@powerhousedao/switchboard 6.2.3-dev.4 → 6.2.3-dev.41

package/dist/server.d.mts

@@ -1,12 +1,34 @@
 import { ILogger } from "document-model";
-import { ChannelScheme, IDocumentModelLoader, IReactorClient, InProcessReactorClientModule, JwtHandler, ReactorBuilder, ReactorClientBuilder, ReactorFeatureFlags, SignerConfig } from "@powerhousedao/reactor";
+import { ChannelScheme, IDocumentModelLoader, IReactorClient, InProcessReactorClientModule, JwtHandler, ReactorBuilder, ReactorClientBuilder, ReactorFeatureFlags, SignerConfig, UnsupportedStoredDocuments, UnsupportedStoredProtocolError } from "@powerhousedao/reactor";
 import { AttachmentReferenceProjectionCapability } from "@powerhousedao/reactor-api";
 import { IAttachmentService } from "@powerhousedao/reactor-attachments";
 import { IRenown } from "@renown/sdk/node";
+import { IErasureService } from "@powerhousedao/reactor-privacy";
 import { DriveInput } from "@powerhousedao/shared/document-drive";
+import { DocumentModelModule, ISigner, SignaturePolicy, UpgradeManifest } from "@powerhousedao/shared/document-model";
+import "@powerhousedao/reactor-workflow";
+import "@powerhousedao/shared/processors";
 import { IRenown as IRenown$1 } from "@renown/sdk";
-import { DocumentModelModule, UpgradeManifest } from "@powerhousedao/shared/document-model";
-
+//#region src/privacy.d.mts
+type PrivacyOptions = {
+  /** Wins over PH_PRIVACY_ENABLED. */
+  enabled?: boolean;
+  /** Wins over PH_PRIVACY_DEPLOYMENT_SECRET. */
+  deploymentSecret?: string;
+  /** The reactor's signer, for a caller-provided reactor. */
+  signer?: ISigner;
+};
+//#endregion
+//#region src/workflow-runtime.d.mts
+/** Whether the operation intake is indexing. Same shape as the attachment
+ * reference projection, because it is the same limitation. */
+type WorkflowTriggersCapability = {
+  status: "available";
+} | {
+  status: "unavailable";
+  reason: "in-process-reactor-module-unavailable" | "live-read-model-registration-unsupported";
+};
+//#endregion
 //#region src/types.d.ts
 /**
  * Drive container document type chosen for the boot-time default drive. The
@@ -14,27 +36,28 @@ import { DocumentModelModule, UpgradeManifest } from "@powerhousedao/shared/docu
  * `powerhouse/reactor-drive` is wired through `addDefaultReactorDrive` and
  * uses the relationship-based child graph.
  */
-type SwitchboardDriveDocumentType = "powerhouse/document-drive" | "powerhouse/reactor-drive";
+export type SwitchboardDriveDocumentType = "powerhouse/document-drive" | "powerhouse/reactor-drive";
 /** A {@link DriveInput} extended with the optional drive-container type. */
-type SwitchboardDriveInput = DriveInput & {
+export type SwitchboardDriveInput = DriveInput & {
   documentType?: SwitchboardDriveDocumentType;
 };
-type StorageOptions = {
+export type StorageOptions = {
   type: "filesystem" | "memory" | "postgres" | "browser";
   filesystemPath?: string;
   postgresUrl?: string;
 };
-type IdentityOptions = {
-  /** Path to the keypair file. Defaults to ~/.ph/keypair.json */keypairPath?: string;
+export type IdentityOptions = {
+  /** Path to the keypair file. Defaults to ~/.ph/keypair.json */
+  keypairPath?: string;
   /**
    * If true, won't start without an existing keypair.
    * Use this to ensure the switchboard only runs with an authenticated identity.
    */
-  requireExisting?: boolean; /** Base url of the Renown instance to use */
-  baseUrl?: string; /** If true, unsigned actions will be rejected */
-  requireSignatures?: boolean;
+  requireExisting?: boolean;
+  /** Base url of the Renown instance to use */
+  baseUrl?: string;
 };
-type StartServerOptions = {
+export type StartServerOptions = {
   /**
    * Pre-built ReactorClientModule (typically from
    * `@powerhousedao/reactor#ReactorClientBuilder.buildModule`). When set, the
@@ -56,6 +79,14 @@ type StartServerOptions = {
    * pieces as needed.
    */
   reactor?: InProcessReactorClientModule;
+  /**
+   * Route uncaught exceptions, and unhandled rejections nothing else listens
+   * for, through the reactor's SIGTERM shutdown, so PGlite stores are flushed
+   * before the process exits with code 1. Installed once the switchboard's own reactor is built;
+   * ignored when `reactor` is passed. For process entry points only, since
+   * it adds process-wide listeners.
+   */
+  fatalErrorShutdown?: boolean;
   /**
    * Registry URL for the HttpPackageLoader. Enables `PackagesSubgraph`
    * (install/uninstall mutations) plus dynamic package resolution.
@@ -85,9 +116,19 @@ type StartServerOptions = {
    * When configured, the switchboard will load the keypair from `ph login`
    * and can authenticate with remote services on behalf of the user.
    */
-  identity?: IdentityOptions; /** Base URL for the attachment service; defaults to `PH_SWITCHBOARD_PUBLIC_URL` then `http(s)://localhost:${port}`. */
+  identity?: IdentityOptions;
+  /** Base URL for the attachment service; defaults to `PH_SWITCHBOARD_PUBLIC_URL` then `http(s)://localhost:${port}`. */
   attachmentServiceUrl?: string;
+  /** Mount the MCP server at `/mcp`. On by default; `false` wins over
+   * MCP_ENABLED, which can turn it off but never on. */
   mcp?: boolean;
+  /** Powerhouse workflows: the runtime, its subgraph, its webhooks and its
+   * document models. Wins over PH_WORKFLOWS_ENABLED and the config file. */
+  workflows?: {
+    enabled?: boolean;
+  };
+  /** The GDPR add-on; off unless this or PH_PRIVACY_ENABLED turns it on. */
+  privacy?: PrivacyOptions;
   processorConfig?: Map<string, unknown>;
   disableLocalPackages?: boolean;
   enableDocumentModelSubgraphs?: boolean;
@@ -144,12 +185,34 @@ type StartServerOptions = {
     enabled?: boolean;
     dbPoolSize?: number;
   };
+  /**
+   * Stored documents at protocol versions this build does not run: "refuse"
+   * (the default) fails the boot with a StoredDocumentsRefusedError;
+   * "read-only" starts with a warning and keeps those documents read-only.
+   * Unset falls back to the REACTOR_UNSUPPORTED_STORED_DOCUMENTS env var.
+   * Ignored when `reactor` is passed.
+   */
+  unsupportedStoredDocuments?: UnsupportedStoredDocuments;
 };
-type SwitchboardReactor = {
+export type SwitchboardReactor = {
   defaultDriveUrl: string | undefined;
-  reactor: IReactorClient; /** Switchboard-backed remote attachment service over its own `/attachments/*` API, for downstream consumers. */
-  attachmentService: IAttachmentService; /** Whether the authoritative attachment-reference projection is active. */
-  attachmentReferenceProjection: AttachmentReferenceProjectionCapability; /** The Renown instance if identity was initialized */
+  reactor: IReactorClient;
+  /** Switchboard-backed remote attachment service over its own `/attachments/*` API, for downstream consumers. */
+  attachmentService: IAttachmentService;
+  /** Whether the authoritative attachment-reference projection is active. */
+  attachmentReferenceProjection: AttachmentReferenceProjectionCapability;
+  /** Whether the workflow runtime's operation intake is indexing. Undefined
+   * when workflows are off; unavailable means no document trigger fires. */
+  workflowTriggers?: WorkflowTriggersCapability;
+  /** Whether workflows are on, after the option, PH_WORKFLOWS_ENABLED and the config file. */
+  workflowsEnabled: boolean;
+  /** Present when the privacy add-on runs: its erasure service. */
+  privacy?: {
+    erasure: IErasureService;
+  };
+  /** Whether `/mcp` is mounted, after the option and MCP_ENABLED. */
+  mcpEnabled: boolean;
+  /** The Renown instance if identity was initialized */
   renown: IRenown$1 | null;
   /**
    * Port the HTTP server actually bound to. May differ from the requested
@@ -173,29 +236,56 @@ type SwitchboardReactor = {
 //#endregion
 //#region src/builder-defaults.d.mts
 type SwitchboardReactorDefaultsOptions = {
-  documentModels?: DocumentModelModule[]; /** Upgrade manifests for versioned models, one per document type. */
-  upgradeManifests?: UpgradeManifest<readonly number[]>[]; /** Default true. */
+  documentModels?: DocumentModelModule[];
+  /** Upgrade manifests for versioned models, one per document type. */
+  upgradeManifests?: UpgradeManifest<readonly number[]>[];
+  /** Default true. */
   includeBaseModels?: boolean;
   /**
    * Channel scheme. Defaults to `ChannelScheme.SWITCHBOARD`, which populates
    * `reactorModule.syncModule.syncManager` — required by reactor-api. Set
    * to `false` only if the caller will configure a scheme themselves.
    */
-  channelScheme?: ChannelScheme | false; /** Defaults to true. Set false when the caller owns SIGINT handling. */
-  signalHandlers?: boolean; /** Executor tuning. Omit to use the reactor's own defaults. */
+  channelScheme?: ChannelScheme | false;
+  /** Defaults to true. Set false when the caller owns SIGINT handling. */
+  signalHandlers?: boolean;
+  /** Executor tuning. Omit to use the reactor's own defaults. */
   executorConfig?: {
     maxSkipThreshold?: number;
     featureFlags?: Partial<ReactorFeatureFlags>;
-  }; /** Wire dynamic document-model loading via HTTP. */
+  };
+  /** Wire dynamic document-model loading via HTTP. */
   documentModelLoader?: IDocumentModelLoader;
   logger?: ILogger;
   /**
-   * Identity signer (typically from `getRenownSignerConfig`). Applied to the
-   * `ReactorClientBuilder`; omit for unsigned operation.
+   * Identity signer (typically from `getRenownSignerConfig`). Signs client
+   * writes and the operations the executor synthesizes, in pooled workers
+   * through `workerSigner`; omit for unsigned operation.
    */
   signer?: SignerConfig;
+  /**
+   * Which keys may sign as which users (typically from
+   * `getRenownTrustPolicyConfig`); wins over one carried by `signer`.
+   */
+  trustPolicy?: Pick<SignerConfig, "trustPolicy" | "workerTrustPolicy">;
+  /** What the client creates new documents as; see `resolveCreateSignaturePolicy`. */
+  createSignaturePolicy?: SignaturePolicy;
 };
-declare function applySwitchboardReactorDefaults(reactorBuilder: ReactorBuilder, clientBuilder: ReactorClientBuilder, options?: SwitchboardReactorDefaultsOptions): void;
+export declare function applySwitchboardReactorDefaults(reactorBuilder: ReactorBuilder, clientBuilder: ReactorClientBuilder, options?: SwitchboardReactorDefaultsOptions): void;
+//#endregion
+//#region src/unsupported-stored-documents.d.mts
+/** From REACTOR_UNSUPPORTED_STORED_DOCUMENTS; `input` wins when defined. */
+export declare function resolveUnsupportedStoredDocuments(input: UnsupportedStoredDocuments | undefined, env: NodeJS.ProcessEnv): UnsupportedStoredDocuments;
+/** The reactor refused to start over documents this build does not run. */
+export declare class StoredDocumentsRefusedError extends Error {
+  readonly versions: readonly {
+    protocol: string;
+    version: number;
+  }[];
+  readonly documents: number;
+  constructor(cause: UnsupportedStoredProtocolError);
+  static isError(error: unknown): error is StoredDocumentsRefusedError;
+}
 //#endregion
 //#region src/server.d.mts
 /**
@@ -203,9 +293,9 @@ declare function applySwitchboardReactorDefaults(reactorBuilder: ReactorBuilder,
  * the port is free, false if the OS reports it in use. Any other error is
  * surfaced so we don't silently mask real issues (permissions, bad host, …).
  */
-declare function isPortAvailable(port: number): Promise<boolean>;
+export declare function isPortAvailable(port: number): Promise<boolean>;
 /** Derive the remote attachment service config for switchboard's own `/attachments/*` API. */
-declare function deriveAttachmentServiceConfig(options: Pick<StartServerOptions, "attachmentServiceUrl" | "https">, serverPort: number, renown: IRenown | null): {
+export declare function deriveAttachmentServiceConfig(options: Pick<StartServerOptions, "attachmentServiceUrl" | "https">, serverPort: number, renown: IRenown | null): {
   remoteUrl: string;
   jwtHandler: JwtHandler | undefined;
 };
@@ -226,7 +316,8 @@ declare function deriveAttachmentServiceConfig(options: Pick<StartServerOptions,
  * trigger the `withShutdownHook` chain that disposes the api. Programmatic
  * full teardown isn't currently exposed — wire it via SIGINT/SIGTERM.
  */
-declare const startSwitchboard: (options?: StartServerOptions) => Promise<SwitchboardReactor>;
+export declare const startSwitchboard: (options?: StartServerOptions) => Promise<SwitchboardReactor>;
 //#endregion
-export { IdentityOptions, StartServerOptions, StorageOptions, SwitchboardDriveDocumentType, SwitchboardDriveInput, SwitchboardReactor, type SwitchboardReactorDefaultsOptions, applySwitchboardReactorDefaults, deriveAttachmentServiceConfig, isPortAvailable, startSwitchboard };
+export type { SwitchboardReactorDefaultsOptions, WorkflowTriggersCapability };
+export {};
 //# sourceMappingURL=server.d.mts.map

package/dist/server.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.mts","names":[],"sources":["../src/types.ts","../src/builder-defaults.mts","../src/server.mts"],"mappings":";;;;;;;;;;;;;;;AAgBA;KAAY,4BAAA;;KAKA,qBAAA,GAAwB,UAAA;EAClC,YAAA,GAAe,4BAAA;AAAA;AAAA,KAGL,cAAA;EACV,IAAA;EACA,cAAA;EACA,WAAA;AAAA;AAAA,KAGU,eAAA;EATiC,+DAW3C,WAAA;EARU;;;;EAaV,eAAA,YAXA;EAcA,OAAA,WAbW;EAgBX,iBAAA;AAAA;AAAA,KAGU,kBAAA;;;;;;;;;AAAZ;;;;;;;;;;;;EAqBE,OAAA,GAAU,4BAAA;EAQV;;;;;;EADA,WAAA;EACA,UAAA;EACA,IAAA;EAYA;;;;;EANA,UAAA;EACA,GAAA;EACA,MAAA;EACA,KAAA,GAAQ,qBAAA;EACR,QAAA;EACA,YAAA;EACA,KAAA;IAEM,OAAA;IACA,QAAA;EAAA;EA0CN;;;;;EAjCA,QAAA,GAAW,eAAA,EAyDT;EAvDF,oBAAA;EACA,GAAA;EACA,eAAA,GAAkB,GAAA;EAClB,oBAAA;EACA,4BAAA;;;;;;EAMA,mBAAA;EACA,MAAA,GAAS,OAAA;EA2Ec;;;;;;;;;EAjEvB,aAAA;EAoDA;;;;;;;;AC5JF;EDkHE,cAAA;;;;;;;;;EASA,UAAA;IACE,UAAA;IACA,mBAAA;IACA,gBAAA;EAAA;ECxHF;;;;;;;;;EDmIA,gBAAA;IACE,OAAA;IACA,UAAA;EAAA;AAAA;AAAA,KAIQ,kBAAA;EACV,eAAA;EACA,OAAA,EAAS,cAAA,ECpHY;EDsHrB,iBAAA,EAAmB,kBAAA,EChGL;EDkGd,6BAAA,EAA+B,uCAAA;EAE/B,MAAA,EAAQ,SAAA;EClGO;;;;EDuGf,IAAA;ECxGA;;;;;;;;;;ACyDF;;EF4DE,QAAA,QAAgB,OAAA;AAAA;;;KCzKN,iCAAA;EAIV,cAAA,GAAiB,mBAAA;EAEjB,gBAAA,GAAmB,eAAA;EAEnB,iBAAA;;ADZF;;;;ECkBE,aAAA,GAAgB,aAAA,UDbN;ECeV,cAAA;EAEA,cAAA;IACE,gBAAA;IACA,YAAA,GAAe,OAAA,CAAQ,mBAAA;EAAA,GDlBkB;ECqB3C,mBAAA,GAAsB,oBAAA;EACtB,MAAA,GAAS,OAAA;EDnBe;;;;ECwBxB,MAAA,GAAS,YAAA;AAAA;AAAA,iBAsBK,+BAAA,CACd,cAAA,EAAgB,cAAA,EAChB,aAAA,EAAe,oBAAA,EACf,OAAA,GAAS,iCAAA;;;;;;;;iBCuDK,eAAA,CAAgB,IAAA,WAAe,OAAA;;iBA0H/B,6BAAA,CACd,OAAA,EAAS,IAAA,CAAK,kBAAA,qCACd,UAAA,UACA,MAAA,EAAQ,OAAA;EACL,SAAA;EAAmB,UAAA,EAAY,UAAA;AAAA;;AF1OpC;;;;;;;;;AAIA;;;;;;;cEogCa,gBAAA,GACX,OAAA,GAAS,kBAAA,KACR,OAAA,CAAQ,kBAAA"}
+{"version":3,"file":"server.d.mts","names":[],"sources":["../src/privacy.mts","../src/workflow-runtime.mts","../src/types.ts","../src/builder-defaults.mts","../src/unsupported-stored-documents.mts","../src/server.mts"],"mappings":";;;;;;;;;;;;KAyBY;;EAEV;;EAEA;;EAEA,SAAS;;;;;;KCsBC;EACN;;EAEA;EACA;;;;;;;;;;YCpCM;;YAKA,wBAAwB;EAClC,eAAe;;YAGL;EACV;EACA;EACA;;YAGU;;EAEV;;;;;EAKA;;EAGA;;YAGU;;;;;;;;;;;;;;;;;;;;;EAqBV,UAAU;;;;;;;;EAQV;;;;;;;EAOA;EACA;EACA;;;;;;EAMA;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA;IAEM;IACA;;;;;;;EASN,WAAW;;EAEX;;;EAGA;;;EAGA;IACE;;;EAGF,UAAU;EACV,kBAAkB;EAClB;EACA;;;;;;EAMA;EACA,SAAS;;;;;;;;;;EAUT;;;;;;;;;;EAUA;;;;;;;;;EASA;IACE;IACA;IACA;;;;;;;;;;;EAWF;IACE;IACA;;;;;;;;;EASF,6BAA6B;;YAGnB;EACV;EACA,SAAS;;EAET,mBAAmB;;EAEnB,+BAA+B;;;EAG/B,mBAAmB;;EAEnB;;EAEA;IAAY,SAAS;;;EAErB;;EAEA,QAAQ;;;;;EAKR;;;;;;;;;;;;;EAaA,gBAAgB;;;;KC5MN;EAIV,iBAAiB;;EAEjB,mBAAmB;;EAEnB;;;;;;EAMA,gBAAgB;;EAEhB;;EAEA;IACE;IACA,eAAe,QAAQ;;;EAGzB,sBAAsB;EACtB,SAAS;;;;;;EAMT,SAAS;;;;;EAKT,cAAc,KAAK;;EAEnB,wBAAwB;;wBAsBV,gCACd,gBAAgB,gBAChB,eAAe,sBACf,UAAS;;;;wBC3EK,kCACd,OAAO,wCACP,KAAK,OAAO,aACX;;qBAaU,oCAAoC;WACtC;IAAqB;IAAkB;;WACvC;EAET,YAAY,OAAO;SAcZ,QAAQ,iBAAiB,SAAS;;;;;;;;;wBCyH3B,gBAAgB,eAAe;;wBAwI/B,8BACd,SAAS,KAAK,uDACd,oBACA,QAAQ;EACL;EAAmB,YAAY;;;;;;;;;;;;;;;;;;;qBAi+BvB,mBAAgB,UAClB,uBACR,QAAQ"}

package/dist/server.mjs

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
-import { i as applySwitchboardReactorDefaults, n as isPortAvailable, r as startSwitchboard, t as deriveAttachmentServiceConfig } from "./server-CiKkVE6g.mjs";
-import "./utils-Baw7rThP.mjs";
-export { applySwitchboardReactorDefaults, deriveAttachmentServiceConfig, isPortAvailable, startSwitchboard };
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="43d97572-0a08-5683-83a3-d8477151600e")}catch(e){}}();
-//# debugId=43d97572-0a08-5683-83a3-d8477151600e
+import { a as resolveUnsupportedStoredDocuments, i as StoredDocumentsRefusedError, n as isPortAvailable, o as applySwitchboardReactorDefaults, r as startSwitchboard, t as deriveAttachmentServiceConfig } from "./server-CMAxYG6D.mjs";
+export { StoredDocumentsRefusedError, applySwitchboardReactorDefaults, deriveAttachmentServiceConfig, isPortAvailable, resolveUnsupportedStoredDocuments, startSwitchboard };
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a4c8ff4a-a754-5a57-860f-5cadf1712728")}catch(e){}}();
+//# debugId=a4c8ff4a-a754-5a57-860f-5cadf1712728

package/dist/{utils-Baw7rThP.mjs → utils-uaBlzyjS.mjs}

@@ -1,8 +1,16 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="686dcce6-c280-5558-89dd-a18a7e514cdf")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5ece528d-aafb-5305-a04d-e0c45c8c30a3")}catch(e){}}();
 import { reactorDriveCreateDocument, reactorDriveCreateState } from "@powerhousedao/reactor-drive";
 import { driveCreateDocument, driveCreateState } from "@powerhousedao/shared/document-drive";
+import { withSignaturePolicy } from "@powerhousedao/shared/document-model";
 //#region src/utils.mts
+/**
+* A configured id pins the drive, and only a legacy drive can take a chosen
+* id; otherwise the client's creation default applies.
+*/
+async function underCreatePolicy(client, document, id) {
+	return id ? withSignaturePolicy(document, "legacy", { id }) : withSignaturePolicy(document, await client.getCreateSignaturePolicy());
+}
 async function addDefaultDrive(client, drive, serverPort) {
 	let driveId = drive.id;
 	if (!driveId || driveId.length === 0) driveId = drive.slug;
@@ -13,7 +21,7 @@ async function addDefaultDrive(client, drive, serverPort) {
 	} catch {}
 	if (existingDrive) return `http://localhost:${serverPort}/d/${driveId}`;
 	const { global } = driveCreateState();
-	const document = driveCreateDocument({
+	const document = await underCreatePolicy(client, driveCreateDocument({
 		global: {
 			...global,
 			name: drive.global.name,
@@ -25,8 +33,7 @@ async function addDefaultDrive(client, drive, serverPort) {
 			listeners: drive.local?.listeners ?? [],
 			triggers: drive.local?.triggers ?? []
 		}
-	});
-	if (drive.id && drive.id.length > 0) document.header.id = drive.id;
+	}), drive.id);
 	if (drive.slug && drive.slug.length > 0) document.header.slug = drive.slug;
 	if (drive.global.name) document.header.name = drive.global.name;
 	if (drive.preferredEditor) document.header.meta = { preferredEditor: drive.preferredEditor };
@@ -47,7 +54,7 @@ async function addDefaultReactorDrive(client, drive, serverPort) {
 	} catch {}
 	if (existingDrive) return `http://localhost:${serverPort}/d/${driveId}`;
 	const { global, local } = reactorDriveCreateState();
-	const document = reactorDriveCreateDocument({
+	const document = await underCreatePolicy(client, reactorDriveCreateDocument({
 		global: {
 			...global,
 			name: drive.global.name,
@@ -58,8 +65,7 @@ async function addDefaultReactorDrive(client, drive, serverPort) {
 			availableOffline: drive.local?.availableOffline ?? local.availableOffline,
 			sharingType: drive.local?.sharingType ?? local.sharingType
 		}
-	});
-	if (drive.id && drive.id.length > 0) document.header.id = drive.id;
+	}), drive.id);
 	if (drive.slug && drive.slug.length > 0) document.header.slug = drive.slug;
 	if (drive.global.name) document.header.name = drive.global.name;
 	if (drive.preferredEditor) document.header.meta = { preferredEditor: drive.preferredEditor };
@@ -76,5 +82,5 @@ function isPostgresUrl(url) {
 //#endregion
 export { addDefaultReactorDrive as n, isPostgresUrl as r, addDefaultDrive as t };
 
-//# sourceMappingURL=utils-Baw7rThP.mjs.map
-//# debugId=686dcce6-c280-5558-89dd-a18a7e514cdf
+//# sourceMappingURL=utils-uaBlzyjS.mjs.map
+//# debugId=5ece528d-aafb-5305-a04d-e0c45c8c30a3

package/dist/utils-uaBlzyjS.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils-uaBlzyjS.mjs","sources":["../src/utils.mts"],"sourcesContent":["import type { IReactorClient } from \"@powerhousedao/reactor\";\nimport {\n  reactorDriveCreateDocument,\n  reactorDriveCreateState,\n} from \"@powerhousedao/reactor-drive\";\nimport {\n  driveCreateDocument,\n  driveCreateState,\n} from \"@powerhousedao/shared/document-drive\";\nimport type { DriveInput } from \"@powerhousedao/shared/document-drive\";\nimport {\n  withSignaturePolicy,\n  type PHDocument,\n} from \"@powerhousedao/shared/document-model\";\n\n/**\n * A configured id pins the drive, and only a legacy drive can take a chosen\n * id; otherwise the client's creation default applies.\n */\nasync function underCreatePolicy<TDocument extends PHDocument>(\n  client: IReactorClient,\n  document: TDocument,\n  id: string | undefined,\n): Promise<TDocument> {\n  return id\n    ? withSignaturePolicy(document, \"legacy\", { id })\n    : withSignaturePolicy(document, await client.getCreateSignaturePolicy());\n}\n\nexport async function addDefaultDrive(\n  client: IReactorClient,\n  drive: DriveInput,\n  serverPort: number,\n) {\n  let driveId = drive.id;\n  if (!driveId || driveId.length === 0) {\n    driveId = drive.slug;\n  }\n\n  if (!driveId || driveId.length === 0) {\n    throw new Error(\"Invalid Drive Id\");\n  }\n\n  // check if the drive already exists\n  let existingDrive;\n  try {\n    existingDrive = await client.get(driveId);\n  } catch {\n    //\n  }\n\n  // already exists, return the existing drive url\n  if (existingDrive) {\n    return `http://localhost:${serverPort}/d/${driveId}`;\n  }\n\n  const { global } = driveCreateState();\n  const created = driveCreateDocument({\n    global: {\n      ...global,\n      name: drive.global.name,\n      icon: drive.global.icon ?? global.icon,\n    },\n    local: {\n      availableOffline: drive.local?.availableOffline ?? false,\n      sharingType: drive.local?.sharingType ?? \"public\",\n      listeners: drive.local?.listeners ?? [],\n      triggers: drive.local?.triggers ?? [],\n    },\n  });\n\n  const document = await underCreatePolicy(client, created, drive.id);\n  if (drive.slug && drive.slug.length > 0) {\n    document.header.slug = drive.slug;\n  }\n  if (drive.global.name) {\n    document.header.name = drive.global.name;\n  }\n  if (drive.preferredEditor) {\n    document.header.meta = { preferredEditor: drive.preferredEditor };\n  }\n\n  try {\n    await client.create(document);\n  } catch (e) {\n    const errorMessage = e instanceof Error ? e.message : String(e);\n    if (!errorMessage.includes(\"already exists\")) {\n      throw e;\n    }\n  }\n\n  return `http://localhost:${serverPort}/d/${driveId}`;\n}\n\nexport async function addDefaultReactorDrive(\n  client: IReactorClient,\n  drive: DriveInput,\n  serverPort: number,\n) {\n  let driveId = drive.id;\n  if (!driveId || driveId.length === 0) {\n    driveId = drive.slug;\n  }\n\n  if (!driveId || driveId.length === 0) {\n    throw new Error(\"Invalid Drive Id\");\n  }\n\n  let existingDrive;\n  try {\n    existingDrive = await client.get(driveId);\n  } catch {\n    //\n  }\n\n  if (existingDrive) {\n    return `http://localhost:${serverPort}/d/${driveId}`;\n  }\n\n  const { global, local } = reactorDriveCreateState();\n  const created = reactorDriveCreateDocument({\n    global: {\n      ...global,\n      name: drive.global.name,\n      icon: drive.global.icon ?? global.icon,\n    },\n    local: {\n      ...local,\n      availableOffline: drive.local?.availableOffline ?? local.availableOffline,\n      sharingType: drive.local?.sharingType ?? local.sharingType,\n    },\n  });\n\n  const document = await underCreatePolicy(client, created, drive.id);\n  if (drive.slug && drive.slug.length > 0) {\n    document.header.slug = drive.slug;\n  }\n  if (drive.global.name) {\n    document.header.name = drive.global.name;\n  }\n  if (drive.preferredEditor) {\n    document.header.meta = { preferredEditor: drive.preferredEditor };\n  }\n\n  try {\n    await client.create(document);\n  } catch (e) {\n    const errorMessage = e instanceof Error ? e.message : String(e);\n    if (!errorMessage.includes(\"already exists\")) {\n      throw e;\n    }\n  }\n\n  return `http://localhost:${serverPort}/d/${driveId}`;\n}\n\nexport function isPostgresUrl(url: string) {\n  return url.startsWith(\"postgresql\") || url.startsWith(\"postgres\");\n}\n"],"names":[],"mappings":";;;;;;;;;;AAmBA,eAAe,kBACb,QACA,UACA,IACoB;CACpB,OAAO,KACH,oBAAoB,UAAU,UAAU,EAAE,GAAG,CAAC,IAC9C,oBAAoB,UAAU,MAAM,OAAO,yBAAyB,CAAC;AAC3E;AAEA,eAAsB,gBACpB,QACA,OACA,YACA;CACA,IAAI,UAAU,MAAM;CACpB,IAAI,CAAC,WAAW,QAAQ,WAAW,GACjC,UAAU,MAAM;CAGlB,IAAI,CAAC,WAAW,QAAQ,WAAW,GACjC,MAAM,IAAI,MAAM,kBAAkB;CAIpC,IAAI;CACJ,IAAI;EACF,gBAAgB,MAAM,OAAO,IAAI,OAAO;CAC1C,QAAQ,CAER;CAGA,IAAI,eACF,OAAO,oBAAoB,WAAW,KAAK;CAG7C,MAAM,EAAE,WAAW,iBAAiB;CAepC,MAAM,WAAW,MAAM,kBAAkB,QAdzB,oBAAoB;EAClC,QAAQ;GACN,GAAG;GACH,MAAM,MAAM,OAAO;GACnB,MAAM,MAAM,OAAO,QAAQ,OAAO;EACpC;EACA,OAAO;GACL,kBAAkB,MAAM,OAAO,oBAAoB;GACnD,aAAa,MAAM,OAAO,eAAe;GACzC,WAAW,MAAM,OAAO,aAAa,CAAC;GACtC,UAAU,MAAM,OAAO,YAAY,CAAC;EACtC;CACF,CAEuD,GAAG,MAAM,EAAE;CAClE,IAAI,MAAM,QAAQ,MAAM,KAAK,SAAS,GACpC,SAAS,OAAO,OAAO,MAAM;CAE/B,IAAI,MAAM,OAAO,MACf,SAAS,OAAO,OAAO,MAAM,OAAO;CAEtC,IAAI,MAAM,iBACR,SAAS,OAAO,OAAO,EAAE,iBAAiB,MAAM,gBAAgB;CAGlE,IAAI;EACF,MAAM,OAAO,OAAO,QAAQ;CAC9B,SAAS,GAAG;EAEV,IAAI,EADiB,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAA,CAC5C,SAAS,gBAAgB,GACzC,MAAM;CAEV;CAEA,OAAO,oBAAoB,WAAW,KAAK;AAC7C;AAEA,eAAsB,uBACpB,QACA,OACA,YACA;CACA,IAAI,UAAU,MAAM;CACpB,IAAI,CAAC,WAAW,QAAQ,WAAW,GACjC,UAAU,MAAM;CAGlB,IAAI,CAAC,WAAW,QAAQ,WAAW,GACjC,MAAM,IAAI,MAAM,kBAAkB;CAGpC,IAAI;CACJ,IAAI;EACF,gBAAgB,MAAM,OAAO,IAAI,OAAO;CAC1C,QAAQ,CAER;CAEA,IAAI,eACF,OAAO,oBAAoB,WAAW,KAAK;CAG7C,MAAM,EAAE,QAAQ,UAAU,wBAAwB;CAclD,MAAM,WAAW,MAAM,kBAAkB,QAbzB,2BAA2B;EACzC,QAAQ;GACN,GAAG;GACH,MAAM,MAAM,OAAO;GACnB,MAAM,MAAM,OAAO,QAAQ,OAAO;EACpC;EACA,OAAO;GACL,GAAG;GACH,kBAAkB,MAAM,OAAO,oBAAoB,MAAM;GACzD,aAAa,MAAM,OAAO,eAAe,MAAM;EACjD;CACF,CAEuD,GAAG,MAAM,EAAE;CAClE,IAAI,MAAM,QAAQ,MAAM,KAAK,SAAS,GACpC,SAAS,OAAO,OAAO,MAAM;CAE/B,IAAI,MAAM,OAAO,MACf,SAAS,OAAO,OAAO,MAAM,OAAO;CAEtC,IAAI,MAAM,iBACR,SAAS,OAAO,OAAO,EAAE,iBAAiB,MAAM,gBAAgB;CAGlE,IAAI;EACF,MAAM,OAAO,OAAO,QAAQ;CAC9B,SAAS,GAAG;EAEV,IAAI,EADiB,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAA,CAC5C,SAAS,gBAAgB,GACzC,MAAM;CAEV;CAEA,OAAO,oBAAoB,WAAW,KAAK;AAC7C;AAEA,SAAgB,cAAc,KAAa;CACzC,OAAO,IAAI,WAAW,YAAY,KAAK,IAAI,WAAW,UAAU;AAClE","debug_id":"5ece528d-aafb-5305-a04d-e0c45c8c30a3"}

package/dist/utils.d.mts

@@ -1,10 +1,9 @@
 import { IReactorClient } from "@powerhousedao/reactor";
 import { DriveInput } from "@powerhousedao/shared/document-drive";
-
 //#region src/utils.d.mts
-declare function addDefaultDrive(client: IReactorClient, drive: DriveInput, serverPort: number): Promise<string>;
-declare function addDefaultReactorDrive(client: IReactorClient, drive: DriveInput, serverPort: number): Promise<string>;
-declare function isPostgresUrl(url: string): boolean;
+export declare function addDefaultDrive(client: IReactorClient, drive: DriveInput, serverPort: number): Promise<string>;
+export declare function addDefaultReactorDrive(client: IReactorClient, drive: DriveInput, serverPort: number): Promise<string>;
+export declare function isPostgresUrl(url: string): boolean;
 //#endregion
-export { addDefaultDrive, addDefaultReactorDrive, isPostgresUrl };
+export {};
 //# sourceMappingURL=utils.d.mts.map

package/dist/utils.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.mts","names":[],"sources":["../src/utils.mts"],"mappings":";;;;iBAWsB,eAAA,CACpB,MAAA,EAAQ,cAAA,EACR,KAAA,EAAO,UAAA,EACP,UAAA,WAAkB,OAAA;AAAA,iBAgEE,sBAAA,CACpB,MAAA,EAAQ,cAAA,EACR,KAAA,EAAO,UAAA,EACP,UAAA,WAAkB,OAAA;AAAA,iBA6DJ,aAAA,CAAc,GAAA"}
+{"version":3,"file":"utils.d.mts","names":[],"sources":["../src/utils.mts"],"mappings":";;;wBA6BsB,gBACpB,QAAQ,gBACR,OAAO,YACP,qBAAkB;wBA8DE,uBACpB,QAAQ,gBACR,OAAO,YACP,qBAAkB;wBA2DJ,cAAc"}

package/dist/utils.mjs

@@ -1,4 +1,4 @@
-import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-Baw7rThP.mjs";
+import { n as addDefaultReactorDrive, r as isPostgresUrl, t as addDefaultDrive } from "./utils-uaBlzyjS.mjs";
 export { addDefaultDrive, addDefaultReactorDrive, isPostgresUrl };
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8227e60f-e412-513a-b0cb-502740b7f818")}catch(e){}}();
-//# debugId=8227e60f-e412-513a-b0cb-502740b7f818
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e030fa72-327e-52e2-9ac0-68feb4ef300a")}catch(e){}}();
+//# debugId=e030fa72-327e-52e2-9ac0-68feb4ef300a

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@powerhousedao/switchboard",
   "type": "module",
-  "version": "6.2.3-dev.4",
+  "version": "6.2.3-dev.41",
   "main": "dist/index.mjs",
   "exports": {
     ".": {
@@ -41,7 +41,7 @@
     "@openfeature/core": "1.9.1",
     "@openfeature/env-var-provider": "0.3.1",
     "@openfeature/server-sdk": "1.19.0",
-    "@powerhousedao/config": "6.2.3-dev.4",
+    "@powerhousedao/config": "6.2.3-dev.41",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.218.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
@@ -55,32 +55,37 @@
     "@opentelemetry/sdk-node": "^0.218.0",
     "@opentelemetry/sdk-trace-base": "^2.7.1",
     "@opentelemetry/semantic-conventions": "^1.41.1",
-    "@powerhousedao/opentelemetry-instrumentation-reactor": "6.2.3-dev.4",
-    "@powerhousedao/reactor": "6.2.3-dev.4",
-    "@powerhousedao/shared": "6.2.3-dev.4",
-    "@powerhousedao/vetra": "6.2.3-dev.4",
-    "@powerhousedao/reactor-api": "6.2.3-dev.4",
-    "@powerhousedao/reactor-attachments": "6.2.3-dev.4",
-    "@powerhousedao/reactor-drive": "6.2.3-dev.4",
-    "@powerhousedao/reactor-group": "6.2.3-dev.4",
-    "@powerhousedao/pglite-fs": "6.2.3-dev.4",
+    "@powerhousedao/opentelemetry-instrumentation-reactor": "6.2.3-dev.41",
+    "@powerhousedao/reactor": "6.2.3-dev.41",
+    "@powerhousedao/shared": "6.2.3-dev.41",
+    "@powerhousedao/vetra": "6.2.3-dev.41",
+    "@powerhousedao/reactor-api": "6.2.3-dev.41",
+    "@powerhousedao/reactor-attachments": "6.2.3-dev.41",
+    "@powerhousedao/reactor-drive": "6.2.3-dev.41",
+    "@powerhousedao/reactor-group": "6.2.3-dev.41",
+    "@powerhousedao/reactor-privacy": "6.2.3-dev.41",
+    "@powerhousedao/reactor-workflow": "6.2.3-dev.41",
+    "@powerhousedao/workflow": "6.2.3-dev.41",
+    "@powerhousedao/pglite-fs": "6.2.3-dev.41",
     "@pyroscope/nodejs": "^0.4.5",
-    "@renown/sdk": "6.2.3-dev.4",
+    "@renown/sdk": "6.2.3-dev.41",
     "@sentry/node": "^10.53.1",
     "@sentry/opentelemetry": "^10.53.1",
-    "document-model": "6.2.3-dev.4",
+    "document-model": "6.2.3-dev.41",
     "dotenv": "^16.4.7",
-    "express": "^4.21.2",
+    "express": "^4.22.1",
+    "graphql": "^16",
+    "graphql-tag": "^2",
     "kysely": "0.28.16",
     "kysely-pglite-dialect": "1.2.0",
     "pg": "8.18.0",
-    "vite": "8.0.10"
+    "vite": "8.3.0"
   },
   "devDependencies": {
     "@types/express": "^4.17.25",
     "@types/node": "25.2.3",
     "@types/pg": "8.16.0",
-    "tsdown": "0.21.1",
+    "tsdown": "0.23.0",
     "concurrently": "9.2.1",
     "nodemon": "3.1.11",
     "react": "19.2.6",
@@ -92,7 +97,7 @@
   "scripts": {
     "tsc": "tsc",
     "test": "vitest run",
-    "lint": "eslint",
+    "lint": "cd ../.. && oxlint apps/switchboard",
     "build": "tsdown && pnpm run install-packages",
     "start": "node dist/index.mjs",
     "start:profile": "mkdir -p .prof && node --cpu-prof --cpu-prof-dir=.prof dist/index.mjs",

package/test/attachment-reference-read-model.test.ts

@@ -232,6 +232,8 @@ describe("Switchboard attachment-reference read model registration", () => {
         writtenOrdinals.push(...references.map(({ ordinal }) => ordinal));
         await attachmentReferenceIndex.store.addReferences(references);
       },
+      removeDocuments: (documentIds) =>
+        attachmentReferenceIndex.store.removeDocuments(documentIds),
     };
 
     const coordinator =
@@ -283,7 +285,10 @@ describe("Switchboard attachment-reference read model registration", () => {
       .withReadModelCoordinator(customCoordinator)
       .buildModule();
     const addReferences = vi.fn();
-    const writer = { addReferences } as IAttachmentReferenceWriter;
+    const writer: IAttachmentReferenceWriter = {
+      addReferences,
+      removeDocuments: vi.fn(),
+    };
 
     await expect(
       registerAttachmentReferenceReadModelOnModule(

package/test/attachments/auth.test.ts

@@ -342,6 +342,91 @@ describe("requireAuth", () => {
     });
   });
 
+  /**
+   * The deployment-wide floor. These routes never pass the GraphQL fetch chain,
+   * so `REQUIRE_AUTHENTICATED_CALLER` reaches them through this option instead
+   * — including on the routes that opt into `allowAnonymous`, which says the
+   * handler can decide without identity, not that the server will serve callers
+   * it cannot name.
+   */
+  describe("requireAuthenticatedCaller", () => {
+    const anonymousUnderOpenPolicy = () =>
+      makeAuthService(() =>
+        Promise.resolve({ user: undefined, admins: [], auth_enabled: false }),
+      );
+
+    it("refuses a missing bearer even with auth disabled, where today it passes", async () => {
+      const { service } = anonymousUnderOpenPolicy();
+      const handler = vi.fn<NodeHandler>();
+      const wrapped = requireAuth(service, handler, {
+        requireAuthenticatedCaller: true,
+      });
+
+      const res = makeRes();
+      await wrapped(makeReq({ headers: {} }), res);
+
+      expect(res.statusCode).toBe(401);
+      expect(JSON.parse(res._body)).toEqual({
+        error: "Authentication required",
+      });
+      expect(handler).not.toHaveBeenCalled();
+    });
+
+    it("overrides allowAnonymous", async () => {
+      const { service } = anonymousUnderOpenPolicy();
+      const handler = vi.fn<NodeHandler>();
+      const wrapped = requireAuth(service, handler, {
+        allowAnonymous: true,
+        requireAuthenticatedCaller: true,
+      });
+
+      const res = makeRes();
+      await wrapped(makeReq({ headers: {} }), res);
+
+      expect(res.statusCode).toBe(401);
+      expect(handler).not.toHaveBeenCalled();
+    });
+
+    it("still serves a verified caller", async () => {
+      const { service } = makeAuthService(() =>
+        Promise.resolve({
+          user: { address: "0x123", chainId: 1, networkId: "mainnet" },
+          admins: [],
+          auth_enabled: false,
+        }),
+      );
+      const handler = vi.fn<NodeHandler>();
+      const wrapped = requireAuth(service, handler, {
+        allowAnonymous: true,
+        requireAuthenticatedCaller: true,
+      });
+
+      const req = makeReq({ headers: { authorization: "Bearer good-token" } });
+      const res = makeRes();
+      await wrapped(req, res);
+
+      expect(res.statusCode).toBe(200);
+      expect(handler).toHaveBeenCalledWith(req, res, undefined, {
+        user: { address: "0x123", chainId: 1, networkId: "mainnet" },
+        authEnabled: false,
+      });
+    });
+
+    it("leaves every route as it was when the deployment has not set it", async () => {
+      const { service } = anonymousUnderOpenPolicy();
+      const handler = vi.fn<NodeHandler>();
+      const wrapped = requireAuth(service, handler, {
+        requireAuthenticatedCaller: false,
+      });
+
+      const res = makeRes();
+      await wrapped(makeReq({ headers: {} }), res);
+
+      expect(res.statusCode).toBe(200);
+      expect(handler).toHaveBeenCalledTimes(1);
+    });
+  });
+
   it("calls verifyBearer with undefined when no authorization header is present", async () => {
     const { service, spy } = makeAuthService(() =>
       Promise.resolve({