@powerhousedao/switchboard 6.2.3-dev.34 → 6.2.3-dev.36

package/dist/server.d.mts

@@ -3,11 +3,22 @@ import { ChannelScheme, IDocumentModelLoader, IReactorClient, InProcessReactorCl
 import { AttachmentReferenceProjectionCapability } from "@powerhousedao/reactor-api";
 import { IAttachmentService } from "@powerhousedao/reactor-attachments";
 import { IRenown } from "@renown/sdk/node";
+import { IErasureService } from "@powerhousedao/reactor-privacy";
 import { DriveInput } from "@powerhousedao/shared/document-drive";
-import { DocumentModelModule, SignaturePolicy, UpgradeManifest } from "@powerhousedao/shared/document-model";
+import { DocumentModelModule, ISigner, SignaturePolicy, UpgradeManifest } from "@powerhousedao/shared/document-model";
 import "@powerhousedao/reactor-workflow";
 import "@powerhousedao/shared/processors";
 import { IRenown as IRenown$1 } from "@renown/sdk";
+//#region src/privacy.d.mts
+type PrivacyOptions = {
+  /** Wins over PH_PRIVACY_ENABLED. */
+  enabled?: boolean;
+  /** Wins over PH_PRIVACY_DEPLOYMENT_SECRET. */
+  deploymentSecret?: string;
+  /** The reactor's signer, for a caller-provided reactor. */
+  signer?: ISigner;
+};
+//#endregion
 //#region src/workflow-runtime.d.mts
 /** Whether the operation intake is indexing. Same shape as the attachment
  * reference projection, because it is the same limitation. */
@@ -116,6 +127,8 @@ export type StartServerOptions = {
   workflows?: {
     enabled?: boolean;
   };
+  /** The GDPR add-on; off unless this or PH_PRIVACY_ENABLED turns it on. */
+  privacy?: PrivacyOptions;
   processorConfig?: Map<string, unknown>;
   disableLocalPackages?: boolean;
   enableDocumentModelSubgraphs?: boolean;
@@ -193,6 +206,10 @@ export type SwitchboardReactor = {
   workflowTriggers?: WorkflowTriggersCapability;
   /** Whether workflows are on, after the option, PH_WORKFLOWS_ENABLED and the config file. */
   workflowsEnabled: boolean;
+  /** Present when the privacy add-on runs: its erasure service. */
+  privacy?: {
+    erasure: IErasureService;
+  };
   /** Whether `/mcp` is mounted, after the option and MCP_ENABLED. */
   mcpEnabled: boolean;
   /** The Renown instance if identity was initialized */

package/dist/server.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.mts","names":[],"sources":["../src/workflow-runtime.mts","../src/types.ts","../src/builder-defaults.mts","../src/unsupported-stored-documents.mts","../src/server.mts"],"mappings":";;;;;;;;;;;;;KA2DY;EACN;;EAEA;EACA;;;;;;;;;;YC5CM;;YAKA,wBAAwB;EAClC,eAAe;;YAGL;EACV;EACA;EACA;;YAGU;;EAEV;;;;;EAKA;;EAGA;;YAGU;;;;;;;;;;;;;;;;;;;;;EAqBV,UAAU;;;;;;;;EAQV;;;;;;;EAOA;EACA;EACA;;;;;;EAMA;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA;IAEM;IACA;;;;;;;EASN,WAAW;;EAEX;;;EAGA;;;EAGA;IACE;;EAEF,kBAAkB;EAClB;EACA;;;;;;EAMA;EACA,SAAS;;;;;;;;;;EAUT;;;;;;;;;;EAUA;;;;;;;;;EASA;IACE;IACA;IACA;;;;;;;;;;;EAWF;IACE;IACA;;;;;;;;;EASF,6BAA6B;;YAGnB;EACV;EACA,SAAS;;EAET,mBAAmB;;EAEnB,+BAA+B;;;EAG/B,mBAAmB;;EAEnB;;EAEA;;EAEA,QAAQ;;;;;EAKR;;;;;;;;;;;;;EAaA,gBAAgB;;;;KCtMN;EAIV,iBAAiB;;EAEjB,mBAAmB;;EAEnB;;;;;;EAMA,gBAAgB;;EAEhB;;EAEA;IACE;IACA,eAAe,QAAQ;;;EAGzB,sBAAsB;EACtB,SAAS;;;;;;EAMT,SAAS;;;;;EAKT,cAAc,KAAK;;EAEnB,wBAAwB;;wBAsBV,gCACd,gBAAgB,gBAChB,eAAe,sBACf,UAAS;;;;wBC3EK,kCACd,OAAO,wCACP,KAAK,OAAO,aACX;;qBAaU,oCAAoC;WACtC;IAAqB;IAAkB;;WACvC;EAET,YAAY,OAAO;SAcZ,QAAQ,iBAAiB,SAAS;;;;;;;;;wBC4G3B,gBAAgB,eAAe;;wBAoI/B,8BACd,SAAS,KAAK,uDACd,oBACA,QAAQ;EACL;EAAmB,YAAY;;;;;;;;;;;;;;;;;;;qBAk7BvB,mBAAgB,UAClB,uBACR,QAAQ"}
+{"version":3,"file":"server.d.mts","names":[],"sources":["../src/privacy.mts","../src/workflow-runtime.mts","../src/types.ts","../src/builder-defaults.mts","../src/unsupported-stored-documents.mts","../src/server.mts"],"mappings":";;;;;;;;;;;;KAyBY;;EAEV;;EAEA;;EAEA,SAAS;;;;;;KCsBC;EACN;;EAEA;EACA;;;;;;;;;;YCpCM;;YAKA,wBAAwB;EAClC,eAAe;;YAGL;EACV;EACA;EACA;;YAGU;;EAEV;;;;;EAKA;;EAGA;;YAGU;;;;;;;;;;;;;;;;;;;;;EAqBV,UAAU;;;;;;;;EAQV;;;;;;;EAOA;EACA;EACA;;;;;;EAMA;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA;IAEM;IACA;;;;;;;EASN,WAAW;;EAEX;;;EAGA;;;EAGA;IACE;;;EAGF,UAAU;EACV,kBAAkB;EAClB;EACA;;;;;;EAMA;EACA,SAAS;;;;;;;;;;EAUT;;;;;;;;;;EAUA;;;;;;;;;EASA;IACE;IACA;IACA;;;;;;;;;;;EAWF;IACE;IACA;;;;;;;;;EASF,6BAA6B;;YAGnB;EACV;EACA,SAAS;;EAET,mBAAmB;;EAEnB,+BAA+B;;;EAG/B,mBAAmB;;EAEnB;;EAEA;IAAY,SAAS;;;EAErB;;EAEA,QAAQ;;;;;EAKR;;;;;;;;;;;;;EAaA,gBAAgB;;;;KC5MN;EAIV,iBAAiB;;EAEjB,mBAAmB;;EAEnB;;;;;;EAMA,gBAAgB;;EAEhB;;EAEA;IACE;IACA,eAAe,QAAQ;;;EAGzB,sBAAsB;EACtB,SAAS;;;;;;EAMT,SAAS;;;;;EAKT,cAAc,KAAK;;EAEnB,wBAAwB;;wBAsBV,gCACd,gBAAgB,gBAChB,eAAe,sBACf,UAAS;;;;wBC3EK,kCACd,OAAO,wCACP,KAAK,OAAO,aACX;;qBAaU,oCAAoC;WACtC;IAAqB;IAAkB;;WACvC;EAET,YAAY,OAAO;SAcZ,QAAQ,iBAAiB,SAAS;;;;;;;;;wBCyH3B,gBAAgB,eAAe;;wBAwI/B,8BACd,SAAS,KAAK,uDACd,oBACA,QAAQ;EACL;EAAmB,YAAY;;;;;;;;;;;;;;;;;;;qBAg9BvB,mBAAgB,UAClB,uBACR,QAAQ"}

package/dist/server.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as resolveUnsupportedStoredDocuments, i as StoredDocumentsRefusedError, n as isPortAvailable, o as applySwitchboardReactorDefaults, r as startSwitchboard, t as deriveAttachmentServiceConfig } from "./server-sQoWp21G.mjs";
+import { a as resolveUnsupportedStoredDocuments, i as StoredDocumentsRefusedError, n as isPortAvailable, o as applySwitchboardReactorDefaults, r as startSwitchboard, t as deriveAttachmentServiceConfig } from "./server-D3CYuEka.mjs";
 export { StoredDocumentsRefusedError, applySwitchboardReactorDefaults, deriveAttachmentServiceConfig, isPortAvailable, resolveUnsupportedStoredDocuments, startSwitchboard };
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1396e5c4-5148-5e73-aaff-79e70b5910cc")}catch(e){}}();
-//# debugId=1396e5c4-5148-5e73-aaff-79e70b5910cc
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="784a735c-87ca-55fa-bea5-af4fb82863ba")}catch(e){}}();
+//# debugId=784a735c-87ca-55fa-bea5-af4fb82863ba

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@powerhousedao/switchboard",
   "type": "module",
-  "version": "6.2.3-dev.34",
+  "version": "6.2.3-dev.36",
   "main": "dist/index.mjs",
   "exports": {
     ".": {
@@ -41,7 +41,7 @@
     "@openfeature/core": "1.9.1",
     "@openfeature/env-var-provider": "0.3.1",
     "@openfeature/server-sdk": "1.19.0",
-    "@powerhousedao/config": "6.2.3-dev.34",
+    "@powerhousedao/config": "6.2.3-dev.36",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.218.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
@@ -55,22 +55,23 @@
     "@opentelemetry/sdk-node": "^0.218.0",
     "@opentelemetry/sdk-trace-base": "^2.7.1",
     "@opentelemetry/semantic-conventions": "^1.41.1",
-    "@powerhousedao/opentelemetry-instrumentation-reactor": "6.2.3-dev.34",
-    "@powerhousedao/reactor": "6.2.3-dev.34",
-    "@powerhousedao/shared": "6.2.3-dev.34",
-    "@powerhousedao/vetra": "6.2.3-dev.34",
-    "@powerhousedao/reactor-api": "6.2.3-dev.34",
-    "@powerhousedao/reactor-attachments": "6.2.3-dev.34",
-    "@powerhousedao/reactor-drive": "6.2.3-dev.34",
-    "@powerhousedao/reactor-group": "6.2.3-dev.34",
-    "@powerhousedao/reactor-workflow": "6.2.3-dev.34",
-    "@powerhousedao/workflow": "6.2.3-dev.34",
-    "@powerhousedao/pglite-fs": "6.2.3-dev.34",
+    "@powerhousedao/opentelemetry-instrumentation-reactor": "6.2.3-dev.36",
+    "@powerhousedao/reactor": "6.2.3-dev.36",
+    "@powerhousedao/shared": "6.2.3-dev.36",
+    "@powerhousedao/vetra": "6.2.3-dev.36",
+    "@powerhousedao/reactor-api": "6.2.3-dev.36",
+    "@powerhousedao/reactor-attachments": "6.2.3-dev.36",
+    "@powerhousedao/reactor-drive": "6.2.3-dev.36",
+    "@powerhousedao/reactor-group": "6.2.3-dev.36",
+    "@powerhousedao/reactor-privacy": "6.2.3-dev.36",
+    "@powerhousedao/reactor-workflow": "6.2.3-dev.36",
+    "@powerhousedao/workflow": "6.2.3-dev.36",
+    "@powerhousedao/pglite-fs": "6.2.3-dev.36",
     "@pyroscope/nodejs": "^0.4.5",
-    "@renown/sdk": "6.2.3-dev.34",
+    "@renown/sdk": "6.2.3-dev.36",
     "@sentry/node": "^10.53.1",
     "@sentry/opentelemetry": "^10.53.1",
-    "document-model": "6.2.3-dev.34",
+    "document-model": "6.2.3-dev.36",
     "dotenv": "^16.4.7",
     "express": "^4.22.1",
     "graphql": "^16",

package/test/attachment-reference-read-model.test.ts

@@ -232,6 +232,8 @@ describe("Switchboard attachment-reference read model registration", () => {
         writtenOrdinals.push(...references.map(({ ordinal }) => ordinal));
         await attachmentReferenceIndex.store.addReferences(references);
       },
+      removeDocuments: (documentIds) =>
+        attachmentReferenceIndex.store.removeDocuments(documentIds),
     };
 
     const coordinator =
@@ -283,7 +285,10 @@ describe("Switchboard attachment-reference read model registration", () => {
       .withReadModelCoordinator(customCoordinator)
       .buildModule();
     const addReferences = vi.fn();
-    const writer = { addReferences } as IAttachmentReferenceWriter;
+    const writer: IAttachmentReferenceWriter = {
+      addReferences,
+      removeDocuments: vi.fn(),
+    };
 
     await expect(
       registerAttachmentReferenceReadModelOnModule(

package/test/attachments/byte-grants.test.ts

@@ -94,7 +94,10 @@ function makeAccess(result: AttachmentAccessResult | Error) {
     result instanceof Error ? Promise.reject(result) : Promise.resolve(result),
   );
   return {
-    access: { canReadAttachment } as IAttachmentAccessService,
+    access: {
+      canReadAttachment,
+      admitCaller: () => Promise.resolve({ kind: "admitted" }),
+    } as IAttachmentAccessService,
     canReadAttachment,
   };
 }

package/test/attachments/download-target.test.ts

@@ -91,7 +91,13 @@ function makeAccess(result: AttachmentAccessResult): {
   spy: ReturnType<typeof vi.fn>;
 } {
   const spy = vi.fn().mockResolvedValue(result);
-  return { access: { canReadAttachment: spy }, spy };
+  return {
+    access: {
+      canReadAttachment: spy,
+      admitCaller: () => Promise.resolve({ kind: "admitted" }),
+    },
+    spy,
+  };
 }
 
 function makeAttachments(opts: {

package/test/attachments/reserve-metadata-parity.test.ts

@@ -0,0 +1,96 @@
+import {
+  InvalidAttachmentMetadata,
+  validateReserveMetadata,
+  type ReserveMetadata,
+} from "@powerhousedao/reactor-attachments";
+import { describe, expect, it } from "vitest";
+import { parseReserveOptions } from "../../src/attachments/routes.js";
+
+type Case = [name: string, meta: Record<string, unknown>];
+
+const base = { mimeType: "text/plain", fileName: "note.txt" };
+
+// The download route's setHeader throws on each of these.
+const headerBreaking: Case[] = [
+  ["CRLF before a parameter", { ...base, mimeType: "text/plain\r\n;a=b" }],
+  ["LF after a ;", { ...base, mimeType: "text/plain;\na=b" }],
+  ["a control char quoted", { ...base, mimeType: 'text/plain; a="\x01"' }],
+  ["a DEL quoted", { ...base, mimeType: 'text/plain; a="\x7f"' }],
+  ["a char above 0xFF quoted", { ...base, mimeType: 'text/plain;a="\u0100"' }],
+];
+
+const cases: Case[] = [
+  ["plain metadata", base],
+  ["an extension", { ...base, extension: "txt" }],
+  ["a null extension", { ...base, extension: null }],
+  ["a parameter", { ...base, mimeType: "text/plain; charset=utf-8" }],
+  ["a quoted parameter", { ...base, mimeType: 'text/plain; a="b c"' }],
+  ["a unicode file name", { ...base, fileName: "résumé.pdf" }],
+  ["a 255-char mimeType", { ...base, mimeType: `a/${"b".repeat(253)}` }],
+  ["a 256-char mimeType", { ...base, mimeType: `a/${"b".repeat(254)}` }],
+  ["a 255-char fileName", { ...base, fileName: "f".repeat(255) }],
+  ["a 256-char fileName", { ...base, fileName: "f".repeat(256) }],
+  ["an empty mimeType", { ...base, mimeType: "" }],
+  ["an empty fileName", { ...base, fileName: "" }],
+  ["an empty extension", { ...base, extension: "" }],
+  ["a mimeType with no slash", { ...base, mimeType: "text" }],
+  ["a mimeType with no subtype", { ...base, mimeType: "text/" }],
+  ["a mimeType with no type", { ...base, mimeType: "/plain" }],
+  ["a mimeType with two slashes", { ...base, mimeType: "text/plain/x" }],
+  ["a mimeType with a space", { ...base, mimeType: "text plain" }],
+  ["a mimeType with a dangling ;", { ...base, mimeType: "text/plain;" }],
+  ["a non-string mimeType", { ...base, mimeType: 5 }],
+  ["a trailing CRLF in mimeType", { ...base, mimeType: "text/plain\r\n" }],
+  [
+    "an injected header in mimeType",
+    { ...base, mimeType: "text/plain\nX-Injected: 1" },
+  ],
+  ["a NUL in mimeType", { ...base, mimeType: "text/pl\x00ain" }],
+  ...headerBreaking,
+  ["a NUL in fileName", { ...base, fileName: "a\x00b" }],
+  ["a LF in fileName", { ...base, fileName: "a\nb" }],
+  ["a CR in fileName", { ...base, fileName: "a\rb" }],
+  ["a tab in fileName", { ...base, fileName: "a\tb" }],
+  ["a DEL in fileName", { ...base, fileName: "a\x7fb" }],
+  ["a non-string fileName", { ...base, fileName: null }],
+  ["a slash in extension", { ...base, extension: "a/b" }],
+  ["a backslash in extension", { ...base, extension: "a\\b" }],
+  ["a bare slash extension", { ...base, extension: "/" }],
+  ["a non-string extension", { ...base, extension: 5 }],
+];
+
+function routeAccepts(meta: Record<string, unknown>): boolean {
+  return parseReserveOptions(meta) !== null;
+}
+
+function validatorAccepts(meta: Record<string, unknown>): boolean {
+  try {
+    validateReserveMetadata(meta as ReserveMetadata);
+    return true;
+  } catch (err) {
+    if (err instanceof InvalidAttachmentMetadata) return false;
+    throw err;
+  }
+}
+
+describe("reserve metadata parity between the route and validateReserveMetadata", () => {
+  it("covers both accepted and rejected metadata", () => {
+    const verdicts = cases.map(([, meta]) => routeAccepts(meta));
+    expect(verdicts).toContain(true);
+    expect(verdicts).toContain(false);
+  });
+
+  it.each(cases)("agrees on %s", (_name, meta) => {
+    expect(validatorAccepts(meta)).toBe(routeAccepts(meta));
+  });
+});
+
+describe("header-breaking mimeType values", () => {
+  it.each(headerBreaking)("the route rejects %s", (_name, meta) => {
+    expect(routeAccepts(meta)).toBe(false);
+  });
+
+  it.each(headerBreaking)("the validator rejects %s", (_name, meta) => {
+    expect(validatorAccepts(meta)).toBe(false);
+  });
+});

package/test/attachments/routes-integration.test.ts

@@ -31,6 +31,7 @@ const ALLOW_ALL: IAttachmentAccessService = {
       documentId: request.documentId as never,
       ref: request.attachmentRef as never,
     }),
+  admitCaller: () => Promise.resolve({ kind: "admitted" }),
 };
 
 describe("attachment routes through the real Express middleware stack", () => {

package/test/attachments/routes.test.ts

@@ -39,6 +39,7 @@ const ALLOW_ALL: IAttachmentAccessService = {
       documentId: request.documentId as never,
       ref: request.attachmentRef as never,
     }),
+  admitCaller: () => Promise.resolve({ kind: "admitted" }),
 };
 const grantedDownload = (attachments: AttachmentBuildResult) =>
   makeDownloadHandler(attachments, ALLOW_ALL, null);

package/test/boot-privacy.test.ts

@@ -0,0 +1,243 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { createServer } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { ILogger } from "document-model";
+import pg from "pg";
+import { describe, expect, it, vi } from "vitest";
+import { startSwitchboard } from "../src/server.mjs";
+
+const ADMIN = "0xadad00000000000000000000000000000000adad";
+const SECRET = "switchboard-privacy-test-deployment-secret-0123";
+
+function stubLogger(): ILogger & { error: ReturnType<typeof vi.fn> } {
+  const logger = {
+    verbose: vi.fn(),
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    child: vi.fn(),
+  };
+  logger.child.mockReturnValue(logger);
+  return logger as unknown as ILogger & { error: ReturnType<typeof vi.fn> };
+}
+
+type Switchboard = Awaited<ReturnType<typeof startSwitchboard>>;
+
+async function withEnv<T>(
+  env: Record<string, string>,
+  run: (tempRoot: string) => Promise<T>,
+): Promise<T> {
+  const tempRoot = await mkdtemp(join(tmpdir(), "switchboard-privacy-"));
+  const names = [
+    "PH_REACTOR_DATABASE_URL",
+    "AUTH_ENABLED",
+    "ADMINS",
+    "PH_PRIVACY_ENABLED",
+    "PH_PRIVACY_DEPLOYMENT_SECRET",
+    ...Object.keys(env),
+  ];
+  const previous = names.map((name) => [name, process.env[name]] as const);
+  for (const name of names) delete process.env[name];
+  process.env.PH_REACTOR_DATABASE_URL = join(tempRoot, "reactor-storage");
+  Object.assign(process.env, env);
+  try {
+    return await run(tempRoot);
+  } finally {
+    for (const [name, value] of previous) {
+      if (value === undefined) {
+        delete process.env[name];
+      } else {
+        process.env[name] = value;
+      }
+    }
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+}
+
+async function freePort(): Promise<number> {
+  const server = createServer();
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+  await new Promise((resolve) => server.close(resolve));
+  if (address === null || typeof address === "string") {
+    throw new Error("no port");
+  }
+  return address.port;
+}
+
+async function boot(
+  tempRoot: string,
+  logger: ILogger = stubLogger(),
+): Promise<Switchboard> {
+  return startSwitchboard({
+    workflows: { enabled: false },
+    dbPath: join(tempRoot, "read-model"),
+    port: await freePort(),
+    strictPort: true,
+    mcp: false,
+    disableLocalPackages: true,
+    identity: { keypairPath: join(tempRoot, "identity.json") },
+    logger,
+  });
+}
+
+async function queryErasure(switchboard: Switchboard) {
+  const response = await fetch(`http://127.0.0.1:${switchboard.port}/graphql`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      query: `{ erasureRequest(requestId: "none") { requestId } }`,
+    }),
+  });
+  return (await response.json()) as {
+    errors?: { message: string; extensions?: { code?: string } }[];
+  };
+}
+
+describe("booting Switchboard with the privacy add-on", () => {
+  it("mounts nothing when PH_PRIVACY_ENABLED is off", async () => {
+    await withEnv({}, async (tempRoot) => {
+      const switchboard = await boot(tempRoot);
+      try {
+        expect(switchboard.privacy).toBeUndefined();
+        const result = await queryErasure(switchboard);
+        expect(result.errors?.[0]?.message).toMatch(/erasureRequest/);
+        expect(result.errors?.[0]?.extensions?.code).not.toBe("FORBIDDEN");
+      } finally {
+        await switchboard.shutdown();
+      }
+    });
+  }, 60_000);
+
+  it("serves erasure to admins only when it is on under authentication", async () => {
+    await withEnv(
+      {
+        AUTH_ENABLED: "true",
+        ADMINS: ADMIN,
+        PH_PRIVACY_ENABLED: "true",
+        PH_PRIVACY_DEPLOYMENT_SECRET: SECRET,
+        PH_PRIVACY_INTERVAL_MS: "50",
+      },
+      async (tempRoot) => {
+        const logger = stubLogger();
+        const switchboard = await boot(tempRoot, logger);
+        try {
+          expect(switchboard.privacy).toBeDefined();
+          expect(await switchboard.privacy!.erasure.plan([])).toEqual({
+            maxPurgeOperations: expect.any(Number) as number,
+            items: [],
+          });
+          await vi.waitUntil(
+            async () =>
+              (await queryErasure(switchboard)).errors?.[0]?.extensions
+                ?.code === "FORBIDDEN",
+            { timeout: 20_000, interval: 100 },
+          );
+          const document = await switchboard.reactor.createEmpty(
+            "powerhouse/document-model",
+          );
+          const id = document.header.id;
+          await switchboard.reactor.deleteDocument(id);
+          const erasure = switchboard.privacy!.erasure;
+          const { requestId } = await erasure.request([id], {
+            requestedBy: ADMIN,
+          });
+          await vi.waitUntil(
+            async () => (await erasure.status(requestId)).status === "complete",
+            { timeout: 30_000, interval: 100 },
+          );
+          expect(
+            logger.error.mock.calls.filter(([message]) =>
+              String(message).startsWith("Erasure"),
+            ),
+          ).toEqual([]);
+        } finally {
+          await switchboard.shutdown();
+        }
+      },
+    );
+  }, 60_000);
+
+  it("refuses to boot under the OPEN policy", async () => {
+    await withEnv(
+      {
+        PH_PRIVACY_ENABLED: "true",
+        PH_PRIVACY_DEPLOYMENT_SECRET: SECRET,
+      },
+      async (tempRoot) => {
+        await expect(boot(tempRoot)).rejects.toThrow(/OPEN/);
+      },
+    );
+  }, 60_000);
+
+  it("refuses to boot without a deployment secret", async () => {
+    await withEnv(
+      { AUTH_ENABLED: "true", ADMINS: ADMIN, PH_PRIVACY_ENABLED: "true" },
+      async (tempRoot) => {
+        await expect(boot(tempRoot)).rejects.toThrow(
+          /PH_PRIVACY_DEPLOYMENT_SECRET/,
+        );
+      },
+    );
+  }, 60_000);
+});
+
+const PG_URL = process.env.REACTOR_TEST_PG_URL;
+
+describe.skipIf(!PG_URL)(
+  "the privacy add-on on a Postgres reactor store",
+  () => {
+    it("erases a document end to end", async () => {
+      const name = `sb_privacy_${process.pid}`;
+      const admin = new pg.Pool({ connectionString: PG_URL });
+      await admin.query(`DROP DATABASE IF EXISTS "${name}" WITH (FORCE)`);
+      await admin.query(`CREATE DATABASE "${name}"`);
+      const url = new URL(PG_URL!);
+      url.pathname = `/${name}`;
+      try {
+        await withEnv(
+          {
+            AUTH_ENABLED: "true",
+            ADMINS: ADMIN,
+            PH_PRIVACY_ENABLED: "true",
+            PH_PRIVACY_DEPLOYMENT_SECRET: SECRET,
+            PH_PRIVACY_INTERVAL_MS: "50",
+          },
+          async (tempRoot) => {
+            process.env.PH_REACTOR_DATABASE_URL = url.toString();
+            const logger = stubLogger();
+            const switchboard = await boot(tempRoot, logger);
+            try {
+              const document = await switchboard.reactor.createEmpty(
+                "powerhouse/document-model",
+              );
+              const id = document.header.id;
+              await switchboard.reactor.deleteDocument(id);
+              const erasure = switchboard.privacy!.erasure;
+              const { requestId } = await erasure.request([id], {
+                requestedBy: ADMIN,
+              });
+              await vi.waitUntil(
+                async () =>
+                  (await erasure.status(requestId)).status === "complete",
+                { timeout: 30_000, interval: 100 },
+              );
+              expect(
+                logger.error.mock.calls.filter(([message]) =>
+                  String(message).startsWith("Erasure"),
+                ),
+              ).toEqual([]);
+            } finally {
+              await switchboard.shutdown();
+            }
+          },
+        );
+      } finally {
+        await admin.query(`DROP DATABASE IF EXISTS "${name}" WITH (FORCE)`);
+        await admin.end();
+      }
+    }, 90_000);
+  },
+);

package/test/boot-unsupported-stored-documents.test.ts

@@ -89,7 +89,8 @@ async function seedStore(dir: string): Promise<void> {
       const { status } = await module.reactor.getJobStatus(created.id);
       return status === JobStatus.READ_READY || status === JobStatus.FAILED;
     },
-    { timeout: 10_000, interval: 5 },
+    // One job is ~40 full snapshots; the Windows runner needs the boot budget.
+    { timeout: BOOT_TIMEOUT, interval: 5 },
   );
   expect((await module.reactor.getJobStatus(created.id)).status).toBe(
     JobStatus.READ_READY,
@@ -100,6 +101,8 @@ async function seedStore(dir: string): Promise<void> {
 
 // PGlite boots are several times slower on Windows runners.
 const BOOT_TIMEOUT = 120_000;
+// Windows can briefly keep just-closed store files locked (EBUSY/EPERM).
+const RM_OPTIONS = { recursive: true, force: true, maxRetries: 10 };
 
 describe("booting over documents this build does not run", () => {
   let seeded: string;
@@ -112,8 +115,8 @@ describe("booting over documents this build does not run", () => {
   }, BOOT_TIMEOUT);
 
   afterAll(async () => {
-    await rm(seeded, { recursive: true, force: true });
-  });
+    await rm(seeded, RM_OPTIONS);
+  }, BOOT_TIMEOUT);
 
   beforeEach(async () => {
     tempRoot = await mkdtemp(join(tmpdir(), "switchboard-stored-protocol-"));
@@ -126,7 +129,7 @@ describe("booting over documents this build does not run", () => {
       process.env.PH_REACTOR_DATABASE_URL,
       { recursive: true },
     );
-  });
+  }, BOOT_TIMEOUT);
 
   afterEach(async () => {
     for (const key of ENV_KEYS) {
@@ -136,8 +139,8 @@ describe("booting over documents this build does not run", () => {
         process.env[key] = previous[key];
       }
     }
-    await rm(tempRoot, { recursive: true, force: true });
-  });
+    await rm(tempRoot, RM_OPTIONS);
+  }, BOOT_TIMEOUT);
 
   function boot(logger: ILogger) {
     return startSwitchboard({

package/test/fatal-shutdown.test.ts

@@ -1,6 +1,9 @@
 import { EventEmitter } from "node:events";
 import { afterEach, describe, expect, it, vi } from "vitest";
-import { installFatalErrorShutdown } from "../src/fatal-shutdown.mjs";
+import {
+  installFatalErrorShutdown,
+  triggerFatalShutdown,
+} from "../src/fatal-shutdown.mjs";
 
 function makeProc() {
   const emitter = new EventEmitter();
@@ -91,6 +94,33 @@ describe("installFatalErrorShutdown", () => {
     expect(proc.exit).not.toHaveBeenCalled();
   });
 
+  it("routes a triggered fatal error through SIGTERM with exit code 1", () => {
+    const proc = makeProc();
+    const onSigterm = vi.fn();
+    proc.on("SIGTERM", onSigterm);
+    installFatalErrorShutdown(logger, proc as never);
+
+    expect(
+      triggerFatalShutdown("Flush failed", new Error("ENOSPC"), proc as never),
+    ).toBe(true);
+    triggerFatalShutdown("Flush failed", new Error("ENOSPC"), proc as never);
+    proc.emit("uncaughtException", new Error("later"));
+
+    expect(proc.kill).toHaveBeenCalledOnce();
+    expect(onSigterm).toHaveBeenCalledOnce();
+    expect(proc.exitCode).toBe(1);
+  });
+
+  it("ignores a trigger when shutdown on fatal errors is not installed", () => {
+    const proc = makeProc();
+
+    expect(
+      triggerFatalShutdown("Flush failed", new Error("ENOSPC"), proc as never),
+    ).toBe(false);
+    expect(proc.kill).not.toHaveBeenCalled();
+    expect(proc.exitCode).toBeUndefined();
+  });
+
   it("installs its listeners once per process", () => {
     const proc = makeProc();
     installFatalErrorShutdown(logger, proc as never);

package/test/workflow-runtime.test.ts

@@ -26,6 +26,7 @@ import { startSwitchboard } from "../src/server.mjs";
 import {
   PH_WORKFLOWS_ENABLED,
   bindPackagePieces,
+  canReadAttachmentRef,
   composeWorkflowRuntime,
   assertWorkflowPackageLoadable,
   resolveWorkflowsEnabled,
@@ -245,7 +246,19 @@ describe("composeWorkflowRuntime", () => {
     expect(deps.webhooks).toEqual({ id: "webhooks" });
     expect(typeof deps.assertCanRead).toBe("function");
     expect(typeof deps.assertCanWrite).toBe("function");
-    expect(typeof deps.canReadAttachmentRef).toBe("function");
+    expect(deps.canReadAttachmentRef).toBe(canReadAttachmentRef);
+  });
+
+  it("lets a step read any well-formed attachment ref", async () => {
+    const hash = "a".repeat(64);
+    // No document references it: runs read attachments as they read documents.
+    expect(await canReadAttachmentRef("wf-1", `attachment://v1:${hash}`)).toBe(
+      true,
+    );
+    expect(await canReadAttachmentRef("wf-1", `attachment://v2:${hash}`)).toBe(
+      false,
+    );
+    expect(await canReadAttachmentRef("wf-1", "not-a-ref")).toBe(false);
   });
 
   it("serves a subgraph the GraphQL manager can construct", async () => {

package/tsconfig.json

@@ -33,6 +33,9 @@
     {
       "path": "../../packages/reactor-group"
     },
+    {
+      "path": "../../packages/reactor-privacy"
+    },
     {
       "path": "../../packages/reactor-workflow"
     },