigner))) return;
 		let header;
 		try {
 			header = await attachments.store.stat(canonicalHash);
@@ -340,10 +374,11 @@ function makeStatHandler(attachments) {
 			sendErrorFromException(res, err);
 			return;
 		}
+		res.setHeader("Cache-Control", "private");
 		if (header.status === "pending") {
 			res.statusCode = 202;
 			res.setHeader("Retry-After", String(RETRY_AFTER_SECONDS));
-			res.setHeader("Attachment-Pending", JSON.stringify({
+			res.setHeader("Attachment-Pending", buildPendingHeader({
 				expiresAtUtc: header.expiresAtUtc,
 				mimeType: header.mimeType,
 				fileName: header.fileName,
@@ -395,7 +430,37 @@ function extractParam(req, name) {
 }
 const MAX_DOCUMENT_ID_LEN = 512;
 const ATTACHMENT_NOT_FOUND_BODY = { error: "Attachment not found" };
-const MAX_DOWNLOAD_TARGET_TTL_SECONDS = 10080 * 60;
+const MAX_DOWNLOAD_TARGET_TTL_SECONDS = 604800;
+/**
+* How long a download target may live, by default.
+*
+* The authorization behind a presigned URL is decided once, when it is issued,
+* and the URL keeps working until it expires however the document's policy
+* changes in between. A week of that is a revocation that does not revoke: an
+* account deactivated, a company reassigned or a group left, and the bytes stay
+* fetchable by anyone holding the link. Minutes are enough to open a file;
+* days are only enough to lose control of it.
+*
+* A deployment that needs longer sets ATTACHMENT_DOWNLOAD_TARGET_MAX_TTL_SECONDS,
+* still bounded by the signing ceiling above.
+*/
+const DEFAULT_DOWNLOAD_TARGET_TTL_SECONDS = 300;
+/**
+* The ceiling in force, read per call so a deployment can set it without the
+* value being frozen at import — which is also what lets a test cover it.
+* Anything unparseable falls back to the default rather than to the maximum:
+* a typo must not quietly widen the window it was meant to narrow.
+*/
+function downloadTargetTtlCapSeconds() {
+	const configured = process.env.ATTACHMENT_DOWNLOAD_TARGET_MAX_TTL_SECONDS;
+	if (configured === void 0) return DEFAULT_DOWNLOAD_TARGET_TTL_SECONDS;
+	const parsed = Number(configured);
+	if (!Number.isInteger(parsed) || parsed <= 0) {
+		logger$2.warn(`Ignoring invalid ATTACHMENT_DOWNLOAD_TARGET_MAX_TTL_SECONDS="${configured}" (expected a positive integer number of seconds) — using ${DEFAULT_DOWNLOAD_TARGET_TTL_SECONDS}`);
+		return DEFAULT_DOWNLOAD_TARGET_TTL_SECONDS;
+	}
+	return Math.min(parsed, MAX_DOWNLOAD_TARGET_TTL_SECONDS);
+}
 /**
 * Returns the single `documentId` query value, or null when it is missing,
 * duplicated, blank, or oversized. Validation happens before authorization so
@@ -416,29 +481,95 @@ function extractSingleDocumentId(req) {
 	return value;
 }
 /**
-* Returns the requested target TTL in seconds: undefined when absent,
-* "invalid" when malformed (duplicated, non-integer, or non-positive), and
-* otherwise the value clamped to the presigning ceiling.
+* Returns the target TTL in seconds, or "invalid" when the caller's own value
+* is malformed (duplicated, non-integer, or non-positive).
+*
+* The cap applies whether or not the caller asked for a lifetime: omitting
+* `expiresIn` used to fall through to whatever the storage backend was
+* configured with, which would make the ceiling something a client opts out of
+* by saying nothing.
 */
 function extractExpiresIn(req) {
-	if (!req.url) return void 0;
+	const cap = downloadTargetTtlCapSeconds();
+	if (!req.url) return cap;
 	let url;
 	try {
 		url = new URL(req.url, "http://switchboard.invalid");
 	} catch {
-		return;
+		return cap;
 	}
 	const values = url.searchParams.getAll("expiresIn");
-	if (values.length === 0) return void 0;
+	if (values.length === 0) return cap;
 	if (values.length > 1) return "invalid";
 	const parsed = Number(values[0]);
 	if (!Number.isInteger(parsed) || parsed <= 0) return "invalid";
-	return Math.min(parsed, MAX_DOWNLOAD_TARGET_TTL_SECONDS);
+	return Math.min(parsed, cap);
+}
+function singleQueryValue(params, name) {
+	const values = params.getAll(name);
+	return values.length === 1 ? values[0] : null;
+}
+/**
+* Byte routes serve only under a grant: a signed URL minted by the
+* download-target route, or a documentId the caller may read the attachment
+* through. A signed request is judged by its signature alone.
+*/
+async function resolveByteGrant(req, hash, actor, attachmentAccess, urlSigner) {
+	let params;
+	try {
+		params = new URL(req.url ?? "", "http://switchboard.invalid").searchParams;
+	} catch {
+		return { kind: "denied" };
+	}
+	const documentId = extractSingleDocumentId(req);
+	if (documentId === null) return { kind: "denied" };
+	if (params.has("signature") || params.has("expires")) {
+		const signature = singleQueryValue(params, "signature");
+		const expires = singleQueryValue(params, "expires");
+		if (!urlSigner || signature === null || expires === null) return { kind: "denied" };
+		return urlSigner.verify(hash, documentId, expires, signature) ? {
+			kind: "granted",
+			documentId
+		} : { kind: "denied" };
+	}
+	let decision;
+	try {
+		decision = await attachmentAccess.canReadAttachment({
+			documentId,
+			attachmentRef: createRef(hash),
+			userAddress: actor?.user?.address,
+			appKey: actor?.user?.appKey
+		});
+	} catch (err) {
+		logger$2.error("Attachment access decision failed: @error", err);
+		return { kind: "error" };
+	}
+	if (decision.kind === "projection-unavailable") return { kind: "unavailable" };
+	if (decision.kind === "denied") return { kind: "denied" };
+	return {
+		kind: "granted",
+		documentId: decision.documentId
+	};
+}
+/** Answers a refused grant; true when the request may proceed. */
+function admitGrant(res, grant) {
+	switch (grant.kind) {
+		case "granted": return true;
+		case "denied":
+			sendJson(res, 404, ATTACHMENT_NOT_FOUND_BODY);
+			return false;
+		case "unavailable":
+			sendError(res, 503, "Attachment downloads are temporarily unavailable");
+			return false;
+		case "error":
+			sendError(res, 500, "Internal error");
+			return false;
+	}
 }
 /**
 * Base URL of this Switchboard as seen by the caller, used to build
-* filesystem `switchboard` download targets that point back at the existing
-* authenticated byte route.
+* filesystem `switchboard` download targets that point back at the signed
+* byte route.
 */
 function requestBaseUrl(req) {
 	const forwardedProto = req.headers["x-forwarded-proto"];
@@ -448,7 +579,7 @@ function requestBaseUrl(req) {
 	if (!host) return null;
 	return `${proto}://${host}`;
 }
-function makeDownloadTargetHandler(attachments, attachmentAccess) {
+function makeDownloadTargetHandler(attachments, attachmentAccess, urlSigner) {
 	return async (req, res, _body, actor) => {
 		res.setHeader("Cache-Control", "no-store");
 		const hash = extractParam(req, "hash");
@@ -472,10 +603,11 @@ function makeDownloadTargetHandler(attachments, attachmentAccess) {
 			decision = await attachmentAccess.canReadAttachment({
 				documentId,
 				attachmentRef: createRef(canonicalHash),
-				userAddress: actor?.user?.address
+				userAddress: actor?.user?.address,
+				appKey: actor?.user?.appKey
 			});
 		} catch (err) {
-			logger$1.error("Attachment access decision failed: @error", err);
+			logger$2.error("Attachment access decision failed: @error", err);
 			sendError(res, 500, "Internal error");
 			return;
 		}
@@ -495,7 +627,7 @@ function makeDownloadTargetHandler(attachments, attachmentAccess) {
 				sendJson(res, 404, ATTACHMENT_NOT_FOUND_BODY);
 				return;
 			}
-			logger$1.error("Attachment metadata lookup failed: @error", err);
+			logger$2.error("Attachment metadata lookup failed: @error", err);
 			sendError(res, 500, "Internal error");
 			return;
 		}
@@ -511,17 +643,23 @@ function makeDownloadTargetHandler(attachments, attachmentAccess) {
 			return;
 		}
 		else {
+			if (!urlSigner) {
+				sendError(res, 503, "Attachment download signing is not configured");
+				return;
+			}
 			const base = requestBaseUrl(req);
 			if (!base) {
 				sendError(res, 500, "Internal error");
 				return;
 			}
+			const signed = urlSigner.sign(canonicalHash, decision.documentId, expiresIn);
 			try {
 				target = parseAttachmentDownloadTarget({
 					kind: "switchboard",
 					method: "GET",
-					url: `${base}/attachments/${canonicalHash}`,
-					headers: {}
+					url: `${base}/attachments/${canonicalHash}?${signed.query}`,
+					headers: {},
+					expiresAtUtc: signed.expiresAtUtc
 				});
 			} catch {
 				sendError(res, 500, "Internal error");
@@ -532,16 +670,82 @@ function makeDownloadTargetHandler(attachments, attachmentAccess) {
 	};
 }
 //#endregion
+//#region src/attachments/url-signer.ts
+const ATTACHMENT_URL_SIGNING_SECRET_ENV = "PH_ATTACHMENT_URL_SIGNING_SECRET";
+const MIN_SECRET_LENGTH = 32;
+const EXPIRES_PATTERN = /^[1-9]\d{0,15}$/;
+const SIGNATURE_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+var AttachmentUrlSigner = class {
+	secret;
+	now;
+	constructor(secret, now = Date.now) {
+		this.secret = secret;
+		this.now = now;
+	}
+	sign(hash, documentId, ttlSeconds) {
+		const expires = Math.floor(this.now() / 1e3) + ttlSeconds;
+		return {
+			query: new URLSearchParams({
+				documentId,
+				expires: String(expires),
+				signature: this.mac(hash, documentId, String(expires))
+			}).toString(),
+			expiresAtUtc: (/* @__PURE__ */ new Date(expires * 1e3)).toISOString()
+		};
+	}
+	verify(hash, documentId, expires, signature) {
+		if (!EXPIRES_PATTERN.test(expires) || !SIGNATURE_PATTERN.test(signature)) return false;
+		if (Number(expires) * 1e3 <= this.now()) return false;
+		const expected = Buffer.from(this.mac(hash, documentId, expires));
+		const presented = Buffer.from(signature);
+		return expected.length === presented.length && timingSafeEqual(expected, presented);
+	}
+	mac(hash, documentId, expires) {
+		return createHmac("sha256", this.secret).update(JSON.stringify([
+			"attachment-download/v1",
+			hash,
+			documentId,
+			expires
+		])).digest("base64url");
+	}
+};
+function resolveAttachmentUrlSigning(env = process.env) {
+	const secret = env[ATTACHMENT_URL_SIGNING_SECRET_ENV];
+	if (secret !== void 0) {
+		if (secret.trim() !== secret || secret.length < MIN_SECRET_LENGTH) throw new Error(`${ATTACHMENT_URL_SIGNING_SECRET_ENV} must be at least ${MIN_SECRET_LENGTH} characters with no leading or trailing whitespace`);
+		return {
+			status: "configured",
+			signer: new AttachmentUrlSigner(secret)
+		};
+	}
+	if (env.NODE_ENV === "production") return { status: "unconfigured" };
+	return {
+		status: "ephemeral",
+		signer: new AttachmentUrlSigner(randomBytes(32))
+	};
+}
+//#endregion
 //#region src/attachments/index.ts
-function registerAttachmentRoutes(api) {
-	const { attachments } = api;
+const logger$1 = childLogger(["switchboard", "attachments"]);
+function registerAttachmentRoutes(api, options = {}) {
+	const { attachments, attachmentAccess } = api;
+	const urlSigner = options.urlSigner === void 0 ? signerFromEnvironment(attachments.backend?.kind ?? "filesystem") : options.urlSigner;
 	mountAuthenticatedNodeRoute(api, "POST", "/attachments/reservations", makeReserveHandler(attachments));
 	mountAuthenticatedNodeRoute(api, "GET", "/attachments/reservations/:reservationId", makeGetReservationHandler(attachments));
 	mountAuthenticatedNodeRoute(api, "DELETE", "/attachments/reservations/:reservationId", makeDeleteReservationHandler(attachments));
 	mountAuthenticatedNodeRoute(api, "PUT", "/attachments/reservations/:reservationId", makeUploadHandler(attachments));
-	mountAuthenticatedNodeRoute(api, "HEAD", "/attachments/:hash", makeStatHandler(attachments));
-	mountAuthenticatedNodeRoute(api, "GET", "/attachments/:hash/download-target", makeDownloadTargetHandler(attachments, api.attachmentAccess), { allowAnonymous: true });
-	mountAuthenticatedNodeRoute(api, "GET", "/attachments/:hash", makeDownloadHandler(attachments));
+	mountAuthenticatedNodeRoute(api, "HEAD", "/attachments/:hash", makeStatHandler(attachments, attachmentAccess, urlSigner), { allowAnonymous: true });
+	mountAuthenticatedNodeRoute(api, "GET", "/attachments/:hash/download-target", makeDownloadTargetHandler(attachments, attachmentAccess, urlSigner), { allowAnonymous: true });
+	mountAuthenticatedNodeRoute(api, "GET", "/attachments/:hash", makeDownloadHandler(attachments, attachmentAccess, urlSigner), { allowAnonymous: true });
+}
+function signerFromEnvironment(backend) {
+	const signing = resolveAttachmentUrlSigning();
+	if (signing.status === "unconfigured") {
+		if (backend === "filesystem") logger$1.error(`${ATTACHMENT_URL_SIGNING_SECRET_ENV} is not set: filesystem attachment download targets are refused until it is`);
+		return null;
+	}
+	if (signing.status === "ephemeral" && backend === "filesystem") logger$1.warn(`${ATTACHMENT_URL_SIGNING_SECRET_ENV} is not set: signing attachment download URLs with a per-process secret`);
+	return signing.signer;
 }
 //#endregion
 //#region src/attachment-reference-read-model.mts
@@ -584,6 +788,43 @@ async function registerAttachmentReferenceReadModelOnModule(clientModule, attach
 	return { status: "available" };
 }
 //#endregion
+//#region src/fatal-shutdown.mts
+const FORCED_EXIT_MS = 15e3;
+const installed = /* @__PURE__ */ new WeakSet();
+/**
+* Sends an uncaught exception or unhandled rejection through the SIGTERM
+* shutdown that `withSignalHandlers()` installs, so the reactor and read-model
+* PGlite stores write their snapshots before the process exits with code 1.
+* Node's default is to exit at once, which drops every write AtomicNodeFs has
+* not flushed yet. A shutdown that hangs is cut off after FORCED_EXIT_MS.
+*
+* A rejection is fatal only when this is its sole listener: Node exits on an
+* unhandled rejection only when nothing listens for it, and Sentry's
+* listener deliberately keeps the process running.
+*/
+function installFatalErrorShutdown(logger, proc = process) {
+	if (installed.has(proc)) return;
+	installed.add(proc);
+	const realExit = proc.exit.bind(proc);
+	let shuttingDown = false;
+	const onFatal = (kind, err) => {
+		logger.error(`${kind}: @error`, err);
+		if (shuttingDown) return;
+		shuttingDown = true;
+		proc.exitCode = 1;
+		setTimeout(() => {
+			logger.error("Shutdown after fatal error timed out; exiting");
+			realExit(1);
+		}, FORCED_EXIT_MS).unref();
+		proc.kill(proc.pid, "SIGTERM");
+	};
+	proc.on("uncaughtException", (err) => onFatal("Uncaught exception", err));
+	proc.on("unhandledRejection", (reason) => {
+		if (proc.listenerCount("unhandledRejection") > 1) return;
+		onFatal("Unhandled rejection", reason);
+	});
+}
+//#endregion
 //#region src/builder-defaults.mts
 /**
 * Apply switchboard's standard configuration to a reactor + client builder
@@ -617,7 +858,13 @@ function applySwitchboardReactorDefaults(reactorBuilder, clientBuilder, options
 	});
 	if (options.documentModelLoader) reactorBuilder.withDocumentModelLoader(options.documentModelLoader);
 	if (options.logger) reactorBuilder.withLogger(options.logger);
-	if (options.signer) clientBuilder.withSigner(options.signer);
+	if (options.signer) {
+		clientBuilder.withSigner(options.signer);
+		reactorBuilder.withSigner(options.signer.signer, options.signer.workerSigner);
+	}
+	if (options.createSignaturePolicy) clientBuilder.withCreateSignaturePolicy(options.createSignaturePolicy);
+	const trust = options.trustPolicy ?? options.signer;
+	if (trust?.trustPolicy) reactorBuilder.withTrustPolicy(trust.trustPolicy, trust.workerTrustPolicy);
 }
 //#endregion
 //#region src/worker-pool.mts
@@ -865,6 +1112,520 @@ async function initFeatureFlags() {
 	return OpenFeature.getClient();
 }
 //#endregion
+//#region src/workflow/resolvers.ts
+function requireAdmin(authorizationService, ctx) {
+	if (!authorizationService.isSupremeAdmin(ctx.user?.address)) throw new GraphQLError("Admin access required");
+}
+function parseJson(value) {
+	if (value === null) return null;
+	try {
+		return JSON.parse(value);
+	} catch {
+		return value;
+	}
+}
+function toStepRecord(row) {
+	return {
+		stepId: row.step_id,
+		stepKey: row.step_key,
+		blockType: row.block_type,
+		status: row.status,
+		input: parseJson(row.input),
+		output: parseJson(row.output),
+		port: row.port,
+		error: row.error,
+		startedAt: row.started_at,
+		endedAt: row.ended_at
+	};
+}
+function toRunRecord(row, steps) {
+	return {
+		id: row.id,
+		workflowId: row.workflow_id,
+		workflowName: row.workflow_name,
+		workflowVersion: row.workflow_version,
+		triggerKind: row.trigger_kind,
+		triggerPayload: parseJson(row.trigger_payload),
+		status: row.status,
+		error: row.error,
+		startedAt: row.started_at,
+		endedAt: row.ended_at,
+		rerunOf: row.rerun_of,
+		steps: steps.map(toStepRecord)
+	};
+}
+const getResolvers = (runtime, authorizationService) => {
+	return {
+		Query: { workflowRuntime: () => ({}) },
+		WorkflowRuntimeQueries: {
+			health: () => "ok",
+			blockDescriptor: (_parent, args) => runtime.blockDescriptor(args.blockType),
+			blockOptions: (_parent, args, ctx) => runtime.blockOptions(args.blockType, args.propName, args.input, args.connectionId ?? void 0, ctx, args.searchValue ?? void 0),
+			pieceCatalog: () => runtime.pieceCatalog(),
+			pieceActions: (_parent, args) => runtime.pieceActions(args.packageName),
+			pieceTriggers: (_parent, args) => runtime.pieceTriggers(args.packageName),
+			blockOutputTree: (_parent, args) => runtime.blockOutputTree(args.blockType, args.config),
+			pieceDetail: (_parent, args) => runtime.pieceDetail(args.packageName),
+			searchBlocks: (_parent, args) => runtime.searchBlocks(args.query, args.limit ?? void 0),
+			connections: (_parent, _args, ctx) => runtime.connections(ctx),
+			webhookEndpoint: (_parent, args, ctx) => runtime.webhookEndpoint(args.workflowId, ctx),
+			secret: async (_parent, args) => {
+				try {
+					return await (await runtime.secrets()).stat(args.ref);
+				} catch {
+					return null;
+				}
+			},
+			secrets: async () => (await runtime.secrets()).list(),
+			triggerStates: async (_parent, _args, ctx) => (await runtime.triggerStates(ctx)).map((row) => ({
+				workflowId: row.workflow_id,
+				blockType: row.block_type,
+				status: row.status,
+				intervalMs: row.interval_ms,
+				nextPollAt: row.next_poll_at,
+				lastPollAt: row.last_poll_at,
+				lastError: row.last_error,
+				consecutiveFailures: row.consecutive_failures
+			})),
+			runs: async (_parent, args, ctx) => (await runtime.runs(args, ctx)).map((record) => toRunRecord(record.row, record.steps)),
+			run: async (_parent, args, ctx) => {
+				const record = await runtime.run(args.id, ctx);
+				return record ? toRunRecord(record.row, record.steps) : null;
+			}
+		},
+		Mutation: { workflowRuntime: () => ({}) },
+		WorkflowRuntimeMutations: {
+			fire: (_parent, args, ctx) => runtime.fire(args.workflowId, args.payload, "manual", void 0, ctx),
+			testTrigger: (_parent, args, ctx) => runtime.testTrigger(args.workflowId, ctx),
+			rerun: (_parent, args, ctx) => runtime.rerun(args.runId, ctx),
+			createSecret: async (_parent, args, ctx) => {
+				requireAdmin(authorizationService, ctx);
+				return (await runtime.secrets()).create({
+					value: args.value,
+					label: args.label ?? void 0
+				});
+			},
+			rotateSecret: async (_parent, args, ctx) => {
+				requireAdmin(authorizationService, ctx);
+				return (await runtime.secrets()).rotate(args.ref, args.value);
+			},
+			deleteSecret: async (_parent, args, ctx) => {
+				requireAdmin(authorizationService, ctx);
+				await (await runtime.secrets()).delete(args.ref);
+				return true;
+			},
+			checkConnection: (_parent, args, ctx) => runtime.checkConnection(args.connectionId, ctx)
+		}
+	};
+};
+//#endregion
+//#region src/workflow/schema.ts
+const schema = gql`
+  """
+  WorkflowRuntime Queries
+  """
+  type WorkflowRuntimeQueries {
+    health: String!
+    """
+    Persisted runs, newest first. Scope them to one workflow, or to every
+    workflow a drive holds; workflowId wins when both are given.
+    """
+    runs(workflowId: String, driveId: String, limit: Int): [WorkflowRunRecord!]!
+    run(id: String!): WorkflowRunRecord
+    """
+    Action descriptor (props, auth) for a piece block type; null for core blocks.
+    """
+    blockDescriptor(blockType: String!): Unknown
+    """
+    Resolves a dynamic prop against the current config values: a DROPDOWN
+    yields { options, placeholder, disabled }, a DYNAMIC prop yields the
+    resolved sub-property descriptor list.
+    """
+    blockOptions(
+      blockType: String!
+      propName: String!
+      input: Unknown
+      connectionId: String
+      "What the author typed, for a DROPDOWN declared with refreshOnSearch."
+      searchValue: String
+    ): Unknown
+    """
+    All published Activepieces pieces with at least one action.
+    """
+    pieceCatalog: Unknown
+    """
+    A piece's actions, each with a ready-to-use blockType.
+    """
+    pieceActions(packageName: String!): Unknown
+    """
+    A piece's triggers, each with a ready-to-use "#trigger:" blockType.
+    """
+    pieceTriggers(packageName: String!): Unknown
+    """
+    Full piece detail (PieceMetadataModel-shaped), verbatim from the cloud API.
+    """
+    pieceDetail(packageName: String!): Unknown
+    """
+    Action/trigger name search across the catalog. The index builds lazily on
+    first use; poll while status is "indexing".
+    """
+    searchBlocks(query: String!, limit: Int): BlockSearchResult!
+    """
+    Health of every registered piece trigger (poll schedule, errors).
+    """
+    triggerStates: [TriggerStateRecord!]!
+    """
+    Authored output shape of a block (SDL / outputSchema / sampleData).
+    """
+    blockOutputTree(blockType: String!, config: Unknown): Unknown
+    """
+    Every powerhouse/connection document, for connection pickers.
+    """
+    connections: [ConnectionRecord!]!
+    """
+    The webhook endpoint for a workflow: the URL to hand the provider. Minted
+    on first ask, whether or not the workflow is armed — an author needs the
+    URL before enabling, and the armed field carries that difference. Null
+    only when the host has no webhook service.
+    """
+    webhookEndpoint(workflowId: String!): WebhookEndpointRecord
+    """
+    Secret metadata (label, version, status). Never the value.
+    """
+    secret(ref: String!): SecretRecord
+    secrets: [SecretRecord!]!
+  }
+
+  type BlockSearchHit {
+    blockType: String!
+    pieceName: String!
+    pieceDisplayName: String!
+    logoUrl: String!
+    displayName: String!
+    description: String!
+    "action | trigger"
+    kind: String!
+    "Triggers only: POLLING | WEBHOOK | APP_WEBHOOK | MANUAL"
+    strategy: String
+    "Why this block cannot run on this reactor; null when it can."
+    unsupported: String
+  }
+
+  type BlockSearchResult {
+    "ready | indexing | error"
+    status: String!
+    hits: [BlockSearchHit!]!
+    indexedPieces: Int!
+    error: String
+  }
+
+  type SecretRecord {
+    ref: String!
+    label: String
+    version: Int!
+    status: String!
+    createdAt: String!
+    updatedAt: String!
+  }
+
+  type ConnectionRecord {
+    id: String!
+    name: String!
+    connectorId: String!
+    authType: String!
+    status: String!
+    accountLabel: String
+  }
+
+  type ConnectionCheckResult {
+    ok: Boolean!
+    detail: String
+    """
+    From auth.getConnectionIdentifier when the check passes; otherwise the
+    label the connection already holds.
+    """
+    accountLabel: String
+  }
+
+  type WebhookEndpointRecord {
+    workflowId: String!
+    url: String!
+    """
+    False when the reactor does not know its own public origin, so the url
+    above is a bare path no provider can call: the author supplies the origin.
+    """
+    absoluteUrl: Boolean!
+    "True while the workflow is ENABLED with a valid webhook trigger"
+    armed: Boolean!
+    createdAt: String!
+  }
+
+  type TriggerStateRecord {
+    workflowId: String!
+    blockType: String!
+    status: String!
+    intervalMs: Int!
+    nextPollAt: String
+    lastPollAt: String
+    lastError: String
+    consecutiveFailures: Int!
+  }
+
+  type Query {
+    workflowRuntime: WorkflowRuntimeQueries!
+  }
+
+  type WorkflowStepRunRecord {
+    stepId: String!
+    stepKey: String!
+    blockType: String!
+    status: String!
+    input: Unknown
+    output: Unknown
+    port: String
+    error: String
+    startedAt: String
+    endedAt: String
+  }
+
+  type WorkflowRunRecord {
+    id: String!
+    workflowId: String!
+    workflowName: String!
+    workflowVersion: Int!
+    triggerKind: String!
+    triggerPayload: Unknown
+    status: String!
+    error: String
+    startedAt: String!
+    endedAt: String
+    rerunOf: String
+    steps: [WorkflowStepRunRecord!]!
+  }
+
+  type WorkflowStepRun {
+    stepId: String!
+    key: String!
+    blockType: String!
+    status: String!
+    input: Unknown
+    output: Unknown
+    port: String
+    error: String
+  }
+
+  type WorkflowRunPayload {
+    runId: String
+    status: String!
+    error: String
+    steps: [WorkflowStepRun!]!
+  }
+
+  """
+  WorkflowRuntime Mutations
+  """
+  type WorkflowRuntimeMutations {
+    """
+    Fires a workflow's core#manual trigger and runs it to completion.
+    """
+    fire(workflowId: String!, payload: Unknown): WorkflowRunPayload!
+    """
+    Runs a piece trigger's test hook; sample items, no cursor changes.
+    """
+    testTrigger(workflowId: String!): Unknown
+    """
+    Resumes a FAILED run: succeeded steps replay from the journal,
+    execution restarts at the failure. Produces a new run.
+    """
+    rerun(runId: String!): WorkflowRunPayload!
+    """
+    Mints a managed secret and returns its ref; the value is stored
+    encrypted and is never readable back over any API.
+    """
+    createSecret(value: String!, label: String): SecretRecord!
+    """
+    Replaces the value behind an existing ref; documents stay untouched.
+    """
+    rotateSecret(ref: String!, value: String!): SecretRecord!
+    """
+    Tombstones a secret; its value becomes unrecoverable.
+    """
+    deleteSecret(ref: String!): Boolean!
+    """
+    Runs the piece's auth.validate against the connection's credentials,
+    then auth.getConnectionIdentifier for the account label, and records the
+    outcome on the connection document.
+    """
+    checkConnection(connectionId: String!): ConnectionCheckResult!
+  }
+
+  type Mutation {
+    workflowRuntime: WorkflowRuntimeMutations!
+  }
+`;
+//#endregion
+//#region src/workflow/subgraph.ts
+/** The runtime's read/write surface. The runtime itself is composed by the
+* host, so the subgraph only serves what it is handed. */
+function createWorkflowRuntimeSubgraph(runtime) {
+	return class WorkflowRuntimeSubgraph extends BaseSubgraph {
+		name = "workflow-runtime";
+		typeDefs = schema;
+		resolvers = getResolvers(runtime, this.authorizationService);
+		additionalContextFields = {};
+	};
+}
+//#endregion
+//#region src/workflow-runtime.mts
+/** The npm name the workflow package owns: its HTTP namespace and its models. */
+const WORKFLOW_PACKAGE_NAME = "@powerhousedao/workflow";
+/** The env var and OpenFeature flag key that turns workflows on. */
+const PH_WORKFLOWS_ENABLED = "PH_WORKFLOWS_ENABLED";
+/** Precedence, unchanged from the reactor-api resolver this replaces: the
+* host's option, then PH_WORKFLOWS_ENABLED, then the config file, then off. */
+async function resolveWorkflowsEnabled({ featureFlags, override, configEnabled = false, env = process.env }) {
+	if (override !== void 0) return override;
+	const raw = env[PH_WORKFLOWS_ENABLED]?.trim();
+	if (raw === "1") return true;
+	if (raw === "0") return false;
+	return featureFlags.getBooleanValue(PH_WORKFLOWS_ENABLED, configEnabled);
+}
+async function assertWorkflowPackageLoadable(load = () => import("@powerhousedao/workflow/document-models")) {
+	try {
+		await load();
+	} catch (error) {
+		throw new Error(`Workflows are enabled but ${WORKFLOW_PACKAGE_NAME} could not be loaded`, { cause: error });
+	}
+}
+function readAssertion(authorizationService, reactorClient) {
+	const resolveCanonical = createCanonicalDocumentIdResolver(reactorClient);
+	const hostCanRead = async (identifier, ctx) => {
+		if (authorizationService.isSupremeAdmin(ctx.user?.address)) return;
+		if (authorizationService.config.policy !== AuthorizationPolicy.DOCUMENT_PERMISSIONS) throw new ForbiddenError();
+		let documentId;
+		try {
+			documentId = await resolveCanonical(identifier);
+		} catch {
+			throw new ForbiddenError();
+		}
+		if (!await authorizationService.canRead(documentId, ctx.user?.address)) throw new ForbiddenError("to read this document");
+	};
+	return async (identifier, caller) => {
+		const ctx = caller;
+		await hostCanRead(identifier, ctx);
+		let served;
+		try {
+			served = await reactorClient.isServed(identifier, { subject: callerSubject(ctx.user) });
+		} catch {
+			throw new ForbiddenError();
+		}
+		if (!served) throw new ForbiddenError("to read this document");
+	};
+}
+/** The same, for a design-time call that writes what it names. */
+function writeAssertion(authorizationService, reactorClient) {
+	const resolveCanonical = createCanonicalDocumentIdResolver(reactorClient);
+	return async (identifier, caller) => {
+		const ctx = caller;
+		if (authorizationService.isSupremeAdmin(ctx.user?.address)) return;
+		if (authorizationService.config.policy !== AuthorizationPolicy.DOCUMENT_PERMISSIONS) throw new ForbiddenError();
+		let documentId;
+		try {
+			documentId = await resolveCanonical(identifier);
+		} catch {
+			throw new ForbiddenError();
+		}
+		if (!await authorizationService.canWrite(documentId, ctx.user?.address)) throw new ForbiddenError("to write this document");
+	};
+}
+/** Whether the workflow document really references the attachment. A step
+* carries no caller, so the relationship is the whole check. */
+function attachmentRefCheck(deps) {
+	const resolveCanonical = createCanonicalDocumentIdResolver(deps.reactorClient);
+	const references = deps.attachmentReferences;
+	const projection = deps.attachmentReferenceProjection;
+	return async (documentId, ref) => {
+		if (!references || projection?.status !== "available") return false;
+		let parsed;
+		try {
+			parsed = parseRef(ref);
+		} catch {
+			return false;
+		}
+		if (parsed.version !== 1) return false;
+		const canonicalRef = createRef(parsed.hash.toLowerCase());
+		try {
+			return await references.hasReference(await resolveCanonical(documentId), canonicalRef);
+		} catch {
+			return false;
+		}
+	};
+}
+async function registerWorkflowTriggersReadModel(engine, runtime, clientModule) {
+	const reactorModule = clientModule?.reactorModule;
+	if (!reactorModule) return {
+		status: "unavailable",
+		reason: "in-process-reactor-module-unavailable"
+	};
+	const coordinator = reactorModule.readModelCoordinator;
+	if (!supportsLiveReadModelRegistration(coordinator)) return {
+		status: "unavailable",
+		reason: "live-read-model-registration-unsupported"
+	};
+	const readModel = new engine.WorkflowTriggersReadModel(reactorModule.database.withSchema(REACTOR_SCHEMA), reactorModule.operationIndex, reactorModule.writeCache, reactorModule.processorManagerConsistencyTracker, runtime);
+	await readModel.init();
+	coordinator.addReadModel(readModel, engine.WORKFLOW_TRIGGERS_READ_MODEL_STAGE);
+	return { status: "available" };
+}
+function bindPackagePieces(registry, source) {
+	const apply = (byPackage) => {
+		registry.setPieces([...byPackage.values()].flat());
+	};
+	apply(source.getPieces());
+	source.onPiecesChange(apply);
+}
+async function composeWorkflowRuntime(deps) {
+	const load = deps.load ?? (() => import("@powerhousedao/reactor-workflow"));
+	let engine;
+	try {
+		engine = await load();
+	} catch (error) {
+		throw new Error("Workflows are enabled but @powerhousedao/reactor-workflow could not be loaded", { cause: error });
+	}
+	engine.setPieceRegistryUrl(deps.pieceRegistryUrl);
+	if (deps.pieces) bindPackagePieces(engine.packagePieces, deps.pieces);
+	const runtime = engine.createWorkflowRuntime({
+		relationalDb: deps.relationalDb,
+		secretsKeyFile: deps.secretsKeyFile,
+		reactorClient: deps.reactorClient,
+		assertCanRead: readAssertion(deps.authorizationService, deps.reactorClient),
+		subjectOf: (caller) => callerSubject(caller.user),
+		assertCanWrite: writeAssertion(deps.authorizationService, deps.reactorClient),
+		webhooks: deps.webhooks,
+		attachments: deps.attachments,
+		canReadAttachmentRef: attachmentRefCheck(deps),
+		logger: deps.logger
+	});
+	const triggers = await registerWorkflowTriggersReadModel(engine, runtime, deps.clientModule);
+	if (triggers.status === "available") deps.logger.info(`Workflow trigger read model registered (${engine.WORKFLOW_TRIGGERS_READ_MODEL}, ${engine.WORKFLOW_TRIGGERS_READ_MODEL_STAGE})`);
+	else deps.logger.error("Workflow document triggers are NOT armed (@reason): this reactor's read-model coordinator takes no live registration, so no document operation reaches the runtime. Webhook and schedule triggers are unaffected.", triggers.reason);
+	let stopped = false;
+	return {
+		subgraph: createWorkflowRuntimeSubgraph(runtime),
+		triggers,
+		async start() {
+			await runtime.registerWebhookEndpoint();
+			runtime.startTriggerSupervisor();
+		},
+		stop() {
+			if (stopped) return Promise.resolve();
+			stopped = true;
+			runtime.shutdown();
+			return Promise.resolve();
+		}
+	};
+}
+//#endregion
 //#region src/pglite-dialect.ts
 var ClosablePGliteDialect = class extends PGliteDialect {
 	#pglite;
@@ -1003,6 +1764,26 @@ function resolveReactorFeatureFlags(env) {
 	};
 }
 //#endregion
+//#region src/create-signature-policy.mts
+/**
+* What new documents are created as, from CREATE_SIGNATURE_POLICY. Without a
+* signer this switchboard cannot write to a v2-required document, so it falls
+* back to legacy and says so.
+*/
+function resolveCreateSignaturePolicy(env, options) {
+	const raw = env.CREATE_SIGNATURE_POLICY?.trim();
+	let policy = DEFAULT_SIGNATURE_POLICY;
+	if (raw) {
+		if (!isSignaturePolicy(raw)) throw new Error(`CREATE_SIGNATURE_POLICY must be "legacy" or "v2-required", got "${raw}"`);
+		policy = raw;
+	}
+	if (policy === "v2-required" && !options.hasSigner) {
+		options.logger?.warn("No signer is configured, so new documents are created legacy: a v2-required document refuses the unsigned operations this switchboard would write. Set up an identity (ph login) to create v2-required documents.");
+		return "legacy";
+	}
+	return policy;
+}
+//#endregion
 //#region src/renown.ts
 const logger = childLogger(["switchboard", "renown"]);
 /**
@@ -1025,12 +1806,94 @@ async function initRenown(options = {}) {
 * Get the signer config for the given renown instance.
 *
 * @param renown - The renown instance
-* @param requireSignature - If true, unsigned actions are rejected
+* @param keypairPath - Where `initRenown` loaded the key from
 */
-function getRenownSignerConfig(renown, requireSignature) {
+function getRenownSignerConfig(renown, keypairPath) {
 	return {
 		signer: renown.signer,
-		verifier: createSignatureVerifier(requireSignature)
+		workerSigner: getRenownWorkerSignerSpec(renown, keypairPath)
+	};
+}
+/**
+* What a pooled executor worker imports to sign as this switchboard: it
+* reloads the key `initRenown` stored, and takes the user known at boot.
+*/
+function getRenownWorkerSignerSpec(renown, keypairPath) {
+	const { signer } = renown;
+	const user = signer.user;
+	return {
+		module: {
+			filePath: createRequire(import.meta.url).resolve("@renown/sdk/node"),
+			exportName: "createNodeRenownSigner"
+		},
+		initArgs: {
+			appName: signer.app?.name ?? "switchboard",
+			keypairPath: resolve(keypairPath ?? DEFAULT_KEYPAIR_PATH),
+			...signer.app?.key ? { did: signer.app.key } : {},
+			...user ? { user: {
+				address: user.address,
+				networkId: user.networkId,
+				chainId: user.chainId
+			} } : {}
+		}
+	};
+}
+/**
+* Admits a key as a signer for an address a Renown credential binds it to; a
+* `self` source has no worker spec. In process, the switchboard's own key is
+* matched against its current user; the worker spec carries the user known now.
+*/
+async function getRenownTrustPolicyConfig(trustSource, renown) {
+	const ownSigner = renown?.signer;
+	if (trustSource.source === "self") return { trustPolicy: createRenownTrustPolicy({
+		switchboard: trustSource.request,
+		ownSigner
+	}) };
+	const switchboardUrl = await resolveSwitchboardEndpoint({
+		switchboardUrl: trustSource.switchboardUrl,
+		baseUrl: trustSource.renownUrl
+	});
+	const options = {
+		...switchboardUrl ? { switchboard: switchboardUrl } : {},
+		...trustSource.renownUrl ? { renownUrl: trustSource.renownUrl } : {}
+	};
+	const self = ownIdentity(renown);
+	return {
+		trustPolicy: createRenownTrustPolicy({
+			...options,
+			ownSigner
+		}),
+		workerTrustPolicy: {
+			module: {
+				filePath: createRequire(import.meta.url).resolve("@renown/sdk/node"),
+				exportName: "createRenownTrustPolicy"
+			},
+			initArgs: {
+				...options,
+				...self ? { self } : {}
+			}
+		}
+	};
+}
+/**
+* Fails the boot when pooled workers would refuse every signed write the
+* in-process executor accepts: a `self` Renown source gives workers no trust
+* policy spec, so under authEnforcement they apply the default.
+*/
+function assertWorkerTrustPolicy(config) {
+	if (config.workers > 0 && config.authEnforcement && config.renownSource === "self") throw new Error("The executor worker pool (REACTOR_WORKERS) cannot verify signers when REACTOR_AUTH_ENFORCEMENT is on and Renown credentials are read from this switchboard (\"self\" via auth.renown.source or RENOWN_SOURCE): pooled workers have no trust policy and would refuse every signed write. Set RENOWN_SOURCE=remote, or disable the worker pool (REACTOR_WORKERS=0).");
+}
+function ownIdentity(renown) {
+	const key = renown?.signer.app?.key;
+	if (!key) return;
+	const user = renown.signer.user;
+	return {
+		key,
+		user: {
+			address: user?.address ?? "",
+			networkId: user?.networkId ?? "",
+			chainId: user?.chainId ?? 0
+		}
 	};
 }
 //#endregion
@@ -1041,8 +1904,6 @@ setLogLevel(LogLevel);
 dotenv.config();
 const DOCUMENT_MODEL_SUBGRAPHS_ENABLED = "DOCUMENT_MODEL_SUBGRAPHS_ENABLED";
 const DOCUMENT_MODEL_SUBGRAPHS_ENABLED_DEFAULT = true;
-const REQUIRE_SIGNATURES = "REQUIRE_SIGNATURES";
-const REQUIRE_SIGNATURES_DEFAULT = false;
 const DEFAULT_PORT = process.env.PORT ? Number(process.env.PORT) : 4001;
 const PORT_FALLBACK_ATTEMPTS = 20;
 const PGLITE_FLUSH_INTERVAL_MS = (() => {
@@ -1077,6 +1938,13 @@ function isPortAvailable(port) {
 function resolveConfigPath(configFile) {
 	return configFile ?? path$1.join(process.cwd(), "powerhouse.config.json");
 }
+function readConfigWorkflowsEnabled(configPath) {
+	try {
+		return getConfig(configPath).workflows?.enabled ?? false;
+	} catch {
+		return false;
+	}
+}
 async function resolveServerPort(requested, strictPort, logger) {
 	if (strictPort) return requested;
 	for (let i = 0; i < PORT_FALLBACK_ATTEMPTS; i++) {
@@ -1189,6 +2057,11 @@ async function initServer(serverPort, options, renown, renownConfig) {
 	}
 	if (workerPool) {
 		if (dev) throw new Error("The executor worker pool (REACTOR_WORKERS) is not supported in dev mode: Vite-loaded document models cannot cross a worker-thread boundary");
+		assertWorkerTrustPolicy({
+			workers: workerPool.numWorkers,
+			authEnforcement: resolveReactorFeatureFlags(process.env).flags.authEnforcement === true,
+			renownSource: renownConfig.source
+		});
 		if (!reactorDbUrl || !isPostgresUrl(reactorDbUrl)) throw new Error("The executor worker pool (REACTOR_WORKERS) requires a Postgres reactor database — set PH_REACTOR_DATABASE_URL or PH_SWITCHBOARD_DATABASE_URL. PGlite cannot be shared across worker threads.");
 	}
 	let projectionWorker = resolveProjectionWorkerOptions(options.projectionWorker, process.env);
@@ -1224,7 +2097,13 @@ async function initServer(serverPort, options, renown, renownConfig) {
 		reactorLogger.error(`Projection worker ${shardId} died; shutting down so the supervisor restarts a healthy process`, reason);
 		process.kill(process.pid, "SIGTERM");
 	};
+	const workflowsEnabled = options.workflows?.enabled === true;
+	if (workflowsEnabled) {
+		await assertWorkflowPackageLoadable();
+		if (!packages.includes("@powerhousedao/workflow")) packages.push(WORKFLOW_PACKAGE_NAME);
+	}
 	let ownedReactorModule;
+	let localRenownRequest;
 	const initializeClient = async (documentModels, { attachmentReferenceWriter, upgradeManifests }) => {
 		if (options.reactor) {
 			const attachmentReferenceProjection = await registerAttachmentReferenceReadModelOnModule(options.reactor, attachmentReferenceWriter);
@@ -1264,7 +2143,19 @@ async function initServer(serverPort, options, renown, renownConfig) {
 			} : void 0,
 			documentModelLoader: httpLoader && dynamicModelLoading ? httpLoader.documentModelLoader : void 0,
 			logger: reactorLogger,
-			signer: renown ? getRenownSignerConfig(renown, options.identity?.requireSignatures) : void 0
+			signer: renown ? getRenownSignerConfig(renown, options.identity?.keypairPath) : void 0,
+			createSignaturePolicy: resolveCreateSignaturePolicy(process.env, {
+				hasSigner: renown !== null,
+				logger
+			}),
+			trustPolicy: reactorFeatureFlags.authEnforcement ? await getRenownTrustPolicyConfig(renownConfig.source === "self" ? {
+				source: "self",
+				request: (query, variables) => localRenownRequest ? localRenownRequest(query, variables) : Promise.reject(/* @__PURE__ */ new Error("The local renown read model is not bound yet"))
+			} : {
+				source: "remote",
+				renownUrl: renownConfig.url,
+				switchboardUrl: renownConfig.switchboardUrl
+			}, renown) : void 0
 		});
 		if (workerPool) {
 			if (!reactorDbUrl) throw new Error("unreachable: worker pool enabled without a reactor database URL");
@@ -1313,12 +2204,14 @@ async function initServer(serverPort, options, renown, renownConfig) {
 			new ReactorInstrumentation(module.reactorModule).start();
 			reactorLogger.info("Reactor metrics instrumentation started");
 		}
-		driveNodeView = new DriveNodeView(baseKysely.withSchema(REACTOR_SCHEMA));
+		const reactorDriveSchemaDb = baseKysely.withSchema(REACTOR_SCHEMA);
+		driveNodeView = new DriveNodeView(reactorDriveSchemaDb);
 		const reactorDriveClient = new ReactorDriveClient({
 			reactor: module.client,
 			readModel: driveNodeView
 		});
 		ownedReactorModule = module;
+		if (options.fatalErrorShutdown) installFatalErrorShutdown(logger);
 		return {
 			module,
 			reactorDriveClient,
@@ -1401,7 +2294,8 @@ async function initServer(serverPort, options, renown, renownConfig) {
 			await abortBoot(api);
 			throw new Error(`Renown credential verification is set to "self" (auth.renown.source or RENOWN_SOURCE) but no loaded package serves the "${RENOWN_READ_MODEL_SUBGRAPH}" subgraph. Install one (@powerhousedao/renown-package) or set RENOWN_SOURCE=remote.`);
 		}
-		localCredentialCheck = createLocalCredentialVerifier((query, variables) => manager.executeSubgraphQuery(RENOWN_READ_MODEL_SUBGRAPH, query, variables), { onError: (error) => logger.error("Renown read model query failed: @error", error) });
+		localRenownRequest = (query, variables) => manager.executeSubgraphQuery(RENOWN_READ_MODEL_SUBGRAPH, query, variables);
+		localCredentialCheck = createLocalCredentialVerifier(localRenownRequest, { onError: (error) => logger.error("Renown read model query failed: @error", error) });
 		logger.info("Renown credentials will be verified against this switchboard's own renown read model");
 	}
 	registerAttachmentRoutes(api);
@@ -1409,6 +2303,44 @@ async function initServer(serverPort, options, renown, renownConfig) {
 	if (process.env.SENTRY_DSN) api.httpAdapter.setupSentryErrorHandler(Sentry);
 	const { client, graphqlManager, documentModelRegistry } = api;
 	const lateSubgraphs = [];
+	let workflows;
+	if (workflowsEnabled) {
+		workflows = await composeWorkflowRuntime({
+			reactorClient: client,
+			clientModule: options.reactor ?? ownedReactorModule,
+			relationalDb: api.relationalDb,
+			secretsKeyFile: readModelPgliteDir === null ? false : void 0,
+			attachments: createAttachmentClient(api.attachments.service),
+			attachmentReferences: api.attachmentReferenceIndex.store,
+			attachmentReferenceProjection: api.attachmentReferenceProjection,
+			webhooks: api.httpRoutes.scopeFor(WORKFLOW_PACKAGE_NAME).webhooks,
+			authorizationService: api.authorizationService,
+			pieces: api.packageManager,
+			pieceRegistryUrl: registryUrl,
+			logger: logger.child(["workflow-runtime"])
+		});
+		const WorkflowRuntimeSubgraph = workflows.subgraph;
+		const workflowSubgraph = new WorkflowRuntimeSubgraph({
+			reactorClient: client,
+			http: graphqlManager.scopeForPackage(WORKFLOW_PACKAGE_NAME),
+			relationalDb: api.relationalDb,
+			analyticsStore: void 0,
+			graphqlManager,
+			syncManager: api.syncManager,
+			authorizationService: graphqlManager.getAuthorizationService(),
+			path: graphqlManager.getBasePath()
+		});
+		lateSubgraphs.push(graphqlManager.registerSubgraphInstance(workflowSubgraph, "graphql", false).catch((error) => {
+			logger.error("Failed to register workflow-runtime subgraph: @error", error);
+		}));
+		await workflows.start();
+		logger.info("Workflow runtime started");
+	}
+	const shutdown = async () => {
+		await workflows?.stop();
+		await api.dispose();
+	};
+	apiRef.current = { dispose: shutdown };
 	if (httpLoader) {
 		const packageManagementService = new PackageManagementService({
 			defaultRegistryUrl: registryUrl,
@@ -1417,7 +2349,9 @@ async function initServer(serverPort, options, renown, renownConfig) {
 			packageManager: api.packageManager
 		});
 		packageManagementService.setOnModelsChanged(() => {
-			graphqlManager.regenerateDocumentModelSubgraphs().catch(logger.error);
+			graphqlManager.regenerateDocumentModelSubgraphs().catch((error) => {
+				logger.error("Failed to regenerate document model subgraphs: @error", error);
+			});
 		});
 		const packagesSubgraph = new PackagesSubgraph({
 			relationalDb: void 0,
@@ -1436,10 +2370,15 @@ async function initServer(serverPort, options, renown, renownConfig) {
 	}
 	if (driveNodeView) {
 		graphqlManager.setAdditionalContextFields({ readModel: driveNodeView });
+		const authorizationService = graphqlManager.getAuthorizationService();
 		const reactorDriveSubgraph = {
 			name: "reactor-drive",
 			path: graphqlManager.getBasePath(),
-			resolvers: createReactorDriveResolvers(),
+			resolvers: createReactorDriveResolvers({
+				reactorClient: client,
+				readModel: driveNodeView,
+				hostCanRead: (documentId, address) => authorizationService.canRead(documentId, address)
+			}),
 			typeDefs: reactorDriveSubgraphTypeDefs,
 			reactorClient: client,
 			relationalDb: void 0
@@ -1490,9 +2429,10 @@ async function initServer(serverPort, options, renown, renownConfig) {
 		reactor: client,
 		attachmentService,
 		attachmentReferenceProjection: api.attachmentReferenceProjection,
+		workflowTriggers: workflows?.triggers,
 		renown,
 		port: serverPort,
-		shutdown: () => api.dispose()
+		shutdown
 	};
 }
 /**
@@ -1519,16 +2459,21 @@ const startSwitchboard = async (options = {}) => {
 	const featureFlags = await initFeatureFlags();
 	const enableDocumentModelSubgraphs = await featureFlags.getBooleanValue(DOCUMENT_MODEL_SUBGRAPHS_ENABLED, options.enableDocumentModelSubgraphs ?? DOCUMENT_MODEL_SUBGRAPHS_ENABLED_DEFAULT);
 	options.enableDocumentModelSubgraphs = enableDocumentModelSubgraphs;
-	const requireSignatures = options.identity?.requireSignatures ?? await featureFlags.getBooleanValue(REQUIRE_SIGNATURES, REQUIRE_SIGNATURES_DEFAULT);
+	const configPathForFlags = resolveConfigPath(options.configFile);
+	const workflowsEnabled = await resolveWorkflowsEnabled({
+		featureFlags,
+		override: options.workflows?.enabled,
+		configEnabled: readConfigWorkflowsEnabled(configPathForFlags)
+	});
+	options.workflows = { enabled: workflowsEnabled };
 	const renownConfig = resolveRenownConfig(getConfig(resolveConfigPath(options.configFile)).auth?.renown, process.env, logger);
 	options.identity = {
 		...options.identity,
-		requireSignatures,
 		baseUrl: options.identity?.baseUrl ?? renownConfig.url
 	};
 	logger.info("Feature flags: @flags", JSON.stringify({
 		DOCUMENT_MODEL_SUBGRAPHS_ENABLED: enableDocumentModelSubgraphs,
-		REQUIRE_SIGNATURES: requireSignatures
+		PH_WORKFLOWS_ENABLED: workflowsEnabled
 	}, null, 2));
 	let renown = null;
 	try {
@@ -1545,9 +2490,9 @@ const startSwitchboard = async (options = {}) => {
 		throw e;
 	}
 };
-if (import.meta.main) await startSwitchboard();
+if (import.meta.main) await startSwitchboard({ fatalErrorShutdown: true });
 //#endregion
 export { parseForcePgVersion as a, applySwitchboardReactorDefaults as i, isPortAvailable as n, startSwitchboard as r, deriveAttachmentServiceConfig as t };
 
-//# sourceMappingURL=server-B2r6AQ4Q.mjs.map
-//# debugId=0a17ca6d-016f-53aa-9705-cef103da6f09
+//# sourceMappingURL=server-Cf0DB8sW.mjs.map
+//# debugId=49b28650-fe00-57f4-844b-978a35d80e91