@powerhousedao/reactor-api 6.2.0-dev.21 → 6.2.0-dev.23

package/dist/index.mjs

@@ -1,6 +1,6 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cae89b22-c317-5acb-b1ec-dc325f23f6cf")}catch(e){}}();
-import { a as isSubgraphClass, c as loadDocumentModels, d as BaseSubgraph, f as AuthorizationPolicy, i as buildGraphqlOperations, l as loadProcessors, m as createAuthorizationService, n as buildGraphQlDriveDocument, o as debounce, p as AuthorizedDocumentHandle, r as buildGraphqlOperation, t as buildGraphQlDocument, u as loadSubgraphs } from "./utils-Dh9tl892.mjs";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="907dd002-0f18-5e7a-aa9e-ad649cd5d408")}catch(e){}}();
+import { a as isSubgraphClass, c as loadDocumentModels, d as BaseSubgraph, f as AuthorizationPolicy, i as buildGraphqlOperations, l as loadProcessors, m as createAuthorizationService, n as buildGraphQlDriveDocument, o as debounce, p as AuthorizedDocumentHandle, r as buildGraphqlOperation, t as buildGraphQlDocument, u as loadSubgraphs } from "./utils-BMmk8cu0.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
@@ -70,16 +70,16 @@ var AnalyticsSubgraph = class extends BaseSubgraph {
 };
 //#endregion
 //#region src/graphql/auth/schema.graphql
-var schema_default$2 = "# Auth Subgraph Schema\n# Contains all document permission and authorization related types\n\nscalar DateTime\n\n# Permission levels for documents\nenum DocumentPermissionLevel {\n  # Can fetch and read the document\n  READ\n  # Can push updates and modify the document\n  WRITE\n  # Can manage document permissions and settings\n  ADMIN\n}\n\n# Document permission entry\ntype DocumentPermissionEntry {\n  documentId: String!\n  userAddress: String!\n  permission: DocumentPermissionLevel!\n  grantedBy: String!\n  createdAt: DateTime!\n  updatedAt: DateTime!\n}\n\n# Group type\ntype Group {\n  id: Int!\n  name: String!\n  description: String\n  createdAt: DateTime!\n  updatedAt: DateTime!\n  members: [String!]!\n}\n\n# Document group permission entry\ntype DocumentGroupPermission {\n  documentId: String!\n  groupId: Int!\n  group: Group!\n  permission: DocumentPermissionLevel!\n  grantedBy: String!\n  createdAt: DateTime!\n  updatedAt: DateTime!\n}\n\n# Operation user permission entry\ntype OperationUserPermission {\n  documentId: String!\n  operationType: String!\n  userAddress: String!\n  grantedBy: String!\n  createdAt: DateTime!\n}\n\n# Operation group permission entry\ntype OperationGroupPermission {\n  documentId: String!\n  operationType: String!\n  groupId: Int!\n  group: Group!\n  grantedBy: String!\n  createdAt: DateTime!\n}\n\n# Combined document access info\ntype DocumentAccessInfo {\n  documentId: String!\n  permissions: [DocumentPermissionEntry!]!\n  groupPermissions: [DocumentGroupPermission!]!\n}\n\n# Operation permissions info\ntype OperationPermissionsInfo {\n  documentId: String!\n  operationType: String!\n  userPermissions: [OperationUserPermission!]!\n  groupPermissions: [OperationGroupPermission!]!\n}\n\n# Document protection info\ntype DocumentProtectionInfo {\n  documentId: String!\n  protected: Boolean!\n  ownerAddress: String\n}\n\ntype Query {\n  # Get permissions for a document\n  documentAccess(documentId: String!): DocumentAccessInfo!\n\n  # Get protection status for a document\n  documentProtection(documentId: String!): DocumentProtectionInfo!\n\n  # Get all documents the current user has explicit access to\n  userDocumentPermissions: [DocumentPermissionEntry!]!\n\n  # Get all groups\n  groups: [Group!]!\n\n  # Get a specific group by ID\n  group(id: Int!): Group\n\n  # Get all groups a user belongs to\n  userGroups(userAddress: String!): [Group!]!\n\n  # Get operation permissions for a document and operation type\n  operationPermissions(\n    documentId: String!\n    operationType: String!\n  ): OperationPermissionsInfo!\n\n  # Check if the current user can execute a specific operation on a document\n  canExecuteOperation(documentId: String!, operationType: String!): Boolean!\n}\n\ntype Mutation {\n  # Set document protection status (requires ADMIN permission or global admin)\n  setDocumentProtection(\n    documentId: String!\n    protected: Boolean!\n  ): DocumentProtectionInfo!\n\n  # Transfer document ownership (requires ADMIN permission or global admin)\n  transferDocumentOwnership(\n    documentId: String!\n    newOwnerAddress: String!\n  ): DocumentProtectionInfo!\n\n  # Grant a user permission on a document (requires ADMIN permission or global admin)\n  grantDocumentPermission(\n    documentId: String!\n    userAddress: String!\n    permission: DocumentPermissionLevel!\n  ): DocumentPermissionEntry!\n\n  # Revoke a user's permission on a document (requires ADMIN permission or global admin)\n  revokeDocumentPermission(documentId: String!, userAddress: String!): Boolean!\n\n  # --- Group Management ---\n\n  # Create a new group\n  createGroup(name: String!, description: String): Group!\n\n  # Delete a group and all its associations\n  deleteGroup(id: Int!): Boolean!\n\n  # Add a user to a group\n  addUserToGroup(userAddress: String!, groupId: Int!): Boolean!\n\n  # Remove a user from a group\n  removeUserFromGroup(userAddress: String!, groupId: Int!): Boolean!\n\n  # --- Group Document Permissions ---\n\n  # Grant a group permission on a document\n  grantGroupPermission(\n    documentId: String!\n    groupId: Int!\n    permission: DocumentPermissionLevel!\n  ): DocumentGroupPermission!\n\n  # Revoke a group's permission on a document\n  revokeGroupPermission(documentId: String!, groupId: Int!): Boolean!\n\n  # --- Operation Permissions ---\n\n  # Grant a user permission to execute an operation on a document\n  grantOperationPermission(\n    documentId: String!\n    operationType: String!\n    userAddress: String!\n  ): OperationUserPermission!\n\n  # Revoke a user's permission to execute an operation\n  revokeOperationPermission(\n    documentId: String!\n    operationType: String!\n    userAddress: String!\n  ): Boolean!\n\n  # Grant a group permission to execute an operation on a document\n  grantGroupOperationPermission(\n    documentId: String!\n    operationType: String!\n    groupId: Int!\n  ): OperationGroupPermission!\n\n  # Revoke a group's permission to execute an operation\n  revokeGroupOperationPermission(\n    documentId: String!\n    operationType: String!\n    groupId: Int!\n  ): Boolean!\n}\n";
+var schema_default$2 = "# Auth Subgraph Schema\n# Contains all document permission and authorization related types\n\nscalar DateTime\n\n# Permission levels for documents\nenum DocumentPermissionLevel {\n  # Can fetch and read the document\n  READ\n  # Can push updates and modify the document\n  WRITE\n  # Can manage document permissions and settings\n  ADMIN\n}\n\n# Document permission entry\ntype DocumentPermissionEntry {\n  documentId: String!\n  userAddress: String!\n  permission: DocumentPermissionLevel!\n  grantedBy: String!\n  createdAt: DateTime!\n  updatedAt: DateTime!\n}\n\n# Operation user permission entry\ntype OperationUserPermission {\n  documentId: String!\n  operationType: String!\n  userAddress: String!\n  grantedBy: String!\n  createdAt: DateTime!\n}\n\n# Combined document access info\ntype DocumentAccessInfo {\n  documentId: String!\n  permissions: [DocumentPermissionEntry!]!\n}\n\n# Operation permissions info\ntype OperationPermissionsInfo {\n  documentId: String!\n  operationType: String!\n  userPermissions: [OperationUserPermission!]!\n}\n\n# Document protection info\ntype DocumentProtectionInfo {\n  documentId: String!\n  protected: Boolean!\n  ownerAddress: String\n}\n\ntype Query {\n  # Get permissions for a document (requires ADMIN permission or global admin)\n  documentAccess(documentId: String!): DocumentAccessInfo!\n\n  # Get protection status for a document (requires ADMIN permission or global admin)\n  documentProtection(documentId: String!): DocumentProtectionInfo!\n\n  # Get all documents the current user has explicit access to\n  userDocumentPermissions: [DocumentPermissionEntry!]!\n\n  # Get operation permissions for a document and operation type\n  # (requires ADMIN permission or global admin)\n  operationPermissions(\n    documentId: String!\n    operationType: String!\n  ): OperationPermissionsInfo!\n\n  # Check if the current user can execute a specific operation on a document\n  canExecuteOperation(documentId: String!, operationType: String!): Boolean!\n}\n\ntype Mutation {\n  # Set document protection status (requires ADMIN permission or global admin)\n  setDocumentProtection(\n    documentId: String!\n    protected: Boolean!\n  ): DocumentProtectionInfo!\n\n  # Transfer document ownership (requires ADMIN permission or global admin)\n  transferDocumentOwnership(\n    documentId: String!\n    newOwnerAddress: String!\n  ): DocumentProtectionInfo!\n\n  # Grant a user permission on a document (requires ADMIN permission or global admin)\n  grantDocumentPermission(\n    documentId: String!\n    userAddress: String!\n    permission: DocumentPermissionLevel!\n  ): DocumentPermissionEntry!\n\n  # Revoke a user's permission on a document (requires ADMIN permission or global admin)\n  revokeDocumentPermission(documentId: String!, userAddress: String!): Boolean!\n\n  # --- Operation Permissions ---\n\n  # Grant a user permission to execute an operation on a document\n  grantOperationPermission(\n    documentId: String!\n    operationType: String!\n    userAddress: String!\n  ): OperationUserPermission!\n\n  # Revoke a user's permission to execute an operation\n  revokeOperationPermission(\n    documentId: String!\n    operationType: String!\n    userAddress: String!\n  ): Boolean!\n}\n";
 //#endregion
 //#region src/graphql/auth/resolvers.ts
-async function documentAccess(service, args) {
+async function documentAccess(service, authorizationService, args, userAddress) {
+	if (!userAddress) throw new GraphQLError("Authentication required");
+	if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to view its permissions");
 	const permissions = await service.getDocumentPermissions(args.documentId);
-	const groupPermissions = await service.getDocumentGroupPermissions(args.documentId);
 	return {
 		documentId: args.documentId,
-		permissions,
-		groupPermissions
+		permissions
 	};
 }
 async function userDocumentPermissions(service, userAddress) {
@@ -96,52 +96,14 @@ async function revokeDocumentPermission(service, authorizationService, args, rev
 	await service.revokePermission(args.documentId, args.userAddress);
 	return true;
 }
-async function groups(service) {
-	return service.listGroups();
-}
-async function group(service, args) {
-	return service.getGroup(args.id);
-}
-async function userGroups(service, args) {
-	return service.getUserGroups(args.userAddress);
-}
-async function createGroup(service, args) {
-	return service.createGroup(args.name, args.description ?? void 0);
-}
-async function deleteGroup(service, args) {
-	await service.deleteGroup(args.id);
-	return true;
-}
-async function addUserToGroup(service, args) {
-	await service.addUserToGroup(args.userAddress, args.groupId);
-	return true;
-}
-async function removeUserFromGroup(service, args) {
-	await service.removeUserFromGroup(args.userAddress, args.groupId);
-	return true;
-}
-async function getGroupMembers(service, groupId) {
-	return service.getGroupMembers(groupId);
-}
-async function grantGroupPermission(service, authorizationService, args, grantedByAddress) {
-	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!await authorizationService.canManage(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant permissions");
-	return service.grantGroupPermission(args.documentId, args.groupId, args.permission, grantedByAddress);
-}
-async function revokeGroupPermission(service, authorizationService, args, revokedByAddress) {
-	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!await authorizationService.canManage(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke permissions");
-	await service.revokeGroupPermission(args.documentId, args.groupId);
-	return true;
-}
-async function operationPermissions(service, args) {
+async function operationPermissions(service, authorizationService, args, userAddress) {
+	if (!userAddress) throw new GraphQLError("Authentication required");
+	if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to view its operation permissions");
 	const userPermissions = await service.getOperationUserPermissions(args.documentId, args.operationType);
-	const groupPermissions = await service.getOperationGroupPermissions(args.documentId, args.operationType);
 	return {
 		documentId: args.documentId,
 		operationType: args.operationType,
-		userPermissions,
-		groupPermissions
+		userPermissions
 	};
 }
 async function canExecuteOperation(authorizationService, args, userAddress) {
@@ -158,18 +120,9 @@ async function revokeOperationPermission(service, authorizationService, args, re
 	await service.revokeOperationPermission(args.documentId, args.operationType, args.userAddress);
 	return true;
 }
-async function grantGroupOperationPermission(service, authorizationService, args, grantedByAddress) {
-	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!await authorizationService.canManage(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant operation permissions");
-	return service.grantGroupOperationPermission(args.documentId, args.operationType, args.groupId, grantedByAddress);
-}
-async function revokeGroupOperationPermission(service, authorizationService, args, revokedByAddress) {
-	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!await authorizationService.canManage(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke operation permissions");
-	await service.revokeGroupOperationPermission(args.documentId, args.operationType, args.groupId);
-	return true;
-}
-async function documentProtection(service, args) {
+async function documentProtection(service, authorizationService, args, userAddress) {
+	if (!userAddress) throw new GraphQLError("Authentication required");
+	if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to view its protection info");
 	return service.getDocumentProtection(args.documentId);
 }
 async function setDocumentProtection(service, authorizationService, args, userAddress) {
@@ -195,8 +148,7 @@ async function transferDocumentOwnership(service, authorizationService, args, us
 * This subgraph is conditionally registered based on the DOCUMENT_PERMISSIONS_ENABLED
 * feature flag. When enabled, it provides GraphQL operations for:
 * - Document permissions (grant/revoke user access)
-* - Group management (create/delete groups, manage membership)
-* - Group document permissions (grant/revoke group access)
+* - Document protection and ownership
 * - Operation-level permissions (fine-grained operation control)
 */
 var AuthSubgraph = class extends BaseSubgraph {
@@ -210,11 +162,11 @@ var AuthSubgraph = class extends BaseSubgraph {
 	typeDefs = gql(schema_default$2);
 	resolvers = {
 		Query: {
-			documentAccess: async (_parent, args) => {
+			documentAccess: async (_parent, args, ctx) => {
 				this.logger.debug("documentAccess(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					return await documentAccess(this.documentPermissionService, args);
+					return await documentAccess(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in documentAccess: @error", error);
 					throw error;
@@ -231,41 +183,11 @@ var AuthSubgraph = class extends BaseSubgraph {
 					throw error;
 				}
 			},
-			groups: async () => {
-				this.logger.debug("groups");
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					return await groups(this.documentPermissionService);
-				} catch (error) {
-					this.logger.error("Error in groups: @error", error);
-					throw error;
-				}
-			},
-			group: async (_parent, args) => {
-				this.logger.debug("group(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					return await group(this.documentPermissionService, args);
-				} catch (error) {
-					this.logger.error("Error in group: @error", error);
-					throw error;
-				}
-			},
-			userGroups: async (_parent, args) => {
-				this.logger.debug("userGroups(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					return await userGroups(this.documentPermissionService, args);
-				} catch (error) {
-					this.logger.error("Error in userGroups: @error", error);
-					throw error;
-				}
-			},
-			operationPermissions: async (_parent, args) => {
+			operationPermissions: async (_parent, args, ctx) => {
 				this.logger.debug("operationPermissions(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					return await operationPermissions(this.documentPermissionService, args);
+					return await operationPermissions(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in operationPermissions: @error", error);
 					throw error;
@@ -283,9 +205,8 @@ var AuthSubgraph = class extends BaseSubgraph {
 			documentProtection: async (_parent, args, ctx) => {
 				this.logger.debug("documentProtection(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				if (!ctx.user?.address) throw new GraphQLError("Authentication required to view document protection info");
 				try {
-					return await documentProtection(this.documentPermissionService, args);
+					return await documentProtection(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in documentProtection: @error", error);
 					throw error;
@@ -337,70 +258,6 @@ var AuthSubgraph = class extends BaseSubgraph {
 					throw error;
 				}
 			},
-			createGroup: async (_parent, args) => {
-				this.logger.debug("createGroup(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					return await createGroup(this.documentPermissionService, args);
-				} catch (error) {
-					this.logger.error("Error in createGroup: @error", error);
-					throw error;
-				}
-			},
-			deleteGroup: async (_parent, args) => {
-				this.logger.debug("deleteGroup(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					return await deleteGroup(this.documentPermissionService, args);
-				} catch (error) {
-					this.logger.error("Error in deleteGroup: @error", error);
-					throw error;
-				}
-			},
-			addUserToGroup: async (_parent, args) => {
-				this.logger.debug("addUserToGroup(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					return await addUserToGroup(this.documentPermissionService, args);
-				} catch (error) {
-					this.logger.error("Error in addUserToGroup: @error", error);
-					throw error;
-				}
-			},
-			removeUserFromGroup: async (_parent, args) => {
-				this.logger.debug("removeUserFromGroup(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					return await removeUserFromGroup(this.documentPermissionService, args);
-				} catch (error) {
-					this.logger.error("Error in removeUserFromGroup: @error", error);
-					throw error;
-				}
-			},
-			grantGroupPermission: async (_parent, args, ctx) => {
-				this.logger.debug("grantGroupPermission(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					const resolved = await this.withCanonicalDocumentId(args, ctx);
-					return await grantGroupPermission(this.documentPermissionService, this.authorizationService, {
-						...resolved,
-						permission: resolved.permission
-					}, ctx.user?.address);
-				} catch (error) {
-					this.logger.error("Error in grantGroupPermission: @error", error);
-					throw error;
-				}
-			},
-			revokeGroupPermission: async (_parent, args, ctx) => {
-				this.logger.debug("revokeGroupPermission(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					return await revokeGroupPermission(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
-				} catch (error) {
-					this.logger.error("Error in revokeGroupPermission: @error", error);
-					throw error;
-				}
-			},
 			grantOperationPermission: async (_parent, args, ctx) => {
 				this.logger.debug("grantOperationPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
@@ -420,44 +277,8 @@ var AuthSubgraph = class extends BaseSubgraph {
 					this.logger.error("Error in revokeOperationPermission: @error", error);
 					throw error;
 				}
-			},
-			grantGroupOperationPermission: async (_parent, args, ctx) => {
-				this.logger.debug("grantGroupOperationPermission(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					return await grantGroupOperationPermission(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
-				} catch (error) {
-					this.logger.error("Error in grantGroupOperationPermission: @error", error);
-					throw error;
-				}
-			},
-			revokeGroupOperationPermission: async (_parent, args, ctx) => {
-				this.logger.debug("revokeGroupOperationPermission(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					return await revokeGroupOperationPermission(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
-				} catch (error) {
-					this.logger.error("Error in revokeGroupOperationPermission: @error", error);
-					throw error;
-				}
 			}
-		},
-		Group: { members: async (parent) => {
-			if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-			return getGroupMembers(this.documentPermissionService, parent.id);
-		} },
-		DocumentGroupPermission: { group: async (parent) => {
-			if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-			const grp = await group(this.documentPermissionService, { id: parent.groupId });
-			if (!grp) throw new GraphQLError(`Group not found: ${parent.groupId}`);
-			return grp;
-		} },
-		OperationGroupPermission: { group: async (parent) => {
-			if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-			const grp = await group(this.documentPermissionService, { id: parent.groupId });
-			if (!grp) throw new GraphQLError(`Group not found: ${parent.groupId}`);
-			return grp;
-		} }
+		}
 	};
 	onSetup() {
 		this.logger.debug("Setting up AuthSubgraph");
@@ -4341,10 +4162,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.0-dev.21";
+	return "6.2.0-dev.23";
 }
 function getGitHash() {
-	return "8c530ad4abddfd97af80105f222545dc95e561a9";
+	return "7601d1b00b40cfb1088bc72bb08dbde9a425c0e5";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -4827,10 +4648,10 @@ const DefaultCoreSubgraphs = [AnalyticsSubgraph, SystemSubgraph];
 //#endregion
 //#region src/migrations/001_create_document_permissions.ts
 var _001_create_document_permissions_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$2,
+	up: () => up$2
 });
-async function up$1(db) {
+async function up$2(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS "DocumentPermission" (
       "id" SERIAL PRIMARY KEY,
@@ -4904,7 +4725,7 @@ async function up$1(db) {
 	await sql`CREATE INDEX IF NOT EXISTS "operationgrouppermission_documentid_index" ON "OperationGroupPermission" ("documentId")`.execute(db);
 	await sql`CREATE INDEX IF NOT EXISTS "operationgrouppermission_groupid_index" ON "OperationGroupPermission" ("groupId")`.execute(db);
 }
-async function down$1(db) {
+async function down$2(db) {
 	await sql`DROP TABLE IF EXISTS "OperationGroupPermission"`.execute(db);
 	await sql`DROP TABLE IF EXISTS "OperationUserPermission"`.execute(db);
 	await sql`DROP TABLE IF EXISTS "DocumentGroupPermission"`.execute(db);
@@ -4915,10 +4736,10 @@ async function down$1(db) {
 //#endregion
 //#region src/migrations/002_add_document_protection.ts
 var _002_add_document_protection_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$1,
+	up: () => up$1
 });
-async function up(db) {
+async function up$1(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS "DocumentProtection" (
       "documentId" VARCHAR(255) PRIMARY KEY,
@@ -4931,10 +4752,80 @@ async function up(db) {
 	await sql`CREATE INDEX IF NOT EXISTS "documentprotection_owneraddress_index" ON "DocumentProtection" ("ownerAddress")`.execute(db);
 	await sql`CREATE INDEX IF NOT EXISTS "documentprotection_protected_index" ON "DocumentProtection" ("protected")`.execute(db);
 }
-async function down(db) {
+async function down$1(db) {
 	await sql`DROP TABLE IF EXISTS "DocumentProtection"`.execute(db);
 }
 //#endregion
+//#region src/migrations/003_remove_group_tables.ts
+var _003_remove_group_tables_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* Removes the group-permission feature: the Group, UserGroup,
+* DocumentGroupPermission, and OperationGroupPermission tables. The feature had
+* no consumers and disclosed ACL/membership metadata (AUTH_REVIEW S-H3/S-H5);
+* it is retired in favor of direct user grants, ownership, and protection.
+*
+* Tables are dropped in reverse dependency order. There are no DB-enforced
+* foreign keys, so the drops cannot violate referential integrity and do not
+* touch the surviving DocumentPermission / OperationUserPermission /
+* DocumentProtection tables.
+*/
+async function up(db) {
+	await sql`DROP TABLE IF EXISTS "OperationGroupPermission"`.execute(db);
+	await sql`DROP TABLE IF EXISTS "DocumentGroupPermission"`.execute(db);
+	await sql`DROP TABLE IF EXISTS "UserGroup"`.execute(db);
+	await sql`DROP TABLE IF EXISTS "Group"`.execute(db);
+}
+async function down(db) {
+	await sql`
+    CREATE TABLE IF NOT EXISTS "Group" (
+      "id" SERIAL PRIMARY KEY,
+      "name" VARCHAR(255) NOT NULL UNIQUE,
+      "description" TEXT,
+      "createdAt" TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      "updatedAt" TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+    )
+  `.execute(db);
+	await sql`
+    CREATE TABLE IF NOT EXISTS "UserGroup" (
+      "userAddress" VARCHAR(255) NOT NULL,
+      "groupId" INTEGER NOT NULL,
+      "createdAt" TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      PRIMARY KEY ("userAddress", "groupId")
+    )
+  `.execute(db);
+	await sql`CREATE INDEX IF NOT EXISTS "usergroup_groupid_index" ON "UserGroup" ("groupId")`.execute(db);
+	await sql`
+    CREATE TABLE IF NOT EXISTS "DocumentGroupPermission" (
+      "id" SERIAL PRIMARY KEY,
+      "documentId" VARCHAR(255) NOT NULL,
+      "groupId" INTEGER NOT NULL,
+      "permission" VARCHAR(20) NOT NULL CHECK ("permission" IN ('READ', 'WRITE', 'ADMIN')),
+      "grantedBy" VARCHAR(255) NOT NULL,
+      "createdAt" TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      "updatedAt" TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      UNIQUE ("documentId", "groupId")
+    )
+  `.execute(db);
+	await sql`CREATE INDEX IF NOT EXISTS "documentgrouppermission_documentid_index" ON "DocumentGroupPermission" ("documentId")`.execute(db);
+	await sql`CREATE INDEX IF NOT EXISTS "documentgrouppermission_groupid_index" ON "DocumentGroupPermission" ("groupId")`.execute(db);
+	await sql`
+    CREATE TABLE IF NOT EXISTS "OperationGroupPermission" (
+      "id" SERIAL PRIMARY KEY,
+      "documentId" VARCHAR(255) NOT NULL,
+      "operationType" VARCHAR(255) NOT NULL,
+      "groupId" INTEGER NOT NULL,
+      "grantedBy" VARCHAR(255) NOT NULL,
+      "createdAt" TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      UNIQUE ("documentId", "operationType", "groupId")
+    )
+  `.execute(db);
+	await sql`CREATE INDEX IF NOT EXISTS "operationgrouppermission_documentid_index" ON "OperationGroupPermission" ("documentId")`.execute(db);
+	await sql`CREATE INDEX IF NOT EXISTS "operationgrouppermission_groupid_index" ON "OperationGroupPermission" ("groupId")`.execute(db);
+}
+//#endregion
 //#region src/migrations/index.ts
 /**
 * Custom migration provider that loads migrations from imported modules
@@ -4943,7 +4834,8 @@ var StaticMigrationProvider = class {
 	getMigrations() {
 		return Promise.resolve({
 			"001_create_document_permissions": _001_create_document_permissions_exports,
-			"002_add_document_protection": _002_add_document_protection_exports
+			"002_add_document_protection": _002_add_document_protection_exports,
+			"003_remove_group_tables": _003_remove_group_tables_exports
 		});
 	}
 };
@@ -5131,7 +5023,7 @@ var AuthService = class {
 * - ADMIN: Can manage document permissions and settings
 *
 * Operation permissions:
-* - Users and groups can be granted permission to execute specific operations
+* - Users can be granted permission to execute specific operations
 */
 var DocumentPermissionService = class {
 	config;
@@ -5210,152 +5102,7 @@ var DocumentPermissionService = class {
 	*/
 	async deleteAllDocumentPermissions(documentId) {
 		await this.db.deleteFrom("DocumentPermission").where("documentId", "=", documentId).execute();
-		await this.db.deleteFrom("DocumentGroupPermission").where("documentId", "=", documentId).execute();
 		await this.db.deleteFrom("OperationUserPermission").where("documentId", "=", documentId).execute();
-		await this.db.deleteFrom("OperationGroupPermission").where("documentId", "=", documentId).execute();
-	}
-	/**
-	* Create a new group
-	*/
-	async createGroup(name, description) {
-		const now = /* @__PURE__ */ new Date();
-		await this.db.insertInto("Group").values({
-			name,
-			description: description ?? null,
-			createdAt: now,
-			updatedAt: now
-		}).execute();
-		return await this.db.selectFrom("Group").select([
-			"id",
-			"name",
-			"description",
-			"createdAt",
-			"updatedAt"
-		]).where("name", "=", name).executeTakeFirstOrThrow();
-	}
-	/**
-	* Delete a group and all its associations
-	*/
-	async deleteGroup(groupId) {
-		await this.db.deleteFrom("OperationGroupPermission").where("groupId", "=", groupId).execute();
-		await this.db.deleteFrom("DocumentGroupPermission").where("groupId", "=", groupId).execute();
-		await this.db.deleteFrom("UserGroup").where("groupId", "=", groupId).execute();
-		await this.db.deleteFrom("Group").where("id", "=", groupId).execute();
-	}
-	/**
-	* Get a group by ID
-	*/
-	async getGroup(groupId) {
-		return await this.db.selectFrom("Group").select([
-			"id",
-			"name",
-			"description",
-			"createdAt",
-			"updatedAt"
-		]).where("id", "=", groupId).executeTakeFirst() ?? null;
-	}
-	/**
-	* List all groups
-	*/
-	async listGroups() {
-		return this.db.selectFrom("Group").select([
-			"id",
-			"name",
-			"description",
-			"createdAt",
-			"updatedAt"
-		]).execute();
-	}
-	/**
-	* Add a user to a group
-	*/
-	async addUserToGroup(userAddress, groupId) {
-		const now = /* @__PURE__ */ new Date();
-		const normalizedAddress = userAddress.toLowerCase();
-		await this.db.insertInto("UserGroup").values({
-			userAddress: normalizedAddress,
-			groupId,
-			createdAt: now
-		}).onConflict((oc) => oc.columns(["userAddress", "groupId"]).doNothing()).execute();
-	}
-	/**
-	* Remove a user from a group
-	*/
-	async removeUserFromGroup(userAddress, groupId) {
-		await this.db.deleteFrom("UserGroup").where("userAddress", "=", userAddress.toLowerCase()).where("groupId", "=", groupId).execute();
-	}
-	/**
-	* Get all groups a user belongs to
-	*/
-	async getUserGroups(userAddress) {
-		return this.db.selectFrom("UserGroup").innerJoin("Group", "Group.id", "UserGroup.groupId").select([
-			"Group.id",
-			"Group.name",
-			"Group.description",
-			"Group.createdAt",
-			"Group.updatedAt"
-		]).where("UserGroup.userAddress", "=", userAddress.toLowerCase()).execute();
-	}
-	/**
-	* Get all members of a group
-	*/
-	async getGroupMembers(groupId) {
-		return (await this.db.selectFrom("UserGroup").select("userAddress").where("groupId", "=", groupId).execute()).map((r) => r.userAddress);
-	}
-	/**
-	* Grant a group permission on a document
-	*/
-	async grantGroupPermission(documentId, groupId, permission, grantedBy) {
-		const now = /* @__PURE__ */ new Date();
-		await this.db.insertInto("DocumentGroupPermission").values({
-			documentId,
-			groupId,
-			permission,
-			grantedBy: grantedBy.toLowerCase(),
-			createdAt: now,
-			updatedAt: now
-		}).onConflict((oc) => oc.columns(["documentId", "groupId"]).doUpdateSet({
-			permission,
-			grantedBy: grantedBy.toLowerCase(),
-			updatedAt: now
-		})).execute();
-		return await this.db.selectFrom("DocumentGroupPermission").select([
-			"documentId",
-			"groupId",
-			"permission",
-			"grantedBy",
-			"createdAt",
-			"updatedAt"
-		]).where("documentId", "=", documentId).where("groupId", "=", groupId).executeTakeFirstOrThrow();
-	}
-	/**
-	* Revoke a group's permission on a document
-	*/
-	async revokeGroupPermission(documentId, groupId) {
-		await this.db.deleteFrom("DocumentGroupPermission").where("documentId", "=", documentId).where("groupId", "=", groupId).execute();
-	}
-	/**
-	* Get all group permissions for a document
-	*/
-	async getDocumentGroupPermissions(documentId) {
-		return this.db.selectFrom("DocumentGroupPermission").select([
-			"documentId",
-			"groupId",
-			"permission",
-			"grantedBy",
-			"createdAt",
-			"updatedAt"
-		]).where("documentId", "=", documentId).execute();
-	}
-	/**
-	* Get best permission level a user has on a document via groups
-	*/
-	async getUserGroupPermission(documentId, userAddress) {
-		const result = await this.db.selectFrom("DocumentGroupPermission").innerJoin("UserGroup", "UserGroup.groupId", "DocumentGroupPermission.groupId").select("DocumentGroupPermission.permission").where("DocumentGroupPermission.documentId", "=", documentId).where("UserGroup.userAddress", "=", userAddress.toLowerCase()).execute();
-		if (result.length === 0) return null;
-		if (result.some((r) => r.permission === "ADMIN")) return "ADMIN";
-		if (result.some((r) => r.permission === "WRITE")) return "WRITE";
-		return "READ";
 	}
 	/**
 	* Grant a user permission to execute an operation on a document
@@ -5389,36 +5136,6 @@ var DocumentPermissionService = class {
 		await this.db.deleteFrom("OperationUserPermission").where("documentId", "=", documentId).where("operationType", "=", operationType).where("userAddress", "=", userAddress.toLowerCase()).execute();
 	}
 	/**
-	* Grant a group permission to execute an operation on a document
-	*/
-	async grantGroupOperationPermission(documentId, operationType, groupId, grantedBy) {
-		const now = /* @__PURE__ */ new Date();
-		await this.db.insertInto("OperationGroupPermission").values({
-			documentId,
-			operationType,
-			groupId,
-			grantedBy: grantedBy.toLowerCase(),
-			createdAt: now
-		}).onConflict((oc) => oc.columns([
-			"documentId",
-			"operationType",
-			"groupId"
-		]).doNothing()).execute();
-		return await this.db.selectFrom("OperationGroupPermission").select([
-			"documentId",
-			"operationType",
-			"groupId",
-			"grantedBy",
-			"createdAt"
-		]).where("documentId", "=", documentId).where("operationType", "=", operationType).where("groupId", "=", groupId).executeTakeFirstOrThrow();
-	}
-	/**
-	* Revoke a group's permission to execute an operation
-	*/
-	async revokeGroupOperationPermission(documentId, operationType, groupId) {
-		await this.db.deleteFrom("OperationGroupPermission").where("documentId", "=", documentId).where("operationType", "=", operationType).where("groupId", "=", groupId).execute();
-	}
-	/**
 	* Get all users with permission to execute an operation
 	*/
 	async getOperationUserPermissions(documentId, operationType) {
@@ -5431,34 +5148,18 @@ var DocumentPermissionService = class {
 		]).where("documentId", "=", documentId).where("operationType", "=", operationType).execute();
 	}
 	/**
-	* Get all groups with permission to execute an operation
-	*/
-	async getOperationGroupPermissions(documentId, operationType) {
-		return this.db.selectFrom("OperationGroupPermission").select([
-			"documentId",
-			"operationType",
-			"groupId",
-			"grantedBy",
-			"createdAt"
-		]).where("documentId", "=", documentId).where("operationType", "=", operationType).execute();
-	}
-	/**
-	* Whether an operation-permission row exists for the user on this
-	* operation, either directly or via a group the user belongs to.
+	* Whether an operation-permission row exists for the user on this operation.
 	*/
 	async hasOperationGrant(documentId, operationType, userAddress) {
 		const normalizedAddress = userAddress.toLowerCase();
-		if (await this.db.selectFrom("OperationUserPermission").select("userAddress").where("documentId", "=", documentId).where("operationType", "=", operationType).where("userAddress", "=", normalizedAddress).executeTakeFirst()) return true;
-		return !!await this.db.selectFrom("OperationGroupPermission").innerJoin("UserGroup", "UserGroup.groupId", "OperationGroupPermission.groupId").select("OperationGroupPermission.groupId").where("OperationGroupPermission.documentId", "=", documentId).where("OperationGroupPermission.operationType", "=", operationType).where("UserGroup.userAddress", "=", normalizedAddress).executeTakeFirst();
+		return !!await this.db.selectFrom("OperationUserPermission").select("userAddress").where("documentId", "=", documentId).where("operationType", "=", operationType).where("userAddress", "=", normalizedAddress).executeTakeFirst();
 	}
 	/**
 	* Check if an operation has any permissions set (is restricted)
 	*/
 	async isOperationRestricted(documentId, operationType) {
 		const userPermCount = await this.db.selectFrom("OperationUserPermission").select(sql`count(*)`.as("count")).where("documentId", "=", documentId).where("operationType", "=", operationType).executeTakeFirst();
-		if (userPermCount && Number(userPermCount.count) > 0) return true;
-		const groupPermCount = await this.db.selectFrom("OperationGroupPermission").select(sql`count(*)`.as("count")).where("documentId", "=", documentId).where("operationType", "=", operationType).executeTakeFirst();
-		return groupPermCount !== void 0 && Number(groupPermCount.count) > 0;
+		return userPermCount !== void 0 && Number(userPermCount.count) > 0;
 	}
 	/**
 	* Check if a specific document has a protection row set to true.
@@ -6234,4 +5935,4 @@ var PackageManagementService = class {
 export { ADMIN_USERS, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, assertAuthRequiredForDocumentPermissions, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=cae89b22-c317-5acb-b1ec-dc325f23f6cf
+//# debugId=907dd002-0f18-5e7a-aa9e-ad649cd5d408