@powerhousedao/reactor-api 6.0.0-dev.4 → 6.0.0-dev.40

package/dist/src/graphql/document-model-subgraph.js

@@ -1,104 +1,595 @@
 import { camelCase, kebabCase } from "change-case";
 import { addFile } from "document-drive";
 import { setName } from "document-model";
-import { generateDocumentModelSchemaLegacy, getDocumentModelSchemaName, } from "../utils/create-schema.js";
+import { GraphQLError, Kind, parse } from "graphql";
+import { generateDocumentModelSchema, getDocumentModelSchemaName, } from "../utils/create-schema.js";
 import { BaseSubgraph } from "./base-subgraph.js";
+import { toGqlPhDocument } from "./reactor/adapters.js";
+import { createEmptyDocument as createEmptyDocumentResolver, createGetParentIdsFn, documentChildren as documentChildrenResolver, documentParents as documentParentsResolver, document as documentResolver, findDocuments as findDocumentsResolver, } from "./reactor/resolvers.js";
 import { buildGraphQlDocument } from "./utils.js";
-export function generateDocumentModelResolversLegacy(documentModel, reactor) {
-    const documentType = documentModel.documentModel.global.id;
-    const documentName = getDocumentModelSchemaName(documentModel.documentModel.global);
-    const operations = documentModel.documentModel.global.specifications
-        .at(-1)
-        ?.modules.flatMap((module) => module.operations.filter((op) => op.name)) ?? [];
-    return {
-        Query: {
-            [documentName]: () => {
-                return {
-                    getDocument: async (args) => {
-                        const { docId, driveId } = args;
-                        if (!docId) {
-                            throw new Error("Document id is required");
+/**
+ * New document model subgraph that uses reactorClient instead of legacy reactor.
+ * This class auto-generates GraphQL queries and mutations for a document model.
+ */
+export class DocumentModelSubgraph extends BaseSubgraph {
+    documentModel;
+    constructor(documentModel, args) {
+        super(args);
+        this.documentModel = documentModel;
+        this.name = kebabCase(documentModel.documentModel.global.name);
+        this.typeDefs = generateDocumentModelSchema(this.documentModel.documentModel.global, { useNewApi: true });
+        this.resolvers = this.generateResolvers();
+    }
+    /**
+     * Check if user has global read access (admin, user, or guest)
+     */
+    hasGlobalReadAccess(ctx) {
+        const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "");
+        const isGlobalUser = ctx.isUser?.(ctx.user?.address ?? "");
+        const isGlobalGuest = ctx.isGuest?.(ctx.user?.address ?? "") ||
+            process.env.FREE_ENTRY === "true";
+        return !!(isGlobalAdmin || isGlobalUser || isGlobalGuest);
+    }
+    /**
+     * Check if user has global write access (admin or user, not guest)
+     */
+    hasGlobalWriteAccess(ctx) {
+        const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "");
+        const isGlobalUser = ctx.isUser?.(ctx.user?.address ?? "");
+        return !!(isGlobalAdmin || isGlobalUser);
+    }
+    /**
+     * Get the parent IDs function for hierarchical permission checks.
+     * Uses the shared createGetParentIdsFn from reactor/resolvers.
+     */
+    getParentIdsFn() {
+        return createGetParentIdsFn(this.reactorClient);
+    }
+    /**
+     * Check if user can read a document (with hierarchy)
+     */
+    async canReadDocument(documentId, ctx) {
+        if (this.hasGlobalReadAccess(ctx)) {
+            return true;
+        }
+        if (this.documentPermissionService) {
+            return this.documentPermissionService.canRead(documentId, ctx.user?.address, this.getParentIdsFn());
+        }
+        return false;
+    }
+    /**
+     * Check if user can write to a document (with hierarchy)
+     */
+    async canWriteDocument(documentId, ctx) {
+        if (this.hasGlobalWriteAccess(ctx)) {
+            return true;
+        }
+        if (this.documentPermissionService) {
+            return this.documentPermissionService.canWrite(documentId, ctx.user?.address, this.getParentIdsFn());
+        }
+        return false;
+    }
+    /**
+     * Throw an error if user cannot read the document
+     */
+    async assertCanRead(documentId, ctx) {
+        const canRead = await this.canReadDocument(documentId, ctx);
+        if (!canRead) {
+            throw new GraphQLError("Forbidden: insufficient permissions to read this document");
+        }
+    }
+    /**
+     * Throw an error if user cannot write to the document
+     */
+    async assertCanWrite(documentId, ctx) {
+        const canWrite = await this.canWriteDocument(documentId, ctx);
+        if (!canWrite) {
+            throw new GraphQLError("Forbidden: insufficient permissions to write to this document");
+        }
+    }
+    /**
+     * Check if user can execute a specific operation on a document.
+     * Throws an error if the operation is restricted and user lacks permission.
+     */
+    async assertCanExecuteOperation(documentId, operationType, ctx) {
+        if (!this.documentPermissionService) {
+            return;
+        }
+        if (ctx.isAdmin?.(ctx.user?.address ?? "")) {
+            return;
+        }
+        const isRestricted = await this.documentPermissionService.isOperationRestricted(documentId, operationType);
+        if (isRestricted) {
+            const canExecute = await this.documentPermissionService.canExecuteOperation(documentId, operationType, ctx.user?.address);
+            if (!canExecute) {
+                throw new GraphQLError(`Forbidden: insufficient permissions to execute operation "${operationType}" on this document`);
+            }
+        }
+    }
+    /**
+     * Generate __resolveType functions for union types found in the document model schema.
+     * Parses the state schema to find union definitions and their member types,
+     * then uses unique field presence to discriminate between member types at runtime.
+     */
+    generateUnionResolvers() {
+        const documentName = getDocumentModelSchemaName(this.documentModel.documentModel.global);
+        const specification = this.documentModel.documentModel.global.specifications.at(-1);
+        if (!specification)
+            return {};
+        const globalSchema = specification.state.global.schema ?? "";
+        const localSchema = specification.state.local.schema ?? "";
+        const fullSchema = `${globalSchema}\n${localSchema}`;
+        if (!fullSchema.trim())
+            return {};
+        let ast;
+        try {
+            ast = parse(fullSchema);
+        }
+        catch {
+            return {};
+        }
+        // Build map: object type name -> field names
+        const objectFieldsMap = new Map();
+        for (const def of ast.definitions) {
+            if (def.kind === Kind.OBJECT_TYPE_DEFINITION) {
+                objectFieldsMap.set(def.name.value, def.fields?.map((f) => f.name.value) ?? []);
+            }
+        }
+        const resolvers = {};
+        for (const def of ast.definitions) {
+            if (def.kind !== Kind.UNION_TYPE_DEFINITION)
+                continue;
+            const unionName = def.name.value;
+            const memberTypes = def.types?.map((t) => t.name.value) ?? [];
+            if (memberTypes.length === 0)
+                continue;
+            // Compute unique fields per member type
+            const uniqueFields = {};
+            for (const memberType of memberTypes) {
+                const ownFields = objectFieldsMap.get(memberType) ?? [];
+                const otherFields = new Set(memberTypes
+                    .filter((t) => t !== memberType)
+                    .flatMap((t) => objectFieldsMap.get(t) ?? []));
+                uniqueFields[memberType] = ownFields.filter((f) => !otherFields.has(f));
+            }
+            const prefixedUnionName = `${documentName}_${unionName}`;
+            resolvers[prefixedUnionName] = {
+                __resolveType: (obj) => {
+                    for (const memberType of memberTypes) {
+                        const fields = uniqueFields[memberType] ?? [];
+                        if (fields.length > 0 && fields.some((f) => f in obj)) {
+                            return `${documentName}_${memberType}`;
                         }
-                        if (driveId) {
-                            const docIds = await reactor.getDocuments(driveId);
-                            if (!docIds.includes(docId)) {
-                                throw new Error(`Document with id ${docId} is not part of ${driveId}`);
+                    }
+                    return `${documentName}_${memberTypes[0]}`;
+                },
+            };
+        }
+        return resolvers;
+    }
+    /**
+     * Generate resolvers for this document model using reactorClient
+     * Uses flat queries (not nested) consistent with ReactorSubgraph patterns
+     */
+    generateResolvers() {
+        const documentType = this.documentModel.documentModel.global.id;
+        const documentName = getDocumentModelSchemaName(this.documentModel.documentModel.global);
+        const operations = this.documentModel.documentModel.global.specifications
+            .at(-1)
+            ?.modules.flatMap((module) => module.operations.filter((op) => op.name)) ?? [];
+        return {
+            ...this.generateUnionResolvers(),
+            Query: {
+                // Flat query: Get a specific document by identifier
+                // Uses shared documentResolver from reactor/resolvers.ts
+                [`${documentName}_document`]: async (_, args, ctx) => {
+                    const { identifier, view } = args;
+                    if (!identifier) {
+                        throw new GraphQLError("Document identifier is required");
+                    }
+                    // Use shared resolver function
+                    const result = await documentResolver(this.reactorClient, {
+                        identifier,
+                        view,
+                    });
+                    // Validate document type
+                    if (result.document.documentType !== documentType) {
+                        throw new GraphQLError(`Document with id ${identifier} is not of type ${documentType}`);
+                    }
+                    // Check permissions
+                    await this.assertCanRead(result.document.id, ctx);
+                    // Return shared resolver result directly (matches PHDocument format)
+                    return result;
+                },
+                // Flat query: Find documents by search criteria (type is built-in)
+                // Uses shared findDocumentsResolver from reactor/resolvers.ts
+                [`${documentName}_findDocuments`]: async (_, args, ctx) => {
+                    const { search, view, paging } = args;
+                    // Use shared resolver function with built-in type filter
+                    const result = await findDocumentsResolver(this.reactorClient, {
+                        search: {
+                            type: documentType, // Type is built-in for this document model subgraph
+                            parentId: search.parentId,
+                        },
+                        view,
+                        paging,
+                    });
+                    // Filter by permission if needed
+                    if (!this.hasGlobalReadAccess(ctx) &&
+                        this.documentPermissionService) {
+                        const filteredItems = [];
+                        for (const item of result.items) {
+                            const canRead = await this.canReadDocument(item.id, ctx);
+                            if (canRead) {
+                                filteredItems.push(item);
                             }
                         }
-                        const doc = await reactor.getDocument(docId);
-                        if (doc.header.documentType !== documentType) {
-                            throw new Error(`Document with id ${docId} is not of type ${documentType}`);
-                        }
                         return {
-                            driveId: driveId,
-                            ...buildGraphQlDocument(doc),
+                            ...result,
+                            items: filteredItems,
+                            totalCount: filteredItems.length,
                         };
-                    },
-                    getDocuments: async (args) => {
-                        const { driveId } = args;
-                        const docsIds = await reactor.getDocuments(driveId);
-                        const docs = await Promise.all(docsIds.map(async (docId) => {
-                            const doc = await reactor.getDocument(docId);
-                            return {
-                                driveId: driveId,
-                                ...buildGraphQlDocument(doc),
-                            };
-                        }));
-                        return docs.filter((doc) => doc.documentType === documentType);
-                    },
-                };
-            },
-        },
-        Mutation: {
-            [`${documentName}_createDocument`]: async (_, args) => {
-                const { driveId, name } = args;
-                const document = await reactor.addDocument(documentType);
-                if (driveId) {
-                    await reactor.addAction(driveId, addFile({
-                        name,
-                        id: document.header.id,
-                        documentType: documentType,
-                    }));
-                }
-                if (name) {
-                    await reactor.addAction(document.header.id, setName(name));
-                }
-                return document.header.id;
+                    }
+                    // Return shared resolver result directly (matches PHDocument format)
+                    return result;
+                },
+                // Flat query: Get children of a document (filtered by this document type)
+                // Uses shared documentChildrenResolver from reactor/resolvers.ts
+                [`${documentName}_documentChildren`]: async (_, args, ctx) => {
+                    const { parentIdentifier, view, paging } = args;
+                    await this.assertCanRead(parentIdentifier, ctx);
+                    // Use shared resolver function
+                    const result = await documentChildrenResolver(this.reactorClient, {
+                        parentIdentifier,
+                        view,
+                        paging,
+                    });
+                    // Filter children by this document type
+                    const filteredItems = result.items.filter((item) => item.documentType === documentType);
+                    return {
+                        ...result,
+                        items: filteredItems,
+                        totalCount: filteredItems.length,
+                    };
+                },
+                // Flat query: Get parents of a document
+                // Uses shared documentParentsResolver from reactor/resolvers.ts
+                [`${documentName}_documentParents`]: async (_, args, ctx) => {
+                    const { childIdentifier, view, paging } = args;
+                    await this.assertCanRead(childIdentifier, ctx);
+                    // Use shared resolver function - return directly
+                    return documentParentsResolver(this.reactorClient, {
+                        childIdentifier,
+                        view,
+                        paging,
+                    });
+                },
             },
-            ...operations.reduce((mutations, op) => {
-                mutations[`${documentName}_${camelCase(op.name)}`] = async (_, args) => {
-                    const { docId, input } = args;
-                    const doc = await reactor.getDocument(docId);
-                    if (!doc) {
-                        throw new Error("Document not found");
+            Mutation: {
+                // Uses shared createEmptyDocumentResolver from reactor/resolvers.ts
+                [`${documentName}_createDocument`]: async (_, args, ctx) => {
+                    const { parentIdentifier, name } = args;
+                    if (parentIdentifier) {
+                        await this.assertCanWrite(parentIdentifier, ctx);
+                    }
+                    else if (!this.hasGlobalWriteAccess(ctx)) {
+                        throw new GraphQLError("Forbidden: insufficient permissions to create documents");
                     }
-                    const action = documentModel.actions[camelCase(op.name)];
-                    if (!action) {
-                        throw new Error(`Action ${op.name} not found`);
+                    // Use shared resolver function - returns PHDocument format
+                    const createdDoc = await createEmptyDocumentResolver(this.reactorClient, {
+                        documentType,
+                        parentIdentifier,
+                    });
+                    if (name) {
+                        const updatedDoc = await this.reactorClient.execute(createdDoc.id, "main", [setName(name)]);
+                        // Use toGqlPhDocument for PHDocument format with revisionsList
+                        return toGqlPhDocument(updatedDoc);
                     }
-                    const result = await reactor.addAction(docId, action(input));
-                    if (result.status !== "SUCCESS") {
-                        throw new Error(result.error?.message ?? `Failed to ${op.name}`);
+                    // Return directly - already in PHDocument format
+                    return createdDoc;
+                },
+                // Uses shared createEmptyDocumentResolver from reactor/resolvers.ts
+                [`${documentName}_createEmptyDocument`]: async (_, args, ctx) => {
+                    const { parentIdentifier } = args;
+                    if (parentIdentifier) {
+                        await this.assertCanWrite(parentIdentifier, ctx);
                     }
-                    const errorOp = result.operations.find((op) => op.error);
-                    if (errorOp) {
-                        throw new Error(errorOp.error);
+                    else if (!this.hasGlobalWriteAccess(ctx)) {
+                        throw new GraphQLError("Forbidden: insufficient permissions to create documents");
                     }
-                    return result.operations.at(-1)?.index ?? -1;
-                };
-                return mutations;
-            }, {}),
-        },
-    };
+                    // Use shared resolver function - returns PHDocument format directly
+                    return createEmptyDocumentResolver(this.reactorClient, {
+                        documentType,
+                        parentIdentifier,
+                    });
+                },
+                // Generate sync and async mutations for each operation
+                ...operations.reduce((mutations, op) => {
+                    // Sync mutation
+                    mutations[`${documentName}_${camelCase(op.name)}`] = async (_, args, ctx) => {
+                        const { docId, input } = args;
+                        await this.assertCanWrite(docId, ctx);
+                        await this.assertCanExecuteOperation(docId, op.name, ctx);
+                        const doc = await this.reactorClient.get(docId);
+                        if (doc.header.documentType !== documentType) {
+                            throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
+                        }
+                        const action = this.documentModel.actions[camelCase(op.name)];
+                        if (!action) {
+                            throw new GraphQLError(`Action ${op.name} not found`);
+                        }
+                        try {
+                            const updatedDoc = await this.reactorClient.execute(docId, "main", [action(input)]);
+                            // Use toGqlPhDocument for PHDocument format with revisionsList
+                            return toGqlPhDocument(updatedDoc);
+                        }
+                        catch (error) {
+                            throw new GraphQLError(error instanceof Error
+                                ? error.message
+                                : `Failed to ${op.name}`);
+                        }
+                    };
+                    // Async mutation - returns job ID
+                    mutations[`${documentName}_${camelCase(op.name)}Async`] = async (_, args, ctx) => {
+                        const { docId, input } = args;
+                        await this.assertCanWrite(docId, ctx);
+                        await this.assertCanExecuteOperation(docId, op.name, ctx);
+                        const doc = await this.reactorClient.get(docId);
+                        if (doc.header.documentType !== documentType) {
+                            throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
+                        }
+                        const action = this.documentModel.actions[camelCase(op.name)];
+                        if (!action) {
+                            throw new GraphQLError(`Action ${op.name} not found`);
+                        }
+                        try {
+                            const jobInfo = await this.reactorClient.executeAsync(docId, "main", [action(input)]);
+                            return jobInfo.id;
+                        }
+                        catch (error) {
+                            throw new GraphQLError(error instanceof Error
+                                ? error.message
+                                : `Failed to ${op.name}`);
+                        }
+                    };
+                    return mutations;
+                }, {}),
+            },
+        };
+    }
 }
+/**
+ * @deprecated Use `DocumentModelSubgraph` instead. This class uses the legacy `reactor` (IDocumentDriveServer)
+ * interface. The new `DocumentModelSubgraph` class uses `reactorClient` (IReactorClient) which provides
+ * better patterns and more capabilities. Enable via `useNewDocumentModelSubgraph: true` in GraphQLManager.
+ */
 export class DocumentModelSubgraphLegacy extends BaseSubgraph {
     documentModel;
     constructor(documentModel, args) {
         super(args);
         this.documentModel = documentModel;
         this.name = kebabCase(documentModel.documentModel.global.name);
-        this.typeDefs = generateDocumentModelSchemaLegacy(this.documentModel.documentModel.global);
-        this.resolvers = generateDocumentModelResolversLegacy(this.documentModel, args.reactor);
+        this.typeDefs = generateDocumentModelSchema(this.documentModel.documentModel.global);
+        this.resolvers = this.generateResolvers();
+    }
+    /**
+     * Check if user has global read access (admin, user, or guest)
+     */
+    hasGlobalReadAccess(ctx) {
+        const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "");
+        const isGlobalUser = ctx.isUser?.(ctx.user?.address ?? "");
+        const isGlobalGuest = ctx.isGuest?.(ctx.user?.address ?? "") ||
+            process.env.FREE_ENTRY === "true";
+        return !!(isGlobalAdmin || isGlobalUser || isGlobalGuest);
+    }
+    /**
+     * Check if user has global write access (admin or user, not guest)
+     */
+    hasGlobalWriteAccess(ctx) {
+        const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "");
+        const isGlobalUser = ctx.isUser?.(ctx.user?.address ?? "");
+        return !!(isGlobalAdmin || isGlobalUser);
+    }
+    /**
+     * Get the parent IDs function for hierarchical permission checks
+     */
+    getParentIdsFn() {
+        return async (documentId) => {
+            try {
+                const result = await this.reactorClient.getParents(documentId);
+                return result.results.map((doc) => doc.header.id);
+            }
+            catch {
+                return [];
+            }
+        };
+    }
+    /**
+     * Check if user can read a document (with hierarchy)
+     */
+    async canReadDocument(documentId, ctx) {
+        // Global access allows reading
+        if (this.hasGlobalReadAccess(ctx)) {
+            return true;
+        }
+        // Check document-level permissions with hierarchy
+        if (this.documentPermissionService) {
+            return this.documentPermissionService.canRead(documentId, ctx.user?.address, this.getParentIdsFn());
+        }
+        return false;
+    }
+    /**
+     * Check if user can write to a document (with hierarchy)
+     */
+    async canWriteDocument(documentId, ctx) {
+        // Global write access allows writing
+        if (this.hasGlobalWriteAccess(ctx)) {
+            return true;
+        }
+        // Check document-level permissions with hierarchy
+        if (this.documentPermissionService) {
+            return this.documentPermissionService.canWrite(documentId, ctx.user?.address, this.getParentIdsFn());
+        }
+        return false;
+    }
+    /**
+     * Throw an error if user cannot read the document
+     */
+    async assertCanRead(documentId, ctx) {
+        const canRead = await this.canReadDocument(documentId, ctx);
+        if (!canRead) {
+            throw new GraphQLError("Forbidden: insufficient permissions to read this document");
+        }
+    }
+    /**
+     * Throw an error if user cannot write to the document
+     */
+    async assertCanWrite(documentId, ctx) {
+        const canWrite = await this.canWriteDocument(documentId, ctx);
+        if (!canWrite) {
+            throw new GraphQLError("Forbidden: insufficient permissions to write to this document");
+        }
+    }
+    /**
+     * Check if user can execute a specific operation on a document.
+     * Throws an error if the operation is restricted and user lacks permission.
+     */
+    async assertCanExecuteOperation(documentId, operationType, ctx) {
+        // Skip if no permission service
+        if (!this.documentPermissionService) {
+            return;
+        }
+        // Global admins bypass operation-level restrictions
+        if (ctx.isAdmin?.(ctx.user?.address ?? "")) {
+            return;
+        }
+        // Check if this operation has any restrictions set
+        const isRestricted = await this.documentPermissionService.isOperationRestricted(documentId, operationType);
+        if (isRestricted) {
+            // Operation is restricted, check if user has permission
+            const canExecute = await this.documentPermissionService.canExecuteOperation(documentId, operationType, ctx.user?.address);
+            if (!canExecute) {
+                throw new GraphQLError(`Forbidden: insufficient permissions to execute operation "${operationType}" on this document`);
+            }
+        }
+    }
+    /**
+     * Generate resolvers for this document model with permission checks
+     */
+    generateResolvers() {
+        const documentType = this.documentModel.documentModel.global.id;
+        const documentName = getDocumentModelSchemaName(this.documentModel.documentModel.global);
+        const operations = this.documentModel.documentModel.global.specifications
+            .at(-1)
+            ?.modules.flatMap((module) => module.operations.filter((op) => op.name)) ?? [];
+        return {
+            Query: {
+                [documentName]: (_, __, ctx) => {
+                    return {
+                        getDocument: async (args) => {
+                            const { docId, driveId } = args;
+                            if (!docId) {
+                                throw new Error("Document id is required");
+                            }
+                            // Check read permission before accessing document
+                            await this.assertCanRead(docId, ctx);
+                            if (driveId) {
+                                const docIds = await this.reactor.getDocuments(driveId);
+                                if (!docIds.includes(docId)) {
+                                    throw new Error(`Document with id ${docId} is not part of ${driveId}`);
+                                }
+                            }
+                            const doc = await this.reactor.getDocument(docId);
+                            if (doc.header.documentType !== documentType) {
+                                throw new Error(`Document with id ${docId} is not of type ${documentType}`);
+                            }
+                            return {
+                                driveId: driveId,
+                                ...buildGraphQlDocument(doc),
+                            };
+                        },
+                        getDocuments: async (args) => {
+                            const { driveId } = args;
+                            // Check read permission on drive before listing documents
+                            await this.assertCanRead(driveId, ctx);
+                            const docsIds = await this.reactor.getDocuments(driveId);
+                            const docs = await Promise.all(docsIds.map(async (docId) => {
+                                const doc = await this.reactor.getDocument(docId);
+                                return {
+                                    driveId: driveId,
+                                    ...buildGraphQlDocument(doc),
+                                };
+                            }));
+                            const filteredByType = docs.filter((doc) => doc.documentType === documentType);
+                            // If user doesn't have global read access, filter by document-level permissions
+                            if (!this.hasGlobalReadAccess(ctx) &&
+                                this.documentPermissionService) {
+                                const filteredDocs = [];
+                                for (const doc of filteredByType) {
+                                    const canRead = await this.canReadDocument(doc.id, ctx);
+                                    if (canRead) {
+                                        filteredDocs.push(doc);
+                                    }
+                                }
+                                return filteredDocs;
+                            }
+                            return filteredByType;
+                        },
+                    };
+                },
+            },
+            Mutation: {
+                [`${documentName}_createDocument`]: async (_, args, ctx) => {
+                    const { driveId, name } = args;
+                    // If creating under a drive, check write permission on drive
+                    if (driveId) {
+                        await this.assertCanWrite(driveId, ctx);
+                    }
+                    else if (!this.hasGlobalWriteAccess(ctx)) {
+                        throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+                    }
+                    const document = await this.reactor.addDocument(documentType);
+                    if (driveId) {
+                        await this.reactor.addAction(driveId, addFile({
+                            name,
+                            id: document.header.id,
+                            documentType: documentType,
+                        }));
+                    }
+                    if (name) {
+                        await this.reactor.addAction(document.header.id, setName(name));
+                    }
+                    return document.header.id;
+                },
+                ...operations.reduce((mutations, op) => {
+                    mutations[`${documentName}_${camelCase(op.name)}`] = async (_, args, ctx) => {
+                        const { docId, input } = args;
+                        // Check write permission before mutating document
+                        await this.assertCanWrite(docId, ctx);
+                        // Check operation-level permissions
+                        await this.assertCanExecuteOperation(docId, op.name, ctx);
+                        const doc = await this.reactor.getDocument(docId);
+                        if (!doc) {
+                            throw new Error("Document not found");
+                        }
+                        const action = this.documentModel.actions[camelCase(op.name)];
+                        if (!action) {
+                            throw new Error(`Action ${op.name} not found`);
+                        }
+                        const result = await this.reactor.addAction(docId, action(input));
+                        if (result.status !== "SUCCESS") {
+                            throw new Error(result.error?.message ?? `Failed to ${op.name}`);
+                        }
+                        const errorOp = result.operations.find((op) => op.error);
+                        if (errorOp) {
+                            throw new Error(errorOp.error);
+                        }
+                        return result.operations.at(-1)?.index ?? -1;
+                    };
+                    return mutations;
+                }, {}),
+            },
+        };
     }
 }
 //# sourceMappingURL=document-model-subgraph.js.map