@powerhousedao/switchboard 6.2.3-dev.34 → 6.2.3-dev.35

package/CHANGELOG.md

@@ -1,3 +1,43 @@
+## 6.2.3-dev.35 (2026-10-01)
+
+### 🚀 Features
+
+- ⚠️  **registry:** serve every replica from Postgres and S3, processing publishes in a worker ([0d25d5fe35](https://github.com/powerhouse-inc/powerhouse/commit/0d25d5fe35))
+- **switchboard:** configure the erasure purge timeout ([354375ea61](https://github.com/powerhouse-inc/powerhouse/commit/354375ea61))
+- **switchboard:** run the privacy add-on behind PH_PRIVACY_ENABLED ([38c9a43856](https://github.com/powerhouse-inc/powerhouse/commit/38c9a43856))
+- **reactor-privacy:** erase requested documents on a serial schedule ([f4f31289a1](https://github.com/powerhouse-inc/powerhouse/commit/f4f31289a1))
+- **reactor-privacy:** serve disclosure and erasure to supreme admins only ([7a6b5232cb](https://github.com/powerhouse-inc/powerhouse/commit/7a6b5232cb))
+- **reactor-privacy:** scaffold the package and its migration ledger ([152ecff77b](https://github.com/powerhouse-inc/powerhouse/commit/152ecff77b))
+- **reactor-drive:** erase a purged document's nodes in NodeProcessor ([5a608e73bf](https://github.com/powerhouse-inc/powerhouse/commit/5a608e73bf))
+- **reactor-attachments:** delete a purged document's attachment references ([4121c83347](https://github.com/powerhouse-inc/powerhouse/commit/4121c83347))
+
+### 🩹 Fixes
+
+- **switchboard:** let workflow steps read attachments as they read documents ([b8c861360b](https://github.com/powerhouse-inc/powerhouse/commit/b8c861360b))
+- **switchboard:** shut down when a PGlite store cannot flush ([42ea6fd893](https://github.com/powerhouse-inc/powerhouse/commit/42ea6fd893))
+- **reactor:** a drive's purge does not require a live former member ([e8266b1035](https://github.com/powerhouse-inc/powerhouse/commit/e8266b1035))
+- **reactor-privacy:** warn and record lastError while a leaked purge blocks dispatch ([cd6fe4f022](https://github.com/powerhouse-inc/powerhouse/commit/cd6fe4f022))
+- **reactor-privacy:** reopen every failed request with no failed item each tick ([d9c19c3837](https://github.com/powerhouse-inc/powerhouse/commit/d9c19c3837))
+- **reactor-api:** ignore polled refusals of an unknown kind ([aac4a3e752](https://github.com/powerhouse-inc/powerhouse/commit/aac4a3e752))
+- **reactor-api:** fail a poll with a recoverable code when a refusal is not recorded ([3ab1c92f7b](https://github.com/powerhouse-inc/powerhouse/commit/3ab1c92f7b))
+- **reactor:** keep a polled marker refusal only when the marker was owed ([07cae595da](https://github.com/powerhouse-inc/powerhouse/commit/07cae595da))
+- **reactor:** persist a purge refusal only from a MARKER_REFUSED dead letter ([ef2c3f4729](https://github.com/powerhouse-inc/powerhouse/commit/ef2c3f4729))
+
+### 🔥 Performance
+
+- **reactor-privacy:** dispatch the next purge without rescanning the backlog ([5de3703ebf](https://github.com/powerhouse-inc/powerhouse/commit/5de3703ebf))
+
+### ⚠️  Breaking Changes
+
+- **registry:** serve every replica from Postgres and S3, processing publishes in a worker  ([0d25d5fe35](https://github.com/powerhouse-inc/powerhouse/commit/0d25d5fe35))
+  /packages and /pieces return pages ({items,total,limit,offset,hasMore}) instead of full arrays, and piece bundles move to /-/pieces/bundled/<name>/<version>.tgz.
+
+### ❤️ Thank You
+
+- acaldas
+- Benjamin Jordan
+- Claude Opus 5.5
+
 ## 6.2.3-dev.34 (2026-09-30)
 
 ### 🚀 Features

package/dist/index.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="691165f8-a729-5658-bf22-e7b2440e6156")}catch(e){}}();
-import { i as StoredDocumentsRefusedError, r as startSwitchboard, s as parseForcePgVersion } from "./server-sQoWp21G.mjs";
+import { i as StoredDocumentsRefusedError, r as startSwitchboard, s as parseForcePgVersion } from "./server-CXAp5TOI.mjs";
 import { metrics } from "@opentelemetry/api";
 import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
 import { ExpressInstrumentation } from "@opentelemetry/instrumentation-express";

package/dist/{server-sQoWp21G.mjs → server-CXAp5TOI.mjs}

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="66287c02-682f-57d0-8260-a1005691b2bc")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bf12fafa-a066-5f83-98b1-3dddd60afc6a")}catch(e){}}();
 import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-uaBlzyjS.mjs";
 import { createRequire, register } from "node:module";
 import { ReactorInstrumentation } from "@powerhousedao/opentelemetry-instrumentation-reactor";
@@ -11,7 +11,7 @@ import { existsSync, promises, realpathSync } from "node:fs";
 import path, { resolve } from "node:path";
 import { AtomicNodeFs } from "@powerhousedao/pglite-fs";
 import { ChannelScheme, DriveCollectionId, EventBus, REACTOR_SCHEMA, ReactorBuilder, ReactorClientBuilder, UnsupportedStoredProtocolError, createHybridProjectionCoordinatorFactory, instrumentPgPool, parseDriveUrl, supportsLiveReadModelRegistration } from "@powerhousedao/reactor";
-import { AuthorizationPolicy, BaseSubgraph, ForbiddenError, HttpPackageLoader, ImportPackageLoader, PGLITE_UTC_PARSERS, PackageManagementService, PackagesSubgraph, callerSubject, createCanonicalDocumentIdResolver, getUniqueDocumentModels, initializeAndStartAPI, resolveRenownConfig } from "@powerhousedao/reactor-api";
+import { AuthorizationPolicy, BaseSubgraph, ForbiddenError, HttpPackageLoader, ImportPackageLoader, PGLITE_UTC_PARSERS, PackageManagementService, PackagesSubgraph, PrivacyPermissionAdapter, callerSubject, createCanonicalDocumentIdResolver, getUniqueDocumentModels, initializeAndStartAPI, resolveRenownConfig } from "@powerhousedao/reactor-api";
 import { httpsHooksPath } from "@powerhousedao/reactor-api/https-hooks";
 import { AttachmentAlreadyExists, AttachmentNotFound, AttachmentPending, AttachmentReferenceReadModel, AttachmentSchemaCompiler, HashMismatch, InvalidAttachmentRef, ReservationNotFound, SizeMismatch, UploadTooLarge, createRef, createRemoteAttachmentService, parseAttachmentDownloadTarget, parseRef } from "@powerhousedao/reactor-attachments";
 import { createAttachmentClient } from "@powerhousedao/reactor-attachments/client";
@@ -23,6 +23,7 @@ import path$1 from "path";
 import { Pool } from "pg";
 import { Readable } from "node:stream";
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { DisclosureService, MIN_DEPLOYMENT_SECRET_BYTES, createModuleErasure, createPrivacySubgraph, registerSubjectDocumentsReadModel } from "@powerhousedao/reactor-privacy";
 import { ReactorGroupV1 } from "@powerhousedao/reactor-group";
 import { driveDocumentModelModule } from "@powerhousedao/shared/document-drive";
 import { DEFAULT_SIGNATURE_POLICY, isSignaturePolicy } from "@powerhousedao/shared/document-model";
@@ -790,7 +791,7 @@ async function registerAttachmentReferenceReadModelOnModule(clientModule, attach
 //#endregion
 //#region src/fatal-shutdown.mts
 const FORCED_EXIT_MS = 15e3;
-const installed = /* @__PURE__ */ new WeakSet();
+const fatalHandlers = /* @__PURE__ */ new WeakMap();
 /**
 * Sends an uncaught exception or unhandled rejection through the SIGTERM
 * shutdown that `withSignalHandlers()` installs, so the reactor and read-model
@@ -803,8 +804,7 @@ const installed = /* @__PURE__ */ new WeakSet();
 * listener deliberately keeps the process running.
 */
 function installFatalErrorShutdown(logger, proc = process) {
-	if (installed.has(proc)) return;
-	installed.add(proc);
+	if (fatalHandlers.has(proc)) return;
 	const realExit = proc.exit.bind(proc);
 	let shuttingDown = false;
 	const onFatal = (kind, err) => {
@@ -818,12 +818,97 @@ function installFatalErrorShutdown(logger, proc = process) {
 		}, FORCED_EXIT_MS).unref();
 		proc.kill(proc.pid, "SIGTERM");
 	};
+	fatalHandlers.set(proc, onFatal);
 	proc.on("uncaughtException", (err) => onFatal("Uncaught exception", err));
 	proc.on("unhandledRejection", (reason) => {
 		if (proc.listenerCount("unhandledRejection") > 1) return;
 		onFatal("Unhandled rejection", reason);
 	});
 }
+/**
+* Routes a fatal condition the caller detected through the same shutdown as an
+* uncaught error. Returns false, and does nothing, when
+* `installFatalErrorShutdown` has not run for `proc`.
+*/
+function triggerFatalShutdown(kind, err, proc = process) {
+	const onFatal = fatalHandlers.get(proc);
+	if (!onFatal) return false;
+	onFatal(kind, err);
+	return true;
+}
+//#endregion
+//#region src/privacy.mts
+const DAY_MS = 864e5;
+/** Enabling privacy on a switchboard that cannot run it safely. */
+var PrivacyBootError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "PrivacyBootError";
+	}
+};
+function positive(env, name, unitMs) {
+	const raw = env[name];
+	if (raw === void 0 || raw.trim() === "") return void 0;
+	const value = Number(raw);
+	if (!Number.isFinite(value) || value <= 0) throw new PrivacyBootError(`${name} must be a positive number, got "${raw}"`);
+	return value * unitMs;
+}
+function resolvePrivacy(options, env) {
+	if (!(options?.enabled ?? env.PH_PRIVACY_ENABLED === "true")) return { enabled: false };
+	const deploymentSecret = options?.deploymentSecret ?? env.PH_PRIVACY_DEPLOYMENT_SECRET;
+	if (!deploymentSecret || Buffer.byteLength(deploymentSecret, "utf8") < MIN_DEPLOYMENT_SECRET_BYTES) throw new PrivacyBootError(`PH_PRIVACY_ENABLED needs PH_PRIVACY_DEPLOYMENT_SECRET of at least ${MIN_DEPLOYMENT_SECRET_BYTES} bytes`);
+	return {
+		enabled: true,
+		deploymentSecret,
+		intervalMs: positive(env, "PH_PRIVACY_INTERVAL_MS", 1),
+		deadlineMs: positive(env, "PH_PRIVACY_DEADLINE_DAYS", DAY_MS),
+		markerGraceMs: positive(env, "PH_PRIVACY_MARKER_GRACE_DAYS", DAY_MS),
+		purgeTimeoutMs: positive(env, "PH_PRIVACY_PURGE_TIMEOUT_MINUTES", 6e4)
+	};
+}
+/** Subject index, erasure scheduler and admin subgraph on a built reactor. */
+async function startPrivacy(deps) {
+	const { config, reactorModule, authorizationService } = deps;
+	if (authorizationService.config.policy === AuthorizationPolicy.OPEN) throw new PrivacyBootError("PH_PRIVACY_ENABLED is refused under the OPEN authorization policy: every caller, anonymous included, would administer erasure. Enable authentication (AUTH_ENABLED=true with ADMINS) first.");
+	if (!reactorModule) throw new PrivacyBootError("PH_PRIVACY_ENABLED needs an in-process reactor module");
+	if (!deps.signer?.app?.key) throw new PrivacyBootError("PH_PRIVACY_ENABLED needs a reactor signer (a Renown identity): every receiver refuses an unsigned purge marker");
+	const permissions = deps.documentPermissionService ? new PrivacyPermissionAdapter(deps.documentPermissionService) : void 0;
+	const { service, scheduler } = createModuleErasure(reactorModule, {
+		deploymentSecret: config.deploymentSecret,
+		signer: deps.signer,
+		permissions,
+		intervalMs: config.intervalMs,
+		deadlineMs: config.deadlineMs,
+		markerGraceMs: config.markerGraceMs,
+		purgeTimeoutMs: config.purgeTimeoutMs,
+		logger: deps.logger
+	});
+	const disclosure = new DisclosureService(reactorModule.database, config.deploymentSecret, permissions);
+	let subgraph;
+	try {
+		subgraph = createPrivacySubgraph({
+			authorizationService,
+			erasure: service,
+			disclosure
+		});
+	} catch (error) {
+		throw new PrivacyBootError(error instanceof Error ? error.message : String(error));
+	}
+	await registerSubjectDocumentsReadModel(reactorModule, { deploymentSecret: config.deploymentSecret });
+	await deps.graphqlManager.registerSubgraphInstance({
+		...subgraph,
+		path: deps.graphqlManager.getBasePath(),
+		reactorClient: deps.reactorClient,
+		relationalDb: void 0
+	}, "graphql", false);
+	scheduler.start();
+	deps.logger.info("Privacy add-on started: subject index, erasure scheduler");
+	return {
+		erasure: service,
+		scheduler,
+		stop: () => scheduler.stop()
+	};
+}
 //#endregion
 //#region src/builder-defaults.mts
 /**
@@ -1930,28 +2015,14 @@ function writeAssertion(authorizationService, reactorClient) {
 		if (!await authorizationService.canWrite(documentId, ctx.user?.address)) throw new ForbiddenError("to write this document");
 	};
 }
-/** Whether the workflow document really references the attachment. A step
-* carries no caller, so the relationship is the whole check. */
-function attachmentRefCheck(deps) {
-	const resolveCanonical = createCanonicalDocumentIdResolver(deps.reactorClient);
-	const references = deps.attachmentReferences;
-	const projection = deps.attachmentReferenceProjection;
-	return async (documentId, ref) => {
-		if (!references || projection?.status !== "available") return false;
-		let parsed;
-		try {
-			parsed = parseRef(ref);
-		} catch {
-			return false;
-		}
-		if (parsed.version !== 1) return false;
-		const canonicalRef = createRef(parsed.hash.toLowerCase());
-		try {
-			return await references.hasReference(await resolveCanonical(documentId), canonicalRef);
-		} catch {
-			return false;
-		}
-	};
+/** A step reads any well-formed attachment, as it reads any document: a run
+* carries no caller to check against. */
+function canReadAttachmentRef(_documentId, ref) {
+	try {
+		return Promise.resolve(parseRef(ref).version === 1);
+	} catch {
+		return Promise.resolve(false);
+	}
 }
 async function registerWorkflowTriggersReadModel(engine, runtime, clientModule) {
 	const reactorModule = clientModule?.reactorModule;
@@ -1995,7 +2066,7 @@ async function composeWorkflowRuntime(deps) {
 		assertCanWrite: writeAssertion(deps.authorizationService, deps.reactorClient),
 		webhooks: deps.webhooks,
 		attachments: deps.attachments,
-		canReadAttachmentRef: attachmentRefCheck(deps),
+		canReadAttachmentRef,
 		logger: deps.logger
 	});
 	const triggers = await registerWorkflowTriggersReadModel(engine, runtime, deps.clientModule);
@@ -2332,6 +2403,9 @@ const PGLITE_FLUSH_INTERVAL_MS = (() => {
 	const parsed = Number(raw);
 	return Number.isFinite(parsed) && parsed >= 0 ? parsed : 100;
 })();
+function onPgliteFlushError(err) {
+	triggerFatalShutdown("PGlite snapshot flush failed", err);
+}
 const PGLITE_IN_MEMORY = process.env.PH_PGLITE_IN_MEMORY === "1";
 /**
 * Attempt to bind a throwaway TCP server to the given port. Resolves true if
@@ -2396,7 +2470,8 @@ async function createReactorKysely(opts) {
 	const { PGlite } = await loadPGliteModule(reactorPgliteMajor);
 	const pglite = inMemory ? new PGlite() : new PGlite({ fs: new AtomicNodeFs(reactorPgliteDir, {
 		logger,
-		flushIntervalMs
+		flushIntervalMs,
+		onFlushError: onPgliteFlushError
 	}) });
 	logger.info(inMemory ? `Using in-memory PGlite (PG${reactorPgliteMajor}) for reactor storage [PH_PGLITE_IN_MEMORY=1]` : `Using PGlite (PG${reactorPgliteMajor}) for reactor storage at ${reactorPgliteDir}`);
 	return {
@@ -2519,6 +2594,7 @@ async function initServer(serverPort, options, renown, renownConfig) {
 		process.kill(process.pid, "SIGTERM");
 	};
 	const workflowsEnabled = options.workflows?.enabled === true;
+	const privacyConfig = resolvePrivacy(options.privacy, process.env);
 	if (workflowsEnabled) {
 		await assertWorkflowPackageLoadable();
 		if (!packages.includes("@powerhousedao/workflow")) packages.push(WORKFLOW_PACKAGE_NAME);
@@ -2698,7 +2774,8 @@ async function initServer(serverPort, options, renown, renownConfig) {
 		pgliteFactory = PGLITE_IN_MEMORY ? () => new ReadModelPGlite({ parsers: PGLITE_UTC_PARSERS }) : (connectionString) => new ReadModelPGlite({
 			fs: new AtomicNodeFs(connectionString ?? readModelPgliteDir, {
 				logger,
-				flushIntervalMs: PGLITE_FLUSH_INTERVAL_MS
+				flushIntervalMs: PGLITE_FLUSH_INTERVAL_MS,
+				onFlushError: onPgliteFlushError
 			}),
 			parsers: PGLITE_UTC_PARSERS
 		});
@@ -2743,8 +2820,6 @@ async function initServer(serverPort, options, renown, renownConfig) {
 			relationalDb: api.relationalDb,
 			secretsKeyFile: readModelPgliteDir === null ? false : void 0,
 			attachments: createAttachmentClient(api.attachments.service),
-			attachmentReferences: api.attachmentReferenceIndex.store,
-			attachmentReferenceProjection: api.attachmentReferenceProjection,
 			webhooks: api.httpRoutes.scopeFor(WORKFLOW_PACKAGE_NAME).webhooks,
 			http: api.httpRoutes.scopeFor(WORKFLOW_PACKAGE_NAME),
 			authorizationService: api.authorizationService,
@@ -2769,7 +2844,28 @@ async function initServer(serverPort, options, renown, renownConfig) {
 		await workflows.start();
 		logger.info("Workflow runtime started");
 	}
+	let privacy;
+	if (privacyConfig.enabled) {
+		const signer = options.reactor ? options.privacy?.signer : options.privacy?.signer ?? renown?.signer;
+		try {
+			privacy = await startPrivacy({
+				config: privacyConfig,
+				reactorModule: (options.reactor ?? ownedReactorModule)?.reactorModule,
+				signer,
+				authorizationService: api.authorizationService,
+				documentPermissionService: api.documentPermissionService,
+				graphqlManager,
+				reactorClient: client,
+				logger: logger.child(["privacy"])
+			});
+		} catch (error) {
+			await workflows?.stop();
+			await abortBoot(api);
+			throw error;
+		}
+	}
 	const shutdown = async () => {
+		await privacy?.stop();
 		await workflows?.stop();
 		await api.dispose();
 	};
@@ -2864,6 +2960,7 @@ async function initServer(serverPort, options, renown, renownConfig) {
 		attachmentReferenceProjection: api.attachmentReferenceProjection,
 		workflowTriggers: workflows?.triggers,
 		workflowsEnabled,
+		privacy: privacy ? { erasure: privacy.erasure } : void 0,
 		mcpEnabled: options.mcp !== false,
 		renown,
 		port: serverPort,
@@ -2935,5 +3032,5 @@ if (import.meta.main) await startSwitchboard({ fatalErrorShutdown: true });
 //#endregion
 export { resolveUnsupportedStoredDocuments as a, StoredDocumentsRefusedError as i, isPortAvailable as n, applySwitchboardReactorDefaults as o, startSwitchboard as r, parseForcePgVersion as s, deriveAttachmentServiceConfig as t };
 
-//# sourceMappingURL=server-sQoWp21G.mjs.map
-//# debugId=66287c02-682f-57d0-8260-a1005691b2bc
+//# sourceMappingURL=server-CXAp5TOI.mjs.map
+//# debugId=bf12fafa-a066-5f83-98b1-3dddd60afc6a