@powerhousedao/reactor-api 6.2.0-dev.2 → 6.2.0-dev.20

package/dist/index.mjs

@@ -1,6 +1,6 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="30eaf1c5-796a-5cab-8266-cfe233f9e901")}catch(e){}}();
-import { a as isSubgraphClass, c as loadDocumentModels, d as BaseSubgraph, i as buildGraphqlOperations, l as loadProcessors, n as buildGraphQlDriveDocument, o as debounce, r as buildGraphqlOperation, t as buildGraphQlDocument, u as loadSubgraphs } from "./utils-BFkbSO_H.mjs";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cae89b22-c317-5acb-b1ec-dc325f23f6cf")}catch(e){}}();
+import { a as isSubgraphClass, c as loadDocumentModels, d as BaseSubgraph, f as AuthorizationPolicy, i as buildGraphqlOperations, l as loadProcessors, m as createAuthorizationService, n as buildGraphQlDriveDocument, o as debounce, p as AuthorizedDocumentHandle, r as buildGraphqlOperation, t as buildGraphQlDocument, u as loadSubgraphs } from "./utils-Dh9tl892.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
@@ -8,13 +8,12 @@ import { GraphQLError, Kind, parse, print } from "graphql";
 import { ConsoleLogger, childLogger, documentModelDocumentModelModule } from "document-model";
 import path from "node:path";
 import { match } from "path-to-regexp";
-import { verifyAuthBearerToken } from "@renown/sdk";
 import { buildSubgraphSchema } from "@apollo/subgraph";
 import { typeDefs } from "@powerhousedao/document-engineering/graphql";
 import { camelCase, kebabCase, pascalCase } from "change-case";
 import { GraphQLJSONObject } from "graphql-type-json";
 import { setName } from "@powerhousedao/shared/document-model";
-import { DEFAULT_DRIVE_CONTAINER_TYPES, PropagationMode as PropagationMode$1, consolidateSyncOperations, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl } from "@powerhousedao/reactor";
+import { DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, PropagationMode as PropagationMode$1, consolidateSyncOperations, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl } from "@powerhousedao/reactor";
 import * as z$1 from "zod";
 import { z } from "zod";
 import { createHandler } from "graphql-sse/lib/use/fetch";
@@ -35,6 +34,7 @@ import { tmpdir } from "node:os";
 import { WebSocketServer } from "ws";
 import { createRelationalDb } from "@powerhousedao/shared/processors";
 import { Kysely, Migrator, sql } from "kysely";
+import { verifyAuthBearerToken } from "@renown/sdk";
 import { PGlite } from "@electric-sql/pglite";
 import { AtomicNodeFs } from "@powerhousedao/pglite-fs";
 import knex from "knex";
@@ -85,18 +85,14 @@ async function documentAccess(service, args) {
 async function userDocumentPermissions(service, userAddress) {
 	return service.getUserDocuments(userAddress);
 }
-async function grantDocumentPermission(service, args, grantedByAddress, isGlobalAdmin) {
+async function grantDocumentPermission(service, authorizationService, args, grantedByAddress) {
 	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant permissions");
 	return service.grantPermission(args.documentId, args.userAddress, args.permission, grantedByAddress);
 }
-async function revokeDocumentPermission(service, args, revokedByAddress, isGlobalAdmin) {
+async function revokeDocumentPermission(service, authorizationService, args, revokedByAddress) {
 	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke permissions");
 	await service.revokePermission(args.documentId, args.userAddress);
 	return true;
 }
@@ -127,18 +123,14 @@ async function removeUserFromGroup(service, args) {
 async function getGroupMembers(service, groupId) {
 	return service.getGroupMembers(groupId);
 }
-async function grantGroupPermission(service, args, grantedByAddress, isGlobalAdmin) {
+async function grantGroupPermission(service, authorizationService, args, grantedByAddress) {
 	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant permissions");
 	return service.grantGroupPermission(args.documentId, args.groupId, args.permission, grantedByAddress);
 }
-async function revokeGroupPermission(service, args, revokedByAddress, isGlobalAdmin) {
+async function revokeGroupPermission(service, authorizationService, args, revokedByAddress) {
 	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke permissions");
 	await service.revokeGroupPermission(args.documentId, args.groupId);
 	return true;
 }
@@ -152,59 +144,43 @@ async function operationPermissions(service, args) {
 		groupPermissions
 	};
 }
-async function canExecuteOperation(service, args, userAddress) {
-	return service.canExecuteOperation(args.documentId, args.operationType, userAddress);
+async function canExecuteOperation(authorizationService, args, userAddress) {
+	return authorizationService.canMutate(args.documentId, args.operationType, userAddress);
 }
-async function grantOperationPermission(service, args, grantedByAddress, isGlobalAdmin) {
+async function grantOperationPermission(service, authorizationService, args, grantedByAddress) {
 	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant operation permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant operation permissions");
 	return service.grantOperationPermission(args.documentId, args.operationType, args.userAddress, grantedByAddress);
 }
-async function revokeOperationPermission(service, args, revokedByAddress, isGlobalAdmin) {
+async function revokeOperationPermission(service, authorizationService, args, revokedByAddress) {
 	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke operation permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke operation permissions");
 	await service.revokeOperationPermission(args.documentId, args.operationType, args.userAddress);
 	return true;
 }
-async function grantGroupOperationPermission(service, args, grantedByAddress, isGlobalAdmin) {
+async function grantGroupOperationPermission(service, authorizationService, args, grantedByAddress) {
 	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant operation permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant operation permissions");
 	return service.grantGroupOperationPermission(args.documentId, args.operationType, args.groupId, grantedByAddress);
 }
-async function revokeGroupOperationPermission(service, args, revokedByAddress, isGlobalAdmin) {
+async function revokeGroupOperationPermission(service, authorizationService, args, revokedByAddress) {
 	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke operation permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke operation permissions");
 	await service.revokeGroupOperationPermission(args.documentId, args.operationType, args.groupId);
 	return true;
 }
 async function documentProtection(service, args) {
 	return service.getDocumentProtection(args.documentId);
 }
-async function setDocumentProtection(service, authorizationService, args, userAddress, isGlobalAdmin) {
+async function setDocumentProtection(service, authorizationService, args, userAddress) {
 	if (!userAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (authorizationService) {
-			if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to change protection");
-		} else if (!await service.canManageDocument(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to change protection");
-	}
+	if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to change protection");
 	await service.setDocumentProtection(args.documentId, args.protected);
 	return service.getDocumentProtection(args.documentId);
 }
-async function transferDocumentOwnership(service, authorizationService, args, userAddress, isGlobalAdmin) {
+async function transferDocumentOwnership(service, authorizationService, args, userAddress) {
 	if (!userAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (authorizationService) {
-			if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to transfer ownership");
-		} else if (!await service.canManageDocument(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to transfer ownership");
-	}
+	if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to transfer ownership");
 	const previousOwner = await service.getDocumentOwner(args.documentId);
 	if (previousOwner) await service.revokePermission(args.documentId, previousOwner);
 	await service.setDocumentOwner(args.documentId, args.newOwnerAddress);
@@ -297,9 +273,8 @@ var AuthSubgraph = class extends BaseSubgraph {
 			},
 			canExecuteOperation: async (_parent, args, ctx) => {
 				this.logger.debug("canExecuteOperation(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					return await canExecuteOperation(this.documentPermissionService, args, ctx.user?.address);
+					return await canExecuteOperation(this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in canExecuteOperation: @error", error);
 					throw error;
@@ -322,8 +297,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("setDocumentProtection(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await setDocumentProtection(this.documentPermissionService, this.authorizationService, args, ctx.user?.address, isGlobalAdmin);
+					return await setDocumentProtection(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in setDocumentProtection: @error", error);
 					throw error;
@@ -333,8 +307,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("transferDocumentOwnership(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await transferDocumentOwnership(this.documentPermissionService, this.authorizationService, args, ctx.user?.address, isGlobalAdmin);
+					return await transferDocumentOwnership(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in transferDocumentOwnership: @error", error);
 					throw error;
@@ -344,8 +317,11 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("grantDocumentPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await grantDocumentPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					const resolved = await this.withCanonicalDocumentId(args, ctx);
+					return await grantDocumentPermission(this.documentPermissionService, this.authorizationService, {
+						...resolved,
+						permission: resolved.permission
+					}, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in grantDocumentPermission: @error", error);
 					throw error;
@@ -355,8 +331,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("revokeDocumentPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await revokeDocumentPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await revokeDocumentPermission(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in revokeDocumentPermission: @error", error);
 					throw error;
@@ -406,8 +381,11 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("grantGroupPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await grantGroupPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					const resolved = await this.withCanonicalDocumentId(args, ctx);
+					return await grantGroupPermission(this.documentPermissionService, this.authorizationService, {
+						...resolved,
+						permission: resolved.permission
+					}, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in grantGroupPermission: @error", error);
 					throw error;
@@ -417,8 +395,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("revokeGroupPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await revokeGroupPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await revokeGroupPermission(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in revokeGroupPermission: @error", error);
 					throw error;
@@ -428,8 +405,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("grantOperationPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await grantOperationPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await grantOperationPermission(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in grantOperationPermission: @error", error);
 					throw error;
@@ -439,8 +415,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("revokeOperationPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await revokeOperationPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await revokeOperationPermission(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in revokeOperationPermission: @error", error);
 					throw error;
@@ -450,8 +425,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("grantGroupOperationPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await grantGroupOperationPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await grantGroupOperationPermission(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in grantGroupOperationPermission: @error", error);
 					throw error;
@@ -461,8 +435,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("revokeGroupOperationPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await revokeGroupOperationPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await revokeGroupOperationPermission(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in revokeGroupOperationPermission: @error", error);
 					throw error;
@@ -533,133 +506,6 @@ async function createHttpAdapter(type) {
 	}
 }
 //#endregion
-//#region src/services/auth.service.ts
-var AuthService = class {
-	config;
-	constructor(config) {
-		this.config = config;
-	}
-	async authenticateRequest(request) {
-		if (!this.config.enabled) return {
-			user: void 0,
-			admins: [],
-			auth_enabled: false
-		};
-		const method = request.method;
-		if (method === "OPTIONS" || method === "GET") return {
-			user: void 0,
-			admins: this.config.admins,
-			auth_enabled: true
-		};
-		return this.verifyBearer(request.headers.get("authorization") ?? void 0);
-	}
-	/**
-	* Verify a Bearer token regardless of HTTP method. Use this from non-GraphQL
-	* middleware that must enforce authentication on every request.
-	*/
-	async verifyBearer(authorization) {
-		if (!this.config.enabled) return {
-			user: void 0,
-			admins: [],
-			auth_enabled: false
-		};
-		const token = authorization?.split(" ")[1];
-		if (!token) return {
-			user: void 0,
-			admins: this.config.admins,
-			auth_enabled: true
-		};
-		try {
-			const verified = await this.verifyToken(token);
-			if (!verified) return new Response(JSON.stringify({ error: "Verification failed" }), { status: 401 });
-			const user = this.extractUserFromVerification(verified);
-			if (!user) return new Response(JSON.stringify({ error: "Missing credentials" }), { status: 401 });
-			if (!this.config.skipCredentialVerification) {
-				if (!await this.verifyCredentialExists(user.address, user.chainId, verified.issuer)) return new Response(JSON.stringify({ error: "Credentials no longer valid" }), { status: 401 });
-			}
-			return {
-				user,
-				admins: this.config.admins,
-				auth_enabled: true
-			};
-		} catch {
-			return new Response(JSON.stringify({ error: "Authentication failed" }), { status: 401 });
-		}
-	}
-	async authenticateWebSocketConnection(connectionParams) {
-		if (!this.config.enabled) return null;
-		const authHeader = connectionParams.authorization;
-		if (!authHeader) throw new Error("Missing authorization in connection parameters");
-		const token = authHeader.split(" ")[1];
-		if (!token) throw new Error("Invalid authorization format");
-		const verified = await this.verifyToken(token);
-		if (!verified) throw new Error("Token verification failed");
-		const user = this.extractUserFromVerification(verified);
-		if (!user) throw new Error("Invalid credentials");
-		if (!this.config.skipCredentialVerification) {
-			if (!await this.verifyCredentialExists(user.address, user.chainId, verified.issuer)) throw new Error("Credentials no longer valid");
-		}
-		return user;
-	}
-	/**
-	* Verify the auth bearer token
-	*/
-	async verifyToken(token) {
-		return await verifyAuthBearerToken(token);
-	}
-	/**
-	* Extract user information from verification result
-	*/
-	extractUserFromVerification(verified) {
-		try {
-			const { address, chainId, networkId } = verified.verifiableCredential.credentialSubject;
-			if (!address || !chainId || !networkId) return null;
-			return {
-				address,
-				chainId,
-				networkId
-			};
-		} catch {
-			return null;
-		}
-	}
-	/**
-	* Get additional context fields for GraphQL
-	*/
-	getAdditionalContextFields() {
-		if (!this.config.enabled) return { isAdmin: () => true };
-		return { isAdmin: (address) => this.config.enabled && this.config.admins?.includes(address.toLowerCase()) };
-	}
-	/**
-	* Get user context for GraphQL
-	*/
-	getUserContext(user) {
-		if (!user) return {};
-		return { user: {
-			address: user.address.toLowerCase(),
-			chainId: user.chainId,
-			networkId: user.networkId
-		} };
-	}
-	/**
-	* Verify that the credential still exists on the Renown API
-	*/
-	async verifyCredentialExists(address, chainId, appId) {
-		const url = `https://www.renown.id/api/auth/credential?address=${address}&chainId=${chainId}&connectId=${appId}&appId=${appId}`;
-		try {
-			const response = await fetch(url, { method: "GET" });
-			const credential = (await response.json()).credential;
-			const appIdVerfied = credential.credentialSubject.id;
-			const addressVerfied = credential.issuer.id.split(":")[4];
-			const chainIdVerfied = credential.issuer.id.split(":")[3];
-			if (response.status !== 200) return false;
-			return appIdVerfied === appId && addressVerfied.toLocaleLowerCase() === address.toLocaleLowerCase() && chainIdVerfied === chainId.toString();
-		} catch {
-			return false;
-		}
-	}
-};
-//#endregion
 //#region src/utils/create-schema.ts
 const logger = childLogger(["reactor-api", "create-schema"]);
 /**
@@ -1246,7 +1092,6 @@ function ActionContextInputSchema() {
 }
 function ActionInputSchema() {
 	return z$1.object({
-		attachments: z$1.array(z$1.lazy(() => AttachmentInputSchema())).nullish(),
 		context: z$1.lazy(() => ActionContextInputSchema().nullish()),
 		id: z$1.string(),
 		input: z$1.custom((v) => v != null),
@@ -1255,15 +1100,6 @@ function ActionInputSchema() {
 		type: z$1.string()
 	});
 }
-function AttachmentInputSchema() {
-	return z$1.object({
-		data: z$1.string(),
-		extension: z$1.string().nullish(),
-		fileName: z$1.string().nullish(),
-		hash: z$1.string(),
-		mimeType: z$1.string()
-	});
-}
 function ChannelMetaInputSchema() {
 	return z$1.object({ id: z$1.string() });
 }
@@ -1454,13 +1290,6 @@ const GetDocumentWithOperationsDocument = gql`
               timestampUtcMs
               input
               scope
-              attachments {
-                data
-                mimeType
-                hash
-                extension
-                fileName
-              }
               context {
                 signer {
                   user {
@@ -1573,13 +1402,6 @@ const GetDocumentOperationsDocument = gql`
           timestampUtcMs
           input
           scope
-          attachments {
-            data
-            mimeType
-            hash
-            extension
-            fileName
-          }
           context {
             signer {
               user {
@@ -1830,13 +1652,6 @@ const PollSyncEnvelopesDocument = gql`
               timestampUtcMs
               input
               scope
-              attachments {
-                data
-                mimeType
-                hash
-                extension
-                fileName
-              }
               context {
                 signer {
                   user {
@@ -2153,6 +1968,17 @@ function toGqlDocumentChangeEvent(event) {
 		} : null
 	};
 }
+/**
+* Distinct document ids a change event references: affected documents plus the
+* parent/child ids in `context` (delete/relationship events carry only context).
+*/
+function collectChangedDocumentIds(event) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const doc of event.documents) if (doc.header.id) ids.add(doc.header.id);
+	if (event.context?.parentId) ids.add(event.context.parentId);
+	if (event.context?.childId) ids.add(event.context.childId);
+	return [...ids];
+}
 function matchesSearchFilter(event, search) {
 	if (search.type) {
 		if (!event.documents.some((doc) => doc.header.documentType === search.type)) return false;
@@ -2624,7 +2450,7 @@ async function touchChannel(syncManager, args) {
 	};
 	const options = { sinceTimestampUtcMs: args.input.sinceTimestampUtcMs };
 	try {
-		await syncManager.add(args.input.name, args.input.collectionId, {
+		await syncManager.add(args.input.name, DriveCollectionId.fromKey(args.input.collectionId), {
 			type: "polling",
 			parameters: {}
 		}, filter, options, args.input.id);
@@ -2647,14 +2473,14 @@ async function touchChannel(syncManager, args) {
 *   client ordinal the switchboard has successfully applied, so the client
 *   can trim its own outbox)
 */
-function pollSyncEnvelopes(syncManager, args) {
+function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new Set()) {
 	let remote;
 	try {
 		remote = syncManager.getById(args.channelId);
 	} catch (error) {
 		throw new GraphQLError(`Channel not found: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
-	const deadLetters = remote.channel.deadLetter.items.map((syncOp) => ({
+	const deadLetters = remote.channel.deadLetter.items.filter((syncOp) => !forbiddenIds.has(syncOp.documentId)).map((syncOp) => ({
 		documentId: syncOp.documentId,
 		error: syncOp.error?.message ?? "Unknown error",
 		jobId: syncOp.jobId,
@@ -2678,6 +2504,12 @@ function pollSyncEnvelopes(syncManager, args) {
 		}
 	}
 	const operations = remote.channel.outbox.items;
+	if (forbiddenIds.size > 0) {
+		for (const syncOp of operations) if (forbiddenIds.has(syncOp.documentId)) {
+			syncOp.deliveredCount = syncOp.operations.length;
+			syncOp.emittedCount = syncOp.operations.length;
+		}
+	}
 	if (operations.length === 0) return {
 		envelopes: [],
 		ackOrdinal: remote.channel.inbox.ackOrdinal,
@@ -2869,7 +2701,7 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						view
 					});
 					if (result.document.documentType !== documentType) throw new GraphQLError(`Document with id ${identifier} is not of type ${documentType}`);
-					await this.assertCanRead(result.document.id, ctx);
+					await this.assertCanReadCanonical(result.document.id, ctx);
 					return result;
 				},
 				documents: async (_, args, ctx) => {
@@ -2878,7 +2710,7 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						search: { type: documentType },
 						paging
 					});
-					if (!this.hasGlobalAdminAccess(ctx) && this.documentPermissionService) {
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
 						return {
@@ -2899,7 +2731,7 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						view,
 						paging
 					});
-					if (!this.hasGlobalAdminAccess(ctx) && this.documentPermissionService) {
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
 						return {
@@ -2911,10 +2743,10 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 					return result;
 				},
 				documentOutgoingRelationships: async (_, args, ctx) => {
-					const { sourceIdentifier, relationshipType, view, paging } = args;
-					await this.assertCanRead(sourceIdentifier, ctx);
+					const { relationshipType, view, paging } = args;
+					const handle = await this.assertCanRead(args.sourceIdentifier, ctx);
 					const result = await documentOutgoingRelationships(this.reactorClient, {
-						sourceIdentifier,
+						sourceIdentifier: handle.fetchIdentifier,
 						relationshipType,
 						view,
 						paging
@@ -2927,10 +2759,10 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 					};
 				},
 				documentIncomingRelationships: async (_, args, ctx) => {
-					const { targetIdentifier, relationshipType, view, paging } = args;
-					await this.assertCanRead(targetIdentifier, ctx);
+					const { relationshipType, view, paging } = args;
+					const handle = await this.assertCanRead(args.targetIdentifier, ctx);
 					return documentIncomingRelationships(this.reactorClient, {
-						targetIdentifier,
+						targetIdentifier: handle.fetchIdentifier,
 						relationshipType,
 						view,
 						paging
@@ -2940,11 +2772,10 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 			Mutation: { [documentName]: () => ({}) },
 			[`${documentName}Mutations`]: {
 				createDocument: async (_, args, ctx) => {
-					const { parentIdentifier, name, slug, preferredEditor, initialState } = args;
-					if (parentIdentifier) await this.assertCanWrite(parentIdentifier, ctx);
-					else if (this.authorizationService) {
-						if (!ctx.user?.address) throw new GraphQLError("Forbidden: authentication required to create documents");
-					} else if (!this.hasGlobalAdminAccess(ctx)) throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+					const { name, slug, preferredEditor, initialState } = args;
+					let parentIdentifier = args.parentIdentifier;
+					if (parentIdentifier) parentIdentifier = (await this.assertCanWrite(parentIdentifier, ctx)).fetchIdentifier;
+					else this.assertCanCreate(ctx);
 					let createdDoc;
 					if (initialState || preferredEditor) createdDoc = await createDocumentWithInitialState(this.reactorClient, {
 						documentType,
@@ -2959,46 +2790,42 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						parentIdentifier,
 						name
 					}, this.graphqlManager.reactorDriveClient);
-					if (this.authorizationService && ctx.user?.address && createdDoc?.id) await this.documentPermissionService?.initializeDocumentProtection(createdDoc.id, ctx.user.address, this.authorizationService.config.defaultProtection);
+					if (ctx.user?.address && createdDoc?.id) await this.documentPermissionService?.initializeDocumentProtection(createdDoc.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					if (!initialState && !preferredEditor && name && createdDoc.name !== name) return toGqlPhDocument(await this.reactorClient.execute(createdDoc.id, "main", [setName(name)]));
 					return createdDoc;
 				},
 				createEmptyDocument: async (_, args, ctx) => {
-					const { parentIdentifier } = args;
-					if (parentIdentifier) await this.assertCanWrite(parentIdentifier, ctx);
-					else if (this.authorizationService) {
-						if (!ctx.user?.address) throw new GraphQLError("Forbidden: authentication required to create documents");
-					} else if (!this.hasGlobalAdminAccess(ctx)) throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+					let parentIdentifier = args.parentIdentifier;
+					if (parentIdentifier) parentIdentifier = (await this.assertCanWrite(parentIdentifier, ctx)).fetchIdentifier;
+					else this.assertCanCreate(ctx);
 					const result = await createEmptyDocument(this.reactorClient, {
 						documentType,
 						parentIdentifier
 					}, this.graphqlManager.reactorDriveClient);
-					if (this.authorizationService && ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
+					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
 				},
 				...operations.reduce((mutations, op) => {
 					mutations[camelCase(op.name)] = async (_, args, ctx) => {
 						const { docId, input } = args;
-						if (!this.authorizationService) await this.assertCanWrite(docId, ctx);
-						await this.assertCanExecuteOperation(docId, op.name, ctx);
-						if ((await this.reactorClient.get(docId)).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
+						const effectiveDocId = (await this.assertCanExecuteOperation(docId, op.name, ctx)).fetchIdentifier;
+						if ((await this.reactorClient.get(effectiveDocId)).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
 						const action = this.documentModel.actions[camelCase(op.name)];
 						if (!action) throw new GraphQLError(`Action ${op.name} not found`);
 						try {
-							return toGqlPhDocument(await this.reactorClient.execute(docId, "main", [action(input)]));
+							return toGqlPhDocument(await this.reactorClient.execute(effectiveDocId, "main", [action(input)]));
 						} catch (error) {
 							throw new GraphQLError(error instanceof Error ? error.message : `Failed to ${op.name}`);
 						}
 					};
 					mutations[`${camelCase(op.name)}Async`] = async (_, args, ctx) => {
 						const { docId, input } = args;
-						if (!this.authorizationService) await this.assertCanWrite(docId, ctx);
-						await this.assertCanExecuteOperation(docId, op.name, ctx);
-						if ((await this.reactorClient.get(docId)).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
+						const effectiveDocId = (await this.assertCanExecuteOperation(docId, op.name, ctx)).fetchIdentifier;
+						if ((await this.reactorClient.get(effectiveDocId)).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
 						const action = this.documentModel.actions[camelCase(op.name)];
 						if (!action) throw new GraphQLError(`Action ${op.name} not found`);
 						try {
-							return (await this.reactorClient.executeAsync(docId, "main", [action(input)])).id;
+							return (await this.reactorClient.executeAsync(effectiveDocId, "main", [action(input)])).id;
 						} catch (error) {
 							throw new GraphQLError(error instanceof Error ? error.message : `Failed to ${op.name}`);
 						}
@@ -3177,7 +3004,6 @@ var GraphQLManager = class {
 	coreSubgraphsMap = /* @__PURE__ */ new Map();
 	contextFields = {};
 	subgraphs = /* @__PURE__ */ new Map();
-	authService = null;
 	subgraphWsDisposers = /* @__PURE__ */ new Map();
 	#authMiddleware;
 	#driveMiddleware;
@@ -3191,7 +3017,8 @@ var GraphQLManager = class {
 	* it for reactor-drive parents.
 	*/
 	reactorDriveClient;
-	constructor(path, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, logger, httpAdapter, gatewayAdapter, authConfig, documentPermissionService, featureFlags = DefaultFeatureFlags, port = 4001, authorizationService, reactorDriveClient) {
+	authorizationService;
+	constructor(path, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, logger, httpAdapter, gatewayAdapter, authService, documentPermissionService, featureFlags = DefaultFeatureFlags, port = 4001, authorizationService, reactorDriveClient) {
 		this.path = path;
 		this.httpServer = httpServer;
 		this.wsServer = wsServer;
@@ -3202,13 +3029,13 @@ var GraphQLManager = class {
 		this.logger = logger;
 		this.httpAdapter = httpAdapter;
 		this.gatewayAdapter = gatewayAdapter;
-		this.authConfig = authConfig;
+		this.authService = authService;
 		this.documentPermissionService = documentPermissionService;
 		this.featureFlags = featureFlags;
 		this.port = port;
+		if (!authorizationService) throw new Error("GraphQLManager requires an authorizationService");
 		this.authorizationService = authorizationService;
 		this.reactorDriveClient = reactorDriveClient;
-		if (this.authConfig) this.authService = new AuthService(this.authConfig);
 		this.driveOwnershipCache = new DriveOwnershipCache(this.reactorClient);
 		this.wsServer.setMaxListeners(0);
 	}
@@ -3328,6 +3155,14 @@ var GraphQLManager = class {
 	getBasePath() {
 		return this.path;
 	}
+	/**
+	* Get the authorization service shared with subgraphs. Use this when
+	* constructing a subgraph instance externally for
+	* {@link registerSubgraphInstance}.
+	*/
+	getAuthorizationService() {
+		return this.authorizationService;
+	}
 	async registerSubgraph(subgraph, supergraph = "", core = false) {
 		const subgraphInstance = new subgraph({
 			relationalDb: this.relationalDb,
@@ -3387,8 +3222,7 @@ var GraphQLManager = class {
 				db: this.relationalDb,
 				...this.getAdditionalContextFields(),
 				driveId,
-				user: authCtx?.user,
-				isAdmin: authCtx ? (addr) => !authCtx.auth_enabled ? true : authCtx.admins.includes(addr.toLowerCase()) : () => true
+				user: authCtx?.user
 			});
 		};
 	}
@@ -3532,8 +3366,8 @@ var GraphQLManager = class {
 };
 //#endregion
 //#region src/graphql/packages/resolvers.ts
-function requireAdmin(ctx) {
-	if (!(ctx.isAdmin?.(ctx.user?.address ?? "") ?? false)) throw new GraphQLError("Admin access required");
+function requireAdmin(authorizationService, ctx) {
+	if (!authorizationService.isSupremeAdmin(ctx.user?.address)) throw new GraphQLError("Admin access required");
 }
 function formatPackageInfo(info) {
 	return {
@@ -3551,16 +3385,16 @@ async function installedPackage(service, args) {
 	const pkg = await service.getInstalledPackage(args.name);
 	return pkg ? formatPackageInfo(pkg) : null;
 }
-async function installPackage(service, args, ctx) {
-	requireAdmin(ctx);
+async function installPackage(service, authorizationService, args, ctx) {
+	requireAdmin(authorizationService, ctx);
 	const result = await service.installPackage(args.name, args.registryUrl ?? void 0);
 	return {
 		package: formatPackageInfo(result.package),
 		documentModelsLoaded: result.documentModelsLoaded
 	};
 }
-async function uninstallPackage(service, args, ctx) {
-	requireAdmin(ctx);
+async function uninstallPackage(service, authorizationService, args, ctx) {
+	requireAdmin(authorizationService, ctx);
 	return service.uninstallPackage(args.name);
 }
 //#endregion
@@ -3606,7 +3440,7 @@ var PackagesSubgraph = class extends BaseSubgraph {
 			installPackage: async (_parent, args, ctx) => {
 				this.logger.debug("installPackage(@args)", args);
 				try {
-					return await installPackage(this.packageManagementService, args, ctx);
+					return await installPackage(this.packageManagementService, this.authorizationService, args, ctx);
 				} catch (error) {
 					this.logger.error("Error in installPackage: @error", error);
 					throw error;
@@ -3615,7 +3449,7 @@ var PackagesSubgraph = class extends BaseSubgraph {
 			uninstallPackage: async (_parent, args, ctx) => {
 				this.logger.debug("uninstallPackage(@args)", args);
 				try {
-					return await uninstallPackage(this.packageManagementService, args, ctx);
+					return await uninstallPackage(this.packageManagementService, this.authorizationService, args, ctx);
 				} catch (error) {
 					this.logger.error("Error in uninstallPackage: @error", error);
 					throw error;
@@ -3801,20 +3635,12 @@ const ActionSignerDTO = z.object({
 	app: ActionSignerAppDTO.nullable().optional()
 }).strip();
 const ActionContextDTO = z.object({ signer: ActionSignerDTO.nullable().optional() }).strip();
-const AttachmentDTO = z.object({
-	data: z.string(),
-	mimeType: z.string(),
-	hash: z.string(),
-	extension: z.string().nullable().optional(),
-	fileName: z.string().nullable().optional()
-}).strip();
 const OperationActionDTO = z.object({
 	id: z.string(),
 	type: z.string(),
 	timestampUtcMs: z.string(),
 	input: z.unknown(),
 	scope: z.string(),
-	attachments: z.array(AttachmentDTO).nullable().optional(),
 	context: ActionContextDTO.nullable().optional()
 }).strip();
 const OperationDTO = z.object({
@@ -3941,7 +3767,7 @@ function createReactorGraphQLClient(url, fetchImpl = fetch, headers) {
 }
 //#endregion
 //#region src/graphql/reactor/schema.graphql
-var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n  result: JSONObject!\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n  result: JSONObject!\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  attachments: [Attachment!]\n  context: ActionContext\n}\n\ntype Attachment {\n  data: String!\n  mimeType: String!\n  hash: String!\n  extension: String\n  fileName: String\n}\n\n# Input types for sync operations\ninput ActionContextInput {\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  attachments: [AttachmentInput!]\n  context: ActionContextInput\n}\n\ninput AttachmentInput {\n  data: String!\n  mimeType: String!\n  hash: String!\n  extension: String\n  fileName: String\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  # Poll for sync envelopes from a channel\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
+var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n  result: JSONObject!\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n  result: JSONObject!\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n# Input types for sync operations\ninput ActionContextInput {\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  # Poll for sync envelopes from a channel\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
 //#endregion
 //#region src/graphql/reactor/pubsub.ts
 const pubSub = new PubSub();
@@ -3990,7 +3816,8 @@ function ensureJobSubscription(reactorClient, jobId) {
 					error: jobInfo.error?.message ?? null,
 					result: jobInfo.result ?? {}
 				},
-				jobId
+				jobId,
+				documentId: jobInfo.documentId
 			};
 			pubSub.publish(SUBSCRIPTION_TRIGGERS.JOB_CHANGES, payload);
 			const isTerminal = String(jobInfo.status) === "FAILED" || String(jobInfo.status) === "READ_MODELS_READY" || jobInfo.completedAtUtcIso !== void 0;
@@ -4040,12 +3867,14 @@ var ReactorSubgraph = class extends BaseSubgraph {
 	* Delegates to base assertCanExecuteOperation for each action.
 	*/
 	async assertCanExecuteOperations(documentId, actions, ctx) {
+		let handle = AuthorizedDocumentHandle.skipped(documentId);
 		for (const action of actions) {
 			if (!action || typeof action !== "object") continue;
 			const operationType = action.type;
 			if (typeof operationType !== "string") continue;
-			await this.assertCanExecuteOperation(documentId, operationType, ctx);
+			handle = await this.assertCanExecuteOperation(documentId, operationType, ctx);
 		}
+		return handle;
 	}
 	/**
 	* Returns the drive id when the given identifier (id or slug) refers
@@ -4062,11 +3891,25 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			return;
 		}
 	}
+	/**
+	* Adds to `forbidden` the canonical document ids in `syncOps` that the caller
+	* cannot read, checking each distinct id once. Sync operation document ids are
+	* canonical (never slugs), so no resolution is needed.
+	*/
+	async #collectForbiddenDocuments(syncOps, forbidden, ctx) {
+		const checked = /* @__PURE__ */ new Set();
+		for (const syncOp of syncOps) {
+			const documentId = syncOp.documentId;
+			if (checked.has(documentId) || forbidden.has(documentId)) continue;
+			checked.add(documentId);
+			if (!await this.canReadDocument(documentId, ctx)) forbidden.add(documentId);
+		}
+	}
 	typeDefs = gql(schema_default);
 	resolvers = {
 		PHDocument: { operations: async (parent, args, ctx) => {
 			this.logger.debug("PHDocument.operations(@parent.id, @args)", parent.id, args);
-			await this.assertCanRead(parent.id, ctx);
+			await this.assertCanReadCanonical(parent.id, ctx);
 			try {
 				const filter = {
 					documentId: parent.id,
@@ -4099,8 +3942,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			document: async (_parent, args, ctx) => {
 				this.logger.debug("document(@args)", args);
 				try {
-					await this.assertCanRead(args.identifier, ctx);
-					return await document(this.reactorClient, args);
+					const handle = await this.assertCanRead(args.identifier, ctx);
+					return await document(this.reactorClient, {
+						...args,
+						identifier: handle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in document: @Error", error);
 					throw error;
@@ -4109,8 +3955,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			documentOutgoingRelationships: async (_parent, args, ctx) => {
 				this.logger.debug("documentOutgoingRelationships(@args)", args);
 				try {
-					await this.assertCanRead(args.sourceIdentifier, ctx);
-					return await documentOutgoingRelationships(this.reactorClient, args);
+					const handle = await this.assertCanRead(args.sourceIdentifier, ctx);
+					return await documentOutgoingRelationships(this.reactorClient, {
+						...args,
+						sourceIdentifier: handle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in documentOutgoingRelationships: @Error", error);
 					throw error;
@@ -4119,9 +3968,12 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			documentIncomingRelationships: async (_parent, args, ctx) => {
 				this.logger.debug("documentIncomingRelationships(@args)", args);
 				try {
-					await this.assertCanRead(args.targetIdentifier, ctx);
-					const result = await documentIncomingRelationships(this.reactorClient, args);
-					if (!this.hasGlobalAdminAccess(ctx) && this.documentPermissionService) {
+					const handle = await this.assertCanRead(args.targetIdentifier, ctx);
+					const result = await documentIncomingRelationships(this.reactorClient, {
+						...args,
+						targetIdentifier: handle.fetchIdentifier
+					});
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
 						return {
@@ -4142,7 +3994,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 						...args,
 						search: args.search ?? {}
 					});
-					if (!this.hasGlobalAdminAccess(ctx) && this.documentPermissionService) {
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
 						return {
@@ -4168,17 +4020,37 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			documentOperations: async (_parent, args, ctx) => {
 				this.logger.debug("documentOperations(@args)", args);
 				try {
-					await this.assertCanRead(args.filter.documentId, ctx);
-					return await documentOperations(this.reactorClient, args);
+					const handle = await this.assertCanRead(args.filter.documentId, ctx);
+					return await documentOperations(this.reactorClient, {
+						...args,
+						filter: {
+							...args.filter,
+							documentId: handle.fetchIdentifier
+						}
+					});
 				} catch (error) {
 					this.logger.error("Error in documentOperations: @Error", error);
 					throw error;
 				}
 			},
-			pollSyncEnvelopes: (_parent, args) => {
+			pollSyncEnvelopes: async (_parent, args, ctx) => {
 				this.logger.debug("pollSyncEnvelopes(@args)", args);
 				try {
-					const { envelopes, ackOrdinal, deadLetters, hasMore } = pollSyncEnvelopes(this.syncManager, args);
+					let remote;
+					try {
+						remote = this.syncManager.getById(args.channelId);
+					} catch (error) {
+						throw new GraphQLError(`Channel not found: ${error instanceof Error ? error.message : "Unknown error"}`);
+					}
+					const driveId = remote.collectionId.driveId;
+					const isAdmin = this.authorizationService.isSupremeAdmin(ctx.user?.address);
+					if (!isAdmin) await this.assertCanReadCanonical(driveId, ctx);
+					const forbiddenIds = /* @__PURE__ */ new Set();
+					if (!isAdmin) {
+						if (await this.authorizationService.canRead(driveId, void 0)) await this.#collectForbiddenDocuments(remote.channel.outbox.items, forbiddenIds, ctx);
+						await this.#collectForbiddenDocuments(remote.channel.deadLetter.items, forbiddenIds, ctx);
+					}
+					const { envelopes, ackOrdinal, deadLetters, hasMore } = pollSyncEnvelopes(this.syncManager, args, forbiddenIds);
 					return {
 						envelopes,
 						ackOrdinal,
@@ -4197,13 +4069,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 				try {
 					if (args.parentIdentifier) {
 						const parent = await document(this.reactorClient, { identifier: args.parentIdentifier });
-						await this.assertCanWrite(parent.document.id, ctx);
-					} else if (this.authorizationService) {
-						if (!ctx.user?.address) throw new GraphQLError("Forbidden: authentication required to create documents");
-					} else if (!this.hasGlobalAdminAccess(ctx)) throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+						await this.assertCanWriteCanonical(parent.document.id, ctx);
+					} else this.assertCanCreate(ctx);
 					const result = await createDocument(this.reactorClient, args, this.graphqlManager.reactorDriveClient);
 					if (result?.id && isDriveContainerType(result.documentType)) this.graphqlManager.driveOwnershipCache.add(result.id);
-					if (this.authorizationService && ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
+					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
 				} catch (error) {
 					this.logger.error("Error in createDocument(@args): @Error", args, error);
@@ -4215,13 +4085,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 				try {
 					if (args.parentIdentifier) {
 						const parent = await document(this.reactorClient, { identifier: args.parentIdentifier });
-						await this.assertCanWrite(parent.document.id, ctx);
-					} else if (this.authorizationService) {
-						if (!ctx.user?.address) throw new GraphQLError("Forbidden: authentication required to create documents");
-					} else if (!this.hasGlobalAdminAccess(ctx)) throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+						await this.assertCanWriteCanonical(parent.document.id, ctx);
+					} else this.assertCanCreate(ctx);
 					const result = await createEmptyDocument(this.reactorClient, args, this.graphqlManager.reactorDriveClient);
 					if (result?.id && isDriveContainerType(result.documentType)) this.graphqlManager.driveOwnershipCache.add(result.id);
-					if (this.authorizationService && ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
+					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
 				} catch (error) {
 					this.logger.error("Error in createEmptyDocument(@args): @Error", args, error);
@@ -4231,9 +4099,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			mutateDocument: async (_parent, args, ctx) => {
 				this.logger.debug("mutateDocument(@args)", args);
 				try {
-					if (!this.authorizationService) await this.assertCanWrite(args.documentIdentifier, ctx);
-					await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
-					return await mutateDocument(this.reactorClient, args);
+					const handle = await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
+					return await mutateDocument(this.reactorClient, {
+						...args,
+						documentIdentifier: handle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in mutateDocument(@args): @Error", args, error);
 					throw error;
@@ -4242,9 +4112,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			mutateDocumentAsync: async (_parent, args, ctx) => {
 				this.logger.debug("mutateDocumentAsync(@args)", args);
 				try {
-					if (!this.authorizationService) await this.assertCanWrite(args.documentIdentifier, ctx);
-					await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
-					return await mutateDocumentAsync(this.reactorClient, args);
+					const handle = await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
+					return await mutateDocumentAsync(this.reactorClient, {
+						...args,
+						documentIdentifier: handle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in mutateDocumentAsync(@args): @Error", args, error);
 					throw error;
@@ -4253,8 +4125,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			renameDocument: async (_parent, args, ctx) => {
 				this.logger.debug("renameDocument(@args)", args);
 				try {
-					await this.assertCanWrite(args.documentIdentifier, ctx);
-					return await renameDocument(this.reactorClient, args);
+					const handle = await this.assertCanWrite(args.documentIdentifier, ctx);
+					return await renameDocument(this.reactorClient, {
+						...args,
+						documentIdentifier: handle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in renameDocument(@args): @Error", args, error);
 					throw error;
@@ -4263,8 +4138,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			setPreferredEditor: async (_parent, args, ctx) => {
 				this.logger.debug("setPreferredEditor(@args)", args);
 				try {
-					await this.assertCanWrite(args.documentIdentifier, ctx);
-					return await setPreferredEditor(this.reactorClient, args);
+					const handle = await this.assertCanWrite(args.documentIdentifier, ctx);
+					return await setPreferredEditor(this.reactorClient, {
+						...args,
+						documentIdentifier: handle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in setPreferredEditor(@args): @Error", args, error);
 					throw error;
@@ -4273,8 +4151,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			addRelationship: async (_parent, args, ctx) => {
 				this.logger.debug("addRelationship(@args)", args);
 				try {
-					await this.assertCanWrite(args.sourceIdentifier, ctx);
-					return await addRelationship(this.reactorClient, args);
+					const handle = await this.assertCanWrite(args.sourceIdentifier, ctx);
+					return await addRelationship(this.reactorClient, {
+						...args,
+						sourceIdentifier: handle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in addRelationship(@args): @Error", args, error);
 					throw error;
@@ -4283,8 +4164,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			removeRelationship: async (_parent, args, ctx) => {
 				this.logger.debug("removeRelationship(@args)", args);
 				try {
-					await this.assertCanWrite(args.sourceIdentifier, ctx);
-					return await removeRelationship(this.reactorClient, args);
+					const handle = await this.assertCanWrite(args.sourceIdentifier, ctx);
+					return await removeRelationship(this.reactorClient, {
+						...args,
+						sourceIdentifier: handle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in removeRelationship(@args): @Error", args, error);
 					throw error;
@@ -4293,9 +4177,13 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			moveRelationship: async (_parent, args, ctx) => {
 				this.logger.debug("moveRelationship(@args)", args);
 				try {
-					await this.assertCanWrite(args.sourceParentIdentifier, ctx);
-					await this.assertCanWrite(args.targetParentIdentifier, ctx);
-					return await moveRelationship(this.reactorClient, args);
+					const sourceHandle = await this.assertCanWrite(args.sourceParentIdentifier, ctx);
+					const targetHandle = await this.assertCanWrite(args.targetParentIdentifier, ctx);
+					return await moveRelationship(this.reactorClient, {
+						...args,
+						sourceParentIdentifier: sourceHandle.fetchIdentifier,
+						targetParentIdentifier: targetHandle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in moveRelationship(@args): @Error @args", error, args);
 					throw error;
@@ -4304,9 +4192,12 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			deleteDocument: async (_parent, args, ctx) => {
 				this.logger.debug("deleteDocument(@args)", args);
 				try {
-					await this.assertCanWrite(args.identifier, ctx);
-					const driveIdToInvalidate = await this.#resolveDriveId(args.identifier);
-					const result = await deleteDocument(this.reactorClient, args, this.graphqlManager.reactorDriveClient);
+					const identifier = (await this.assertCanWrite(args.identifier, ctx)).fetchIdentifier;
+					const driveIdToInvalidate = await this.#resolveDriveId(identifier);
+					const result = await deleteDocument(this.reactorClient, {
+						...args,
+						identifier
+					}, this.graphqlManager.reactorDriveClient);
 					if (result && driveIdToInvalidate) this.graphqlManager.driveOwnershipCache.remove(driveIdToInvalidate);
 					return result;
 				} catch (error) {
@@ -4317,25 +4208,49 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			deleteDocuments: async (_parent, args, ctx) => {
 				this.logger.debug("deleteDocuments(@args)", args);
 				try {
-					for (const identifier of args.identifiers) await this.assertCanWrite(identifier, ctx);
-					return await deleteDocuments(this.reactorClient, args);
+					const identifiers = [];
+					for (const identifier of args.identifiers) {
+						const handle = await this.assertCanWrite(identifier, ctx);
+						identifiers.push(handle.fetchIdentifier);
+					}
+					return await deleteDocuments(this.reactorClient, {
+						...args,
+						identifiers
+					});
 				} catch (error) {
 					this.logger.error("Error in deleteDocuments(@args): @Error", args, error);
 					throw error;
 				}
 			},
-			touchChannel: async (_parent, args) => {
+			touchChannel: async (_parent, args, ctx) => {
 				this.logger.debug("touchChannel(@args)", args);
 				try {
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
+						const driveId = DriveCollectionId.fromKey(args.input.collectionId).driveId;
+						await this.assertCanReadCanonical(driveId, ctx);
+					}
 					return await touchChannel(this.syncManager, args);
 				} catch (error) {
 					this.logger.error("Error in touchChannel(@args): @Error", args, error);
 					throw error;
 				}
 			},
-			pushSyncEnvelopes: async (_parent, args) => {
+			pushSyncEnvelopes: async (_parent, args, ctx) => {
 				this.logger.debug("pushSyncEnvelopes(@args)", args);
 				try {
+					const checkedOperations = /* @__PURE__ */ new Map();
+					for (const envelope of args.envelopes) for (const op of envelope.operations ?? []) {
+						const documentId = op.context.documentId;
+						const operationType = op.operation.action.type;
+						let checkedTypes = checkedOperations.get(documentId);
+						if (!checkedTypes) {
+							checkedTypes = /* @__PURE__ */ new Set();
+							checkedOperations.set(documentId, checkedTypes);
+						}
+						if (checkedTypes.has(operationType)) continue;
+						checkedTypes.add(operationType);
+						await this.assertCanExecuteOperationCanonical(documentId, operationType, ctx);
+					}
 					const mutableArgs = { envelopes: args.envelopes.map((envelope) => ({
 						type: envelope.type,
 						channelMeta: { id: envelope.channelMeta.id },
@@ -4366,31 +4281,43 @@ var ReactorSubgraph = class extends BaseSubgraph {
 		},
 		Subscription: {
 			documentChanges: {
-				subscribe: withFilter((() => {
+				subscribe: (rootValue, args, ctx, info) => {
 					this.logger.debug("documentChanges subscription started");
-					ensureGlobalDocumentSubscription(this.reactorClient);
-					return getPubSub().asyncIterableIterator(SUBSCRIPTION_TRIGGERS.DOCUMENT_CHANGES);
-				}), ((payload, args) => {
-					if (!payload) return false;
-					const search = {
-						type: args.search?.type ?? void 0,
-						parentId: args.search?.parentId ?? void 0
-					};
-					return matchesSearchFilter(payload.documentChanges, search);
-				})),
+					return withFilter(() => {
+						ensureGlobalDocumentSubscription(this.reactorClient);
+						return getPubSub().asyncIterableIterator(SUBSCRIPTION_TRIGGERS.DOCUMENT_CHANGES);
+					}, async (payload, filterArgs, filterCtx) => {
+						if (!payload) return false;
+						const search = {
+							type: filterArgs?.search?.type ?? void 0,
+							parentId: filterArgs?.search?.parentId ?? void 0
+						};
+						if (!matchesSearchFilter(payload.documentChanges, search)) return false;
+						if (this.authorizationService.isSupremeAdmin(filterCtx?.user?.address)) return true;
+						const documentIds = collectChangedDocumentIds(payload.documentChanges);
+						if (documentIds.length === 0) return false;
+						for (const documentId of documentIds) if (!await this.canReadDocument(documentId, filterCtx)) return false;
+						return true;
+					})(rootValue, args, ctx, info);
+				},
 				resolve: (payload) => {
 					return toGqlDocumentChangeEvent(payload.documentChanges);
 				}
 			},
 			jobChanges: {
-				subscribe: withFilter(((_parent, args) => {
+				subscribe: (rootValue, args, ctx, info) => {
 					this.logger.debug("jobChanges(@args) subscription started", args);
-					ensureJobSubscription(this.reactorClient, args.jobId);
-					return getPubSub().asyncIterableIterator(SUBSCRIPTION_TRIGGERS.JOB_CHANGES);
-				}), ((payload, args) => {
-					if (!payload) return false;
-					return matchesJobFilter(payload, args);
-				})),
+					return withFilter(() => {
+						ensureJobSubscription(this.reactorClient, args.jobId);
+						return getPubSub().asyncIterableIterator(SUBSCRIPTION_TRIGGERS.JOB_CHANGES);
+					}, async (payload, filterArgs, filterCtx) => {
+						if (!payload || !filterArgs) return false;
+						if (!matchesJobFilter(payload, filterArgs)) return false;
+						if (this.authorizationService.isSupremeAdmin(filterCtx?.user?.address)) return true;
+						if (!payload.documentId) return false;
+						return this.canReadDocument(payload.documentId, filterCtx);
+					})(rootValue, args, ctx, info);
+				},
 				resolve: (payload) => {
 					return payload.jobChanges;
 				}
@@ -4414,10 +4341,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.0-dev.2";
+	return "6.2.0-dev.20";
 }
 function getGitHash() {
-	return "2f6b59fedf158291a28658f048853eeca309be9d";
+	return "69a4177a74abeda6e2812c8c19f79e3defc14df0";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -5038,104 +4965,159 @@ async function runMigrations(db) {
 	}
 }
 //#endregion
-//#region src/services/authorization.service.ts
-/**
-* Central authorization service — single source of truth for all permission checks.
-*
-* Authorization model:
-* 1. Supreme admin (ADMINS env) → ALLOW ALL
-* 2. Is document protected?
-*    a. NOT protected:
-*       - READ: anyone (even anonymous) → ALLOW
-*       - WRITE: authenticated user → ALLOW
-*    b. PROTECTED:
-*       - READ: requires explicit READ/WRITE/ADMIN grant (direct or via group/parent)
-*       - WRITE: requires explicit WRITE/ADMIN grant (direct or via group/parent)
-* 3. Operation restricted? → Check OperationUserPermission
-* 4. Document owner = implicit ADMIN
-* 5. Drive protected = all children effectively protected
-*/
-var AuthorizationService = class {
+//#region src/services/auth.service.ts
+const DEFAULT_CREDENTIAL_CACHE_TTL_MS = 6e4;
+const CREDENTIAL_CACHE_MAX_ENTRIES = 1e3;
+var AuthService = class {
 	config;
-	constructor(documentPermissionService, config) {
-		this.documentPermissionService = documentPermissionService;
+	credentialCache = /* @__PURE__ */ new Map();
+	constructor(config) {
 		this.config = config;
 	}
+	async authenticateRequest(request) {
+		if (!this.config.enabled) return {
+			user: void 0,
+			admins: [],
+			auth_enabled: false
+		};
+		const method = request.method;
+		if (method === "OPTIONS" || method === "GET") return {
+			user: void 0,
+			admins: this.config.admins,
+			auth_enabled: true
+		};
+		return this.verifyBearer(request.headers.get("authorization") ?? void 0);
+	}
 	/**
-	* Check if a user is a supreme admin (from ADMINS env var).
+	* Verify a Bearer token regardless of HTTP method. Use this from non-GraphQL
+	* middleware that must enforce authentication on every request.
 	*/
-	isSupremeAdmin(userAddress) {
-		if (!userAddress) return false;
-		return this.config.admins.includes(userAddress.toLowerCase());
+	async verifyBearer(authorization) {
+		if (!this.config.enabled) return {
+			user: void 0,
+			admins: [],
+			auth_enabled: false
+		};
+		const token = authorization?.split(" ")[1];
+		if (!token) return {
+			user: void 0,
+			admins: this.config.admins,
+			auth_enabled: true
+		};
+		try {
+			const verified = await this.verifyToken(token);
+			if (!verified) return new Response(JSON.stringify({ error: "Verification failed" }), { status: 401 });
+			const user = this.extractUserFromVerification(verified);
+			if (!user) return new Response(JSON.stringify({ error: "Missing credentials" }), { status: 401 });
+			if (!this.config.skipCredentialVerification) {
+				if (!await this.verifyCredentialExists(user.address, user.chainId, verified.issuer)) return new Response(JSON.stringify({ error: "Credentials no longer valid" }), { status: 401 });
+			}
+			return {
+				user,
+				admins: this.config.admins,
+				auth_enabled: true
+			};
+		} catch {
+			return new Response(JSON.stringify({ error: "Authentication failed" }), { status: 401 });
+		}
+	}
+	async authenticateWebSocketConnection(connectionParams) {
+		if (!this.config.enabled) return null;
+		const authHeader = connectionParams.authorization;
+		if (!authHeader) throw new Error("Missing authorization in connection parameters");
+		const token = authHeader.split(" ")[1];
+		if (!token) throw new Error("Invalid authorization format");
+		const verified = await this.verifyToken(token);
+		if (!verified) throw new Error("Token verification failed");
+		const user = this.extractUserFromVerification(verified);
+		if (!user) throw new Error("Invalid credentials");
+		if (!this.config.skipCredentialVerification) {
+			if (!await this.verifyCredentialExists(user.address, user.chainId, verified.issuer)) throw new Error("Credentials no longer valid");
+		}
+		return user;
 	}
 	/**
-	* Check if a user can read a document.
-	*
-	* - Supreme admin → yes
-	* - Not protected → anyone can read (even anonymous)
-	* - Protected → requires READ/WRITE/ADMIN grant (direct, group, or parent inheritance)
-	* - Owner → yes (implicit ADMIN)
+	* Verify the auth bearer token
 	*/
-	async canRead(documentId, userAddress, getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (!(getParentIds ? await this.documentPermissionService.isProtectedWithAncestors(documentId, getParentIds) : await this.documentPermissionService.isDocumentProtected(documentId))) return true;
-		if (!userAddress) return false;
-		const owner = await this.documentPermissionService.getDocumentOwner(documentId);
-		if (owner && owner === userAddress.toLowerCase()) return true;
-		if (getParentIds) return this.documentPermissionService.canRead(documentId, userAddress, getParentIds);
-		return this.documentPermissionService.canReadDocument(documentId, userAddress);
+	async verifyToken(token) {
+		return await verifyAuthBearerToken(token);
 	}
 	/**
-	* Check if a user can write to a document.
-	*
-	* - Supreme admin → yes
-	* - Not protected → anyone can write (even anonymous)
-	* - Protected → requires authentication + WRITE/ADMIN grant
-	* - Owner → yes (implicit ADMIN)
+	* Extract user information from verification result
 	*/
-	async canWrite(documentId, userAddress, getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (!(getParentIds ? await this.documentPermissionService.isProtectedWithAncestors(documentId, getParentIds) : await this.documentPermissionService.isDocumentProtected(documentId))) return true;
-		if (!userAddress) return false;
-		const owner = await this.documentPermissionService.getDocumentOwner(documentId);
-		if (owner && owner === userAddress.toLowerCase()) return true;
-		if (getParentIds) return this.documentPermissionService.canWrite(documentId, userAddress, getParentIds);
-		return this.documentPermissionService.canWriteDocument(documentId, userAddress);
+	extractUserFromVerification(verified) {
+		try {
+			const { address, chainId, networkId } = verified.verifiableCredential.credentialSubject;
+			if (!address || !chainId || !networkId) return null;
+			return {
+				address,
+				chainId,
+				networkId
+			};
+		} catch {
+			return null;
+		}
 	}
 	/**
-	* Check if a user can manage a document (change permissions, protection, transfer ownership).
+	* Verify that the credential still exists on the Renown API.
 	*
-	* - Supreme admin → yes
-	* - Owner → yes
-	* - Has ADMIN grant → yes
+	* Results are cached per (address, chainId, issuer) for a short TTL so the
+	* blocking external round-trip is not paid on every request. Concurrent
+	* checks for the same key share a single in-flight request, and entries
+	* that resolve to false are evicted immediately so failed or revoked
+	* credentials are re-checked on the next request.
 	*/
-	async canManage(documentId, userAddress, _getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (!userAddress) return false;
-		const owner = await this.documentPermissionService.getDocumentOwner(documentId);
-		if (owner && owner === userAddress.toLowerCase()) return true;
-		return this.documentPermissionService.canManageDocument(documentId, userAddress);
+	verifyCredentialExists(address, chainId, appId) {
+		const ttlMs = this.config.credentialVerificationCacheTtlMs ?? DEFAULT_CREDENTIAL_CACHE_TTL_MS;
+		if (ttlMs <= 0) return this.fetchCredentialExists(address, chainId, appId);
+		const key = `${address.toLowerCase()}:${chainId}:${appId}`;
+		const now = Date.now();
+		const cached = this.credentialCache.get(key);
+		if (cached && cached.expiresAt > now) return cached.exists;
+		this.pruneCredentialCache(now);
+		const entry = {
+			exists: this.fetchCredentialExists(address, chainId, appId).then((exists) => {
+				if (!exists && this.credentialCache.get(key) === entry) this.credentialCache.delete(key);
+				return exists;
+			}),
+			expiresAt: now + ttlMs
+		};
+		this.credentialCache.set(key, entry);
+		return entry.exists;
 	}
 	/**
-	* Check if a user can execute a specific operation.
-	* If the operation is not restricted, falls through to the standard write check.
-	* If the operation is restricted, requires an explicit OperationUserPermission grant.
+	* Enforce the cache size cap before inserting a new entry: drop expired
+	* entries first, then evict oldest-inserted entries (insertion order
+	* matches expiry order since the TTL is constant) until under the cap, so
+	* a flood of distinct keys cannot grow the map without bound.
 	*/
-	async canExecuteOperation(documentId, operationType, userAddress, getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (!await this.documentPermissionService.isOperationRestricted(documentId, operationType)) return this.canWrite(documentId, userAddress, getParentIds);
-		return this.documentPermissionService.canExecuteOperation(documentId, operationType, userAddress?.toLowerCase());
+	pruneCredentialCache(now) {
+		if (this.credentialCache.size < CREDENTIAL_CACHE_MAX_ENTRIES) return;
+		for (const [key, entry] of this.credentialCache) if (entry.expiresAt <= now) this.credentialCache.delete(key);
+		while (this.credentialCache.size >= CREDENTIAL_CACHE_MAX_ENTRIES) {
+			const oldestKey = this.credentialCache.keys().next().value;
+			if (oldestKey === void 0) break;
+			this.credentialCache.delete(oldestKey);
+		}
 	}
 	/**
-	* Combined check for mutations: can the user write + execute the operation?
-	* This enables READ-only users with operation grants to execute specific operations.
-	* For restricted operations, only the operation grant is checked (bypasses write check),
-	* allowing READ-only users with an explicit operation grant to execute that operation.
+	* Fetch the credential from the Renown API and validate it against the
+	* expected address, chainId and issuer. Never throws; returns false on any
+	* network or validation failure.
 	*/
-	async canMutate(documentId, operationType, userAddress, getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (await this.documentPermissionService.isOperationRestricted(documentId, operationType)) return this.documentPermissionService.canExecuteOperation(documentId, operationType, userAddress?.toLowerCase());
-		return this.canWrite(documentId, userAddress, getParentIds);
+	async fetchCredentialExists(address, chainId, appId) {
+		const url = `https://www.renown.id/api/auth/credential?address=${address}&chainId=${chainId}&connectId=${appId}&appId=${appId}`;
+		try {
+			const response = await fetch(url, { method: "GET" });
+			if (response.status !== 200) return false;
+			const credential = (await response.json()).credential;
+			const appIdVerfied = credential.credentialSubject.id;
+			const addressVerfied = credential.issuer.id.split(":")[4];
+			const chainIdVerfied = credential.issuer.id.split(":")[3];
+			return appIdVerfied === appId && addressVerfied.toLocaleLowerCase() === address.toLocaleLowerCase() && chainIdVerfied === chainId.toString();
+		} catch {
+			return false;
+		}
 	}
 };
 //#endregion
@@ -5233,63 +5215,6 @@ var DocumentPermissionService = class {
 		await this.db.deleteFrom("OperationGroupPermission").where("documentId", "=", documentId).execute();
 	}
 	/**
-	* Check if a user can read a document.
-	* Returns true if user has READ, WRITE, or ADMIN permission (direct or via group)
-	*/
-	async canReadDocument(documentId, userAddress) {
-		if (!userAddress) return false;
-		if (await this.getUserPermission(documentId, userAddress) !== null) return true;
-		return await this.getUserGroupPermission(documentId, userAddress) !== null;
-	}
-	/**
-	* Check if a user can write to a document.
-	* Returns true if user has WRITE or ADMIN permission (direct or via group)
-	*/
-	async canWriteDocument(documentId, userAddress) {
-		if (!userAddress) return false;
-		const directPermission = await this.getUserPermission(documentId, userAddress);
-		if (directPermission === "WRITE" || directPermission === "ADMIN") return true;
-		const groupPermission = await this.getUserGroupPermission(documentId, userAddress);
-		return groupPermission === "WRITE" || groupPermission === "ADMIN";
-	}
-	/**
-	* Check if a user can manage a document (change permissions, settings).
-	* Returns true if user has ADMIN permission (direct or via group)
-	*/
-	async canManageDocument(documentId, userAddress) {
-		if (!userAddress) return false;
-		if (await this.getUserPermission(documentId, userAddress) === "ADMIN") return true;
-		return await this.getUserGroupPermission(documentId, userAddress) === "ADMIN";
-	}
-	/**
-	* Check if a user can read a document, including parent permission inheritance.
-	* Returns true if user has permission on the document OR any parent in the hierarchy.
-	*/
-	async canRead(documentId, userAddress, getParentIds) {
-		if (await this.canReadDocument(documentId, userAddress)) return true;
-		const parentIds = await getParentIds(documentId);
-		for (const parentId of parentIds) if (await this.canRead(parentId, userAddress, getParentIds)) return true;
-		return false;
-	}
-	/**
-	* Check if a user can write to a document, including parent permission inheritance.
-	* Returns true if user has write permission on the document OR any parent in the hierarchy.
-	*/
-	async canWrite(documentId, userAddress, getParentIds) {
-		if (await this.canWriteDocument(documentId, userAddress)) return true;
-		const parentIds = await getParentIds(documentId);
-		for (const parentId of parentIds) if (await this.canWrite(parentId, userAddress, getParentIds)) return true;
-		return false;
-	}
-	/**
-	* Filter a list of document IDs to only include those the user can read.
-	*/
-	async filterReadableDocuments(documentIds, userAddress, getParentIds) {
-		const results = [];
-		for (const docId of documentIds) if (await this.canRead(docId, userAddress, getParentIds)) results.push(docId);
-		return results;
-	}
-	/**
 	* Create a new group
 	*/
 	async createGroup(name, description) {
@@ -5518,11 +5443,10 @@ var DocumentPermissionService = class {
 		]).where("documentId", "=", documentId).where("operationType", "=", operationType).execute();
 	}
 	/**
-	* Check if a user can execute a specific operation on a document.
-	* Returns true if user has direct permission or is in a group with permission.
+	* Whether an operation-permission row exists for the user on this
+	* operation, either directly or via a group the user belongs to.
 	*/
-	async canExecuteOperation(documentId, operationType, userAddress) {
-		if (!userAddress) return false;
+	async hasOperationGrant(documentId, operationType, userAddress) {
 		const normalizedAddress = userAddress.toLowerCase();
 		if (await this.db.selectFrom("OperationUserPermission").select("userAddress").where("documentId", "=", documentId).where("operationType", "=", operationType).where("userAddress", "=", normalizedAddress).executeTakeFirst()) return true;
 		return !!await this.db.selectFrom("OperationGroupPermission").innerJoin("UserGroup", "UserGroup.groupId", "OperationGroupPermission.groupId").select("OperationGroupPermission.groupId").where("OperationGroupPermission.documentId", "=", documentId).where("OperationGroupPermission.operationType", "=", operationType).where("UserGroup.userAddress", "=", normalizedAddress).executeTakeFirst();
@@ -5649,6 +5573,60 @@ var DocumentPermissionService = class {
 	}
 };
 //#endregion
+//#region src/services/get-parent-ids.ts
+/**
+* The canonical parent-document resolver used for permission inheritance:
+* a document's parents are the sources of its incoming "child"
+* relationships. Lookup failures resolve to "no parents" so a relationship
+* store outage degrades to no inherited permissions rather than an error.
+*/
+function createGetParentIdsFn(reactorClient) {
+	return async (documentId) => {
+		try {
+			return (await reactorClient.getIncomingRelationships(documentId, "child")).results.map((doc) => doc.header.id);
+		} catch {
+			return [];
+		}
+	};
+}
+//#endregion
+//#region src/services/mcp-request-authorizer.ts
+/**
+* Authorization gate for the /mcp endpoint (AUTH_REVIEW S-C1). MCP tools have
+* unrestricted reactor access, so access is limited to supreme admins when
+* auth is enabled. OPEN policy is public; any other policy without an
+* AuthService fails closed.
+*/
+function createMcpRequestAuthorizer(authService, authorizationService) {
+	return async (req) => {
+		if (!authService) {
+			if (authorizationService.config.policy === AuthorizationPolicy.OPEN) return { authorized: true };
+			return {
+				authorized: false,
+				status: 401,
+				message: "Authentication required"
+			};
+		}
+		const context = await authService.verifyBearer(req.headers.authorization);
+		if (context instanceof Response) return {
+			authorized: false,
+			status: context.status,
+			message: "Authentication failed"
+		};
+		if (!context.user) return {
+			authorized: false,
+			status: 401,
+			message: "Authentication required"
+		};
+		if (!authorizationService.isSupremeAdmin(context.user.address)) return {
+			authorized: false,
+			status: 403,
+			message: "Forbidden: MCP access requires an administrator"
+		};
+		return { authorized: true };
+	};
+}
+//#endregion
 //#region src/utils/db.ts
 function isPG(connectionString) {
 	if (connectionString.startsWith("postgresql://") || connectionString.startsWith("postgres://")) return true;
@@ -5774,6 +5752,33 @@ const initAnalyticsStoreSql = [
 //#region src/server.ts
 const defaultLogger = childLogger(["reactor-api", "server"]);
 const DEFAULT_PORT = 4e3;
+/**
+* Doc-perms require auth: with auth off no `user` is ever resolved, so every
+* authorization check fails closed. Refuse to boot rather than run broken.
+*/
+function assertAuthRequiredForDocumentPermissions(authEnabled, documentPermissionsRequested) {
+	if (!authEnabled && documentPermissionsRequested) throw new Error("Document permissions require authentication: AUTH_ENABLED is false but document permissions were requested (DOCUMENT_PERMISSIONS_ENABLED=true or a documentPermissionService was provided). Enable authentication (AUTH_ENABLED=true, or auth.enabled in the config file) or disable document permissions.");
+}
+/**
+* Refuses SKIP_CREDENTIAL_VERIFICATION at boot outside tests or an explicit
+* opt-in: it removes the only binding between a token's claimed address and its
+* signing key. Fail-closed — unset NODE_ENV counts as production.
+*/
+function assertSkipCredentialVerificationAllowed(authEnabled, skipCredentialVerification, env) {
+	if (!authEnabled || !skipCredentialVerification) return;
+	const inAutomatedTest = env.VITEST === "true" || env.NODE_ENV === "test";
+	const acknowledged = env.ALLOW_INSECURE_SKIP_CREDENTIAL_VERIFICATION === "true";
+	if (!inAutomatedTest && !acknowledged) throw new Error("SKIP_CREDENTIAL_VERIFICATION is set but refused: it disables the live Renown credential check — the only check binding a token's claimed address to the key that signed it — so honoring it allows identity spoofing, including of admins. It is never safe in production. For local or sandbox use, also set ALLOW_INSECURE_SKIP_CREDENTIAL_VERIFICATION=true to acknowledge the risk; automated test runs (VITEST=true or NODE_ENV=test) are exempt.");
+}
+function createReadinessGate() {
+	let ready = false;
+	return {
+		isReady: () => ready,
+		markReady: () => {
+			ready = true;
+		}
+	};
+}
 function resolveAttachmentStoragePath(options) {
 	if (options.attachmentStoragePath) return options.attachmentStoragePath;
 	if (options.dbPath && !options.dbPath.startsWith("postgres")) return path.resolve(options.dbPath, "..", "attachments");
@@ -5812,11 +5817,8 @@ function makeDbClosers(knexInstance, pglite) {
 /**
 * Sets up the subgraph manager and registers subgraphs
 */
-async function setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, auth, documentPermissionService, enableDocumentModelSubgraphs, port, authorizationService, reactorDriveClient) {
-	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter("apollo", logger), {
-		enabled: auth?.enabled ?? false,
-		admins: auth?.admins ?? []
-	}, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient);
+async function setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient) {
+	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter("apollo", logger), authService, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient);
 	await graphqlManager.init(subgraphs.core, authFetchMiddleware);
 	for (const [, collection] of subgraphs.extended.entries()) for (const subgraph of collection) await graphqlManager.registerSubgraph(subgraph, "graphql");
 	await graphqlManager.updateRouter();
@@ -5890,6 +5892,7 @@ async function startServer(httpAdapter, port, httpsOptions, logger) {
 async function _setupCommonInfrastructure(options) {
 	const port = options.port ?? DEFAULT_PORT;
 	const { adapter: httpAdapter } = await createHttpAdapter("express");
+	const logger = options.logger ?? defaultLogger;
 	let admins = [];
 	let authEnabled = false;
 	if (options.configFile) {
@@ -5900,17 +5903,26 @@ async function _setupCommonInfrastructure(options) {
 		admins = options.auth.admins.map((a) => a.toLowerCase());
 		authEnabled = options.auth.enabled;
 	}
-	const { AUTH_ENABLED, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION } = process.env;
+	const { AUTH_ENABLED, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION, CREDENTIAL_VERIFICATION_CACHE_TTL_MS } = process.env;
 	if (AUTH_ENABLED !== void 0) authEnabled = AUTH_ENABLED === "true";
 	if (ADMINS !== void 0) admins = ADMINS.split(",").map((a) => a.toLowerCase());
 	let defaultProtection = false;
 	if (DEFAULT_PROTECTION !== void 0) defaultProtection = DEFAULT_PROTECTION.toLowerCase() === "true";
-	const { USERS, GUESTS, FREE_ENTRY } = process.env;
-	if (USERS || GUESTS || FREE_ENTRY) console.warn("[DEPRECATION WARNING] The USERS, GUESTS, and FREE_ENTRY environment variables are no longer supported. Access control is now managed per-document via the DocumentProtection system. Use DEFAULT_PROTECTION=true for strict mode, or manage protection per document via the GraphQL API. See the auth documentation for migration guidance.");
 	let skipCredentialVerification = false;
 	if (SKIP_CREDENTIAL_VERIFICATION !== void 0) skipCredentialVerification = SKIP_CREDENTIAL_VERIFICATION === "true";
-	const logger = options.logger ?? defaultLogger;
+	let credentialVerificationCacheTtlMs;
+	if (CREDENTIAL_VERIFICATION_CACHE_TTL_MS !== void 0) {
+		const parsed = Number(CREDENTIAL_VERIFICATION_CACHE_TTL_MS);
+		if (CREDENTIAL_VERIFICATION_CACHE_TTL_MS.trim() !== "" && Number.isFinite(parsed) && parsed >= 0) credentialVerificationCacheTtlMs = parsed;
+		else logger.warn(`Ignoring invalid CREDENTIAL_VERIFICATION_CACHE_TTL_MS="${CREDENTIAL_VERIFICATION_CACHE_TTL_MS}" (expected a non-negative number of milliseconds; 0 disables caching) — using the default TTL`);
+	}
+	const documentPermissionsRequested = options.documentPermissionService !== void 0 || DOCUMENT_PERMISSIONS_ENABLED === "true";
+	assertAuthRequiredForDocumentPermissions(authEnabled, documentPermissionsRequested);
+	assertSkipCredentialVerificationAllowed(authEnabled, skipCredentialVerification, process.env);
+	if (authEnabled && skipCredentialVerification) logger.warn("SECURITY: SKIP_CREDENTIAL_VERIFICATION is enabled — Renown credential verification is disabled and a bearer token's claimed address is NOT cryptographically bound to its signing key. Identity is unverifiable; use only in development or test.");
 	httpAdapter.getRoute("/health", () => new Response("OK", { status: 200 }));
+	const readiness = createReadinessGate();
+	httpAdapter.getRoute("/ready", () => readiness.isReady() ? new Response("OK", { status: 200 }) : new Response("starting", { status: 503 }));
 	const explorerPrefix = `${config.basePath}/explorer`;
 	httpAdapter.getRoute(`${explorerPrefix}/:endpoint?`, (request) => {
 		const url = new URL(request.url);
@@ -5926,7 +5938,8 @@ async function _setupCommonInfrastructure(options) {
 		authService = new AuthService({
 			enabled: authEnabled,
 			admins,
-			skipCredentialVerification
+			skipCredentialVerification,
+			credentialVerificationCacheTtlMs
 		});
 		authFetchMiddleware = createAuthFetchMiddleware(authService);
 	}
@@ -5942,14 +5955,12 @@ async function _setupCommonInfrastructure(options) {
 		documentPermissionService = new DocumentPermissionService(db, { defaultProtection });
 		logger.info("Document permission service initialized");
 	}
-	let authorizationService;
-	if (documentPermissionService) {
-		authorizationService = new AuthorizationService(documentPermissionService, {
-			admins,
-			defaultProtection
-		});
-		logger.info("Authorization service initialized");
-	}
+	const policy = documentPermissionService ? AuthorizationPolicy.DOCUMENT_PERMISSIONS : authEnabled ? AuthorizationPolicy.ADMIN_ONLY : AuthorizationPolicy.OPEN;
+	const authorizationConfig = {
+		admins,
+		defaultProtection,
+		policy
+	};
 	const attachmentStoragePath = resolveAttachmentStoragePath(options);
 	await mkdir(attachmentStoragePath, { recursive: true });
 	const { db: attachmentDb, knex: attachmentKnex, pglite: attachmentPglite } = getDbClient(options.dbPath, options.pgliteFactory);
@@ -5969,23 +5980,20 @@ async function _setupCommonInfrastructure(options) {
 		httpAdapter,
 		authFetchMiddleware,
 		authService,
-		auth: {
-			enabled: authEnabled,
-			admins
-		},
 		relationalDb,
 		analyticsStore,
 		documentPermissionService,
-		authorizationService,
+		authorizationConfig,
 		attachments,
 		packages,
-		dbClosers
+		dbClosers,
+		readiness
 	};
 }
 /**
 * Private helper function containing common setup logic for API initialization
 */
-async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, auth, processorApp, readModels, attachments, authorizationService, documentModelRegistry, dbClosers = [], reactorDriveClient) {
+async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient) {
 	const hostModule = {
 		relationalDb,
 		analyticsStore,
@@ -6030,6 +6038,8 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 		}))).flat());
 	}
 	const { httpServer, wsServer } = await startServer(httpAdapter, port, options.https, logger);
+	const authorizationService = createAuthorizationService(authorizationConfig, documentPermissionService, createGetParentIdsFn(reactorClient));
+	logger.info(`Authorization service initialized (policy: ${authorizationConfig.policy})`);
 	const coreSubgraphs = DefaultCoreSubgraphs.slice();
 	coreSubgraphs.push(ReactorSubgraph);
 	if (documentPermissionService) {
@@ -6039,12 +6049,13 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	const graphqlManager = await setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, {
 		extended: subgraphs,
 		core: coreSubgraphs
-	}, logger.child(["graphql-manager"]), auth, documentPermissionService, options.enableDocumentModelSubgraphs, port, authorizationService, reactorDriveClient);
+	}, logger.child(["graphql-manager"]), authorizationService, authService, documentPermissionService, options.enableDocumentModelSubgraphs, port, reactorDriveClient);
 	setupEventListeners(packages, graphqlManager, reactorProcessorManager, hostModule, documentModelRegistry);
 	if (mcpServerEnabled) {
 		await setupMcpServer({
 			client: reactorClient,
-			syncManager
+			syncManager,
+			authorizeRequest: createMcpRequestAuthorizer(authService, authorizationService)
 		}, httpAdapter);
 		logger.info(`MCP server available at http://localhost:${port}/mcp`);
 	}
@@ -6101,7 +6112,7 @@ function buildApiDispose(args) {
 	};
 }
 async function initializeAndStartAPI(clientInitializer, options, processorApp) {
-	const { port, httpAdapter, authFetchMiddleware, authService, auth, relationalDb, analyticsStore, documentPermissionService, authorizationService, attachments, packages, dbClosers } = await _setupCommonInfrastructure(options);
+	const { port, httpAdapter, authFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
 	const { documentModels, processors, subgraphs } = await packages.init();
 	const { module: reactorClientModule, reactorDriveClient } = await clientInitializer(documentModels);
 	const reactorClient = reactorClientModule.client;
@@ -6112,10 +6123,11 @@ async function initializeAndStartAPI(clientInitializer, options, processorApp) {
 	const documentModelRegistry = reactorClientModule.reactorModule?.documentModelRegistry;
 	if (!documentModelRegistry) throw new Error("DocumentModelRegistry not available from ReactorClientModule");
 	return {
-		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, auth, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, authorizationService, documentModelRegistry, dbClosers, reactorDriveClient),
+		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient),
 		client: reactorClient,
 		syncManager,
-		documentModelRegistry
+		documentModelRegistry,
+		readiness
 	};
 }
 //#endregion
@@ -6219,7 +6231,7 @@ var PackageManagementService = class {
 	}
 };
 //#endregion
-export { ADMIN_USERS, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentInputSchema, AuthService, AuthSubgraph, BaseSubgraph, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
+export { ADMIN_USERS, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, assertAuthRequiredForDocumentPermissions, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=30eaf1c5-796a-5cab-8266-cfe233f9e901
+//# debugId=cae89b22-c317-5acb-b1ec-dc325f23f6cf