@powerhousedao/reactor-api 6.2.0-dev.4 → 6.2.0-dev.41

package/dist/index.mjs

@@ -1,20 +1,19 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5769db0f-d60a-5870-9d50-dc4f5aca8086")}catch(e){}}();
-import { a as isSubgraphClass, c as loadDocumentModels, d as BaseSubgraph, i as buildGraphqlOperations, l as loadProcessors, n as buildGraphQlDriveDocument, o as debounce, r as buildGraphqlOperation, t as buildGraphQlDocument, u as loadSubgraphs } from "./utils-BFkbSO_H.mjs";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6300f5e6-16a2-5335-a19f-9064a271f52d")}catch(e){}}();
+import { a as isSubgraphClass, c as loadDocumentModels, d as BaseSubgraph, f as AuthorizationPolicy, i as buildGraphqlOperations, l as loadProcessors, m as createAuthorizationService, n as buildGraphQlDriveDocument, o as debounce, p as AuthorizedDocumentHandle, r as buildGraphqlOperation, t as buildGraphQlDocument, u as loadSubgraphs } from "./utils-iibOQ50e.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
 import { GraphQLError, Kind, parse, print } from "graphql";
+import { DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, PropagationMode as PropagationMode$1, consolidateSyncOperations, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl } from "@powerhousedao/reactor";
 import { ConsoleLogger, childLogger, documentModelDocumentModelModule } from "document-model";
 import path from "node:path";
 import { match } from "path-to-regexp";
-import { verifyAuthBearerToken } from "@renown/sdk";
 import { buildSubgraphSchema } from "@apollo/subgraph";
 import { typeDefs } from "@powerhousedao/document-engineering/graphql";
 import { camelCase, kebabCase, pascalCase } from "change-case";
 import { GraphQLJSONObject } from "graphql-type-json";
 import { setName } from "@powerhousedao/shared/document-model";
-import { DEFAULT_DRIVE_CONTAINER_TYPES, PropagationMode as PropagationMode$1, consolidateSyncOperations, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl } from "@powerhousedao/reactor";
 import * as z$1 from "zod";
 import { z } from "zod";
 import { createHandler } from "graphql-sse/lib/use/fetch";
@@ -35,6 +34,7 @@ import { tmpdir } from "node:os";
 import { WebSocketServer } from "ws";
 import { createRelationalDb } from "@powerhousedao/shared/processors";
 import { Kysely, Migrator, sql } from "kysely";
+import { verifyAuthBearerToken } from "@renown/sdk";
 import { PGlite } from "@electric-sql/pglite";
 import { AtomicNodeFs } from "@powerhousedao/pglite-fs";
 import knex from "knex";
@@ -70,141 +70,70 @@ var AnalyticsSubgraph = class extends BaseSubgraph {
 };
 //#endregion
 //#region src/graphql/auth/schema.graphql
-var schema_default$2 = "# Auth Subgraph Schema\n# Contains all document permission and authorization related types\n\nscalar DateTime\n\n# Permission levels for documents\nenum DocumentPermissionLevel {\n  # Can fetch and read the document\n  READ\n  # Can push updates and modify the document\n  WRITE\n  # Can manage document permissions and settings\n  ADMIN\n}\n\n# Document permission entry\ntype DocumentPermissionEntry {\n  documentId: String!\n  userAddress: String!\n  permission: DocumentPermissionLevel!\n  grantedBy: String!\n  createdAt: DateTime!\n  updatedAt: DateTime!\n}\n\n# Group type\ntype Group {\n  id: Int!\n  name: String!\n  description: String\n  createdAt: DateTime!\n  updatedAt: DateTime!\n  members: [String!]!\n}\n\n# Document group permission entry\ntype DocumentGroupPermission {\n  documentId: String!\n  groupId: Int!\n  group: Group!\n  permission: DocumentPermissionLevel!\n  grantedBy: String!\n  createdAt: DateTime!\n  updatedAt: DateTime!\n}\n\n# Operation user permission entry\ntype OperationUserPermission {\n  documentId: String!\n  operationType: String!\n  userAddress: String!\n  grantedBy: String!\n  createdAt: DateTime!\n}\n\n# Operation group permission entry\ntype OperationGroupPermission {\n  documentId: String!\n  operationType: String!\n  groupId: Int!\n  group: Group!\n  grantedBy: String!\n  createdAt: DateTime!\n}\n\n# Combined document access info\ntype DocumentAccessInfo {\n  documentId: String!\n  permissions: [DocumentPermissionEntry!]!\n  groupPermissions: [DocumentGroupPermission!]!\n}\n\n# Operation permissions info\ntype OperationPermissionsInfo {\n  documentId: String!\n  operationType: String!\n  userPermissions: [OperationUserPermission!]!\n  groupPermissions: [OperationGroupPermission!]!\n}\n\n# Document protection info\ntype DocumentProtectionInfo {\n  documentId: String!\n  protected: Boolean!\n  ownerAddress: String\n}\n\ntype Query {\n  # Get permissions for a document\n  documentAccess(documentId: String!): DocumentAccessInfo!\n\n  # Get protection status for a document\n  documentProtection(documentId: String!): DocumentProtectionInfo!\n\n  # Get all documents the current user has explicit access to\n  userDocumentPermissions: [DocumentPermissionEntry!]!\n\n  # Get all groups\n  groups: [Group!]!\n\n  # Get a specific group by ID\n  group(id: Int!): Group\n\n  # Get all groups a user belongs to\n  userGroups(userAddress: String!): [Group!]!\n\n  # Get operation permissions for a document and operation type\n  operationPermissions(\n    documentId: String!\n    operationType: String!\n  ): OperationPermissionsInfo!\n\n  # Check if the current user can execute a specific operation on a document\n  canExecuteOperation(documentId: String!, operationType: String!): Boolean!\n}\n\ntype Mutation {\n  # Set document protection status (requires ADMIN permission or global admin)\n  setDocumentProtection(\n    documentId: String!\n    protected: Boolean!\n  ): DocumentProtectionInfo!\n\n  # Transfer document ownership (requires ADMIN permission or global admin)\n  transferDocumentOwnership(\n    documentId: String!\n    newOwnerAddress: String!\n  ): DocumentProtectionInfo!\n\n  # Grant a user permission on a document (requires ADMIN permission or global admin)\n  grantDocumentPermission(\n    documentId: String!\n    userAddress: String!\n    permission: DocumentPermissionLevel!\n  ): DocumentPermissionEntry!\n\n  # Revoke a user's permission on a document (requires ADMIN permission or global admin)\n  revokeDocumentPermission(documentId: String!, userAddress: String!): Boolean!\n\n  # --- Group Management ---\n\n  # Create a new group\n  createGroup(name: String!, description: String): Group!\n\n  # Delete a group and all its associations\n  deleteGroup(id: Int!): Boolean!\n\n  # Add a user to a group\n  addUserToGroup(userAddress: String!, groupId: Int!): Boolean!\n\n  # Remove a user from a group\n  removeUserFromGroup(userAddress: String!, groupId: Int!): Boolean!\n\n  # --- Group Document Permissions ---\n\n  # Grant a group permission on a document\n  grantGroupPermission(\n    documentId: String!\n    groupId: Int!\n    permission: DocumentPermissionLevel!\n  ): DocumentGroupPermission!\n\n  # Revoke a group's permission on a document\n  revokeGroupPermission(documentId: String!, groupId: Int!): Boolean!\n\n  # --- Operation Permissions ---\n\n  # Grant a user permission to execute an operation on a document\n  grantOperationPermission(\n    documentId: String!\n    operationType: String!\n    userAddress: String!\n  ): OperationUserPermission!\n\n  # Revoke a user's permission to execute an operation\n  revokeOperationPermission(\n    documentId: String!\n    operationType: String!\n    userAddress: String!\n  ): Boolean!\n\n  # Grant a group permission to execute an operation on a document\n  grantGroupOperationPermission(\n    documentId: String!\n    operationType: String!\n    groupId: Int!\n  ): OperationGroupPermission!\n\n  # Revoke a group's permission to execute an operation\n  revokeGroupOperationPermission(\n    documentId: String!\n    operationType: String!\n    groupId: Int!\n  ): Boolean!\n}\n";
+var schema_default$2 = "# Auth Subgraph Schema\n# Contains all document permission and authorization related types\n\nscalar DateTime\n\n# Permission levels for documents\nenum DocumentPermissionLevel {\n  # Can fetch and read the document\n  READ\n  # Can push updates and modify the document\n  WRITE\n  # Can manage document permissions and settings\n  ADMIN\n}\n\n# Document permission entry\ntype DocumentPermissionEntry {\n  documentId: String!\n  userAddress: String!\n  permission: DocumentPermissionLevel!\n  grantedBy: String!\n  createdAt: DateTime!\n  updatedAt: DateTime!\n}\n\n# Operation user permission entry\ntype OperationUserPermission {\n  documentId: String!\n  operationType: String!\n  userAddress: String!\n  grantedBy: String!\n  createdAt: DateTime!\n}\n\n# Combined document access info\ntype DocumentAccessInfo {\n  documentId: String!\n  permissions: [DocumentPermissionEntry!]!\n}\n\n# Operation permissions info\ntype OperationPermissionsInfo {\n  documentId: String!\n  operationType: String!\n  userPermissions: [OperationUserPermission!]!\n}\n\n# Document protection info\ntype DocumentProtectionInfo {\n  documentId: String!\n  protected: Boolean!\n  ownerAddress: String\n}\n\ntype Query {\n  # Get permissions for a document (requires ADMIN permission or global admin)\n  documentAccess(documentId: String!): DocumentAccessInfo!\n\n  # Get protection status for a document (requires ADMIN permission or global admin)\n  documentProtection(documentId: String!): DocumentProtectionInfo!\n\n  # Get all documents the current user has explicit access to\n  userDocumentPermissions: [DocumentPermissionEntry!]!\n\n  # Get operation permissions for a document and operation type\n  # (requires ADMIN permission or global admin)\n  operationPermissions(\n    documentId: String!\n    operationType: String!\n  ): OperationPermissionsInfo!\n\n  # Check if the current user can execute a specific operation on a document\n  canExecuteOperation(documentId: String!, operationType: String!): Boolean!\n}\n\ntype Mutation {\n  # Set document protection status (requires ADMIN permission or global admin)\n  setDocumentProtection(\n    documentId: String!\n    protected: Boolean!\n  ): DocumentProtectionInfo!\n\n  # Transfer document ownership (requires ADMIN permission or global admin)\n  transferDocumentOwnership(\n    documentId: String!\n    newOwnerAddress: String!\n  ): DocumentProtectionInfo!\n\n  # Grant a user permission on a document (requires ADMIN permission or global admin)\n  grantDocumentPermission(\n    documentId: String!\n    userAddress: String!\n    permission: DocumentPermissionLevel!\n  ): DocumentPermissionEntry!\n\n  # Revoke a user's permission on a document (requires ADMIN permission or global admin)\n  revokeDocumentPermission(documentId: String!, userAddress: String!): Boolean!\n\n  # --- Operation Permissions ---\n\n  # Grant a user permission to execute an operation on a document\n  grantOperationPermission(\n    documentId: String!\n    operationType: String!\n    userAddress: String!\n  ): OperationUserPermission!\n\n  # Revoke a user's permission to execute an operation\n  revokeOperationPermission(\n    documentId: String!\n    operationType: String!\n    userAddress: String!\n  ): Boolean!\n}\n";
 //#endregion
 //#region src/graphql/auth/resolvers.ts
-async function documentAccess(service, args) {
+async function documentAccess(service, authorizationService, args, userAddress) {
+	if (!userAddress) throw new GraphQLError("Authentication required");
+	if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to view its permissions");
 	const permissions = await service.getDocumentPermissions(args.documentId);
-	const groupPermissions = await service.getDocumentGroupPermissions(args.documentId);
 	return {
 		documentId: args.documentId,
-		permissions,
-		groupPermissions
+		permissions
 	};
 }
 async function userDocumentPermissions(service, userAddress) {
 	return service.getUserDocuments(userAddress);
 }
-async function grantDocumentPermission(service, args, grantedByAddress, isGlobalAdmin) {
+async function grantDocumentPermission(service, authorizationService, args, grantedByAddress) {
 	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant permissions");
 	return service.grantPermission(args.documentId, args.userAddress, args.permission, grantedByAddress);
 }
-async function revokeDocumentPermission(service, args, revokedByAddress, isGlobalAdmin) {
+async function revokeDocumentPermission(service, authorizationService, args, revokedByAddress) {
 	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke permissions");
 	await service.revokePermission(args.documentId, args.userAddress);
 	return true;
 }
-async function groups(service) {
-	return service.listGroups();
-}
-async function group(service, args) {
-	return service.getGroup(args.id);
-}
-async function userGroups(service, args) {
-	return service.getUserGroups(args.userAddress);
-}
-async function createGroup(service, args) {
-	return service.createGroup(args.name, args.description ?? void 0);
-}
-async function deleteGroup(service, args) {
-	await service.deleteGroup(args.id);
-	return true;
-}
-async function addUserToGroup(service, args) {
-	await service.addUserToGroup(args.userAddress, args.groupId);
-	return true;
-}
-async function removeUserFromGroup(service, args) {
-	await service.removeUserFromGroup(args.userAddress, args.groupId);
-	return true;
-}
-async function getGroupMembers(service, groupId) {
-	return service.getGroupMembers(groupId);
-}
-async function grantGroupPermission(service, args, grantedByAddress, isGlobalAdmin) {
-	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant permissions");
-	}
-	return service.grantGroupPermission(args.documentId, args.groupId, args.permission, grantedByAddress);
-}
-async function revokeGroupPermission(service, args, revokedByAddress, isGlobalAdmin) {
-	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke permissions");
-	}
-	await service.revokeGroupPermission(args.documentId, args.groupId);
-	return true;
-}
-async function operationPermissions(service, args) {
+async function operationPermissions(service, authorizationService, args, userAddress) {
+	if (!userAddress) throw new GraphQLError("Authentication required");
+	if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to view its operation permissions");
 	const userPermissions = await service.getOperationUserPermissions(args.documentId, args.operationType);
-	const groupPermissions = await service.getOperationGroupPermissions(args.documentId, args.operationType);
 	return {
 		documentId: args.documentId,
 		operationType: args.operationType,
-		userPermissions,
-		groupPermissions
+		userPermissions
 	};
 }
-async function canExecuteOperation(service, args, userAddress) {
-	return service.canExecuteOperation(args.documentId, args.operationType, userAddress);
+async function canExecuteOperation(authorizationService, args, userAddress) {
+	return authorizationService.canMutate(args.documentId, args.operationType, userAddress);
 }
-async function grantOperationPermission(service, args, grantedByAddress, isGlobalAdmin) {
+async function grantOperationPermission(service, authorizationService, args, grantedByAddress) {
 	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant operation permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant operation permissions");
 	return service.grantOperationPermission(args.documentId, args.operationType, args.userAddress, grantedByAddress);
 }
-async function revokeOperationPermission(service, args, revokedByAddress, isGlobalAdmin) {
+async function revokeOperationPermission(service, authorizationService, args, revokedByAddress) {
 	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke operation permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke operation permissions");
 	await service.revokeOperationPermission(args.documentId, args.operationType, args.userAddress);
 	return true;
 }
-async function grantGroupOperationPermission(service, args, grantedByAddress, isGlobalAdmin) {
-	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant operation permissions");
-	}
-	return service.grantGroupOperationPermission(args.documentId, args.operationType, args.groupId, grantedByAddress);
-}
-async function revokeGroupOperationPermission(service, args, revokedByAddress, isGlobalAdmin) {
-	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke operation permissions");
-	}
-	await service.revokeGroupOperationPermission(args.documentId, args.operationType, args.groupId);
-	return true;
-}
-async function documentProtection(service, args) {
+async function documentProtection(service, authorizationService, args, userAddress) {
+	if (!userAddress) throw new GraphQLError("Authentication required");
+	if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to view its protection info");
 	return service.getDocumentProtection(args.documentId);
 }
-async function setDocumentProtection(service, authorizationService, args, userAddress, isGlobalAdmin) {
+async function setDocumentProtection(service, authorizationService, args, userAddress) {
 	if (!userAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (authorizationService) {
-			if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to change protection");
-		} else if (!await service.canManageDocument(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to change protection");
-	}
+	if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to change protection");
 	await service.setDocumentProtection(args.documentId, args.protected);
 	return service.getDocumentProtection(args.documentId);
 }
-async function transferDocumentOwnership(service, authorizationService, args, userAddress, isGlobalAdmin) {
+async function transferDocumentOwnership(service, authorizationService, args, userAddress) {
 	if (!userAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (authorizationService) {
-			if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to transfer ownership");
-		} else if (!await service.canManageDocument(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to transfer ownership");
-	}
+	if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to transfer ownership");
 	const previousOwner = await service.getDocumentOwner(args.documentId);
 	if (previousOwner) await service.revokePermission(args.documentId, previousOwner);
 	await service.setDocumentOwner(args.documentId, args.newOwnerAddress);
@@ -219,8 +148,7 @@ async function transferDocumentOwnership(service, authorizationService, args, us
 * This subgraph is conditionally registered based on the DOCUMENT_PERMISSIONS_ENABLED
 * feature flag. When enabled, it provides GraphQL operations for:
 * - Document permissions (grant/revoke user access)
-* - Group management (create/delete groups, manage membership)
-* - Group document permissions (grant/revoke group access)
+* - Document protection and ownership
 * - Operation-level permissions (fine-grained operation control)
 */
 var AuthSubgraph = class extends BaseSubgraph {
@@ -234,11 +162,11 @@ var AuthSubgraph = class extends BaseSubgraph {
 	typeDefs = gql(schema_default$2);
 	resolvers = {
 		Query: {
-			documentAccess: async (_parent, args) => {
+			documentAccess: async (_parent, args, ctx) => {
 				this.logger.debug("documentAccess(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					return await documentAccess(this.documentPermissionService, args);
+					return await documentAccess(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in documentAccess: @error", error);
 					throw error;
@@ -255,41 +183,11 @@ var AuthSubgraph = class extends BaseSubgraph {
 					throw error;
 				}
 			},
-			groups: async () => {
-				this.logger.debug("groups");
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					return await groups(this.documentPermissionService);
-				} catch (error) {
-					this.logger.error("Error in groups: @error", error);
-					throw error;
-				}
-			},
-			group: async (_parent, args) => {
-				this.logger.debug("group(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					return await group(this.documentPermissionService, args);
-				} catch (error) {
-					this.logger.error("Error in group: @error", error);
-					throw error;
-				}
-			},
-			userGroups: async (_parent, args) => {
-				this.logger.debug("userGroups(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					return await userGroups(this.documentPermissionService, args);
-				} catch (error) {
-					this.logger.error("Error in userGroups: @error", error);
-					throw error;
-				}
-			},
-			operationPermissions: async (_parent, args) => {
+			operationPermissions: async (_parent, args, ctx) => {
 				this.logger.debug("operationPermissions(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					return await operationPermissions(this.documentPermissionService, args);
+					return await operationPermissions(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in operationPermissions: @error", error);
 					throw error;
@@ -297,9 +195,8 @@ var AuthSubgraph = class extends BaseSubgraph {
 			},
 			canExecuteOperation: async (_parent, args, ctx) => {
 				this.logger.debug("canExecuteOperation(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					return await canExecuteOperation(this.documentPermissionService, args, ctx.user?.address);
+					return await canExecuteOperation(this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in canExecuteOperation: @error", error);
 					throw error;
@@ -308,9 +205,8 @@ var AuthSubgraph = class extends BaseSubgraph {
 			documentProtection: async (_parent, args, ctx) => {
 				this.logger.debug("documentProtection(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				if (!ctx.user?.address) throw new GraphQLError("Authentication required to view document protection info");
 				try {
-					return await documentProtection(this.documentPermissionService, args);
+					return await documentProtection(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in documentProtection: @error", error);
 					throw error;
@@ -322,8 +218,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("setDocumentProtection(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await setDocumentProtection(this.documentPermissionService, this.authorizationService, args, ctx.user?.address, isGlobalAdmin);
+					return await setDocumentProtection(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in setDocumentProtection: @error", error);
 					throw error;
@@ -333,8 +228,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("transferDocumentOwnership(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await transferDocumentOwnership(this.documentPermissionService, this.authorizationService, args, ctx.user?.address, isGlobalAdmin);
+					return await transferDocumentOwnership(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in transferDocumentOwnership: @error", error);
 					throw error;
@@ -344,8 +238,11 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("grantDocumentPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await grantDocumentPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					const resolved = await this.withCanonicalDocumentId(args, ctx);
+					return await grantDocumentPermission(this.documentPermissionService, this.authorizationService, {
+						...resolved,
+						permission: resolved.permission
+					}, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in grantDocumentPermission: @error", error);
 					throw error;
@@ -355,81 +252,17 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("revokeDocumentPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await revokeDocumentPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await revokeDocumentPermission(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in revokeDocumentPermission: @error", error);
 					throw error;
 				}
 			},
-			createGroup: async (_parent, args) => {
-				this.logger.debug("createGroup(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					return await createGroup(this.documentPermissionService, args);
-				} catch (error) {
-					this.logger.error("Error in createGroup: @error", error);
-					throw error;
-				}
-			},
-			deleteGroup: async (_parent, args) => {
-				this.logger.debug("deleteGroup(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					return await deleteGroup(this.documentPermissionService, args);
-				} catch (error) {
-					this.logger.error("Error in deleteGroup: @error", error);
-					throw error;
-				}
-			},
-			addUserToGroup: async (_parent, args) => {
-				this.logger.debug("addUserToGroup(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					return await addUserToGroup(this.documentPermissionService, args);
-				} catch (error) {
-					this.logger.error("Error in addUserToGroup: @error", error);
-					throw error;
-				}
-			},
-			removeUserFromGroup: async (_parent, args) => {
-				this.logger.debug("removeUserFromGroup(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					return await removeUserFromGroup(this.documentPermissionService, args);
-				} catch (error) {
-					this.logger.error("Error in removeUserFromGroup: @error", error);
-					throw error;
-				}
-			},
-			grantGroupPermission: async (_parent, args, ctx) => {
-				this.logger.debug("grantGroupPermission(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await grantGroupPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
-				} catch (error) {
-					this.logger.error("Error in grantGroupPermission: @error", error);
-					throw error;
-				}
-			},
-			revokeGroupPermission: async (_parent, args, ctx) => {
-				this.logger.debug("revokeGroupPermission(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await revokeGroupPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
-				} catch (error) {
-					this.logger.error("Error in revokeGroupPermission: @error", error);
-					throw error;
-				}
-			},
 			grantOperationPermission: async (_parent, args, ctx) => {
 				this.logger.debug("grantOperationPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await grantOperationPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await grantOperationPermission(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in grantOperationPermission: @error", error);
 					throw error;
@@ -439,52 +272,13 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("revokeOperationPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await revokeOperationPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await revokeOperationPermission(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in revokeOperationPermission: @error", error);
 					throw error;
 				}
-			},
-			grantGroupOperationPermission: async (_parent, args, ctx) => {
-				this.logger.debug("grantGroupOperationPermission(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await grantGroupOperationPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
-				} catch (error) {
-					this.logger.error("Error in grantGroupOperationPermission: @error", error);
-					throw error;
-				}
-			},
-			revokeGroupOperationPermission: async (_parent, args, ctx) => {
-				this.logger.debug("revokeGroupOperationPermission(@args)", args);
-				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await revokeGroupOperationPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
-				} catch (error) {
-					this.logger.error("Error in revokeGroupOperationPermission: @error", error);
-					throw error;
-				}
 			}
-		},
-		Group: { members: async (parent) => {
-			if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-			return getGroupMembers(this.documentPermissionService, parent.id);
-		} },
-		DocumentGroupPermission: { group: async (parent) => {
-			if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-			const grp = await group(this.documentPermissionService, { id: parent.groupId });
-			if (!grp) throw new GraphQLError(`Group not found: ${parent.groupId}`);
-			return grp;
-		} },
-		OperationGroupPermission: { group: async (parent) => {
-			if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
-			const grp = await group(this.documentPermissionService, { id: parent.groupId });
-			if (!grp) throw new GraphQLError(`Group not found: ${parent.groupId}`);
-			return grp;
-		} }
+		}
 	};
 	onSetup() {
 		this.logger.debug("Setting up AuthSubgraph");
@@ -511,7 +305,7 @@ function createAuthFetchMiddleware(authService) {
 async function createGatewayAdapter(type, logger) {
 	switch (type) {
 		case "apollo": {
-			const { ApolloGatewayAdapter } = await import("./adapter-gateway-apollo-IZuGzFaY.mjs");
+			const { ApolloGatewayAdapter } = await import("./adapter-gateway-apollo-CxV_hMTv.mjs");
 			return new ApolloGatewayAdapter(logger);
 		}
 		case "mercurius": {
@@ -533,133 +327,6 @@ async function createHttpAdapter(type) {
 	}
 }
 //#endregion
-//#region src/services/auth.service.ts
-var AuthService = class {
-	config;
-	constructor(config) {
-		this.config = config;
-	}
-	async authenticateRequest(request) {
-		if (!this.config.enabled) return {
-			user: void 0,
-			admins: [],
-			auth_enabled: false
-		};
-		const method = request.method;
-		if (method === "OPTIONS" || method === "GET") return {
-			user: void 0,
-			admins: this.config.admins,
-			auth_enabled: true
-		};
-		return this.verifyBearer(request.headers.get("authorization") ?? void 0);
-	}
-	/**
-	* Verify a Bearer token regardless of HTTP method. Use this from non-GraphQL
-	* middleware that must enforce authentication on every request.
-	*/
-	async verifyBearer(authorization) {
-		if (!this.config.enabled) return {
-			user: void 0,
-			admins: [],
-			auth_enabled: false
-		};
-		const token = authorization?.split(" ")[1];
-		if (!token) return {
-			user: void 0,
-			admins: this.config.admins,
-			auth_enabled: true
-		};
-		try {
-			const verified = await this.verifyToken(token);
-			if (!verified) return new Response(JSON.stringify({ error: "Verification failed" }), { status: 401 });
-			const user = this.extractUserFromVerification(verified);
-			if (!user) return new Response(JSON.stringify({ error: "Missing credentials" }), { status: 401 });
-			if (!this.config.skipCredentialVerification) {
-				if (!await this.verifyCredentialExists(user.address, user.chainId, verified.issuer)) return new Response(JSON.stringify({ error: "Credentials no longer valid" }), { status: 401 });
-			}
-			return {
-				user,
-				admins: this.config.admins,
-				auth_enabled: true
-			};
-		} catch {
-			return new Response(JSON.stringify({ error: "Authentication failed" }), { status: 401 });
-		}
-	}
-	async authenticateWebSocketConnection(connectionParams) {
-		if (!this.config.enabled) return null;
-		const authHeader = connectionParams.authorization;
-		if (!authHeader) throw new Error("Missing authorization in connection parameters");
-		const token = authHeader.split(" ")[1];
-		if (!token) throw new Error("Invalid authorization format");
-		const verified = await this.verifyToken(token);
-		if (!verified) throw new Error("Token verification failed");
-		const user = this.extractUserFromVerification(verified);
-		if (!user) throw new Error("Invalid credentials");
-		if (!this.config.skipCredentialVerification) {
-			if (!await this.verifyCredentialExists(user.address, user.chainId, verified.issuer)) throw new Error("Credentials no longer valid");
-		}
-		return user;
-	}
-	/**
-	* Verify the auth bearer token
-	*/
-	async verifyToken(token) {
-		return await verifyAuthBearerToken(token);
-	}
-	/**
-	* Extract user information from verification result
-	*/
-	extractUserFromVerification(verified) {
-		try {
-			const { address, chainId, networkId } = verified.verifiableCredential.credentialSubject;
-			if (!address || !chainId || !networkId) return null;
-			return {
-				address,
-				chainId,
-				networkId
-			};
-		} catch {
-			return null;
-		}
-	}
-	/**
-	* Get additional context fields for GraphQL
-	*/
-	getAdditionalContextFields() {
-		if (!this.config.enabled) return { isAdmin: () => true };
-		return { isAdmin: (address) => this.config.enabled && this.config.admins?.includes(address.toLowerCase()) };
-	}
-	/**
-	* Get user context for GraphQL
-	*/
-	getUserContext(user) {
-		if (!user) return {};
-		return { user: {
-			address: user.address.toLowerCase(),
-			chainId: user.chainId,
-			networkId: user.networkId
-		} };
-	}
-	/**
-	* Verify that the credential still exists on the Renown API
-	*/
-	async verifyCredentialExists(address, chainId, appId) {
-		const url = `https://www.renown.id/api/auth/credential?address=${address}&chainId=${chainId}&connectId=${appId}&appId=${appId}`;
-		try {
-			const response = await fetch(url, { method: "GET" });
-			const credential = (await response.json()).credential;
-			const appIdVerfied = credential.credentialSubject.id;
-			const addressVerfied = credential.issuer.id.split(":")[4];
-			const chainIdVerfied = credential.issuer.id.split(":")[3];
-			if (response.status !== 200) return false;
-			return appIdVerfied === appId && addressVerfied.toLocaleLowerCase() === address.toLocaleLowerCase() && chainIdVerfied === chainId.toString();
-		} catch {
-			return false;
-		}
-	}
-};
-//#endregion
 //#region src/utils/create-schema.ts
 const logger = childLogger(["reactor-api", "create-schema"]);
 /**
@@ -683,6 +350,49 @@ const stripScalarDefinitions = (doc) => {
 		definitions: filteredDefinitions
 	});
 };
+/**
+* Type-system definition kinds that GraphQL requires to be uniquely named.
+* A subgraph SDL with two definitions sharing a name fails federation
+* composition ("There can be only one type named X"), which is fatal to the
+* whole gateway. We dedupe these by name; field/operation/extension nodes are
+* left untouched.
+*/
+const TYPE_DEFINITION_KINDS = new Set([
+	Kind.OBJECT_TYPE_DEFINITION,
+	Kind.ENUM_TYPE_DEFINITION,
+	Kind.INPUT_OBJECT_TYPE_DEFINITION,
+	Kind.INTERFACE_TYPE_DEFINITION,
+	Kind.UNION_TYPE_DEFINITION,
+	Kind.SCALAR_TYPE_DEFINITION
+]);
+/**
+* Drop duplicate type-system definitions by name, keeping the first occurrence.
+* Deduping is by name across ALL kinds (a `type` and an `enum` sharing a name
+* collide in GraphQL too), so the first definition of a given name wins
+* regardless of kind. State types are emitted before operation types, so
+* keep-first preserves the authoritative state definition. This heals a document
+* model that defines the same name twice (global+local, state+operation, or
+* twice in one scope) so the assembled subgraph SDL composes instead of crashing
+* the gateway (Sentry #917).
+*/
+const dedupeTypeDefinitions = (doc) => {
+	const seen = /* @__PURE__ */ new Set();
+	const definitions = doc.definitions.filter((def) => {
+		if (!TYPE_DEFINITION_KINDS.has(def.kind)) return true;
+		const name = def.name?.value;
+		if (!name) return true;
+		if (seen.has(name)) {
+			logger.debug(`Dropping duplicate type definition: ${name}`);
+			return false;
+		}
+		seen.add(name);
+		return true;
+	});
+	return {
+		kind: Kind.DOCUMENT,
+		definitions
+	};
+};
 const buildSubgraphSchemaModule = (documentModels, resolvers, typeDefs) => {
 	const newResolvers = {
 		...resolvers,
@@ -748,7 +458,7 @@ const getDocumentModelTypeDefs = (documentModels, typeDefs$1) => {
               stateJSON: JSONObject
           }\n`;
 	});
-	return gql`
+	return dedupeTypeDefinitions(gql`
     scalar JSONObject
     ${typeDefs.join("\n").replaceAll(";", "")}
 
@@ -820,7 +530,7 @@ const getDocumentModelTypeDefs = (documentModels, typeDefs$1) => {
     }
 
     ${stripScalarDefinitions(typeDefs$1)}
-  `;
+  `);
 };
 /**
 * Extract type names from a GraphQL schema.
@@ -2122,6 +1832,17 @@ function toGqlDocumentChangeEvent(event) {
 		} : null
 	};
 }
+/**
+* Distinct document ids a change event references: affected documents plus the
+* parent/child ids in `context` (delete/relationship events carry only context).
+*/
+function collectChangedDocumentIds(event) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const doc of event.documents) if (doc.header.id) ids.add(doc.header.id);
+	if (event.context?.parentId) ids.add(event.context.parentId);
+	if (event.context?.childId) ids.add(event.context.childId);
+	return [...ids];
+}
 function matchesSearchFilter(event, search) {
 	if (search.type) {
 		if (!event.documents.some((doc) => doc.header.documentType === search.type)) return false;
@@ -2593,7 +2314,7 @@ async function touchChannel(syncManager, args) {
 	};
 	const options = { sinceTimestampUtcMs: args.input.sinceTimestampUtcMs };
 	try {
-		await syncManager.add(args.input.name, args.input.collectionId, {
+		await syncManager.add(args.input.name, DriveCollectionId.fromKey(args.input.collectionId), {
 			type: "polling",
 			parameters: {}
 		}, filter, options, args.input.id);
@@ -2616,14 +2337,14 @@ async function touchChannel(syncManager, args) {
 *   client ordinal the switchboard has successfully applied, so the client
 *   can trim its own outbox)
 */
-function pollSyncEnvelopes(syncManager, args) {
+function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new Set()) {
 	let remote;
 	try {
 		remote = syncManager.getById(args.channelId);
 	} catch (error) {
 		throw new GraphQLError(`Channel not found: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
-	const deadLetters = remote.channel.deadLetter.items.map((syncOp) => ({
+	const deadLetters = remote.channel.deadLetter.items.filter((syncOp) => !forbiddenIds.has(syncOp.documentId)).map((syncOp) => ({
 		documentId: syncOp.documentId,
 		error: syncOp.error?.message ?? "Unknown error",
 		jobId: syncOp.jobId,
@@ -2647,6 +2368,12 @@ function pollSyncEnvelopes(syncManager, args) {
 		}
 	}
 	const operations = remote.channel.outbox.items;
+	if (forbiddenIds.size > 0) {
+		for (const syncOp of operations) if (forbiddenIds.has(syncOp.documentId)) {
+			syncOp.deliveredCount = syncOp.operations.length;
+			syncOp.emittedCount = syncOp.operations.length;
+		}
+	}
 	if (operations.length === 0) return {
 		envelopes: [],
 		ackOrdinal: remote.channel.inbox.ackOrdinal,
@@ -2694,7 +2421,7 @@ function pollSyncEnvelopes(syncManager, args) {
 					context: op.context
 				})),
 				cursor: {
-					remoteName: remote.name,
+					remoteName: remote.meta.name,
 					cursorOrdinal: 0,
 					lastSyncedAtUtcMs: Date.now().toString()
 				},
@@ -2739,7 +2466,7 @@ function pushSyncEnvelopes(syncManager, args) {
 			throw new GraphQLError(`Channel not found: ${error instanceof Error ? error.message : "Unknown error"}`);
 		}
 		if (!envelope.operations || envelope.operations.length === 0) continue;
-		const syncOps = envelopesToSyncOperations(envelope, remote.name);
+		const syncOps = envelopesToSyncOperations(envelope, remote.meta.name);
 		if (!remoteSyncOps.has(remote)) remoteSyncOps.set(remote, []);
 		remoteSyncOps.get(remote).push(...syncOps);
 	}
@@ -2838,7 +2565,7 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						view
 					});
 					if (result.document.documentType !== documentType) throw new GraphQLError(`Document with id ${identifier} is not of type ${documentType}`);
-					await this.assertCanRead(result.document.id, ctx);
+					await this.assertCanReadCanonical(result.document.id, ctx);
 					return result;
 				},
 				documents: async (_, args, ctx) => {
@@ -2847,7 +2574,7 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						search: { type: documentType },
 						paging
 					});
-					if (!this.hasGlobalAdminAccess(ctx) && this.documentPermissionService) {
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
 						return {
@@ -2868,7 +2595,7 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						view,
 						paging
 					});
-					if (!this.hasGlobalAdminAccess(ctx) && this.documentPermissionService) {
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
 						return {
@@ -2880,10 +2607,10 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 					return result;
 				},
 				documentOutgoingRelationships: async (_, args, ctx) => {
-					const { sourceIdentifier, relationshipType, view, paging } = args;
-					await this.assertCanRead(sourceIdentifier, ctx);
+					const { relationshipType, view, paging } = args;
+					const handle = await this.assertCanRead(args.sourceIdentifier, ctx);
 					const result = await documentOutgoingRelationships(this.reactorClient, {
-						sourceIdentifier,
+						sourceIdentifier: handle.fetchIdentifier,
 						relationshipType,
 						view,
 						paging
@@ -2896,10 +2623,10 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 					};
 				},
 				documentIncomingRelationships: async (_, args, ctx) => {
-					const { targetIdentifier, relationshipType, view, paging } = args;
-					await this.assertCanRead(targetIdentifier, ctx);
+					const { relationshipType, view, paging } = args;
+					const handle = await this.assertCanRead(args.targetIdentifier, ctx);
 					return documentIncomingRelationships(this.reactorClient, {
-						targetIdentifier,
+						targetIdentifier: handle.fetchIdentifier,
 						relationshipType,
 						view,
 						paging
@@ -2909,11 +2636,10 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 			Mutation: { [documentName]: () => ({}) },
 			[`${documentName}Mutations`]: {
 				createDocument: async (_, args, ctx) => {
-					const { parentIdentifier, name, slug, preferredEditor, initialState } = args;
-					if (parentIdentifier) await this.assertCanWrite(parentIdentifier, ctx);
-					else if (this.authorizationService) {
-						if (!ctx.user?.address) throw new GraphQLError("Forbidden: authentication required to create documents");
-					} else if (!this.hasGlobalAdminAccess(ctx)) throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+					const { name, slug, preferredEditor, initialState } = args;
+					let parentIdentifier = args.parentIdentifier;
+					if (parentIdentifier) parentIdentifier = (await this.assertCanWrite(parentIdentifier, ctx)).fetchIdentifier;
+					else this.assertCanCreate(ctx);
 					let createdDoc;
 					if (initialState || preferredEditor) createdDoc = await createDocumentWithInitialState(this.reactorClient, {
 						documentType,
@@ -2928,46 +2654,42 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						parentIdentifier,
 						name
 					}, this.graphqlManager.reactorDriveClient);
-					if (this.authorizationService && ctx.user?.address && createdDoc?.id) await this.documentPermissionService?.initializeDocumentProtection(createdDoc.id, ctx.user.address, this.authorizationService.config.defaultProtection);
+					if (ctx.user?.address && createdDoc?.id) await this.documentPermissionService?.initializeDocumentProtection(createdDoc.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					if (!initialState && !preferredEditor && name && createdDoc.name !== name) return toGqlPhDocument(await this.reactorClient.execute(createdDoc.id, "main", [setName(name)]));
 					return createdDoc;
 				},
 				createEmptyDocument: async (_, args, ctx) => {
-					const { parentIdentifier } = args;
-					if (parentIdentifier) await this.assertCanWrite(parentIdentifier, ctx);
-					else if (this.authorizationService) {
-						if (!ctx.user?.address) throw new GraphQLError("Forbidden: authentication required to create documents");
-					} else if (!this.hasGlobalAdminAccess(ctx)) throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+					let parentIdentifier = args.parentIdentifier;
+					if (parentIdentifier) parentIdentifier = (await this.assertCanWrite(parentIdentifier, ctx)).fetchIdentifier;
+					else this.assertCanCreate(ctx);
 					const result = await createEmptyDocument(this.reactorClient, {
 						documentType,
 						parentIdentifier
 					}, this.graphqlManager.reactorDriveClient);
-					if (this.authorizationService && ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
+					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
 				},
 				...operations.reduce((mutations, op) => {
 					mutations[camelCase(op.name)] = async (_, args, ctx) => {
 						const { docId, input } = args;
-						if (!this.authorizationService) await this.assertCanWrite(docId, ctx);
-						await this.assertCanExecuteOperation(docId, op.name, ctx);
-						if ((await this.reactorClient.get(docId)).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
+						const effectiveDocId = (await this.assertCanExecuteOperation(docId, op.name, ctx)).fetchIdentifier;
+						if ((await this.reactorClient.get(effectiveDocId)).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
 						const action = this.documentModel.actions[camelCase(op.name)];
 						if (!action) throw new GraphQLError(`Action ${op.name} not found`);
 						try {
-							return toGqlPhDocument(await this.reactorClient.execute(docId, "main", [action(input)]));
+							return toGqlPhDocument(await this.reactorClient.execute(effectiveDocId, "main", [action(input)]));
 						} catch (error) {
 							throw new GraphQLError(error instanceof Error ? error.message : `Failed to ${op.name}`);
 						}
 					};
 					mutations[`${camelCase(op.name)}Async`] = async (_, args, ctx) => {
 						const { docId, input } = args;
-						if (!this.authorizationService) await this.assertCanWrite(docId, ctx);
-						await this.assertCanExecuteOperation(docId, op.name, ctx);
-						if ((await this.reactorClient.get(docId)).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
+						const effectiveDocId = (await this.assertCanExecuteOperation(docId, op.name, ctx)).fetchIdentifier;
+						if ((await this.reactorClient.get(effectiveDocId)).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
 						const action = this.documentModel.actions[camelCase(op.name)];
 						if (!action) throw new GraphQLError(`Action ${op.name} not found`);
 						try {
-							return (await this.reactorClient.executeAsync(docId, "main", [action(input)])).id;
+							return (await this.reactorClient.executeAsync(effectiveDocId, "main", [action(input)])).id;
 						} catch (error) {
 							throw new GraphQLError(error instanceof Error ? error.message : `Failed to ${op.name}`);
 						}
@@ -3146,7 +2868,6 @@ var GraphQLManager = class {
 	coreSubgraphsMap = /* @__PURE__ */ new Map();
 	contextFields = {};
 	subgraphs = /* @__PURE__ */ new Map();
-	authService = null;
 	subgraphWsDisposers = /* @__PURE__ */ new Map();
 	#authMiddleware;
 	#driveMiddleware;
@@ -3160,7 +2881,8 @@ var GraphQLManager = class {
 	* it for reactor-drive parents.
 	*/
 	reactorDriveClient;
-	constructor(path, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, logger, httpAdapter, gatewayAdapter, authConfig, documentPermissionService, featureFlags = DefaultFeatureFlags, port = 4001, authorizationService, reactorDriveClient) {
+	authorizationService;
+	constructor(path, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, logger, httpAdapter, gatewayAdapter, authService, documentPermissionService, featureFlags = DefaultFeatureFlags, port = 4001, authorizationService, reactorDriveClient) {
 		this.path = path;
 		this.httpServer = httpServer;
 		this.wsServer = wsServer;
@@ -3171,13 +2893,13 @@ var GraphQLManager = class {
 		this.logger = logger;
 		this.httpAdapter = httpAdapter;
 		this.gatewayAdapter = gatewayAdapter;
-		this.authConfig = authConfig;
+		this.authService = authService;
 		this.documentPermissionService = documentPermissionService;
 		this.featureFlags = featureFlags;
 		this.port = port;
+		if (!authorizationService) throw new Error("GraphQLManager requires an authorizationService");
 		this.authorizationService = authorizationService;
 		this.reactorDriveClient = reactorDriveClient;
-		if (this.authConfig) this.authService = new AuthService(this.authConfig);
 		this.driveOwnershipCache = new DriveOwnershipCache(this.reactorClient);
 		this.wsServer.setMaxListeners(0);
 	}
@@ -3297,6 +3019,14 @@ var GraphQLManager = class {
 	getBasePath() {
 		return this.path;
 	}
+	/**
+	* Get the authorization service shared with subgraphs. Use this when
+	* constructing a subgraph instance externally for
+	* {@link registerSubgraphInstance}.
+	*/
+	getAuthorizationService() {
+		return this.authorizationService;
+	}
 	async registerSubgraph(subgraph, supergraph = "", core = false) {
 		const subgraphInstance = new subgraph({
 			relationalDb: this.relationalDb,
@@ -3356,8 +3086,7 @@ var GraphQLManager = class {
 				db: this.relationalDb,
 				...this.getAdditionalContextFields(),
 				driveId,
-				user: authCtx?.user,
-				isAdmin: authCtx ? (addr) => !authCtx.auth_enabled ? true : authCtx.admins.includes(addr.toLowerCase()) : () => true
+				user: authCtx?.user
 			});
 		};
 	}
@@ -3501,8 +3230,8 @@ var GraphQLManager = class {
 };
 //#endregion
 //#region src/graphql/packages/resolvers.ts
-function requireAdmin(ctx) {
-	if (!(ctx.isAdmin?.(ctx.user?.address ?? "") ?? false)) throw new GraphQLError("Admin access required");
+function requireAdmin(authorizationService, ctx) {
+	if (!authorizationService.isSupremeAdmin(ctx.user?.address)) throw new GraphQLError("Admin access required");
 }
 function formatPackageInfo(info) {
 	return {
@@ -3520,16 +3249,16 @@ async function installedPackage(service, args) {
 	const pkg = await service.getInstalledPackage(args.name);
 	return pkg ? formatPackageInfo(pkg) : null;
 }
-async function installPackage(service, args, ctx) {
-	requireAdmin(ctx);
+async function installPackage(service, authorizationService, args, ctx) {
+	requireAdmin(authorizationService, ctx);
 	const result = await service.installPackage(args.name, args.registryUrl ?? void 0);
 	return {
 		package: formatPackageInfo(result.package),
 		documentModelsLoaded: result.documentModelsLoaded
 	};
 }
-async function uninstallPackage(service, args, ctx) {
-	requireAdmin(ctx);
+async function uninstallPackage(service, authorizationService, args, ctx) {
+	requireAdmin(authorizationService, ctx);
 	return service.uninstallPackage(args.name);
 }
 //#endregion
@@ -3575,7 +3304,7 @@ var PackagesSubgraph = class extends BaseSubgraph {
 			installPackage: async (_parent, args, ctx) => {
 				this.logger.debug("installPackage(@args)", args);
 				try {
-					return await installPackage(this.packageManagementService, args, ctx);
+					return await installPackage(this.packageManagementService, this.authorizationService, args, ctx);
 				} catch (error) {
 					this.logger.error("Error in installPackage: @error", error);
 					throw error;
@@ -3584,7 +3313,7 @@ var PackagesSubgraph = class extends BaseSubgraph {
 			uninstallPackage: async (_parent, args, ctx) => {
 				this.logger.debug("uninstallPackage(@args)", args);
 				try {
-					return await uninstallPackage(this.packageManagementService, args, ctx);
+					return await uninstallPackage(this.packageManagementService, this.authorizationService, args, ctx);
 				} catch (error) {
 					this.logger.error("Error in uninstallPackage: @error", error);
 					throw error;
@@ -3951,7 +3680,8 @@ function ensureJobSubscription(reactorClient, jobId) {
 					error: jobInfo.error?.message ?? null,
 					result: jobInfo.result ?? {}
 				},
-				jobId
+				jobId,
+				documentId: jobInfo.documentId
 			};
 			pubSub.publish(SUBSCRIPTION_TRIGGERS.JOB_CHANGES, payload);
 			const isTerminal = String(jobInfo.status) === "FAILED" || String(jobInfo.status) === "READ_MODELS_READY" || jobInfo.completedAtUtcIso !== void 0;
@@ -4001,12 +3731,14 @@ var ReactorSubgraph = class extends BaseSubgraph {
 	* Delegates to base assertCanExecuteOperation for each action.
 	*/
 	async assertCanExecuteOperations(documentId, actions, ctx) {
+		let handle = AuthorizedDocumentHandle.skipped(documentId);
 		for (const action of actions) {
 			if (!action || typeof action !== "object") continue;
 			const operationType = action.type;
 			if (typeof operationType !== "string") continue;
-			await this.assertCanExecuteOperation(documentId, operationType, ctx);
+			handle = await this.assertCanExecuteOperation(documentId, operationType, ctx);
 		}
+		return handle;
 	}
 	/**
 	* Returns the drive id when the given identifier (id or slug) refers
@@ -4023,11 +3755,25 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			return;
 		}
 	}
+	/**
+	* Adds to `forbidden` the canonical document ids in `syncOps` that the caller
+	* cannot read, checking each distinct id once. Sync operation document ids are
+	* canonical (never slugs), so no resolution is needed.
+	*/
+	async #collectForbiddenDocuments(syncOps, forbidden, ctx) {
+		const checked = /* @__PURE__ */ new Set();
+		for (const syncOp of syncOps) {
+			const documentId = syncOp.documentId;
+			if (checked.has(documentId) || forbidden.has(documentId)) continue;
+			checked.add(documentId);
+			if (!await this.canReadDocument(documentId, ctx)) forbidden.add(documentId);
+		}
+	}
 	typeDefs = gql(schema_default);
 	resolvers = {
 		PHDocument: { operations: async (parent, args, ctx) => {
 			this.logger.debug("PHDocument.operations(@parent.id, @args)", parent.id, args);
-			await this.assertCanRead(parent.id, ctx);
+			await this.assertCanReadCanonical(parent.id, ctx);
 			try {
 				const filter = {
 					documentId: parent.id,
@@ -4060,8 +3806,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			document: async (_parent, args, ctx) => {
 				this.logger.debug("document(@args)", args);
 				try {
-					await this.assertCanRead(args.identifier, ctx);
-					return await document(this.reactorClient, args);
+					const handle = await this.assertCanRead(args.identifier, ctx);
+					return await document(this.reactorClient, {
+						...args,
+						identifier: handle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in document: @Error", error);
 					throw error;
@@ -4070,8 +3819,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			documentOutgoingRelationships: async (_parent, args, ctx) => {
 				this.logger.debug("documentOutgoingRelationships(@args)", args);
 				try {
-					await this.assertCanRead(args.sourceIdentifier, ctx);
-					return await documentOutgoingRelationships(this.reactorClient, args);
+					const handle = await this.assertCanRead(args.sourceIdentifier, ctx);
+					return await documentOutgoingRelationships(this.reactorClient, {
+						...args,
+						sourceIdentifier: handle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in documentOutgoingRelationships: @Error", error);
 					throw error;
@@ -4080,9 +3832,12 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			documentIncomingRelationships: async (_parent, args, ctx) => {
 				this.logger.debug("documentIncomingRelationships(@args)", args);
 				try {
-					await this.assertCanRead(args.targetIdentifier, ctx);
-					const result = await documentIncomingRelationships(this.reactorClient, args);
-					if (!this.hasGlobalAdminAccess(ctx) && this.documentPermissionService) {
+					const handle = await this.assertCanRead(args.targetIdentifier, ctx);
+					const result = await documentIncomingRelationships(this.reactorClient, {
+						...args,
+						targetIdentifier: handle.fetchIdentifier
+					});
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
 						return {
@@ -4103,7 +3858,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 						...args,
 						search: args.search ?? {}
 					});
-					if (!this.hasGlobalAdminAccess(ctx) && this.documentPermissionService) {
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
 						return {
@@ -4129,18 +3884,38 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			documentOperations: async (_parent, args, ctx) => {
 				this.logger.debug("documentOperations(@args)", args);
 				try {
-					await this.assertCanRead(args.filter.documentId, ctx);
-					return await documentOperations(this.reactorClient, args);
+					const handle = await this.assertCanRead(args.filter.documentId, ctx);
+					return await documentOperations(this.reactorClient, {
+						...args,
+						filter: {
+							...args.filter,
+							documentId: handle.fetchIdentifier
+						}
+					});
 				} catch (error) {
 					this.logger.error("Error in documentOperations: @Error", error);
 					throw error;
 				}
 			},
-			pollSyncEnvelopes: (_parent, args) => {
+			pollSyncEnvelopes: async (_parent, args, ctx) => {
 				this.logger.debug("pollSyncEnvelopes(@args)", args);
 				try {
-					const { envelopes, ackOrdinal, deadLetters, hasMore } = pollSyncEnvelopes(this.syncManager, args);
-					return {
+					let remote;
+					try {
+						remote = this.syncManager.getById(args.channelId);
+					} catch (error) {
+						throw new GraphQLError(`Channel not found: ${error instanceof Error ? error.message : "Unknown error"}`);
+					}
+					const driveId = remote.meta.collectionId.driveId;
+					const isAdmin = this.authorizationService.isSupremeAdmin(ctx.user?.address);
+					if (!isAdmin) await this.assertCanReadCanonical(driveId, ctx);
+					const forbiddenIds = /* @__PURE__ */ new Set();
+					if (!isAdmin) {
+						if (await this.authorizationService.canRead(driveId, void 0)) await this.#collectForbiddenDocuments(remote.channel.outbox.items, forbiddenIds, ctx);
+						await this.#collectForbiddenDocuments(remote.channel.deadLetter.items, forbiddenIds, ctx);
+					}
+					const { envelopes, ackOrdinal, deadLetters, hasMore } = pollSyncEnvelopes(this.syncManager, args, forbiddenIds);
+					return {
 						envelopes,
 						ackOrdinal,
 						deadLetters,
@@ -4158,13 +3933,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 				try {
 					if (args.parentIdentifier) {
 						const parent = await document(this.reactorClient, { identifier: args.parentIdentifier });
-						await this.assertCanWrite(parent.document.id, ctx);
-					} else if (this.authorizationService) {
-						if (!ctx.user?.address) throw new GraphQLError("Forbidden: authentication required to create documents");
-					} else if (!this.hasGlobalAdminAccess(ctx)) throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+						await this.assertCanWriteCanonical(parent.document.id, ctx);
+					} else this.assertCanCreate(ctx);
 					const result = await createDocument(this.reactorClient, args, this.graphqlManager.reactorDriveClient);
 					if (result?.id && isDriveContainerType(result.documentType)) this.graphqlManager.driveOwnershipCache.add(result.id);
-					if (this.authorizationService && ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
+					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
 				} catch (error) {
 					this.logger.error("Error in createDocument(@args): @Error", args, error);
@@ -4176,13 +3949,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 				try {
 					if (args.parentIdentifier) {
 						const parent = await document(this.reactorClient, { identifier: args.parentIdentifier });
-						await this.assertCanWrite(parent.document.id, ctx);
-					} else if (this.authorizationService) {
-						if (!ctx.user?.address) throw new GraphQLError("Forbidden: authentication required to create documents");
-					} else if (!this.hasGlobalAdminAccess(ctx)) throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+						await this.assertCanWriteCanonical(parent.document.id, ctx);
+					} else this.assertCanCreate(ctx);
 					const result = await createEmptyDocument(this.reactorClient, args, this.graphqlManager.reactorDriveClient);
 					if (result?.id && isDriveContainerType(result.documentType)) this.graphqlManager.driveOwnershipCache.add(result.id);
-					if (this.authorizationService && ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
+					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
 				} catch (error) {
 					this.logger.error("Error in createEmptyDocument(@args): @Error", args, error);
@@ -4192,9 +3963,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			mutateDocument: async (_parent, args, ctx) => {
 				this.logger.debug("mutateDocument(@args)", args);
 				try {
-					if (!this.authorizationService) await this.assertCanWrite(args.documentIdentifier, ctx);
-					await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
-					return await mutateDocument(this.reactorClient, args);
+					const handle = await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
+					return await mutateDocument(this.reactorClient, {
+						...args,
+						documentIdentifier: handle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in mutateDocument(@args): @Error", args, error);
 					throw error;
@@ -4203,9 +3976,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			mutateDocumentAsync: async (_parent, args, ctx) => {
 				this.logger.debug("mutateDocumentAsync(@args)", args);
 				try {
-					if (!this.authorizationService) await this.assertCanWrite(args.documentIdentifier, ctx);
-					await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
-					return await mutateDocumentAsync(this.reactorClient, args);
+					const handle = await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
+					return await mutateDocumentAsync(this.reactorClient, {
+						...args,
+						documentIdentifier: handle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in mutateDocumentAsync(@args): @Error", args, error);
 					throw error;
@@ -4214,8 +3989,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			renameDocument: async (_parent, args, ctx) => {
 				this.logger.debug("renameDocument(@args)", args);
 				try {
-					await this.assertCanWrite(args.documentIdentifier, ctx);
-					return await renameDocument(this.reactorClient, args);
+					const handle = await this.assertCanWrite(args.documentIdentifier, ctx);
+					return await renameDocument(this.reactorClient, {
+						...args,
+						documentIdentifier: handle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in renameDocument(@args): @Error", args, error);
 					throw error;
@@ -4224,8 +4002,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			setPreferredEditor: async (_parent, args, ctx) => {
 				this.logger.debug("setPreferredEditor(@args)", args);
 				try {
-					await this.assertCanWrite(args.documentIdentifier, ctx);
-					return await setPreferredEditor(this.reactorClient, args);
+					const handle = await this.assertCanWrite(args.documentIdentifier, ctx);
+					return await setPreferredEditor(this.reactorClient, {
+						...args,
+						documentIdentifier: handle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in setPreferredEditor(@args): @Error", args, error);
 					throw error;
@@ -4234,8 +4015,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			addRelationship: async (_parent, args, ctx) => {
 				this.logger.debug("addRelationship(@args)", args);
 				try {
-					await this.assertCanWrite(args.sourceIdentifier, ctx);
-					return await addRelationship(this.reactorClient, args);
+					const handle = await this.assertCanWrite(args.sourceIdentifier, ctx);
+					return await addRelationship(this.reactorClient, {
+						...args,
+						sourceIdentifier: handle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in addRelationship(@args): @Error", args, error);
 					throw error;
@@ -4244,8 +4028,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			removeRelationship: async (_parent, args, ctx) => {
 				this.logger.debug("removeRelationship(@args)", args);
 				try {
-					await this.assertCanWrite(args.sourceIdentifier, ctx);
-					return await removeRelationship(this.reactorClient, args);
+					const handle = await this.assertCanWrite(args.sourceIdentifier, ctx);
+					return await removeRelationship(this.reactorClient, {
+						...args,
+						sourceIdentifier: handle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in removeRelationship(@args): @Error", args, error);
 					throw error;
@@ -4254,9 +4041,13 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			moveRelationship: async (_parent, args, ctx) => {
 				this.logger.debug("moveRelationship(@args)", args);
 				try {
-					await this.assertCanWrite(args.sourceParentIdentifier, ctx);
-					await this.assertCanWrite(args.targetParentIdentifier, ctx);
-					return await moveRelationship(this.reactorClient, args);
+					const sourceHandle = await this.assertCanWrite(args.sourceParentIdentifier, ctx);
+					const targetHandle = await this.assertCanWrite(args.targetParentIdentifier, ctx);
+					return await moveRelationship(this.reactorClient, {
+						...args,
+						sourceParentIdentifier: sourceHandle.fetchIdentifier,
+						targetParentIdentifier: targetHandle.fetchIdentifier
+					});
 				} catch (error) {
 					this.logger.error("Error in moveRelationship(@args): @Error @args", error, args);
 					throw error;
@@ -4265,9 +4056,12 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			deleteDocument: async (_parent, args, ctx) => {
 				this.logger.debug("deleteDocument(@args)", args);
 				try {
-					await this.assertCanWrite(args.identifier, ctx);
-					const driveIdToInvalidate = await this.#resolveDriveId(args.identifier);
-					const result = await deleteDocument(this.reactorClient, args, this.graphqlManager.reactorDriveClient);
+					const identifier = (await this.assertCanWrite(args.identifier, ctx)).fetchIdentifier;
+					const driveIdToInvalidate = await this.#resolveDriveId(identifier);
+					const result = await deleteDocument(this.reactorClient, {
+						...args,
+						identifier
+					}, this.graphqlManager.reactorDriveClient);
 					if (result && driveIdToInvalidate) this.graphqlManager.driveOwnershipCache.remove(driveIdToInvalidate);
 					return result;
 				} catch (error) {
@@ -4278,25 +4072,49 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			deleteDocuments: async (_parent, args, ctx) => {
 				this.logger.debug("deleteDocuments(@args)", args);
 				try {
-					for (const identifier of args.identifiers) await this.assertCanWrite(identifier, ctx);
-					return await deleteDocuments(this.reactorClient, args);
+					const identifiers = [];
+					for (const identifier of args.identifiers) {
+						const handle = await this.assertCanWrite(identifier, ctx);
+						identifiers.push(handle.fetchIdentifier);
+					}
+					return await deleteDocuments(this.reactorClient, {
+						...args,
+						identifiers
+					});
 				} catch (error) {
 					this.logger.error("Error in deleteDocuments(@args): @Error", args, error);
 					throw error;
 				}
 			},
-			touchChannel: async (_parent, args) => {
+			touchChannel: async (_parent, args, ctx) => {
 				this.logger.debug("touchChannel(@args)", args);
 				try {
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
+						const driveId = DriveCollectionId.fromKey(args.input.collectionId).driveId;
+						await this.assertCanReadCanonical(driveId, ctx);
+					}
 					return await touchChannel(this.syncManager, args);
 				} catch (error) {
 					this.logger.error("Error in touchChannel(@args): @Error", args, error);
 					throw error;
 				}
 			},
-			pushSyncEnvelopes: async (_parent, args) => {
+			pushSyncEnvelopes: async (_parent, args, ctx) => {
 				this.logger.debug("pushSyncEnvelopes(@args)", args);
 				try {
+					const checkedOperations = /* @__PURE__ */ new Map();
+					for (const envelope of args.envelopes) for (const op of envelope.operations ?? []) {
+						const documentId = op.context.documentId;
+						const operationType = op.operation.action.type;
+						let checkedTypes = checkedOperations.get(documentId);
+						if (!checkedTypes) {
+							checkedTypes = /* @__PURE__ */ new Set();
+							checkedOperations.set(documentId, checkedTypes);
+						}
+						if (checkedTypes.has(operationType)) continue;
+						checkedTypes.add(operationType);
+						await this.assertCanExecuteOperationCanonical(documentId, operationType, ctx);
+					}
 					const mutableArgs = { envelopes: args.envelopes.map((envelope) => ({
 						type: envelope.type,
 						channelMeta: { id: envelope.channelMeta.id },
@@ -4327,31 +4145,43 @@ var ReactorSubgraph = class extends BaseSubgraph {
 		},
 		Subscription: {
 			documentChanges: {
-				subscribe: withFilter((() => {
+				subscribe: (rootValue, args, ctx, info) => {
 					this.logger.debug("documentChanges subscription started");
-					ensureGlobalDocumentSubscription(this.reactorClient);
-					return getPubSub().asyncIterableIterator(SUBSCRIPTION_TRIGGERS.DOCUMENT_CHANGES);
-				}), ((payload, args) => {
-					if (!payload) return false;
-					const search = {
-						type: args.search?.type ?? void 0,
-						parentId: args.search?.parentId ?? void 0
-					};
-					return matchesSearchFilter(payload.documentChanges, search);
-				})),
+					return withFilter(() => {
+						ensureGlobalDocumentSubscription(this.reactorClient);
+						return getPubSub().asyncIterableIterator(SUBSCRIPTION_TRIGGERS.DOCUMENT_CHANGES);
+					}, async (payload, filterArgs, filterCtx) => {
+						if (!payload) return false;
+						const search = {
+							type: filterArgs?.search?.type ?? void 0,
+							parentId: filterArgs?.search?.parentId ?? void 0
+						};
+						if (!matchesSearchFilter(payload.documentChanges, search)) return false;
+						if (this.authorizationService.isSupremeAdmin(filterCtx?.user?.address)) return true;
+						const documentIds = collectChangedDocumentIds(payload.documentChanges);
+						if (documentIds.length === 0) return false;
+						for (const documentId of documentIds) if (!await this.canReadDocument(documentId, filterCtx)) return false;
+						return true;
+					})(rootValue, args, ctx, info);
+				},
 				resolve: (payload) => {
 					return toGqlDocumentChangeEvent(payload.documentChanges);
 				}
 			},
 			jobChanges: {
-				subscribe: withFilter(((_parent, args) => {
+				subscribe: (rootValue, args, ctx, info) => {
 					this.logger.debug("jobChanges(@args) subscription started", args);
-					ensureJobSubscription(this.reactorClient, args.jobId);
-					return getPubSub().asyncIterableIterator(SUBSCRIPTION_TRIGGERS.JOB_CHANGES);
-				}), ((payload, args) => {
-					if (!payload) return false;
-					return matchesJobFilter(payload, args);
-				})),
+					return withFilter(() => {
+						ensureJobSubscription(this.reactorClient, args.jobId);
+						return getPubSub().asyncIterableIterator(SUBSCRIPTION_TRIGGERS.JOB_CHANGES);
+					}, async (payload, filterArgs, filterCtx) => {
+						if (!payload || !filterArgs) return false;
+						if (!matchesJobFilter(payload, filterArgs)) return false;
+						if (this.authorizationService.isSupremeAdmin(filterCtx?.user?.address)) return true;
+						if (!payload.documentId) return false;
+						return this.canReadDocument(payload.documentId, filterCtx);
+					})(rootValue, args, ctx, info);
+				},
 				resolve: (payload) => {
 					return payload.jobChanges;
 				}
@@ -4375,10 +4205,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.0-dev.4";
+	return "6.2.0-dev.41";
 }
 function getGitHash() {
-	return "79386a1a3182a6350dbd6c359927889a9f1f9c2d";
+	return "e8127a8841bc768f5b494738716eb7d460a4e2c6";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -4861,10 +4691,10 @@ const DefaultCoreSubgraphs = [AnalyticsSubgraph, SystemSubgraph];
 //#endregion
 //#region src/migrations/001_create_document_permissions.ts
 var _001_create_document_permissions_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$2,
+	up: () => up$2
 });
-async function up$1(db) {
+async function up$2(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS "DocumentPermission" (
       "id" SERIAL PRIMARY KEY,
@@ -4938,7 +4768,7 @@ async function up$1(db) {
 	await sql`CREATE INDEX IF NOT EXISTS "operationgrouppermission_documentid_index" ON "OperationGroupPermission" ("documentId")`.execute(db);
 	await sql`CREATE INDEX IF NOT EXISTS "operationgrouppermission_groupid_index" ON "OperationGroupPermission" ("groupId")`.execute(db);
 }
-async function down$1(db) {
+async function down$2(db) {
 	await sql`DROP TABLE IF EXISTS "OperationGroupPermission"`.execute(db);
 	await sql`DROP TABLE IF EXISTS "OperationUserPermission"`.execute(db);
 	await sql`DROP TABLE IF EXISTS "DocumentGroupPermission"`.execute(db);
@@ -4949,10 +4779,10 @@ async function down$1(db) {
 //#endregion
 //#region src/migrations/002_add_document_protection.ts
 var _002_add_document_protection_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$1,
+	up: () => up$1
 });
-async function up(db) {
+async function up$1(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS "DocumentProtection" (
       "documentId" VARCHAR(255) PRIMARY KEY,
@@ -4965,10 +4795,80 @@ async function up(db) {
 	await sql`CREATE INDEX IF NOT EXISTS "documentprotection_owneraddress_index" ON "DocumentProtection" ("ownerAddress")`.execute(db);
 	await sql`CREATE INDEX IF NOT EXISTS "documentprotection_protected_index" ON "DocumentProtection" ("protected")`.execute(db);
 }
-async function down(db) {
+async function down$1(db) {
 	await sql`DROP TABLE IF EXISTS "DocumentProtection"`.execute(db);
 }
 //#endregion
+//#region src/migrations/003_remove_group_tables.ts
+var _003_remove_group_tables_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* Removes the group-permission feature: the Group, UserGroup,
+* DocumentGroupPermission, and OperationGroupPermission tables. The feature had
+* no consumers and disclosed ACL/membership metadata (AUTH_REVIEW S-H3/S-H5);
+* it is retired in favor of direct user grants, ownership, and protection.
+*
+* Tables are dropped in reverse dependency order. There are no DB-enforced
+* foreign keys, so the drops cannot violate referential integrity and do not
+* touch the surviving DocumentPermission / OperationUserPermission /
+* DocumentProtection tables.
+*/
+async function up(db) {
+	await sql`DROP TABLE IF EXISTS "OperationGroupPermission"`.execute(db);
+	await sql`DROP TABLE IF EXISTS "DocumentGroupPermission"`.execute(db);
+	await sql`DROP TABLE IF EXISTS "UserGroup"`.execute(db);
+	await sql`DROP TABLE IF EXISTS "Group"`.execute(db);
+}
+async function down(db) {
+	await sql`
+    CREATE TABLE IF NOT EXISTS "Group" (
+      "id" SERIAL PRIMARY KEY,
+      "name" VARCHAR(255) NOT NULL UNIQUE,
+      "description" TEXT,
+      "createdAt" TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      "updatedAt" TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+    )
+  `.execute(db);
+	await sql`
+    CREATE TABLE IF NOT EXISTS "UserGroup" (
+      "userAddress" VARCHAR(255) NOT NULL,
+      "groupId" INTEGER NOT NULL,
+      "createdAt" TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      PRIMARY KEY ("userAddress", "groupId")
+    )
+  `.execute(db);
+	await sql`CREATE INDEX IF NOT EXISTS "usergroup_groupid_index" ON "UserGroup" ("groupId")`.execute(db);
+	await sql`
+    CREATE TABLE IF NOT EXISTS "DocumentGroupPermission" (
+      "id" SERIAL PRIMARY KEY,
+      "documentId" VARCHAR(255) NOT NULL,
+      "groupId" INTEGER NOT NULL,
+      "permission" VARCHAR(20) NOT NULL CHECK ("permission" IN ('READ', 'WRITE', 'ADMIN')),
+      "grantedBy" VARCHAR(255) NOT NULL,
+      "createdAt" TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      "updatedAt" TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      UNIQUE ("documentId", "groupId")
+    )
+  `.execute(db);
+	await sql`CREATE INDEX IF NOT EXISTS "documentgrouppermission_documentid_index" ON "DocumentGroupPermission" ("documentId")`.execute(db);
+	await sql`CREATE INDEX IF NOT EXISTS "documentgrouppermission_groupid_index" ON "DocumentGroupPermission" ("groupId")`.execute(db);
+	await sql`
+    CREATE TABLE IF NOT EXISTS "OperationGroupPermission" (
+      "id" SERIAL PRIMARY KEY,
+      "documentId" VARCHAR(255) NOT NULL,
+      "operationType" VARCHAR(255) NOT NULL,
+      "groupId" INTEGER NOT NULL,
+      "grantedBy" VARCHAR(255) NOT NULL,
+      "createdAt" TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      UNIQUE ("documentId", "operationType", "groupId")
+    )
+  `.execute(db);
+	await sql`CREATE INDEX IF NOT EXISTS "operationgrouppermission_documentid_index" ON "OperationGroupPermission" ("documentId")`.execute(db);
+	await sql`CREATE INDEX IF NOT EXISTS "operationgrouppermission_groupid_index" ON "OperationGroupPermission" ("groupId")`.execute(db);
+}
+//#endregion
 //#region src/migrations/index.ts
 /**
 * Custom migration provider that loads migrations from imported modules
@@ -4977,7 +4877,8 @@ var StaticMigrationProvider = class {
 	getMigrations() {
 		return Promise.resolve({
 			"001_create_document_permissions": _001_create_document_permissions_exports,
-			"002_add_document_protection": _002_add_document_protection_exports
+			"002_add_document_protection": _002_add_document_protection_exports,
+			"003_remove_group_tables": _003_remove_group_tables_exports
 		});
 	}
 };
@@ -4999,104 +4900,159 @@ async function runMigrations(db) {
 	}
 }
 //#endregion
-//#region src/services/authorization.service.ts
-/**
-* Central authorization service — single source of truth for all permission checks.
-*
-* Authorization model:
-* 1. Supreme admin (ADMINS env) → ALLOW ALL
-* 2. Is document protected?
-*    a. NOT protected:
-*       - READ: anyone (even anonymous) → ALLOW
-*       - WRITE: authenticated user → ALLOW
-*    b. PROTECTED:
-*       - READ: requires explicit READ/WRITE/ADMIN grant (direct or via group/parent)
-*       - WRITE: requires explicit WRITE/ADMIN grant (direct or via group/parent)
-* 3. Operation restricted? → Check OperationUserPermission
-* 4. Document owner = implicit ADMIN
-* 5. Drive protected = all children effectively protected
-*/
-var AuthorizationService = class {
+//#region src/services/auth.service.ts
+const DEFAULT_CREDENTIAL_CACHE_TTL_MS = 6e4;
+const CREDENTIAL_CACHE_MAX_ENTRIES = 1e3;
+var AuthService = class {
 	config;
-	constructor(documentPermissionService, config) {
-		this.documentPermissionService = documentPermissionService;
+	credentialCache = /* @__PURE__ */ new Map();
+	constructor(config) {
 		this.config = config;
 	}
+	async authenticateRequest(request) {
+		if (!this.config.enabled) return {
+			user: void 0,
+			admins: [],
+			auth_enabled: false
+		};
+		const method = request.method;
+		if (method === "OPTIONS" || method === "GET") return {
+			user: void 0,
+			admins: this.config.admins,
+			auth_enabled: true
+		};
+		return this.verifyBearer(request.headers.get("authorization") ?? void 0);
+	}
 	/**
-	* Check if a user is a supreme admin (from ADMINS env var).
+	* Verify a Bearer token regardless of HTTP method. Use this from non-GraphQL
+	* middleware that must enforce authentication on every request.
 	*/
-	isSupremeAdmin(userAddress) {
-		if (!userAddress) return false;
-		return this.config.admins.includes(userAddress.toLowerCase());
+	async verifyBearer(authorization) {
+		if (!this.config.enabled) return {
+			user: void 0,
+			admins: [],
+			auth_enabled: false
+		};
+		const token = authorization?.split(" ")[1];
+		if (!token) return {
+			user: void 0,
+			admins: this.config.admins,
+			auth_enabled: true
+		};
+		try {
+			const verified = await this.verifyToken(token);
+			if (!verified) return new Response(JSON.stringify({ error: "Verification failed" }), { status: 401 });
+			const user = this.extractUserFromVerification(verified);
+			if (!user) return new Response(JSON.stringify({ error: "Missing credentials" }), { status: 401 });
+			if (!this.config.skipCredentialVerification) {
+				if (!await this.verifyCredentialExists(user.address, user.chainId, verified.issuer)) return new Response(JSON.stringify({ error: "Credentials no longer valid" }), { status: 401 });
+			}
+			return {
+				user,
+				admins: this.config.admins,
+				auth_enabled: true
+			};
+		} catch {
+			return new Response(JSON.stringify({ error: "Authentication failed" }), { status: 401 });
+		}
+	}
+	async authenticateWebSocketConnection(connectionParams) {
+		if (!this.config.enabled) return null;
+		const authHeader = connectionParams.authorization;
+		if (!authHeader) throw new Error("Missing authorization in connection parameters");
+		const token = authHeader.split(" ")[1];
+		if (!token) throw new Error("Invalid authorization format");
+		const verified = await this.verifyToken(token);
+		if (!verified) throw new Error("Token verification failed");
+		const user = this.extractUserFromVerification(verified);
+		if (!user) throw new Error("Invalid credentials");
+		if (!this.config.skipCredentialVerification) {
+			if (!await this.verifyCredentialExists(user.address, user.chainId, verified.issuer)) throw new Error("Credentials no longer valid");
+		}
+		return user;
 	}
 	/**
-	* Check if a user can read a document.
-	*
-	* - Supreme admin → yes
-	* - Not protected → anyone can read (even anonymous)
-	* - Protected → requires READ/WRITE/ADMIN grant (direct, group, or parent inheritance)
-	* - Owner → yes (implicit ADMIN)
+	* Verify the auth bearer token
 	*/
-	async canRead(documentId, userAddress, getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (!(getParentIds ? await this.documentPermissionService.isProtectedWithAncestors(documentId, getParentIds) : await this.documentPermissionService.isDocumentProtected(documentId))) return true;
-		if (!userAddress) return false;
-		const owner = await this.documentPermissionService.getDocumentOwner(documentId);
-		if (owner && owner === userAddress.toLowerCase()) return true;
-		if (getParentIds) return this.documentPermissionService.canRead(documentId, userAddress, getParentIds);
-		return this.documentPermissionService.canReadDocument(documentId, userAddress);
+	async verifyToken(token) {
+		return await verifyAuthBearerToken(token);
 	}
 	/**
-	* Check if a user can write to a document.
-	*
-	* - Supreme admin → yes
-	* - Not protected → anyone can write (even anonymous)
-	* - Protected → requires authentication + WRITE/ADMIN grant
-	* - Owner → yes (implicit ADMIN)
+	* Extract user information from verification result
 	*/
-	async canWrite(documentId, userAddress, getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (!(getParentIds ? await this.documentPermissionService.isProtectedWithAncestors(documentId, getParentIds) : await this.documentPermissionService.isDocumentProtected(documentId))) return true;
-		if (!userAddress) return false;
-		const owner = await this.documentPermissionService.getDocumentOwner(documentId);
-		if (owner && owner === userAddress.toLowerCase()) return true;
-		if (getParentIds) return this.documentPermissionService.canWrite(documentId, userAddress, getParentIds);
-		return this.documentPermissionService.canWriteDocument(documentId, userAddress);
+	extractUserFromVerification(verified) {
+		try {
+			const { address, chainId, networkId } = verified.verifiableCredential.credentialSubject;
+			if (!address || !chainId || !networkId) return null;
+			return {
+				address,
+				chainId,
+				networkId
+			};
+		} catch {
+			return null;
+		}
 	}
 	/**
-	* Check if a user can manage a document (change permissions, protection, transfer ownership).
+	* Verify that the credential still exists on the Renown API.
 	*
-	* - Supreme admin → yes
-	* - Owner → yes
-	* - Has ADMIN grant → yes
+	* Results are cached per (address, chainId, issuer) for a short TTL so the
+	* blocking external round-trip is not paid on every request. Concurrent
+	* checks for the same key share a single in-flight request, and entries
+	* that resolve to false are evicted immediately so failed or revoked
+	* credentials are re-checked on the next request.
 	*/
-	async canManage(documentId, userAddress, _getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (!userAddress) return false;
-		const owner = await this.documentPermissionService.getDocumentOwner(documentId);
-		if (owner && owner === userAddress.toLowerCase()) return true;
-		return this.documentPermissionService.canManageDocument(documentId, userAddress);
+	verifyCredentialExists(address, chainId, appId) {
+		const ttlMs = this.config.credentialVerificationCacheTtlMs ?? DEFAULT_CREDENTIAL_CACHE_TTL_MS;
+		if (ttlMs <= 0) return this.fetchCredentialExists(address, chainId, appId);
+		const key = `${address.toLowerCase()}:${chainId}:${appId}`;
+		const now = Date.now();
+		const cached = this.credentialCache.get(key);
+		if (cached && cached.expiresAt > now) return cached.exists;
+		this.pruneCredentialCache(now);
+		const entry = {
+			exists: this.fetchCredentialExists(address, chainId, appId).then((exists) => {
+				if (!exists && this.credentialCache.get(key) === entry) this.credentialCache.delete(key);
+				return exists;
+			}),
+			expiresAt: now + ttlMs
+		};
+		this.credentialCache.set(key, entry);
+		return entry.exists;
 	}
 	/**
-	* Check if a user can execute a specific operation.
-	* If the operation is not restricted, falls through to the standard write check.
-	* If the operation is restricted, requires an explicit OperationUserPermission grant.
+	* Enforce the cache size cap before inserting a new entry: drop expired
+	* entries first, then evict oldest-inserted entries (insertion order
+	* matches expiry order since the TTL is constant) until under the cap, so
+	* a flood of distinct keys cannot grow the map without bound.
 	*/
-	async canExecuteOperation(documentId, operationType, userAddress, getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (!await this.documentPermissionService.isOperationRestricted(documentId, operationType)) return this.canWrite(documentId, userAddress, getParentIds);
-		return this.documentPermissionService.canExecuteOperation(documentId, operationType, userAddress?.toLowerCase());
+	pruneCredentialCache(now) {
+		if (this.credentialCache.size < CREDENTIAL_CACHE_MAX_ENTRIES) return;
+		for (const [key, entry] of this.credentialCache) if (entry.expiresAt <= now) this.credentialCache.delete(key);
+		while (this.credentialCache.size >= CREDENTIAL_CACHE_MAX_ENTRIES) {
+			const oldestKey = this.credentialCache.keys().next().value;
+			if (oldestKey === void 0) break;
+			this.credentialCache.delete(oldestKey);
+		}
 	}
 	/**
-	* Combined check for mutations: can the user write + execute the operation?
-	* This enables READ-only users with operation grants to execute specific operations.
-	* For restricted operations, only the operation grant is checked (bypasses write check),
-	* allowing READ-only users with an explicit operation grant to execute that operation.
+	* Fetch the credential from the Renown API and validate it against the
+	* expected address, chainId and issuer. Never throws; returns false on any
+	* network or validation failure.
 	*/
-	async canMutate(documentId, operationType, userAddress, getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (await this.documentPermissionService.isOperationRestricted(documentId, operationType)) return this.documentPermissionService.canExecuteOperation(documentId, operationType, userAddress?.toLowerCase());
-		return this.canWrite(documentId, userAddress, getParentIds);
+	async fetchCredentialExists(address, chainId, appId) {
+		const url = `https://www.renown.id/api/auth/credential?address=${address}&chainId=${chainId}&connectId=${appId}&appId=${appId}`;
+		try {
+			const response = await fetch(url, { method: "GET" });
+			if (response.status !== 200) return false;
+			const credential = (await response.json()).credential;
+			const appIdVerfied = credential.credentialSubject.id;
+			const addressVerfied = credential.issuer.id.split(":")[4];
+			const chainIdVerfied = credential.issuer.id.split(":")[3];
+			return appIdVerfied === appId && addressVerfied.toLocaleLowerCase() === address.toLocaleLowerCase() && chainIdVerfied === chainId.toString();
+		} catch {
+			return false;
+		}
 	}
 };
 //#endregion
@@ -5110,7 +5066,7 @@ var AuthorizationService = class {
 * - ADMIN: Can manage document permissions and settings
 *
 * Operation permissions:
-* - Users and groups can be granted permission to execute specific operations
+* - Users can be granted permission to execute specific operations
 */
 var DocumentPermissionService = class {
 	config;
@@ -5189,209 +5145,7 @@ var DocumentPermissionService = class {
 	*/
 	async deleteAllDocumentPermissions(documentId) {
 		await this.db.deleteFrom("DocumentPermission").where("documentId", "=", documentId).execute();
-		await this.db.deleteFrom("DocumentGroupPermission").where("documentId", "=", documentId).execute();
 		await this.db.deleteFrom("OperationUserPermission").where("documentId", "=", documentId).execute();
-		await this.db.deleteFrom("OperationGroupPermission").where("documentId", "=", documentId).execute();
-	}
-	/**
-	* Check if a user can read a document.
-	* Returns true if user has READ, WRITE, or ADMIN permission (direct or via group)
-	*/
-	async canReadDocument(documentId, userAddress) {
-		if (!userAddress) return false;
-		if (await this.getUserPermission(documentId, userAddress) !== null) return true;
-		return await this.getUserGroupPermission(documentId, userAddress) !== null;
-	}
-	/**
-	* Check if a user can write to a document.
-	* Returns true if user has WRITE or ADMIN permission (direct or via group)
-	*/
-	async canWriteDocument(documentId, userAddress) {
-		if (!userAddress) return false;
-		const directPermission = await this.getUserPermission(documentId, userAddress);
-		if (directPermission === "WRITE" || directPermission === "ADMIN") return true;
-		const groupPermission = await this.getUserGroupPermission(documentId, userAddress);
-		return groupPermission === "WRITE" || groupPermission === "ADMIN";
-	}
-	/**
-	* Check if a user can manage a document (change permissions, settings).
-	* Returns true if user has ADMIN permission (direct or via group)
-	*/
-	async canManageDocument(documentId, userAddress) {
-		if (!userAddress) return false;
-		if (await this.getUserPermission(documentId, userAddress) === "ADMIN") return true;
-		return await this.getUserGroupPermission(documentId, userAddress) === "ADMIN";
-	}
-	/**
-	* Check if a user can read a document, including parent permission inheritance.
-	* Returns true if user has permission on the document OR any parent in the hierarchy.
-	*/
-	async canRead(documentId, userAddress, getParentIds) {
-		if (await this.canReadDocument(documentId, userAddress)) return true;
-		const parentIds = await getParentIds(documentId);
-		for (const parentId of parentIds) if (await this.canRead(parentId, userAddress, getParentIds)) return true;
-		return false;
-	}
-	/**
-	* Check if a user can write to a document, including parent permission inheritance.
-	* Returns true if user has write permission on the document OR any parent in the hierarchy.
-	*/
-	async canWrite(documentId, userAddress, getParentIds) {
-		if (await this.canWriteDocument(documentId, userAddress)) return true;
-		const parentIds = await getParentIds(documentId);
-		for (const parentId of parentIds) if (await this.canWrite(parentId, userAddress, getParentIds)) return true;
-		return false;
-	}
-	/**
-	* Filter a list of document IDs to only include those the user can read.
-	*/
-	async filterReadableDocuments(documentIds, userAddress, getParentIds) {
-		const results = [];
-		for (const docId of documentIds) if (await this.canRead(docId, userAddress, getParentIds)) results.push(docId);
-		return results;
-	}
-	/**
-	* Create a new group
-	*/
-	async createGroup(name, description) {
-		const now = /* @__PURE__ */ new Date();
-		await this.db.insertInto("Group").values({
-			name,
-			description: description ?? null,
-			createdAt: now,
-			updatedAt: now
-		}).execute();
-		return await this.db.selectFrom("Group").select([
-			"id",
-			"name",
-			"description",
-			"createdAt",
-			"updatedAt"
-		]).where("name", "=", name).executeTakeFirstOrThrow();
-	}
-	/**
-	* Delete a group and all its associations
-	*/
-	async deleteGroup(groupId) {
-		await this.db.deleteFrom("OperationGroupPermission").where("groupId", "=", groupId).execute();
-		await this.db.deleteFrom("DocumentGroupPermission").where("groupId", "=", groupId).execute();
-		await this.db.deleteFrom("UserGroup").where("groupId", "=", groupId).execute();
-		await this.db.deleteFrom("Group").where("id", "=", groupId).execute();
-	}
-	/**
-	* Get a group by ID
-	*/
-	async getGroup(groupId) {
-		return await this.db.selectFrom("Group").select([
-			"id",
-			"name",
-			"description",
-			"createdAt",
-			"updatedAt"
-		]).where("id", "=", groupId).executeTakeFirst() ?? null;
-	}
-	/**
-	* List all groups
-	*/
-	async listGroups() {
-		return this.db.selectFrom("Group").select([
-			"id",
-			"name",
-			"description",
-			"createdAt",
-			"updatedAt"
-		]).execute();
-	}
-	/**
-	* Add a user to a group
-	*/
-	async addUserToGroup(userAddress, groupId) {
-		const now = /* @__PURE__ */ new Date();
-		const normalizedAddress = userAddress.toLowerCase();
-		await this.db.insertInto("UserGroup").values({
-			userAddress: normalizedAddress,
-			groupId,
-			createdAt: now
-		}).onConflict((oc) => oc.columns(["userAddress", "groupId"]).doNothing()).execute();
-	}
-	/**
-	* Remove a user from a group
-	*/
-	async removeUserFromGroup(userAddress, groupId) {
-		await this.db.deleteFrom("UserGroup").where("userAddress", "=", userAddress.toLowerCase()).where("groupId", "=", groupId).execute();
-	}
-	/**
-	* Get all groups a user belongs to
-	*/
-	async getUserGroups(userAddress) {
-		return this.db.selectFrom("UserGroup").innerJoin("Group", "Group.id", "UserGroup.groupId").select([
-			"Group.id",
-			"Group.name",
-			"Group.description",
-			"Group.createdAt",
-			"Group.updatedAt"
-		]).where("UserGroup.userAddress", "=", userAddress.toLowerCase()).execute();
-	}
-	/**
-	* Get all members of a group
-	*/
-	async getGroupMembers(groupId) {
-		return (await this.db.selectFrom("UserGroup").select("userAddress").where("groupId", "=", groupId).execute()).map((r) => r.userAddress);
-	}
-	/**
-	* Grant a group permission on a document
-	*/
-	async grantGroupPermission(documentId, groupId, permission, grantedBy) {
-		const now = /* @__PURE__ */ new Date();
-		await this.db.insertInto("DocumentGroupPermission").values({
-			documentId,
-			groupId,
-			permission,
-			grantedBy: grantedBy.toLowerCase(),
-			createdAt: now,
-			updatedAt: now
-		}).onConflict((oc) => oc.columns(["documentId", "groupId"]).doUpdateSet({
-			permission,
-			grantedBy: grantedBy.toLowerCase(),
-			updatedAt: now
-		})).execute();
-		return await this.db.selectFrom("DocumentGroupPermission").select([
-			"documentId",
-			"groupId",
-			"permission",
-			"grantedBy",
-			"createdAt",
-			"updatedAt"
-		]).where("documentId", "=", documentId).where("groupId", "=", groupId).executeTakeFirstOrThrow();
-	}
-	/**
-	* Revoke a group's permission on a document
-	*/
-	async revokeGroupPermission(documentId, groupId) {
-		await this.db.deleteFrom("DocumentGroupPermission").where("documentId", "=", documentId).where("groupId", "=", groupId).execute();
-	}
-	/**
-	* Get all group permissions for a document
-	*/
-	async getDocumentGroupPermissions(documentId) {
-		return this.db.selectFrom("DocumentGroupPermission").select([
-			"documentId",
-			"groupId",
-			"permission",
-			"grantedBy",
-			"createdAt",
-			"updatedAt"
-		]).where("documentId", "=", documentId).execute();
-	}
-	/**
-	* Get best permission level a user has on a document via groups
-	*/
-	async getUserGroupPermission(documentId, userAddress) {
-		const result = await this.db.selectFrom("DocumentGroupPermission").innerJoin("UserGroup", "UserGroup.groupId", "DocumentGroupPermission.groupId").select("DocumentGroupPermission.permission").where("DocumentGroupPermission.documentId", "=", documentId).where("UserGroup.userAddress", "=", userAddress.toLowerCase()).execute();
-		if (result.length === 0) return null;
-		if (result.some((r) => r.permission === "ADMIN")) return "ADMIN";
-		if (result.some((r) => r.permission === "WRITE")) return "WRITE";
-		return "READ";
 	}
 	/**
 	* Grant a user permission to execute an operation on a document
@@ -5425,36 +5179,6 @@ var DocumentPermissionService = class {
 		await this.db.deleteFrom("OperationUserPermission").where("documentId", "=", documentId).where("operationType", "=", operationType).where("userAddress", "=", userAddress.toLowerCase()).execute();
 	}
 	/**
-	* Grant a group permission to execute an operation on a document
-	*/
-	async grantGroupOperationPermission(documentId, operationType, groupId, grantedBy) {
-		const now = /* @__PURE__ */ new Date();
-		await this.db.insertInto("OperationGroupPermission").values({
-			documentId,
-			operationType,
-			groupId,
-			grantedBy: grantedBy.toLowerCase(),
-			createdAt: now
-		}).onConflict((oc) => oc.columns([
-			"documentId",
-			"operationType",
-			"groupId"
-		]).doNothing()).execute();
-		return await this.db.selectFrom("OperationGroupPermission").select([
-			"documentId",
-			"operationType",
-			"groupId",
-			"grantedBy",
-			"createdAt"
-		]).where("documentId", "=", documentId).where("operationType", "=", operationType).where("groupId", "=", groupId).executeTakeFirstOrThrow();
-	}
-	/**
-	* Revoke a group's permission to execute an operation
-	*/
-	async revokeGroupOperationPermission(documentId, operationType, groupId) {
-		await this.db.deleteFrom("OperationGroupPermission").where("documentId", "=", documentId).where("operationType", "=", operationType).where("groupId", "=", groupId).execute();
-	}
-	/**
 	* Get all users with permission to execute an operation
 	*/
 	async getOperationUserPermissions(documentId, operationType) {
@@ -5467,35 +5191,18 @@ var DocumentPermissionService = class {
 		]).where("documentId", "=", documentId).where("operationType", "=", operationType).execute();
 	}
 	/**
-	* Get all groups with permission to execute an operation
+	* Whether an operation-permission row exists for the user on this operation.
 	*/
-	async getOperationGroupPermissions(documentId, operationType) {
-		return this.db.selectFrom("OperationGroupPermission").select([
-			"documentId",
-			"operationType",
-			"groupId",
-			"grantedBy",
-			"createdAt"
-		]).where("documentId", "=", documentId).where("operationType", "=", operationType).execute();
-	}
-	/**
-	* Check if a user can execute a specific operation on a document.
-	* Returns true if user has direct permission or is in a group with permission.
-	*/
-	async canExecuteOperation(documentId, operationType, userAddress) {
-		if (!userAddress) return false;
+	async hasOperationGrant(documentId, operationType, userAddress) {
 		const normalizedAddress = userAddress.toLowerCase();
-		if (await this.db.selectFrom("OperationUserPermission").select("userAddress").where("documentId", "=", documentId).where("operationType", "=", operationType).where("userAddress", "=", normalizedAddress).executeTakeFirst()) return true;
-		return !!await this.db.selectFrom("OperationGroupPermission").innerJoin("UserGroup", "UserGroup.groupId", "OperationGroupPermission.groupId").select("OperationGroupPermission.groupId").where("OperationGroupPermission.documentId", "=", documentId).where("OperationGroupPermission.operationType", "=", operationType).where("UserGroup.userAddress", "=", normalizedAddress).executeTakeFirst();
+		return !!await this.db.selectFrom("OperationUserPermission").select("userAddress").where("documentId", "=", documentId).where("operationType", "=", operationType).where("userAddress", "=", normalizedAddress).executeTakeFirst();
 	}
 	/**
 	* Check if an operation has any permissions set (is restricted)
 	*/
 	async isOperationRestricted(documentId, operationType) {
 		const userPermCount = await this.db.selectFrom("OperationUserPermission").select(sql`count(*)`.as("count")).where("documentId", "=", documentId).where("operationType", "=", operationType).executeTakeFirst();
-		if (userPermCount && Number(userPermCount.count) > 0) return true;
-		const groupPermCount = await this.db.selectFrom("OperationGroupPermission").select(sql`count(*)`.as("count")).where("documentId", "=", documentId).where("operationType", "=", operationType).executeTakeFirst();
-		return groupPermCount !== void 0 && Number(groupPermCount.count) > 0;
+		return userPermCount !== void 0 && Number(userPermCount.count) > 0;
 	}
 	/**
 	* Check if a specific document has a protection row set to true.
@@ -5610,6 +5317,60 @@ var DocumentPermissionService = class {
 	}
 };
 //#endregion
+//#region src/services/get-parent-ids.ts
+/**
+* The canonical parent-document resolver used for permission inheritance:
+* a document's parents are the sources of its incoming "child"
+* relationships. Lookup failures resolve to "no parents" so a relationship
+* store outage degrades to no inherited permissions rather than an error.
+*/
+function createGetParentIdsFn(reactorClient) {
+	return async (documentId) => {
+		try {
+			return (await reactorClient.getIncomingRelationships(documentId, "child")).results.map((doc) => doc.header.id);
+		} catch {
+			return [];
+		}
+	};
+}
+//#endregion
+//#region src/services/mcp-request-authorizer.ts
+/**
+* Authorization gate for the /mcp endpoint (AUTH_REVIEW S-C1). MCP tools have
+* unrestricted reactor access, so access is limited to supreme admins when
+* auth is enabled. OPEN policy is public; any other policy without an
+* AuthService fails closed.
+*/
+function createMcpRequestAuthorizer(authService, authorizationService) {
+	return async (req) => {
+		if (!authService) {
+			if (authorizationService.config.policy === AuthorizationPolicy.OPEN) return { authorized: true };
+			return {
+				authorized: false,
+				status: 401,
+				message: "Authentication required"
+			};
+		}
+		const context = await authService.verifyBearer(req.headers.authorization);
+		if (context instanceof Response) return {
+			authorized: false,
+			status: context.status,
+			message: "Authentication failed"
+		};
+		if (!context.user) return {
+			authorized: false,
+			status: 401,
+			message: "Authentication required"
+		};
+		if (!authorizationService.isSupremeAdmin(context.user.address)) return {
+			authorized: false,
+			status: 403,
+			message: "Forbidden: MCP access requires an administrator"
+		};
+		return { authorized: true };
+	};
+}
+//#endregion
 //#region src/utils/db.ts
 function isPG(connectionString) {
 	if (connectionString.startsWith("postgresql://") || connectionString.startsWith("postgres://")) return true;
@@ -5735,6 +5496,24 @@ const initAnalyticsStoreSql = [
 //#region src/server.ts
 const defaultLogger = childLogger(["reactor-api", "server"]);
 const DEFAULT_PORT = 4e3;
+/**
+* Doc-perms require auth: with auth off no `user` is ever resolved, so every
+* authorization check fails closed. Refuse to boot rather than run broken.
+*/
+function assertAuthRequiredForDocumentPermissions(authEnabled, documentPermissionsRequested) {
+	if (!authEnabled && documentPermissionsRequested) throw new Error("Document permissions require authentication: AUTH_ENABLED is false but document permissions were requested (DOCUMENT_PERMISSIONS_ENABLED=true or a documentPermissionService was provided). Enable authentication (AUTH_ENABLED=true, or auth.enabled in the config file) or disable document permissions.");
+}
+/**
+* Refuses SKIP_CREDENTIAL_VERIFICATION at boot outside tests or an explicit
+* opt-in: it removes the only binding between a token's claimed address and its
+* signing key. Fail-closed — unset NODE_ENV counts as production.
+*/
+function assertSkipCredentialVerificationAllowed(authEnabled, skipCredentialVerification, env) {
+	if (!authEnabled || !skipCredentialVerification) return;
+	const inAutomatedTest = env.VITEST === "true" || env.NODE_ENV === "test";
+	const acknowledged = env.ALLOW_INSECURE_SKIP_CREDENTIAL_VERIFICATION === "true";
+	if (!inAutomatedTest && !acknowledged) throw new Error("SKIP_CREDENTIAL_VERIFICATION is set but refused: it disables the live Renown credential check — the only check binding a token's claimed address to the key that signed it — so honoring it allows identity spoofing, including of admins. It is never safe in production. For local or sandbox use, also set ALLOW_INSECURE_SKIP_CREDENTIAL_VERIFICATION=true to acknowledge the risk; automated test runs (VITEST=true or NODE_ENV=test) are exempt.");
+}
 function createReadinessGate() {
 	let ready = false;
 	return {
@@ -5782,11 +5561,8 @@ function makeDbClosers(knexInstance, pglite) {
 /**
 * Sets up the subgraph manager and registers subgraphs
 */
-async function setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, auth, documentPermissionService, enableDocumentModelSubgraphs, port, authorizationService, reactorDriveClient) {
-	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter("apollo", logger), {
-		enabled: auth?.enabled ?? false,
-		admins: auth?.admins ?? []
-	}, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient);
+async function setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient) {
+	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter("apollo", logger), authService, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient);
 	await graphqlManager.init(subgraphs.core, authFetchMiddleware);
 	for (const [, collection] of subgraphs.extended.entries()) for (const subgraph of collection) await graphqlManager.registerSubgraph(subgraph, "graphql");
 	await graphqlManager.updateRouter();
@@ -5860,6 +5636,7 @@ async function startServer(httpAdapter, port, httpsOptions, logger) {
 async function _setupCommonInfrastructure(options) {
 	const port = options.port ?? DEFAULT_PORT;
 	const { adapter: httpAdapter } = await createHttpAdapter("express");
+	const logger = options.logger ?? defaultLogger;
 	let admins = [];
 	let authEnabled = false;
 	if (options.configFile) {
@@ -5870,16 +5647,23 @@ async function _setupCommonInfrastructure(options) {
 		admins = options.auth.admins.map((a) => a.toLowerCase());
 		authEnabled = options.auth.enabled;
 	}
-	const { AUTH_ENABLED, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION } = process.env;
+	const { AUTH_ENABLED, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION, CREDENTIAL_VERIFICATION_CACHE_TTL_MS } = process.env;
 	if (AUTH_ENABLED !== void 0) authEnabled = AUTH_ENABLED === "true";
 	if (ADMINS !== void 0) admins = ADMINS.split(",").map((a) => a.toLowerCase());
 	let defaultProtection = false;
 	if (DEFAULT_PROTECTION !== void 0) defaultProtection = DEFAULT_PROTECTION.toLowerCase() === "true";
-	const { USERS, GUESTS, FREE_ENTRY } = process.env;
-	if (USERS || GUESTS || FREE_ENTRY) console.warn("[DEPRECATION WARNING] The USERS, GUESTS, and FREE_ENTRY environment variables are no longer supported. Access control is now managed per-document via the DocumentProtection system. Use DEFAULT_PROTECTION=true for strict mode, or manage protection per document via the GraphQL API. See the auth documentation for migration guidance.");
 	let skipCredentialVerification = false;
 	if (SKIP_CREDENTIAL_VERIFICATION !== void 0) skipCredentialVerification = SKIP_CREDENTIAL_VERIFICATION === "true";
-	const logger = options.logger ?? defaultLogger;
+	let credentialVerificationCacheTtlMs;
+	if (CREDENTIAL_VERIFICATION_CACHE_TTL_MS !== void 0) {
+		const parsed = Number(CREDENTIAL_VERIFICATION_CACHE_TTL_MS);
+		if (CREDENTIAL_VERIFICATION_CACHE_TTL_MS.trim() !== "" && Number.isFinite(parsed) && parsed >= 0) credentialVerificationCacheTtlMs = parsed;
+		else logger.warn(`Ignoring invalid CREDENTIAL_VERIFICATION_CACHE_TTL_MS="${CREDENTIAL_VERIFICATION_CACHE_TTL_MS}" (expected a non-negative number of milliseconds; 0 disables caching) — using the default TTL`);
+	}
+	const documentPermissionsRequested = options.documentPermissionService !== void 0 || DOCUMENT_PERMISSIONS_ENABLED === "true";
+	assertAuthRequiredForDocumentPermissions(authEnabled, documentPermissionsRequested);
+	assertSkipCredentialVerificationAllowed(authEnabled, skipCredentialVerification, process.env);
+	if (authEnabled && skipCredentialVerification) logger.warn("SECURITY: SKIP_CREDENTIAL_VERIFICATION is enabled — Renown credential verification is disabled and a bearer token's claimed address is NOT cryptographically bound to its signing key. Identity is unverifiable; use only in development or test.");
 	httpAdapter.getRoute("/health", () => new Response("OK", { status: 200 }));
 	const readiness = createReadinessGate();
 	httpAdapter.getRoute("/ready", () => readiness.isReady() ? new Response("OK", { status: 200 }) : new Response("starting", { status: 503 }));
@@ -5898,7 +5682,8 @@ async function _setupCommonInfrastructure(options) {
 		authService = new AuthService({
 			enabled: authEnabled,
 			admins,
-			skipCredentialVerification
+			skipCredentialVerification,
+			credentialVerificationCacheTtlMs
 		});
 		authFetchMiddleware = createAuthFetchMiddleware(authService);
 	}
@@ -5914,14 +5699,12 @@ async function _setupCommonInfrastructure(options) {
 		documentPermissionService = new DocumentPermissionService(db, { defaultProtection });
 		logger.info("Document permission service initialized");
 	}
-	let authorizationService;
-	if (documentPermissionService) {
-		authorizationService = new AuthorizationService(documentPermissionService, {
-			admins,
-			defaultProtection
-		});
-		logger.info("Authorization service initialized");
-	}
+	const policy = documentPermissionService ? AuthorizationPolicy.DOCUMENT_PERMISSIONS : authEnabled ? AuthorizationPolicy.ADMIN_ONLY : AuthorizationPolicy.OPEN;
+	const authorizationConfig = {
+		admins,
+		defaultProtection,
+		policy
+	};
 	const attachmentStoragePath = resolveAttachmentStoragePath(options);
 	await mkdir(attachmentStoragePath, { recursive: true });
 	const { db: attachmentDb, knex: attachmentKnex, pglite: attachmentPglite } = getDbClient(options.dbPath, options.pgliteFactory);
@@ -5941,14 +5724,10 @@ async function _setupCommonInfrastructure(options) {
 		httpAdapter,
 		authFetchMiddleware,
 		authService,
-		auth: {
-			enabled: authEnabled,
-			admins
-		},
 		relationalDb,
 		analyticsStore,
 		documentPermissionService,
-		authorizationService,
+		authorizationConfig,
 		attachments,
 		packages,
 		dbClosers,
@@ -5958,7 +5737,7 @@ async function _setupCommonInfrastructure(options) {
 /**
 * Private helper function containing common setup logic for API initialization
 */
-async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, auth, processorApp, readModels, attachments, authorizationService, documentModelRegistry, dbClosers = [], reactorDriveClient) {
+async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient) {
 	const hostModule = {
 		relationalDb,
 		analyticsStore,
@@ -6003,6 +5782,8 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 		}))).flat());
 	}
 	const { httpServer, wsServer } = await startServer(httpAdapter, port, options.https, logger);
+	const authorizationService = createAuthorizationService(authorizationConfig, documentPermissionService, createGetParentIdsFn(reactorClient));
+	logger.info(`Authorization service initialized (policy: ${authorizationConfig.policy})`);
 	const coreSubgraphs = DefaultCoreSubgraphs.slice();
 	coreSubgraphs.push(ReactorSubgraph);
 	if (documentPermissionService) {
@@ -6012,12 +5793,13 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	const graphqlManager = await setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, {
 		extended: subgraphs,
 		core: coreSubgraphs
-	}, logger.child(["graphql-manager"]), auth, documentPermissionService, options.enableDocumentModelSubgraphs, port, authorizationService, reactorDriveClient);
+	}, logger.child(["graphql-manager"]), authorizationService, authService, documentPermissionService, options.enableDocumentModelSubgraphs, port, reactorDriveClient);
 	setupEventListeners(packages, graphqlManager, reactorProcessorManager, hostModule, documentModelRegistry);
 	if (mcpServerEnabled) {
 		await setupMcpServer({
 			client: reactorClient,
-			syncManager
+			syncManager,
+			authorizeRequest: createMcpRequestAuthorizer(authService, authorizationService)
 		}, httpAdapter);
 		logger.info(`MCP server available at http://localhost:${port}/mcp`);
 	}
@@ -6074,18 +5856,18 @@ function buildApiDispose(args) {
 	};
 }
 async function initializeAndStartAPI(clientInitializer, options, processorApp) {
-	const { port, httpAdapter, authFetchMiddleware, authService, auth, relationalDb, analyticsStore, documentPermissionService, authorizationService, attachments, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
+	const { port, httpAdapter, authFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
 	const { documentModels, processors, subgraphs } = await packages.init();
 	const { module: reactorClientModule, reactorDriveClient } = await clientInitializer(documentModels);
 	const reactorClient = reactorClientModule.client;
 	const syncManager = reactorClientModule.reactorModule?.syncModule?.syncManager;
-	if (!syncManager) throw new Error("SyncManager not available from ReactorClientModule");
+	if (!syncManager) throw new Error("SyncManager not available from InProcessReactorClientModule");
 	const reactorProcessorManager = reactorClientModule.reactorModule?.processorManager;
-	if (!reactorProcessorManager) throw new Error("ProcessorManager not available from ReactorClientModule");
+	if (!reactorProcessorManager) throw new Error("ProcessorManager not available from InProcessReactorClientModule");
 	const documentModelRegistry = reactorClientModule.reactorModule?.documentModelRegistry;
-	if (!documentModelRegistry) throw new Error("DocumentModelRegistry not available from ReactorClientModule");
+	if (!documentModelRegistry) throw new Error("DocumentModelRegistry not available from InProcessReactorClientModule");
 	return {
-		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, auth, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, authorizationService, documentModelRegistry, dbClosers, reactorDriveClient),
+		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient),
 		client: reactorClient,
 		syncManager,
 		documentModelRegistry,
@@ -6193,7 +5975,7 @@ var PackageManagementService = class {
 	}
 };
 //#endregion
-export { ADMIN_USERS, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AuthService, AuthSubgraph, BaseSubgraph, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
+export { ADMIN_USERS, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, assertAuthRequiredForDocumentPermissions, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=5769db0f-d60a-5870-9d50-dc4f5aca8086
+//# debugId=6300f5e6-16a2-5335-a19f-9064a271f52d