@powerhousedao/reactor-api 6.2.0-dev.3 → 6.2.0-dev.5

package/dist/index.mjs

@@ -1,6 +1,6 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="30eaf1c5-796a-5cab-8266-cfe233f9e901")}catch(e){}}();
-import { a as isSubgraphClass, c as loadDocumentModels, d as BaseSubgraph, i as buildGraphqlOperations, l as loadProcessors, n as buildGraphQlDriveDocument, o as debounce, r as buildGraphqlOperation, t as buildGraphQlDocument, u as loadSubgraphs } from "./utils-BFkbSO_H.mjs";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="64b14acf-bb9d-528e-b2b6-b3fa2097026f")}catch(e){}}();
+import { a as isSubgraphClass, c as loadDocumentModels, d as BaseSubgraph, f as AuthorizationPolicy, i as buildGraphqlOperations, l as loadProcessors, n as buildGraphQlDriveDocument, o as debounce, p as createAuthorizationService, r as buildGraphqlOperation, t as buildGraphQlDocument, u as loadSubgraphs } from "./utils-CtC8sjRo.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
@@ -85,18 +85,14 @@ async function documentAccess(service, args) {
 async function userDocumentPermissions(service, userAddress) {
 	return service.getUserDocuments(userAddress);
 }
-async function grantDocumentPermission(service, args, grantedByAddress, isGlobalAdmin) {
+async function grantDocumentPermission(service, authorizationService, args, grantedByAddress) {
 	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant permissions");
 	return service.grantPermission(args.documentId, args.userAddress, args.permission, grantedByAddress);
 }
-async function revokeDocumentPermission(service, args, revokedByAddress, isGlobalAdmin) {
+async function revokeDocumentPermission(service, authorizationService, args, revokedByAddress) {
 	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke permissions");
 	await service.revokePermission(args.documentId, args.userAddress);
 	return true;
 }
@@ -127,18 +123,14 @@ async function removeUserFromGroup(service, args) {
 async function getGroupMembers(service, groupId) {
 	return service.getGroupMembers(groupId);
 }
-async function grantGroupPermission(service, args, grantedByAddress, isGlobalAdmin) {
+async function grantGroupPermission(service, authorizationService, args, grantedByAddress) {
 	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant permissions");
 	return service.grantGroupPermission(args.documentId, args.groupId, args.permission, grantedByAddress);
 }
-async function revokeGroupPermission(service, args, revokedByAddress, isGlobalAdmin) {
+async function revokeGroupPermission(service, authorizationService, args, revokedByAddress) {
 	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke permissions");
 	await service.revokeGroupPermission(args.documentId, args.groupId);
 	return true;
 }
@@ -155,56 +147,40 @@ async function operationPermissions(service, args) {
 async function canExecuteOperation(service, args, userAddress) {
 	return service.canExecuteOperation(args.documentId, args.operationType, userAddress);
 }
-async function grantOperationPermission(service, args, grantedByAddress, isGlobalAdmin) {
+async function grantOperationPermission(service, authorizationService, args, grantedByAddress) {
 	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant operation permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant operation permissions");
 	return service.grantOperationPermission(args.documentId, args.operationType, args.userAddress, grantedByAddress);
 }
-async function revokeOperationPermission(service, args, revokedByAddress, isGlobalAdmin) {
+async function revokeOperationPermission(service, authorizationService, args, revokedByAddress) {
 	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke operation permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke operation permissions");
 	await service.revokeOperationPermission(args.documentId, args.operationType, args.userAddress);
 	return true;
 }
-async function grantGroupOperationPermission(service, args, grantedByAddress, isGlobalAdmin) {
+async function grantGroupOperationPermission(service, authorizationService, args, grantedByAddress) {
 	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant operation permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant operation permissions");
 	return service.grantGroupOperationPermission(args.documentId, args.operationType, args.groupId, grantedByAddress);
 }
-async function revokeGroupOperationPermission(service, args, revokedByAddress, isGlobalAdmin) {
+async function revokeGroupOperationPermission(service, authorizationService, args, revokedByAddress) {
 	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke operation permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke operation permissions");
 	await service.revokeGroupOperationPermission(args.documentId, args.operationType, args.groupId);
 	return true;
 }
 async function documentProtection(service, args) {
 	return service.getDocumentProtection(args.documentId);
 }
-async function setDocumentProtection(service, authorizationService, args, userAddress, isGlobalAdmin) {
+async function setDocumentProtection(service, authorizationService, args, userAddress) {
 	if (!userAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (authorizationService) {
-			if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to change protection");
-		} else if (!await service.canManageDocument(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to change protection");
-	}
+	if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to change protection");
 	await service.setDocumentProtection(args.documentId, args.protected);
 	return service.getDocumentProtection(args.documentId);
 }
-async function transferDocumentOwnership(service, authorizationService, args, userAddress, isGlobalAdmin) {
+async function transferDocumentOwnership(service, authorizationService, args, userAddress) {
 	if (!userAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (authorizationService) {
-			if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to transfer ownership");
-		} else if (!await service.canManageDocument(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to transfer ownership");
-	}
+	if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to transfer ownership");
 	const previousOwner = await service.getDocumentOwner(args.documentId);
 	if (previousOwner) await service.revokePermission(args.documentId, previousOwner);
 	await service.setDocumentOwner(args.documentId, args.newOwnerAddress);
@@ -322,8 +298,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("setDocumentProtection(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await setDocumentProtection(this.documentPermissionService, this.authorizationService, args, ctx.user?.address, isGlobalAdmin);
+					return await setDocumentProtection(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in setDocumentProtection: @error", error);
 					throw error;
@@ -333,8 +308,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("transferDocumentOwnership(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await transferDocumentOwnership(this.documentPermissionService, this.authorizationService, args, ctx.user?.address, isGlobalAdmin);
+					return await transferDocumentOwnership(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in transferDocumentOwnership: @error", error);
 					throw error;
@@ -344,8 +318,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("grantDocumentPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await grantDocumentPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await grantDocumentPermission(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in grantDocumentPermission: @error", error);
 					throw error;
@@ -355,8 +328,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("revokeDocumentPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await revokeDocumentPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await revokeDocumentPermission(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in revokeDocumentPermission: @error", error);
 					throw error;
@@ -406,8 +378,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("grantGroupPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await grantGroupPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await grantGroupPermission(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in grantGroupPermission: @error", error);
 					throw error;
@@ -417,8 +388,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("revokeGroupPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await revokeGroupPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await revokeGroupPermission(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in revokeGroupPermission: @error", error);
 					throw error;
@@ -428,8 +398,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("grantOperationPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await grantOperationPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await grantOperationPermission(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in grantOperationPermission: @error", error);
 					throw error;
@@ -439,8 +408,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("revokeOperationPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await revokeOperationPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await revokeOperationPermission(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in revokeOperationPermission: @error", error);
 					throw error;
@@ -450,8 +418,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("grantGroupOperationPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await grantGroupOperationPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await grantGroupOperationPermission(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in grantGroupOperationPermission: @error", error);
 					throw error;
@@ -461,8 +428,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("revokeGroupOperationPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await revokeGroupOperationPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await revokeGroupOperationPermission(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in revokeGroupOperationPermission: @error", error);
 					throw error;
@@ -624,24 +590,6 @@ var AuthService = class {
 		}
 	}
 	/**
-	* Get additional context fields for GraphQL
-	*/
-	getAdditionalContextFields() {
-		if (!this.config.enabled) return { isAdmin: () => true };
-		return { isAdmin: (address) => this.config.enabled && this.config.admins?.includes(address.toLowerCase()) };
-	}
-	/**
-	* Get user context for GraphQL
-	*/
-	getUserContext(user) {
-		if (!user) return {};
-		return { user: {
-			address: user.address.toLowerCase(),
-			chainId: user.chainId,
-			networkId: user.networkId
-		} };
-	}
-	/**
 	* Verify that the credential still exists on the Renown API
 	*/
 	async verifyCredentialExists(address, chainId, appId) {
@@ -1246,7 +1194,6 @@ function ActionContextInputSchema() {
 }
 function ActionInputSchema() {
 	return z$1.object({
-		attachments: z$1.array(z$1.lazy(() => AttachmentInputSchema())).nullish(),
 		context: z$1.lazy(() => ActionContextInputSchema().nullish()),
 		id: z$1.string(),
 		input: z$1.custom((v) => v != null),
@@ -1255,15 +1202,6 @@ function ActionInputSchema() {
 		type: z$1.string()
 	});
 }
-function AttachmentInputSchema() {
-	return z$1.object({
-		data: z$1.string(),
-		extension: z$1.string().nullish(),
-		fileName: z$1.string().nullish(),
-		hash: z$1.string(),
-		mimeType: z$1.string()
-	});
-}
 function ChannelMetaInputSchema() {
 	return z$1.object({ id: z$1.string() });
 }
@@ -1454,13 +1392,6 @@ const GetDocumentWithOperationsDocument = gql`
               timestampUtcMs
               input
               scope
-              attachments {
-                data
-                mimeType
-                hash
-                extension
-                fileName
-              }
               context {
                 signer {
                   user {
@@ -1573,13 +1504,6 @@ const GetDocumentOperationsDocument = gql`
           timestampUtcMs
           input
           scope
-          attachments {
-            data
-            mimeType
-            hash
-            extension
-            fileName
-          }
           context {
             signer {
               user {
@@ -1830,13 +1754,6 @@ const PollSyncEnvelopesDocument = gql`
               timestampUtcMs
               input
               scope
-              attachments {
-                data
-                mimeType
-                hash
-                extension
-                fileName
-              }
               context {
                 signer {
                   user {
@@ -2878,7 +2795,7 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						search: { type: documentType },
 						paging
 					});
-					if (!this.hasGlobalAdminAccess(ctx) && this.documentPermissionService) {
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
 						return {
@@ -2899,7 +2816,7 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						view,
 						paging
 					});
-					if (!this.hasGlobalAdminAccess(ctx) && this.documentPermissionService) {
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
 						return {
@@ -2942,9 +2859,7 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 				createDocument: async (_, args, ctx) => {
 					const { parentIdentifier, name, slug, preferredEditor, initialState } = args;
 					if (parentIdentifier) await this.assertCanWrite(parentIdentifier, ctx);
-					else if (this.authorizationService) {
-						if (!ctx.user?.address) throw new GraphQLError("Forbidden: authentication required to create documents");
-					} else if (!this.hasGlobalAdminAccess(ctx)) throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+					else this.assertCanCreate(ctx);
 					let createdDoc;
 					if (initialState || preferredEditor) createdDoc = await createDocumentWithInitialState(this.reactorClient, {
 						documentType,
@@ -2959,27 +2874,24 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						parentIdentifier,
 						name
 					}, this.graphqlManager.reactorDriveClient);
-					if (this.authorizationService && ctx.user?.address && createdDoc?.id) await this.documentPermissionService?.initializeDocumentProtection(createdDoc.id, ctx.user.address, this.authorizationService.config.defaultProtection);
+					if (ctx.user?.address && createdDoc?.id) await this.documentPermissionService?.initializeDocumentProtection(createdDoc.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					if (!initialState && !preferredEditor && name && createdDoc.name !== name) return toGqlPhDocument(await this.reactorClient.execute(createdDoc.id, "main", [setName(name)]));
 					return createdDoc;
 				},
 				createEmptyDocument: async (_, args, ctx) => {
 					const { parentIdentifier } = args;
 					if (parentIdentifier) await this.assertCanWrite(parentIdentifier, ctx);
-					else if (this.authorizationService) {
-						if (!ctx.user?.address) throw new GraphQLError("Forbidden: authentication required to create documents");
-					} else if (!this.hasGlobalAdminAccess(ctx)) throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+					else this.assertCanCreate(ctx);
 					const result = await createEmptyDocument(this.reactorClient, {
 						documentType,
 						parentIdentifier
 					}, this.graphqlManager.reactorDriveClient);
-					if (this.authorizationService && ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
+					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
 				},
 				...operations.reduce((mutations, op) => {
 					mutations[camelCase(op.name)] = async (_, args, ctx) => {
 						const { docId, input } = args;
-						if (!this.authorizationService) await this.assertCanWrite(docId, ctx);
 						await this.assertCanExecuteOperation(docId, op.name, ctx);
 						if ((await this.reactorClient.get(docId)).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
 						const action = this.documentModel.actions[camelCase(op.name)];
@@ -2992,7 +2904,6 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 					};
 					mutations[`${camelCase(op.name)}Async`] = async (_, args, ctx) => {
 						const { docId, input } = args;
-						if (!this.authorizationService) await this.assertCanWrite(docId, ctx);
 						await this.assertCanExecuteOperation(docId, op.name, ctx);
 						if ((await this.reactorClient.get(docId)).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
 						const action = this.documentModel.actions[camelCase(op.name)];
@@ -3191,6 +3102,7 @@ var GraphQLManager = class {
 	* it for reactor-drive parents.
 	*/
 	reactorDriveClient;
+	authorizationService;
 	constructor(path, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, logger, httpAdapter, gatewayAdapter, authConfig, documentPermissionService, featureFlags = DefaultFeatureFlags, port = 4001, authorizationService, reactorDriveClient) {
 		this.path = path;
 		this.httpServer = httpServer;
@@ -3206,6 +3118,7 @@ var GraphQLManager = class {
 		this.documentPermissionService = documentPermissionService;
 		this.featureFlags = featureFlags;
 		this.port = port;
+		if (!authorizationService) throw new Error("GraphQLManager requires an authorizationService");
 		this.authorizationService = authorizationService;
 		this.reactorDriveClient = reactorDriveClient;
 		if (this.authConfig) this.authService = new AuthService(this.authConfig);
@@ -3328,6 +3241,14 @@ var GraphQLManager = class {
 	getBasePath() {
 		return this.path;
 	}
+	/**
+	* Get the authorization service shared with subgraphs. Use this when
+	* constructing a subgraph instance externally for
+	* {@link registerSubgraphInstance}.
+	*/
+	getAuthorizationService() {
+		return this.authorizationService;
+	}
 	async registerSubgraph(subgraph, supergraph = "", core = false) {
 		const subgraphInstance = new subgraph({
 			relationalDb: this.relationalDb,
@@ -3387,8 +3308,7 @@ var GraphQLManager = class {
 				db: this.relationalDb,
 				...this.getAdditionalContextFields(),
 				driveId,
-				user: authCtx?.user,
-				isAdmin: authCtx ? (addr) => !authCtx.auth_enabled ? true : authCtx.admins.includes(addr.toLowerCase()) : () => true
+				user: authCtx?.user
 			});
 		};
 	}
@@ -3532,8 +3452,8 @@ var GraphQLManager = class {
 };
 //#endregion
 //#region src/graphql/packages/resolvers.ts
-function requireAdmin(ctx) {
-	if (!(ctx.isAdmin?.(ctx.user?.address ?? "") ?? false)) throw new GraphQLError("Admin access required");
+function requireAdmin(authorizationService, ctx) {
+	if (!authorizationService.isSupremeAdmin(ctx.user?.address)) throw new GraphQLError("Admin access required");
 }
 function formatPackageInfo(info) {
 	return {
@@ -3551,16 +3471,16 @@ async function installedPackage(service, args) {
 	const pkg = await service.getInstalledPackage(args.name);
 	return pkg ? formatPackageInfo(pkg) : null;
 }
-async function installPackage(service, args, ctx) {
-	requireAdmin(ctx);
+async function installPackage(service, authorizationService, args, ctx) {
+	requireAdmin(authorizationService, ctx);
 	const result = await service.installPackage(args.name, args.registryUrl ?? void 0);
 	return {
 		package: formatPackageInfo(result.package),
 		documentModelsLoaded: result.documentModelsLoaded
 	};
 }
-async function uninstallPackage(service, args, ctx) {
-	requireAdmin(ctx);
+async function uninstallPackage(service, authorizationService, args, ctx) {
+	requireAdmin(authorizationService, ctx);
 	return service.uninstallPackage(args.name);
 }
 //#endregion
@@ -3606,7 +3526,7 @@ var PackagesSubgraph = class extends BaseSubgraph {
 			installPackage: async (_parent, args, ctx) => {
 				this.logger.debug("installPackage(@args)", args);
 				try {
-					return await installPackage(this.packageManagementService, args, ctx);
+					return await installPackage(this.packageManagementService, this.authorizationService, args, ctx);
 				} catch (error) {
 					this.logger.error("Error in installPackage: @error", error);
 					throw error;
@@ -3615,7 +3535,7 @@ var PackagesSubgraph = class extends BaseSubgraph {
 			uninstallPackage: async (_parent, args, ctx) => {
 				this.logger.debug("uninstallPackage(@args)", args);
 				try {
-					return await uninstallPackage(this.packageManagementService, args, ctx);
+					return await uninstallPackage(this.packageManagementService, this.authorizationService, args, ctx);
 				} catch (error) {
 					this.logger.error("Error in uninstallPackage: @error", error);
 					throw error;
@@ -3801,20 +3721,12 @@ const ActionSignerDTO = z.object({
 	app: ActionSignerAppDTO.nullable().optional()
 }).strip();
 const ActionContextDTO = z.object({ signer: ActionSignerDTO.nullable().optional() }).strip();
-const AttachmentDTO = z.object({
-	data: z.string(),
-	mimeType: z.string(),
-	hash: z.string(),
-	extension: z.string().nullable().optional(),
-	fileName: z.string().nullable().optional()
-}).strip();
 const OperationActionDTO = z.object({
 	id: z.string(),
 	type: z.string(),
 	timestampUtcMs: z.string(),
 	input: z.unknown(),
 	scope: z.string(),
-	attachments: z.array(AttachmentDTO).nullable().optional(),
 	context: ActionContextDTO.nullable().optional()
 }).strip();
 const OperationDTO = z.object({
@@ -3941,7 +3853,7 @@ function createReactorGraphQLClient(url, fetchImpl = fetch, headers) {
 }
 //#endregion
 //#region src/graphql/reactor/schema.graphql
-var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n  result: JSONObject!\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n  result: JSONObject!\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  attachments: [Attachment!]\n  context: ActionContext\n}\n\ntype Attachment {\n  data: String!\n  mimeType: String!\n  hash: String!\n  extension: String\n  fileName: String\n}\n\n# Input types for sync operations\ninput ActionContextInput {\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  attachments: [AttachmentInput!]\n  context: ActionContextInput\n}\n\ninput AttachmentInput {\n  data: String!\n  mimeType: String!\n  hash: String!\n  extension: String\n  fileName: String\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  # Poll for sync envelopes from a channel\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
+var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n  result: JSONObject!\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n  result: JSONObject!\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n# Input types for sync operations\ninput ActionContextInput {\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  # Poll for sync envelopes from a channel\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
 //#endregion
 //#region src/graphql/reactor/pubsub.ts
 const pubSub = new PubSub();
@@ -4121,7 +4033,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 				try {
 					await this.assertCanRead(args.targetIdentifier, ctx);
 					const result = await documentIncomingRelationships(this.reactorClient, args);
-					if (!this.hasGlobalAdminAccess(ctx) && this.documentPermissionService) {
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
 						return {
@@ -4142,7 +4054,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 						...args,
 						search: args.search ?? {}
 					});
-					if (!this.hasGlobalAdminAccess(ctx) && this.documentPermissionService) {
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
 						return {
@@ -4198,12 +4110,10 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					if (args.parentIdentifier) {
 						const parent = await document(this.reactorClient, { identifier: args.parentIdentifier });
 						await this.assertCanWrite(parent.document.id, ctx);
-					} else if (this.authorizationService) {
-						if (!ctx.user?.address) throw new GraphQLError("Forbidden: authentication required to create documents");
-					} else if (!this.hasGlobalAdminAccess(ctx)) throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+					} else this.assertCanCreate(ctx);
 					const result = await createDocument(this.reactorClient, args, this.graphqlManager.reactorDriveClient);
 					if (result?.id && isDriveContainerType(result.documentType)) this.graphqlManager.driveOwnershipCache.add(result.id);
-					if (this.authorizationService && ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
+					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
 				} catch (error) {
 					this.logger.error("Error in createDocument(@args): @Error", args, error);
@@ -4216,12 +4126,10 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					if (args.parentIdentifier) {
 						const parent = await document(this.reactorClient, { identifier: args.parentIdentifier });
 						await this.assertCanWrite(parent.document.id, ctx);
-					} else if (this.authorizationService) {
-						if (!ctx.user?.address) throw new GraphQLError("Forbidden: authentication required to create documents");
-					} else if (!this.hasGlobalAdminAccess(ctx)) throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+					} else this.assertCanCreate(ctx);
 					const result = await createEmptyDocument(this.reactorClient, args, this.graphqlManager.reactorDriveClient);
 					if (result?.id && isDriveContainerType(result.documentType)) this.graphqlManager.driveOwnershipCache.add(result.id);
-					if (this.authorizationService && ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
+					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
 				} catch (error) {
 					this.logger.error("Error in createEmptyDocument(@args): @Error", args, error);
@@ -4231,7 +4139,6 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			mutateDocument: async (_parent, args, ctx) => {
 				this.logger.debug("mutateDocument(@args)", args);
 				try {
-					if (!this.authorizationService) await this.assertCanWrite(args.documentIdentifier, ctx);
 					await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
 					return await mutateDocument(this.reactorClient, args);
 				} catch (error) {
@@ -4242,7 +4149,6 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			mutateDocumentAsync: async (_parent, args, ctx) => {
 				this.logger.debug("mutateDocumentAsync(@args)", args);
 				try {
-					if (!this.authorizationService) await this.assertCanWrite(args.documentIdentifier, ctx);
 					await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
 					return await mutateDocumentAsync(this.reactorClient, args);
 				} catch (error) {
@@ -4414,10 +4320,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.0-dev.3";
+	return "6.2.0-dev.5";
 }
 function getGitHash() {
-	return "a8cbaa93a213811a2678a9e339cf67e0c6dbcfbf";
+	return "23ce3521986ce3f860a9c2fe19790906de027ff2";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -5038,107 +4944,6 @@ async function runMigrations(db) {
 	}
 }
 //#endregion
-//#region src/services/authorization.service.ts
-/**
-* Central authorization service — single source of truth for all permission checks.
-*
-* Authorization model:
-* 1. Supreme admin (ADMINS env) → ALLOW ALL
-* 2. Is document protected?
-*    a. NOT protected:
-*       - READ: anyone (even anonymous) → ALLOW
-*       - WRITE: authenticated user → ALLOW
-*    b. PROTECTED:
-*       - READ: requires explicit READ/WRITE/ADMIN grant (direct or via group/parent)
-*       - WRITE: requires explicit WRITE/ADMIN grant (direct or via group/parent)
-* 3. Operation restricted? → Check OperationUserPermission
-* 4. Document owner = implicit ADMIN
-* 5. Drive protected = all children effectively protected
-*/
-var AuthorizationService = class {
-	config;
-	constructor(documentPermissionService, config) {
-		this.documentPermissionService = documentPermissionService;
-		this.config = config;
-	}
-	/**
-	* Check if a user is a supreme admin (from ADMINS env var).
-	*/
-	isSupremeAdmin(userAddress) {
-		if (!userAddress) return false;
-		return this.config.admins.includes(userAddress.toLowerCase());
-	}
-	/**
-	* Check if a user can read a document.
-	*
-	* - Supreme admin → yes
-	* - Not protected → anyone can read (even anonymous)
-	* - Protected → requires READ/WRITE/ADMIN grant (direct, group, or parent inheritance)
-	* - Owner → yes (implicit ADMIN)
-	*/
-	async canRead(documentId, userAddress, getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (!(getParentIds ? await this.documentPermissionService.isProtectedWithAncestors(documentId, getParentIds) : await this.documentPermissionService.isDocumentProtected(documentId))) return true;
-		if (!userAddress) return false;
-		const owner = await this.documentPermissionService.getDocumentOwner(documentId);
-		if (owner && owner === userAddress.toLowerCase()) return true;
-		if (getParentIds) return this.documentPermissionService.canRead(documentId, userAddress, getParentIds);
-		return this.documentPermissionService.canReadDocument(documentId, userAddress);
-	}
-	/**
-	* Check if a user can write to a document.
-	*
-	* - Supreme admin → yes
-	* - Not protected → anyone can write (even anonymous)
-	* - Protected → requires authentication + WRITE/ADMIN grant
-	* - Owner → yes (implicit ADMIN)
-	*/
-	async canWrite(documentId, userAddress, getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (!(getParentIds ? await this.documentPermissionService.isProtectedWithAncestors(documentId, getParentIds) : await this.documentPermissionService.isDocumentProtected(documentId))) return true;
-		if (!userAddress) return false;
-		const owner = await this.documentPermissionService.getDocumentOwner(documentId);
-		if (owner && owner === userAddress.toLowerCase()) return true;
-		if (getParentIds) return this.documentPermissionService.canWrite(documentId, userAddress, getParentIds);
-		return this.documentPermissionService.canWriteDocument(documentId, userAddress);
-	}
-	/**
-	* Check if a user can manage a document (change permissions, protection, transfer ownership).
-	*
-	* - Supreme admin → yes
-	* - Owner → yes
-	* - Has ADMIN grant → yes
-	*/
-	async canManage(documentId, userAddress, _getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (!userAddress) return false;
-		const owner = await this.documentPermissionService.getDocumentOwner(documentId);
-		if (owner && owner === userAddress.toLowerCase()) return true;
-		return this.documentPermissionService.canManageDocument(documentId, userAddress);
-	}
-	/**
-	* Check if a user can execute a specific operation.
-	* If the operation is not restricted, falls through to the standard write check.
-	* If the operation is restricted, requires an explicit OperationUserPermission grant.
-	*/
-	async canExecuteOperation(documentId, operationType, userAddress, getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (!await this.documentPermissionService.isOperationRestricted(documentId, operationType)) return this.canWrite(documentId, userAddress, getParentIds);
-		return this.documentPermissionService.canExecuteOperation(documentId, operationType, userAddress?.toLowerCase());
-	}
-	/**
-	* Combined check for mutations: can the user write + execute the operation?
-	* This enables READ-only users with operation grants to execute specific operations.
-	* For restricted operations, only the operation grant is checked (bypasses write check),
-	* allowing READ-only users with an explicit operation grant to execute that operation.
-	*/
-	async canMutate(documentId, operationType, userAddress, getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (await this.documentPermissionService.isOperationRestricted(documentId, operationType)) return this.documentPermissionService.canExecuteOperation(documentId, operationType, userAddress?.toLowerCase());
-		return this.canWrite(documentId, userAddress, getParentIds);
-	}
-};
-//#endregion
 //#region src/services/document-permission.service.ts
 /**
 * Service for managing document-level permissions.
@@ -5774,6 +5579,22 @@ const initAnalyticsStoreSql = [
 //#region src/server.ts
 const defaultLogger = childLogger(["reactor-api", "server"]);
 const DEFAULT_PORT = 4e3;
+/**
+* Doc-perms require auth: with auth off no `user` is ever resolved, so every
+* authorization check fails closed. Refuse to boot rather than run broken.
+*/
+function assertAuthRequiredForDocumentPermissions(authEnabled, documentPermissionsRequested) {
+	if (!authEnabled && documentPermissionsRequested) throw new Error("Document permissions require authentication: AUTH_ENABLED is false but document permissions were requested (DOCUMENT_PERMISSIONS_ENABLED=true or a documentPermissionService was provided). Enable authentication (AUTH_ENABLED=true, or auth.enabled in the config file) or disable document permissions.");
+}
+function createReadinessGate() {
+	let ready = false;
+	return {
+		isReady: () => ready,
+		markReady: () => {
+			ready = true;
+		}
+	};
+}
 function resolveAttachmentStoragePath(options) {
 	if (options.attachmentStoragePath) return options.attachmentStoragePath;
 	if (options.dbPath && !options.dbPath.startsWith("postgres")) return path.resolve(options.dbPath, "..", "attachments");
@@ -5812,7 +5633,7 @@ function makeDbClosers(knexInstance, pglite) {
 /**
 * Sets up the subgraph manager and registers subgraphs
 */
-async function setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, auth, documentPermissionService, enableDocumentModelSubgraphs, port, authorizationService, reactorDriveClient) {
+async function setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, auth, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient) {
 	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter("apollo", logger), {
 		enabled: auth?.enabled ?? false,
 		admins: auth?.admins ?? []
@@ -5905,12 +5726,14 @@ async function _setupCommonInfrastructure(options) {
 	if (ADMINS !== void 0) admins = ADMINS.split(",").map((a) => a.toLowerCase());
 	let defaultProtection = false;
 	if (DEFAULT_PROTECTION !== void 0) defaultProtection = DEFAULT_PROTECTION.toLowerCase() === "true";
-	const { USERS, GUESTS, FREE_ENTRY } = process.env;
-	if (USERS || GUESTS || FREE_ENTRY) console.warn("[DEPRECATION WARNING] The USERS, GUESTS, and FREE_ENTRY environment variables are no longer supported. Access control is now managed per-document via the DocumentProtection system. Use DEFAULT_PROTECTION=true for strict mode, or manage protection per document via the GraphQL API. See the auth documentation for migration guidance.");
 	let skipCredentialVerification = false;
 	if (SKIP_CREDENTIAL_VERIFICATION !== void 0) skipCredentialVerification = SKIP_CREDENTIAL_VERIFICATION === "true";
+	const documentPermissionsRequested = options.documentPermissionService !== void 0 || DOCUMENT_PERMISSIONS_ENABLED === "true";
+	assertAuthRequiredForDocumentPermissions(authEnabled, documentPermissionsRequested);
 	const logger = options.logger ?? defaultLogger;
 	httpAdapter.getRoute("/health", () => new Response("OK", { status: 200 }));
+	const readiness = createReadinessGate();
+	httpAdapter.getRoute("/ready", () => readiness.isReady() ? new Response("OK", { status: 200 }) : new Response("starting", { status: 503 }));
 	const explorerPrefix = `${config.basePath}/explorer`;
 	httpAdapter.getRoute(`${explorerPrefix}/:endpoint?`, (request) => {
 		const url = new URL(request.url);
@@ -5942,14 +5765,13 @@ async function _setupCommonInfrastructure(options) {
 		documentPermissionService = new DocumentPermissionService(db, { defaultProtection });
 		logger.info("Document permission service initialized");
 	}
-	let authorizationService;
-	if (documentPermissionService) {
-		authorizationService = new AuthorizationService(documentPermissionService, {
-			admins,
-			defaultProtection
-		});
-		logger.info("Authorization service initialized");
-	}
+	const policy = documentPermissionService ? AuthorizationPolicy.DOCUMENT_PERMISSIONS : authEnabled ? AuthorizationPolicy.ADMIN_ONLY : AuthorizationPolicy.OPEN;
+	const authorizationService = createAuthorizationService({
+		admins,
+		defaultProtection,
+		policy
+	}, documentPermissionService);
+	logger.info(`Authorization service initialized (policy: ${policy})`);
 	const attachmentStoragePath = resolveAttachmentStoragePath(options);
 	await mkdir(attachmentStoragePath, { recursive: true });
 	const { db: attachmentDb, knex: attachmentKnex, pglite: attachmentPglite } = getDbClient(options.dbPath, options.pgliteFactory);
@@ -5979,7 +5801,8 @@ async function _setupCommonInfrastructure(options) {
 		authorizationService,
 		attachments,
 		packages,
-		dbClosers
+		dbClosers,
+		readiness
 	};
 }
 /**
@@ -6039,7 +5862,7 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	const graphqlManager = await setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, {
 		extended: subgraphs,
 		core: coreSubgraphs
-	}, logger.child(["graphql-manager"]), auth, documentPermissionService, options.enableDocumentModelSubgraphs, port, authorizationService, reactorDriveClient);
+	}, logger.child(["graphql-manager"]), authorizationService, auth, documentPermissionService, options.enableDocumentModelSubgraphs, port, reactorDriveClient);
 	setupEventListeners(packages, graphqlManager, reactorProcessorManager, hostModule, documentModelRegistry);
 	if (mcpServerEnabled) {
 		await setupMcpServer({
@@ -6101,7 +5924,7 @@ function buildApiDispose(args) {
 	};
 }
 async function initializeAndStartAPI(clientInitializer, options, processorApp) {
-	const { port, httpAdapter, authFetchMiddleware, authService, auth, relationalDb, analyticsStore, documentPermissionService, authorizationService, attachments, packages, dbClosers } = await _setupCommonInfrastructure(options);
+	const { port, httpAdapter, authFetchMiddleware, authService, auth, relationalDb, analyticsStore, documentPermissionService, authorizationService, attachments, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
 	const { documentModels, processors, subgraphs } = await packages.init();
 	const { module: reactorClientModule, reactorDriveClient } = await clientInitializer(documentModels);
 	const reactorClient = reactorClientModule.client;
@@ -6115,7 +5938,8 @@ async function initializeAndStartAPI(clientInitializer, options, processorApp) {
 		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, auth, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, authorizationService, documentModelRegistry, dbClosers, reactorDriveClient),
 		client: reactorClient,
 		syncManager,
-		documentModelRegistry
+		documentModelRegistry,
+		readiness
 	};
 }
 //#endregion
@@ -6219,7 +6043,7 @@ var PackageManagementService = class {
 	}
 };
 //#endregion
-export { ADMIN_USERS, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentInputSchema, AuthService, AuthSubgraph, BaseSubgraph, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
+export { ADMIN_USERS, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AuthService, AuthSubgraph, BaseSubgraph, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, assertAuthRequiredForDocumentPermissions, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=30eaf1c5-796a-5cab-8266-cfe233f9e901
+//# debugId=64b14acf-bb9d-528e-b2b6-b3fa2097026f