@powerhousedao/reactor-api 6.2.0-dev.9 → 6.2.0-rc.1

package/dist/index.d.mts

@@ -3,9 +3,9 @@ import { IAnalyticsStore } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel } from "@powerhousedao/analytics-engine-graphql";
 import * as graphql from "graphql";
 import { DocumentNode, GraphQLResolveInfo, GraphQLScalarType, GraphQLScalarTypeConfig, GraphQLSchema } from "graphql";
+import { IDocumentModelLoader, IDocumentModelRegistry, IDriveClient, IReactorClient, IRelationalDb, ISyncManager, ParsedDriveUrl, ReactorClientModule, driveIdFromUrl, parseDriveUrl } from "@powerhousedao/reactor";
 import { ILogger } from "document-model";
 import { DocumentModelGlobalState as DocumentModelGlobalState$1, DocumentModelModule, Operation, PHDocument, PHDocumentHeader } from "@powerhousedao/shared/document-model";
-import { IDocumentModelLoader, IDocumentModelRegistry, IDriveClient, IReactorClient, IRelationalDb, ISyncManager, ParsedDriveUrl, ReactorClientModule, driveIdFromUrl, parseDriveUrl } from "@powerhousedao/reactor";
 import * as z$1 from "zod";
 import { DocumentDriveDocument, DocumentDriveGlobalState } from "@powerhousedao/shared/document-drive";
 import { AttachmentBuildResult } from "@powerhousedao/reactor-attachments";
@@ -42,11 +42,7 @@ interface DocumentProtectionTable {
 }
 interface DocumentPermissionDatabase {
   DocumentPermission: DocumentPermissionTable;
-  Group: GroupTable;
-  UserGroup: UserGroupTable;
-  DocumentGroupPermission: DocumentGroupPermissionTable;
   OperationUserPermission: OperationUserPermissionTable;
-  OperationGroupPermission: OperationGroupPermissionTable;
   DocumentProtection: DocumentProtectionTable;
 }
 interface DocumentPermissionTable {
@@ -58,27 +54,6 @@ interface DocumentPermissionTable {
   createdAt: Date;
   updatedAt: Date;
 }
-interface GroupTable {
-  id: Generated<number>;
-  name: string;
-  description: string | null;
-  createdAt: Date;
-  updatedAt: Date;
-}
-interface UserGroupTable {
-  userAddress: string;
-  groupId: number;
-  createdAt: Date;
-}
-interface DocumentGroupPermissionTable {
-  id: Generated<number>;
-  documentId: string;
-  groupId: number;
-  permission: DocumentPermissionLevel;
-  grantedBy: string;
-  createdAt: Date;
-  updatedAt: Date;
-}
 interface OperationUserPermissionTable {
   id: Generated<number>;
   documentId: string;
@@ -87,14 +62,6 @@ interface OperationUserPermissionTable {
   grantedBy: string;
   createdAt: Date;
 }
-interface OperationGroupPermissionTable {
-  id: Generated<number>;
-  documentId: string;
-  operationType: string;
-  groupId: number;
-  grantedBy: string;
-  createdAt: Date;
-}
 type Db = Kysely<any>;
 /**
  * Optional factory used by callers (e.g. Switchboard) to inject a
@@ -120,21 +87,6 @@ interface DocumentPermissionEntry {
   createdAt: Date;
   updatedAt: Date;
 }
-interface Group {
-  id: number;
-  name: string;
-  description: string | null;
-  createdAt: Date;
-  updatedAt: Date;
-}
-interface DocumentGroupPermissionEntry {
-  documentId: string;
-  groupId: number;
-  permission: DocumentPermissionLevel;
-  grantedBy: string;
-  createdAt: Date;
-  updatedAt: Date;
-}
 interface OperationUserPermissionEntry {
   documentId: string;
   operationType: string;
@@ -142,13 +94,6 @@ interface OperationUserPermissionEntry {
   grantedBy: string;
   createdAt: Date;
 }
-interface OperationGroupPermissionEntry {
-  documentId: string;
-  operationType: string;
-  groupId: number;
-  grantedBy: string;
-  createdAt: Date;
-}
 /**
  * Function type for getting parent document IDs
  * This is injected to avoid circular dependencies with the reactor client
@@ -169,7 +114,7 @@ interface DocumentPermissionConfig {
  * - ADMIN: Can manage document permissions and settings
  *
  * Operation permissions:
- * - Users and groups can be granted permission to execute specific operations
+ * - Users can be granted permission to execute specific operations
  */
 declare class DocumentPermissionService {
   private readonly db;
@@ -200,83 +145,6 @@ declare class DocumentPermissionService {
    * Delete all permissions for a document (used when deleting a document)
    */
   deleteAllDocumentPermissions(documentId: string): Promise<void>;
-  /**
-   * Check if a user can read a document.
-   * Returns true if user has READ, WRITE, or ADMIN permission (direct or via group)
-   */
-  canReadDocument(documentId: string, userAddress: string | undefined): Promise<boolean>;
-  /**
-   * Check if a user can write to a document.
-   * Returns true if user has WRITE or ADMIN permission (direct or via group)
-   */
-  canWriteDocument(documentId: string, userAddress: string | undefined): Promise<boolean>;
-  /**
-   * Check if a user can manage a document (change permissions, settings).
-   * Returns true if user has ADMIN permission (direct or via group)
-   */
-  canManageDocument(documentId: string, userAddress: string | undefined): Promise<boolean>;
-  /**
-   * Check if a user can read a document, including parent permission inheritance.
-   * Returns true if user has permission on the document OR any parent in the hierarchy.
-   */
-  canRead(documentId: string, userAddress: string | undefined, getParentIds: GetParentIdsFn): Promise<boolean>;
-  /**
-   * Check if a user can write to a document, including parent permission inheritance.
-   * Returns true if user has write permission on the document OR any parent in the hierarchy.
-   */
-  canWrite(documentId: string, userAddress: string | undefined, getParentIds: GetParentIdsFn): Promise<boolean>;
-  /**
-   * Filter a list of document IDs to only include those the user can read.
-   */
-  filterReadableDocuments(documentIds: string[], userAddress: string | undefined, getParentIds: GetParentIdsFn): Promise<string[]>;
-  /**
-   * Create a new group
-   */
-  createGroup(name: string, description?: string): Promise<Group>;
-  /**
-   * Delete a group and all its associations
-   */
-  deleteGroup(groupId: number): Promise<void>;
-  /**
-   * Get a group by ID
-   */
-  getGroup(groupId: number): Promise<Group | null>;
-  /**
-   * List all groups
-   */
-  listGroups(): Promise<Group[]>;
-  /**
-   * Add a user to a group
-   */
-  addUserToGroup(userAddress: string, groupId: number): Promise<void>;
-  /**
-   * Remove a user from a group
-   */
-  removeUserFromGroup(userAddress: string, groupId: number): Promise<void>;
-  /**
-   * Get all groups a user belongs to
-   */
-  getUserGroups(userAddress: string): Promise<Group[]>;
-  /**
-   * Get all members of a group
-   */
-  getGroupMembers(groupId: number): Promise<string[]>;
-  /**
-   * Grant a group permission on a document
-   */
-  grantGroupPermission(documentId: string, groupId: number, permission: DocumentPermissionLevel, grantedBy: string): Promise<DocumentGroupPermissionEntry>;
-  /**
-   * Revoke a group's permission on a document
-   */
-  revokeGroupPermission(documentId: string, groupId: number): Promise<void>;
-  /**
-   * Get all group permissions for a document
-   */
-  getDocumentGroupPermissions(documentId: string): Promise<DocumentGroupPermissionEntry[]>;
-  /**
-   * Get best permission level a user has on a document via groups
-   */
-  getUserGroupPermission(documentId: string, userAddress: string): Promise<DocumentPermissionLevel | null>;
   /**
    * Grant a user permission to execute an operation on a document
    */
@@ -285,27 +153,14 @@ declare class DocumentPermissionService {
    * Revoke a user's permission to execute an operation
    */
   revokeOperationPermission(documentId: string, operationType: string, userAddress: string): Promise<void>;
-  /**
-   * Grant a group permission to execute an operation on a document
-   */
-  grantGroupOperationPermission(documentId: string, operationType: string, groupId: number, grantedBy: string): Promise<OperationGroupPermissionEntry>;
-  /**
-   * Revoke a group's permission to execute an operation
-   */
-  revokeGroupOperationPermission(documentId: string, operationType: string, groupId: number): Promise<void>;
   /**
    * Get all users with permission to execute an operation
    */
   getOperationUserPermissions(documentId: string, operationType: string): Promise<OperationUserPermissionEntry[]>;
   /**
-   * Get all groups with permission to execute an operation
+   * Whether an operation-permission row exists for the user on this operation.
    */
-  getOperationGroupPermissions(documentId: string, operationType: string): Promise<OperationGroupPermissionEntry[]>;
-  /**
-   * Check if a user can execute a specific operation on a document.
-   * Returns true if user has direct permission or is in a group with permission.
-   */
-  canExecuteOperation(documentId: string, operationType: string, userAddress: string | undefined): Promise<boolean>;
+  hasOperationGrant(documentId: string, operationType: string, userAddress: string): Promise<boolean>;
   /**
    * Check if an operation has any permissions set (is restricted)
    */
@@ -352,6 +207,34 @@ declare class DocumentPermissionService {
 }
 //#endregion
 //#region src/services/authorization.service.d.ts
+/**
+ * A document id that has been resolved to its canonical form, never a slug.
+ *
+ * Protection and grant rows are written under the canonical id, while the
+ * read/operation data paths accept an id-or-slug identifier. The decision layer
+ * must key on the canonical id, so branding it forces every caller to resolve a
+ * slug to its id before consulting this service, closing the slug-aliasing
+ * bypass (S-C1). The only sanctioned cast from string to CanonicalDocumentId
+ * lives in the BaseSubgraph resolution helpers, immediately after the shared
+ * resolveIdOrSlug lookup returns.
+ */
+type CanonicalDocumentId = string & {
+  readonly __canonicalDocumentId: unique symbol;
+};
+/**
+ * Result of a passed per-document authorization check. `fetchIdentifier` is
+ * always safe for the data fetch: the canonical id when resolved, or the raw
+ * identifier when the check was skipped for a policy-wide caller.
+ */
+declare class AuthorizedDocumentHandle {
+  readonly fetchIdentifier: string;
+  readonly isResolved: boolean;
+  private constructor();
+  static resolved(documentId: CanonicalDocumentId): AuthorizedDocumentHandle;
+  static skipped(identifier: string): AuthorizedDocumentHandle;
+  /** The verified canonical id; throws when resolution was skipped. */
+  canonicalId(): CanonicalDocumentId;
+}
 declare const AuthorizationPolicy: {
   readonly OPEN: "OPEN";
   readonly ADMIN_ONLY: "ADMIN_ONLY";
@@ -371,14 +254,33 @@ interface AuthorizationConfig {
  * - OPEN: authentication disabled — everyone (incl. anonymous) is allowed.
  * - ADMIN_ONLY: authentication on, document permissions off — only ADMINS.
  * - DOCUMENT_PERMISSIONS: the full per-document protection + grant model.
+ *
+ * Permission inheritance walks the parent-document hierarchy through a
+ * parent resolver injected at construction; callers never supply one.
  */
 interface IAuthorizationService {
   readonly config: AuthorizationConfig;
+  /**
+   * Whether the user has unrestricted, policy-wide access. Under OPEN this is
+   * true for everyone (including anonymous callers) by design: OPEN means "no
+   * restrictions", and consumers use this check to skip per-document
+   * filtering. It does NOT mean the caller is in the ADMINS list.
+   */
   isSupremeAdmin(userAddress?: string): boolean;
-  canRead(documentId: string, userAddress?: string, getParentIds?: GetParentIdsFn): Promise<boolean>;
-  canWrite(documentId: string, userAddress?: string, getParentIds?: GetParentIdsFn): Promise<boolean>;
-  canManage(documentId: string, userAddress?: string, getParentIds?: GetParentIdsFn): Promise<boolean>;
-  canMutate(documentId: string, operationType: string, userAddress?: string, getParentIds?: GetParentIdsFn): Promise<boolean>;
+  /**
+   * Whether the user may create new documents under the current policy:
+   * everyone in OPEN, only admins in ADMIN_ONLY, any authenticated user in
+   * DOCUMENT_PERMISSIONS.
+   */
+  canCreate(userAddress?: string): boolean;
+  canRead(documentId: CanonicalDocumentId, userAddress?: string): Promise<boolean>;
+  canWrite(documentId: CanonicalDocumentId, userAddress?: string): Promise<boolean>;
+  /**
+   * Whether the user administers the document: supreme admin, document
+   * owner, or holder of an ADMIN grant.
+   */
+  canManage(documentId: CanonicalDocumentId, userAddress?: string): Promise<boolean>;
+  canMutate(documentId: CanonicalDocumentId, operationType: string, userAddress?: string): Promise<boolean>;
 }
 //#endregion
 //#region src/graphql/types.d.ts
@@ -473,6 +375,7 @@ type GqlDriveDocument = GqlDocument & {
 //#endregion
 //#region src/graphql/base-subgraph.d.ts
 declare class BaseSubgraph implements ISubgraph$1 {
+  #private;
   name: string;
   path: string;
   resolvers: Record<string, any>;
@@ -485,12 +388,44 @@ declare class BaseSubgraph implements ISubgraph$1 {
   authorizationService: IAuthorizationService;
   constructor(args: SubgraphArgs$1);
   onSetup(): Promise<void>;
-  protected getParentIdsFn(): GetParentIdsFn;
-  protected canReadDocument(documentId: string, ctx: Context): Promise<boolean>;
-  protected assertCanRead(documentId: string, ctx: Context): Promise<void>;
-  protected assertCanWrite(documentId: string, ctx: Context): Promise<void>;
-  protected assertCanExecuteOperation(documentId: string, operationType: string, ctx: Context): Promise<void>;
-  protected assertCanCreate(ctx: Context): void;
+  /**
+   * Resolves a caller-supplied identifier (id or slug) to its canonical
+   * document id, memoized per request. Both the decision layer and the data
+   * layer must agree on the subject, so this runs the same resolveIdOrSlug
+   * lookup the data path uses. A resolution failure (not found, ambiguous, or
+   * transient) surfaces as a generic Forbidden, fail-closed, so a bad
+   * identifier cannot be used as a document-existence oracle.
+   */
+  resolveCanonicalDocumentId(identifier: string, requestKey: object): Promise<CanonicalDocumentId>;
+  /**
+   * Resolves the args' `documentId` to canonical form. Unconditional (unlike the
+   * assertCan* helpers, no admin skip): ACL rows are keyed on the canonical id.
+   */
+  withCanonicalDocumentId<T extends {
+    documentId: string;
+  }>(args: T, requestKey: object): Promise<T & {
+    documentId: CanonicalDocumentId;
+  }>;
+  /**
+   * Read filter for an already-canonical document id (one sourced from the data
+   * layer, such as a fetched document's id). Performs no slug resolution.
+   */
+  canReadDocument(documentId: CanonicalDocumentId, ctx: Context): Promise<boolean>;
+  /**
+   * Asserts read access, resolving a slug first. Returns a handle whose
+   * `fetchIdentifier` the caller reuses for the data fetch; a denial throws.
+   */
+  assertCanRead(identifier: string, ctx: Context): Promise<AuthorizedDocumentHandle>;
+  assertCanWrite(identifier: string, ctx: Context): Promise<AuthorizedDocumentHandle>;
+  assertCanExecuteOperation(identifier: string, operationType: string, ctx: Context): Promise<AuthorizedDocumentHandle>;
+  /**
+   * Read assertion for an already-canonical document id. No slug resolution;
+   * use only with ids sourced from the data layer or already resolved.
+   */
+  assertCanReadCanonical(documentId: CanonicalDocumentId, ctx: Context): Promise<void>;
+  assertCanWriteCanonical(documentId: CanonicalDocumentId, ctx: Context): Promise<void>;
+  assertCanExecuteOperationCanonical(documentId: CanonicalDocumentId, operationType: string, ctx: Context): Promise<void>;
+  assertCanCreate(ctx: Context): void;
 }
 //#endregion
 //#region src/graphql/analytics-subgraph.d.ts
@@ -514,29 +449,6 @@ type DocumentAccessInfo = {
     createdAt: Date;
     updatedAt: Date;
   }>;
-  groupPermissions: Array<{
-    documentId: string;
-    groupId: number;
-    permission: DocumentPermissionLevel;
-    grantedBy: string;
-    createdAt: Date;
-    updatedAt: Date;
-  }>;
-};
-type Group$1 = {
-  id: number;
-  name: string;
-  description: string | null;
-  createdAt: Date;
-  updatedAt: Date;
-};
-type DocumentGroupPermission = {
-  documentId: string;
-  groupId: number;
-  permission: DocumentPermissionLevel;
-  grantedBy: string;
-  createdAt: Date;
-  updatedAt: Date;
 };
 type OperationUserPermission = {
   documentId: string;
@@ -545,18 +457,10 @@ type OperationUserPermission = {
   grantedBy: string;
   createdAt: Date;
 };
-type OperationGroupPermission = {
-  documentId: string;
-  operationType: string;
-  groupId: number;
-  grantedBy: string;
-  createdAt: Date;
-};
 type OperationPermissionsInfo = {
   documentId: string;
   operationType: string;
   userPermissions: OperationUserPermission[];
-  groupPermissions: OperationGroupPermission[];
 };
 type DocumentProtectionInfo = {
   documentId: string;
@@ -571,8 +475,7 @@ type DocumentProtectionInfo = {
  * This subgraph is conditionally registered based on the DOCUMENT_PERMISSIONS_ENABLED
  * feature flag. When enabled, it provides GraphQL operations for:
  * - Document permissions (grant/revoke user access)
- * - Group management (create/delete groups, manage membership)
- * - Group document permissions (grant/revoke group access)
+ * - Document protection and ownership
  * - Operation-level permissions (fine-grained operation control)
  */
 declare class AuthSubgraph extends BaseSubgraph {
@@ -585,6 +488,10 @@ declare class AuthSubgraph extends BaseSubgraph {
     Query: {
       documentAccess: (_parent: unknown, args: {
         documentId: string;
+      }, ctx: {
+        user?: {
+          address: string;
+        };
       }) => Promise<DocumentAccessInfo>;
       userDocumentPermissions: (_parent: unknown, _args: unknown, ctx: {
         user?: {
@@ -598,16 +505,13 @@ declare class AuthSubgraph extends BaseSubgraph {
         createdAt: Date;
         updatedAt: Date;
       }[]>;
-      groups: () => Promise<Group$1[]>;
-      group: (_parent: unknown, args: {
-        id: number;
-      }) => Promise<Group$1 | null>;
-      userGroups: (_parent: unknown, args: {
-        userAddress: string;
-      }) => Promise<Group$1[]>;
       operationPermissions: (_parent: unknown, args: {
         documentId: string;
         operationType: string;
+      }, ctx: {
+        user?: {
+          address: string;
+        };
       }) => Promise<OperationPermissionsInfo>;
       canExecuteOperation: (_parent: unknown, args: {
         documentId: string;
@@ -666,38 +570,6 @@ declare class AuthSubgraph extends BaseSubgraph {
           address: string;
         };
       }) => Promise<boolean>;
-      createGroup: (_parent: unknown, args: {
-        name: string;
-        description?: string | null;
-      }) => Promise<Group$1>;
-      deleteGroup: (_parent: unknown, args: {
-        id: number;
-      }) => Promise<boolean>;
-      addUserToGroup: (_parent: unknown, args: {
-        userAddress: string;
-        groupId: number;
-      }) => Promise<boolean>;
-      removeUserFromGroup: (_parent: unknown, args: {
-        userAddress: string;
-        groupId: number;
-      }) => Promise<boolean>;
-      grantGroupPermission: (_parent: unknown, args: {
-        documentId: string;
-        groupId: number;
-        permission: string;
-      }, ctx: {
-        user?: {
-          address: string;
-        };
-      }) => Promise<DocumentGroupPermission>;
-      revokeGroupPermission: (_parent: unknown, args: {
-        documentId: string;
-        groupId: number;
-      }, ctx: {
-        user?: {
-          address: string;
-        };
-      }) => Promise<boolean>;
       grantOperationPermission: (_parent: unknown, args: {
         documentId: string;
         operationType: string;
@@ -716,39 +588,6 @@ declare class AuthSubgraph extends BaseSubgraph {
           address: string;
         };
       }) => Promise<boolean>;
-      grantGroupOperationPermission: (_parent: unknown, args: {
-        documentId: string;
-        operationType: string;
-        groupId: number;
-      }, ctx: {
-        user?: {
-          address: string;
-        };
-      }) => Promise<OperationGroupPermission>;
-      revokeGroupOperationPermission: (_parent: unknown, args: {
-        documentId: string;
-        operationType: string;
-        groupId: number;
-      }, ctx: {
-        user?: {
-          address: string;
-        };
-      }) => Promise<boolean>;
-    };
-    Group: {
-      members: (parent: {
-        id: number;
-      }) => Promise<string[]>;
-    };
-    DocumentGroupPermission: {
-      group: (parent: {
-        groupId: number;
-      }) => Promise<Group$1>;
-    };
-    OperationGroupPermission: {
-      group: (parent: {
-        groupId: number;
-      }) => Promise<Group$1>;
     };
   };
   onSetup(): Promise<void>;
@@ -759,6 +598,7 @@ interface AuthConfig {
   enabled: boolean;
   admins: string[];
   skipCredentialVerification?: boolean;
+  credentialVerificationCacheTtlMs?: number;
 }
 interface User {
   address: string;
@@ -772,6 +612,7 @@ interface AuthContext {
 }
 declare class AuthService {
   private readonly config;
+  private readonly credentialCache;
   constructor(config: AuthConfig);
   authenticateRequest(request: globalThis.Request): Promise<AuthContext | globalThis.Response>;
   /**
@@ -789,9 +630,28 @@ declare class AuthService {
    */
   private extractUserFromVerification;
   /**
-   * Verify that the credential still exists on the Renown API
+   * Verify that the credential still exists on the Renown API.
+   *
+   * Results are cached per (address, chainId, issuer) for a short TTL so the
+   * blocking external round-trip is not paid on every request. Concurrent
+   * checks for the same key share a single in-flight request, and entries
+   * that resolve to false are evicted immediately so failed or revoked
+   * credentials are re-checked on the next request.
    */
   private verifyCredentialExists;
+  /**
+   * Enforce the cache size cap before inserting a new entry: drop expired
+   * entries first, then evict oldest-inserted entries (insertion order
+   * matches expiry order since the TTL is constant) until under the cap, so
+   * a flood of distinct keys cannot grow the map without bound.
+   */
+  private pruneCredentialCache;
+  /**
+   * Fetch the credential from the Renown API and validate it against the
+   * expected address, chainId and issuer. Never throws; returns false on any
+   * network or validation failure.
+   */
+  private fetchCredentialExists;
 }
 //#endregion
 //#region src/graphql/gateway/types.d.ts
@@ -944,7 +804,7 @@ declare class GraphQLManager {
   private readonly logger;
   private readonly httpAdapter;
   private readonly gatewayAdapter;
-  private readonly authConfig?;
+  private readonly authService?;
   private readonly documentPermissionService?;
   private readonly featureFlags;
   private readonly port;
@@ -952,7 +812,6 @@ declare class GraphQLManager {
   private coreSubgraphsMap;
   private contextFields;
   private readonly subgraphs;
-  private authService;
   private readonly subgraphWsDisposers;
   readonly driveOwnershipCache: DriveOwnershipCache;
   /** Cached document models for schema generation - updated on init and regenerate */
@@ -965,7 +824,7 @@ declare class GraphQLManager {
    */
   readonly reactorDriveClient?: IDriveClient;
   private readonly authorizationService;
-  constructor(path: string, httpServer: http.Server, wsServer: WebSocketServer, reactorClient: IReactorClient, relationalDb: IRelationalDb, analyticsStore: IAnalyticsStore, syncManager: ISyncManager, logger: ILogger, httpAdapter: IHttpAdapter, gatewayAdapter: IGatewayAdapter<Context$1>, authConfig?: AuthConfig | undefined, documentPermissionService?: DocumentPermissionService | undefined, featureFlags?: GraphqlManagerFeatureFlags, port?: number, authorizationService?: IAuthorizationService, reactorDriveClient?: IDriveClient);
+  constructor(path: string, httpServer: http.Server, wsServer: WebSocketServer, reactorClient: IReactorClient, relationalDb: IRelationalDb, analyticsStore: IAnalyticsStore, syncManager: ISyncManager, logger: ILogger, httpAdapter: IHttpAdapter, gatewayAdapter: IGatewayAdapter<Context$1>, authService?: AuthService | undefined, documentPermissionService?: DocumentPermissionService | undefined, featureFlags?: GraphqlManagerFeatureFlags, port?: number, authorizationService?: IAuthorizationService, reactorDriveClient?: IDriveClient);
   init(coreSubgraphs: SubgraphClass$1[], authMiddleware?: AuthFetchMiddleware): Promise<void>;
   /**
    * Regenerate document model subgraphs when models are dynamically loaded.
@@ -2946,6 +2805,12 @@ type ProcessorInitializer = ProcessorFactoryBuilder;
  * authorization check fails closed. Refuse to boot rather than run broken.
  */
 declare function assertAuthRequiredForDocumentPermissions(authEnabled: boolean, documentPermissionsRequested: boolean): void;
+/**
+ * Refuses SKIP_CREDENTIAL_VERIFICATION at boot outside tests or an explicit
+ * opt-in: it removes the only binding between a token's claimed address and its
+ * signing key. Fail-closed — unset NODE_ENV counts as production.
+ */
+declare function assertSkipCredentialVerificationAllowed(authEnabled: boolean, skipCredentialVerification: boolean, env: NodeJS.ProcessEnv): void;
 /**
  * Initializes and starts the API server using an initializer function.
  * This function first loads packages to get document models, then calls the initializer function
@@ -3005,5 +2870,5 @@ interface DocumentModelSchemaOptions {
  */
 declare function generateDocumentModelSchema(documentModel: DocumentModelGlobalState$1, options?: DocumentModelSchemaOptions): DocumentNode;
 //#endregion
-export { ADMIN_USERS, API, Action, ActionContext, ActionContextInput, ActionContextInputSchema, ActionContextResolvers, ActionInput, ActionInputSchema, ActionResolvers, AddRelationshipDocument, AddRelationshipMutation, AddRelationshipMutationVariables, AnalyticsSubgraph, AuthConfig, AuthContext, AuthFetchMiddleware, AuthService, AuthSubgraph, BaseSubgraph, ChannelMeta, ChannelMetaInput, ChannelMetaInputSchema, ChannelMetaResolvers, ClientInitializerResult, Context, CreateDocumentDocument, CreateDocumentMutation, CreateDocumentMutationVariables, CreateEmptyDocumentDocument, CreateEmptyDocumentMutation, CreateEmptyDocumentMutationVariables, DateTimeScalarConfig, DbClient, DeadLetterInfo, DeadLetterInfoResolvers, DeleteDocumentDocument, DeleteDocumentMutation, DeleteDocumentMutationVariables, DeleteDocumentsDocument, DeleteDocumentsMutation, DeleteDocumentsMutationVariables, DirectiveResolverFn, DocumentChangeContext, DocumentChangeContextResolvers, DocumentChangeEvent, DocumentChangeEventResolvers, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentChangesSubscription, DocumentChangesSubscriptionVariables, DocumentGroupPermissionEntry, DocumentGroupPermissionTable, DocumentModelGlobalState, DocumentModelGlobalStateResolvers, DocumentModelResultPage, DocumentModelResultPageResolvers, DocumentModelSchemaOptions, DocumentOperationsFilterInput, DocumentOperationsFilterInputSchema, DocumentPermissionConfig, DocumentPermissionDatabase, DocumentPermissionEntry, DocumentPermissionLevel, DocumentPermissionService, DocumentPermissionTable, DocumentProtectionTable, DocumentWithChildren, DocumentWithChildrenResolvers, Exact, FetchHandler, FindDocumentsDocument, FindDocumentsQuery, FindDocumentsQueryVariables, GatewayAdapterType, GatewayContextFactory, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentIncomingRelationshipsQuery, GetDocumentIncomingRelationshipsQueryVariables, GetDocumentModelsDocument, GetDocumentModelsQuery, GetDocumentModelsQueryVariables, GetDocumentOperationsDocument, GetDocumentOperationsQuery, GetDocumentOperationsQueryVariables, GetDocumentOutgoingRelationshipsDocument, GetDocumentOutgoingRelationshipsQuery, GetDocumentOutgoingRelationshipsQueryVariables, GetDocumentQuery, GetDocumentQueryVariables, GetDocumentWithOperationsDocument, GetDocumentWithOperationsQuery, GetDocumentWithOperationsQueryVariables, GetJobStatusDocument, GetJobStatusQuery, GetJobStatusQueryVariables, GetParentIdsFn, GqlDocument, GqlDriveDocument, GqlOperation, GqlOperationContext, GqlSigner, GqlSignerApp, GqlSignerUser, GraphQLManager, GraphqlManagerFeatureFlags, Group, GroupTable, HttpAdapterSetup, HttpAdapterType, HttpDocumentModelLoader, HttpPackageLoader, HttpPackageLoaderLogger, HttpPackageLoaderOptions, IGatewayAdapter, IHttpAdapter, type IPackageLoader, type IPackageLoaderOptions, IPackageStorage, IReactorProcessorHostModule, ISubgraph, ImportPackageLoader, InMemoryPackageStorage, Incremental, InputMaybe, InstallPackageResult, InstalledPackageInfo, IsTypeOfResolverFn, JobChangeEvent, JobChangeEventResolvers, JobChangesDocument, JobChangesSubscription, JobChangesSubscriptionVariables, JobInfo, JobInfoResolvers, JsonObjectScalarConfig, MakeEmpty, MakeMaybe, MakeOptional, Maybe, MoveRelationshipDocument, MoveRelationshipMutation, MoveRelationshipMutationVariables, MoveRelationshipResult, MoveRelationshipResultResolvers, MutateDocumentAsyncDocument, MutateDocumentAsyncMutation, MutateDocumentAsyncMutationVariables, MutateDocumentDocument, MutateDocumentMutation, MutateDocumentMutationVariables, Mutation, MutationAddRelationshipArgs, MutationCreateDocumentArgs, MutationCreateEmptyDocumentArgs, MutationDeleteDocumentArgs, MutationDeleteDocumentsArgs, MutationMoveRelationshipArgs, MutationMutateDocumentArgs, MutationMutateDocumentAsyncArgs, MutationPushSyncEnvelopesArgs, MutationRemoveRelationshipArgs, MutationRenameDocumentArgs, MutationResolvers, MutationSetPreferredEditorArgs, MutationTouchChannelArgs, NextResolverFn, OperationContext, OperationContextInput, OperationContextInputSchema, OperationContextResolvers, OperationGroupPermissionEntry, OperationGroupPermissionTable, OperationInput, OperationInputSchema, OperationUserPermissionEntry, OperationUserPermissionTable, OperationWithContext, OperationWithContextInput, OperationWithContextInputSchema, OperationWithContextResolvers, OperationsFilterInput, OperationsFilterInputSchema, PackageManagementService, PackageManagementServiceOptions, PackageManager, PackagesSubgraph, type PackagesSubgraphArgs, PagingInput, PagingInputSchema, type ParsedDriveUrl, PgliteFactory, PhDocument, PhDocumentFieldsFragment, PhDocumentFieldsFragmentDoc, PhDocumentOperationsArgs, PhDocumentResolvers, PhDocumentResultPage, PhDocumentResultPageResolvers, PollSyncEnvelopesDocument, PollSyncEnvelopesQuery, PollSyncEnvelopesQueryVariables, PollSyncEnvelopesResult, PollSyncEnvelopesResultResolvers, Processor, ProcessorDriveFactory, ProcessorFactoryBuilder, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, PushSyncEnvelopesMutation, PushSyncEnvelopesMutationVariables, Query, QueryDocumentArgs, QueryDocumentIncomingRelationshipsArgs, QueryDocumentModelsArgs, QueryDocumentOperationsArgs, QueryDocumentOutgoingRelationshipsArgs, QueryFindDocumentsArgs, QueryJobStatusArgs, QueryPollSyncEnvelopesArgs, QueryResolvers, ReactorModule, ReactorOperation, ReactorOperationResolvers, ReactorOperationResultPage, ReactorOperationResultPageResolvers, ReactorSigner, ReactorSignerApp, ReactorSignerAppInput, ReactorSignerAppInputSchema, ReactorSignerAppResolvers, ReactorSignerInput, ReactorSignerInputSchema, ReactorSignerResolvers, ReactorSignerUser, ReactorSignerUserInput, ReactorSignerUserInputSchema, ReactorSignerUserResolvers, ReactorSubgraph, ReadinessGate, RemoteCursor, RemoteCursorInput, RemoteCursorInputSchema, RemoteCursorResolvers, RemoteFilterInput, RemoteFilterInputSchema, RemoveRelationshipDocument, RemoveRelationshipMutation, RemoveRelationshipMutationVariables, RenameDocumentDocument, RenameDocumentMutation, RenameDocumentMutationVariables, Requester, RequireFields, Resolver, ResolverFn, ResolverTypeWrapper, ResolverWithResolve, Resolvers, ResolversObject, ResolversParentTypes, ResolversTypes, Revision, RevisionResolvers, Scalars, Sdk, SearchFilterInput, SearchFilterInputSchema, SetPreferredEditorDocument, SetPreferredEditorMutation, SetPreferredEditorMutationVariables, SubgraphArgs, SubgraphClass, SubgraphDefinition, Subscription, SubscriptionDocumentChangesArgs, SubscriptionJobChangesArgs, SubscriptionObject, SubscriptionResolveFn, SubscriptionResolver, SubscriptionResolverObject, SubscriptionResolvers, SubscriptionSubscribeFn, SubscriptionSubscriberObject, SyncEnvelope, SyncEnvelopeInput, SyncEnvelopeInputSchema, SyncEnvelopeResolvers, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TlsOptions, TouchChannelDocument, TouchChannelInput, TouchChannelInputSchema, TouchChannelMutation, TouchChannelMutationVariables, TouchChannelResult, TouchChannelResultResolvers, TypeResolveFn, User, UserGroupTable, ViewFilterInput, ViewFilterInputSchema, WithIndex, WsContextFactory, WsDisposer, assertAuthRequiredForDocumentPermissions, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
+export { ADMIN_USERS, API, Action, ActionContext, ActionContextInput, ActionContextInputSchema, ActionContextResolvers, ActionInput, ActionInputSchema, ActionResolvers, AddRelationshipDocument, AddRelationshipMutation, AddRelationshipMutationVariables, AnalyticsSubgraph, AuthConfig, AuthContext, AuthFetchMiddleware, AuthService, AuthSubgraph, type AuthorizationConfig, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, type CanonicalDocumentId, ChannelMeta, ChannelMetaInput, ChannelMetaInputSchema, ChannelMetaResolvers, ClientInitializerResult, Context, CreateDocumentDocument, CreateDocumentMutation, CreateDocumentMutationVariables, CreateEmptyDocumentDocument, CreateEmptyDocumentMutation, CreateEmptyDocumentMutationVariables, DateTimeScalarConfig, DbClient, DeadLetterInfo, DeadLetterInfoResolvers, DeleteDocumentDocument, DeleteDocumentMutation, DeleteDocumentMutationVariables, DeleteDocumentsDocument, DeleteDocumentsMutation, DeleteDocumentsMutationVariables, DirectiveResolverFn, DocumentChangeContext, DocumentChangeContextResolvers, DocumentChangeEvent, DocumentChangeEventResolvers, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentChangesSubscription, DocumentChangesSubscriptionVariables, DocumentModelGlobalState, DocumentModelGlobalStateResolvers, DocumentModelResultPage, DocumentModelResultPageResolvers, DocumentModelSchemaOptions, DocumentOperationsFilterInput, DocumentOperationsFilterInputSchema, DocumentPermissionConfig, DocumentPermissionDatabase, DocumentPermissionEntry, DocumentPermissionLevel, DocumentPermissionService, DocumentPermissionTable, DocumentProtectionTable, DocumentWithChildren, DocumentWithChildrenResolvers, Exact, FetchHandler, FindDocumentsDocument, FindDocumentsQuery, FindDocumentsQueryVariables, GatewayAdapterType, GatewayContextFactory, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentIncomingRelationshipsQuery, GetDocumentIncomingRelationshipsQueryVariables, GetDocumentModelsDocument, GetDocumentModelsQuery, GetDocumentModelsQueryVariables, GetDocumentOperationsDocument, GetDocumentOperationsQuery, GetDocumentOperationsQueryVariables, GetDocumentOutgoingRelationshipsDocument, GetDocumentOutgoingRelationshipsQuery, GetDocumentOutgoingRelationshipsQueryVariables, GetDocumentQuery, GetDocumentQueryVariables, GetDocumentWithOperationsDocument, GetDocumentWithOperationsQuery, GetDocumentWithOperationsQueryVariables, GetJobStatusDocument, GetJobStatusQuery, GetJobStatusQueryVariables, GetParentIdsFn, GqlDocument, GqlDriveDocument, GqlOperation, GqlOperationContext, GqlSigner, GqlSignerApp, GqlSignerUser, GraphQLManager, GraphqlManagerFeatureFlags, HttpAdapterSetup, HttpAdapterType, HttpDocumentModelLoader, HttpPackageLoader, HttpPackageLoaderLogger, HttpPackageLoaderOptions, type IAuthorizationService, IGatewayAdapter, IHttpAdapter, type IPackageLoader, type IPackageLoaderOptions, IPackageStorage, IReactorProcessorHostModule, ISubgraph, ImportPackageLoader, InMemoryPackageStorage, Incremental, InputMaybe, InstallPackageResult, InstalledPackageInfo, IsTypeOfResolverFn, JobChangeEvent, JobChangeEventResolvers, JobChangesDocument, JobChangesSubscription, JobChangesSubscriptionVariables, JobInfo, JobInfoResolvers, JsonObjectScalarConfig, MakeEmpty, MakeMaybe, MakeOptional, Maybe, MoveRelationshipDocument, MoveRelationshipMutation, MoveRelationshipMutationVariables, MoveRelationshipResult, MoveRelationshipResultResolvers, MutateDocumentAsyncDocument, MutateDocumentAsyncMutation, MutateDocumentAsyncMutationVariables, MutateDocumentDocument, MutateDocumentMutation, MutateDocumentMutationVariables, Mutation, MutationAddRelationshipArgs, MutationCreateDocumentArgs, MutationCreateEmptyDocumentArgs, MutationDeleteDocumentArgs, MutationDeleteDocumentsArgs, MutationMoveRelationshipArgs, MutationMutateDocumentArgs, MutationMutateDocumentAsyncArgs, MutationPushSyncEnvelopesArgs, MutationRemoveRelationshipArgs, MutationRenameDocumentArgs, MutationResolvers, MutationSetPreferredEditorArgs, MutationTouchChannelArgs, NextResolverFn, OperationContext, OperationContextInput, OperationContextInputSchema, OperationContextResolvers, OperationInput, OperationInputSchema, OperationUserPermissionEntry, OperationUserPermissionTable, OperationWithContext, OperationWithContextInput, OperationWithContextInputSchema, OperationWithContextResolvers, OperationsFilterInput, OperationsFilterInputSchema, PackageManagementService, PackageManagementServiceOptions, PackageManager, PackagesSubgraph, type PackagesSubgraphArgs, PagingInput, PagingInputSchema, type ParsedDriveUrl, PgliteFactory, PhDocument, PhDocumentFieldsFragment, PhDocumentFieldsFragmentDoc, PhDocumentOperationsArgs, PhDocumentResolvers, PhDocumentResultPage, PhDocumentResultPageResolvers, PollSyncEnvelopesDocument, PollSyncEnvelopesQuery, PollSyncEnvelopesQueryVariables, PollSyncEnvelopesResult, PollSyncEnvelopesResultResolvers, Processor, ProcessorDriveFactory, ProcessorFactoryBuilder, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, PushSyncEnvelopesMutation, PushSyncEnvelopesMutationVariables, Query, QueryDocumentArgs, QueryDocumentIncomingRelationshipsArgs, QueryDocumentModelsArgs, QueryDocumentOperationsArgs, QueryDocumentOutgoingRelationshipsArgs, QueryFindDocumentsArgs, QueryJobStatusArgs, QueryPollSyncEnvelopesArgs, QueryResolvers, ReactorModule, ReactorOperation, ReactorOperationResolvers, ReactorOperationResultPage, ReactorOperationResultPageResolvers, ReactorSigner, ReactorSignerApp, ReactorSignerAppInput, ReactorSignerAppInputSchema, ReactorSignerAppResolvers, ReactorSignerInput, ReactorSignerInputSchema, ReactorSignerResolvers, ReactorSignerUser, ReactorSignerUserInput, ReactorSignerUserInputSchema, ReactorSignerUserResolvers, ReactorSubgraph, ReadinessGate, RemoteCursor, RemoteCursorInput, RemoteCursorInputSchema, RemoteCursorResolvers, RemoteFilterInput, RemoteFilterInputSchema, RemoveRelationshipDocument, RemoveRelationshipMutation, RemoveRelationshipMutationVariables, RenameDocumentDocument, RenameDocumentMutation, RenameDocumentMutationVariables, Requester, RequireFields, Resolver, ResolverFn, ResolverTypeWrapper, ResolverWithResolve, Resolvers, ResolversObject, ResolversParentTypes, ResolversTypes, Revision, RevisionResolvers, Scalars, Sdk, SearchFilterInput, SearchFilterInputSchema, SetPreferredEditorDocument, SetPreferredEditorMutation, SetPreferredEditorMutationVariables, SubgraphArgs, SubgraphClass, SubgraphDefinition, Subscription, SubscriptionDocumentChangesArgs, SubscriptionJobChangesArgs, SubscriptionObject, SubscriptionResolveFn, SubscriptionResolver, SubscriptionResolverObject, SubscriptionResolvers, SubscriptionSubscribeFn, SubscriptionSubscriberObject, SyncEnvelope, SyncEnvelopeInput, SyncEnvelopeInputSchema, SyncEnvelopeResolvers, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TlsOptions, TouchChannelDocument, TouchChannelInput, TouchChannelInputSchema, TouchChannelMutation, TouchChannelMutationVariables, TouchChannelResult, TouchChannelResultResolvers, TypeResolveFn, User, ViewFilterInput, ViewFilterInputSchema, WithIndex, WsContextFactory, WsDisposer, assertAuthRequiredForDocumentPermissions, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
 //# sourceMappingURL=index.d.mts.map