@powerhousedao/reactor-api 6.2.2-dev.15 → 6.2.2-dev.17

package/dist/index.mjs

@@ -1,6 +1,6 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d32f41ec-9597-5e2f-a869-2434aaab2bd1")}catch(e){}}();
-import { a as isSubgraphClass, c as loadDocumentModels, d as BaseSubgraph, f as AuthorizationPolicy, i as buildGraphqlOperations, l as loadProcessors, m as createAuthorizationService, n as buildGraphQlDriveDocument, o as debounce, p as AuthorizedDocumentHandle, r as buildGraphqlOperation, t as buildGraphQlDocument, u as loadSubgraphs } from "./utils-iibOQ50e.mjs";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cb4acb17-dffb-5545-a8f2-04134029dcb8")}catch(e){}}();
+import { a as isSubgraphClass, c as loadDocumentModels, d as BaseSubgraph, f as CanonicalDocumentIdResolutionError, g as createAuthorizationService, h as AuthorizedDocumentHandle, i as buildGraphqlOperations, l as loadProcessors, m as AuthorizationPolicy, n as buildGraphQlDriveDocument, o as debounce, p as createCanonicalDocumentIdResolver, r as buildGraphqlOperation, t as buildGraphQlDocument, u as loadSubgraphs } from "./utils-BdPg2whY.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
@@ -26,7 +26,7 @@ import { driveDocumentModelModule } from "@powerhousedao/shared/document-drive";
 import EventEmitter from "node:events";
 import fs, { watchFile } from "node:fs";
 import { PostgresAnalyticsStore } from "@powerhousedao/analytics-engine-pg";
-import { AttachmentBuilder } from "@powerhousedao/reactor-attachments";
+import { AttachmentBuilder, AttachmentReferenceIndexBuilder, createRef, createS3AttachmentBackend, parseAttachmentStorageConfig, parseRef } from "@powerhousedao/reactor-attachments";
 import { createAttachmentClient } from "@powerhousedao/reactor-attachments/client";
 import { setupMcpServer } from "@powerhousedao/reactor-mcp";
 import { mkdir } from "node:fs/promises";
@@ -460,6 +460,7 @@ const getDocumentModelTypeDefs = (documentModels, typeDefs$1) => {
 	});
 	return dedupeTypeDefinitions(gql`
     scalar JSONObject
+    scalar AttachmentRef
     ${typeDefs.join("\n").replaceAll(";", "")}
 
     type PHOperationContext {
@@ -878,6 +879,7 @@ function generateNewApiSchema(documentName, specification, _stateSchemaTypes, pr
 	return gql`
     scalar DateTime
     scalar JSONObject
+    scalar AttachmentRef
 
     ${revisionType}
 
@@ -1904,9 +1906,10 @@ async function documentModels(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert document models to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function document(reactorClient, args) {
-	let view;
+async function document(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -1931,9 +1934,10 @@ async function document(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function documentOutgoingRelationships(reactorClient, args) {
-	let view;
+async function documentOutgoingRelationships(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -1958,9 +1962,10 @@ async function documentOutgoingRelationships(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert outgoing relationships to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function documentIncomingRelationships(reactorClient, args) {
-	let view;
+async function documentIncomingRelationships(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -1985,9 +1990,10 @@ async function documentIncomingRelationships(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert incoming relationships to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function findDocuments(reactorClient, args) {
-	let view;
+async function findDocuments(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -2029,11 +2035,12 @@ async function jobStatus(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert job status to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function documentOperations(reactorClient, args) {
-	let view;
+async function documentOperations(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	const branch = fromInputMaybe(args.filter.branch);
 	const scopes = toMutableArray(fromInputMaybe(args.filter.scopes));
 	if (branch || scopes) view = {
+		subject,
 		branch,
 		scopes
 	};
@@ -3787,7 +3794,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 				return await documentOperations(this.reactorClient, {
 					filter,
 					paging: args.paging
-				});
+				}, this.viewSubject(ctx));
 			} catch (error) {
 				this.logger.error("Error in PHDocument.operations: @Error", error);
 				throw error;
@@ -3810,7 +3817,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await document(this.reactorClient, {
 						...args,
 						identifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in document: @Error", error);
 					throw error;
@@ -3823,7 +3830,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await documentOutgoingRelationships(this.reactorClient, {
 						...args,
 						sourceIdentifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in documentOutgoingRelationships: @Error", error);
 					throw error;
@@ -3836,7 +3843,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					const result = await documentIncomingRelationships(this.reactorClient, {
 						...args,
 						targetIdentifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
@@ -3857,7 +3864,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					const result = await findDocuments(this.reactorClient, {
 						...args,
 						search: args.search ?? {}
-					});
+					}, this.viewSubject(ctx));
 					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
@@ -3891,7 +3898,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 							...args.filter,
 							documentId: handle.fetchIdentifier
 						}
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in documentOperations: @Error", error);
 					throw error;
@@ -4205,10 +4212,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.2-dev.15";
+	return "6.2.2-dev.17";
 }
 function getGitHash() {
-	return "4841eadb3910dd12862c6539d9c53b2703477721";
+	return "347ea5eb587525a225065488b74fb3054e49fad1";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -4695,6 +4702,70 @@ var PackageManager = class {
 const config = { basePath: process.env.BASE_PATH || "/" };
 const DefaultCoreSubgraphs = [AnalyticsSubgraph, SystemSubgraph];
 //#endregion
+//#region src/attachment-backend.ts
+/** Filesystem is the default; explicit S3 is readiness-gated without fallback. */
+async function createStartupAttachmentBackend({ db, env = process.env, s3Dependencies }) {
+	const storage = parseAttachmentStorageConfig(env);
+	if (storage.kind === "filesystem") return void 0;
+	const backend = createS3AttachmentBackend(db.withSchema("attachments"), storage.s3, s3Dependencies);
+	if (!(await backend.health()).ready) throw new Error("S3 attachment backend readiness check failed");
+	return backend;
+}
+//#endregion
+//#region src/services/attachment-access.service.ts
+const HASH_PATTERN = /^[a-f0-9]{64}$/;
+/**
+* Composes document authorization with the projected document/ref
+* relationship. Order is fixed: validate ref, resolve the canonical document
+* id, check `canRead`, then check the reference index. A denied document
+* never reaches the reference reader, and the facade never touches
+* attachment metadata, storage backends, or presigners.
+*/
+var AttachmentAccessService = class {
+	constructor(resolveCanonicalId, authorization, references, projection) {
+		this.resolveCanonicalId = resolveCanonicalId;
+		this.authorization = authorization;
+		this.references = references;
+		this.projection = projection;
+	}
+	async canReadAttachment(request) {
+		if (this.projection.status !== "available") return { kind: "projection-unavailable" };
+		const ref = normalizeAttachmentRef(request.attachmentRef);
+		if (ref === null) return { kind: "denied" };
+		let documentId;
+		try {
+			documentId = await this.resolveCanonicalId(request.documentId);
+		} catch {
+			return { kind: "denied" };
+		}
+		if (!await this.authorization.canRead(documentId, request.userAddress)) return { kind: "denied" };
+		if (!await this.references.hasReference(documentId, ref)) return { kind: "denied" };
+		return {
+			kind: "allowed",
+			documentId,
+			ref
+		};
+	}
+};
+/**
+* Parses and canonicalizes a caller-supplied ref through the shared parser.
+* Returns null for anything that is not a v1 ref over a 64-char SHA-256 hex
+* hash; hex case is normalized so index lookups use the canonical form.
+*/
+function normalizeAttachmentRef(value) {
+	let hash;
+	let version;
+	try {
+		const parsed = parseRef(value);
+		hash = parsed.hash.toLowerCase();
+		version = parsed.version;
+	} catch {
+		return null;
+	}
+	if (version !== 1 || !HASH_PATTERN.test(hash)) return null;
+	return createRef(hash, version);
+}
+//#endregion
 //#region src/migrations/001_create_document_permissions.ts
 var _001_create_document_permissions_exports = /* @__PURE__ */ __exportAll({
 	down: () => down$2,
@@ -5726,7 +5797,12 @@ async function _setupCommonInfrastructure(options) {
 	await mkdir(attachmentStoragePath, { recursive: true });
 	const { db: attachmentDb, knex: attachmentKnex, pglite: attachmentPglite } = getDbClient(options.dbPath, options.pgliteFactory);
 	dbClosers.push(...makeDbClosers(attachmentKnex, attachmentPglite));
-	const attachments = await new AttachmentBuilder(attachmentDb, attachmentStoragePath).withReservationSweepMs(3600 * 1e3).build();
+	const ATTACHMENT_SWEEP_INTERVAL_MS = 3600 * 1e3;
+	const attachmentBackend = await createStartupAttachmentBackend({ db: attachmentDb });
+	const attachmentBuilder = new AttachmentBuilder(attachmentDb, attachmentStoragePath).withReservationSweepMs(ATTACHMENT_SWEEP_INTERVAL_MS);
+	if (attachmentBackend) attachmentBuilder.withBackend(attachmentBackend);
+	const attachments = await attachmentBuilder.build();
+	const attachmentReferenceIndex = await new AttachmentReferenceIndexBuilder(attachmentDb).build();
 	dbClosers.push(() => {
 		attachments.destroy();
 		return Promise.resolve();
@@ -5746,6 +5822,7 @@ async function _setupCommonInfrastructure(options) {
 		documentPermissionService,
 		authorizationConfig,
 		attachments,
+		attachmentReferenceIndex,
 		packages,
 		dbClosers,
 		readiness
@@ -5754,7 +5831,7 @@ async function _setupCommonInfrastructure(options) {
 /**
 * Private helper function containing common setup logic for API initialization
 */
-async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient) {
+async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient) {
 	const hostModule = {
 		relationalDb,
 		analyticsStore,
@@ -5801,6 +5878,7 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	const { httpServer, wsServer } = await startServer(httpAdapter, port, options.https, logger);
 	const authorizationService = createAuthorizationService(authorizationConfig, documentPermissionService, createGetParentIdsFn(reactorClient));
 	logger.info(`Authorization service initialized (policy: ${authorizationConfig.policy})`);
+	const attachmentAccess = new AttachmentAccessService(createCanonicalDocumentIdResolver(reactorClient), authorizationService, attachmentReferenceIndex.store, attachmentReferenceProjection);
 	const coreSubgraphs = DefaultCoreSubgraphs.slice();
 	coreSubgraphs.push(ReactorSubgraph);
 	if (documentPermissionService) {
@@ -5825,6 +5903,8 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 		graphqlManager,
 		packages,
 		attachments,
+		attachmentReferenceIndex,
+		attachmentAccess,
 		authService,
 		dispose: buildApiDispose({
 			graphqlManager,
@@ -5873,9 +5953,12 @@ function buildApiDispose(args) {
 	};
 }
 async function initializeAndStartAPI(clientInitializer, options, processorApp) {
-	const { port, httpAdapter, authFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
+	const { port, httpAdapter, authFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, attachmentReferenceIndex, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
 	const { documentModels, processors, subgraphs } = await packages.init();
-	const { module: reactorClientModule, reactorDriveClient } = await clientInitializer(documentModels);
+	const { module: reactorClientModule, reactorDriveClient, attachmentReferenceProjection = {
+		status: "unavailable",
+		reason: "initializer-did-not-report"
+	} } = await clientInitializer(documentModels, { attachmentReferenceWriter: attachmentReferenceIndex.store });
 	const reactorClient = reactorClientModule.client;
 	const syncManager = reactorClientModule.reactorModule?.syncModule?.syncManager;
 	if (!syncManager) throw new Error("SyncManager not available from InProcessReactorClientModule");
@@ -5884,11 +5967,12 @@ async function initializeAndStartAPI(clientInitializer, options, processorApp) {
 	const documentModelRegistry = reactorClientModule.reactorModule?.documentModelRegistry;
 	if (!documentModelRegistry) throw new Error("DocumentModelRegistry not available from InProcessReactorClientModule");
 	return {
-		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient),
+		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient),
 		client: reactorClient,
 		syncManager,
 		documentModelRegistry,
-		readiness
+		readiness,
+		attachmentReferenceProjection
 	};
 }
 //#endregion
@@ -5992,7 +6076,7 @@ var PackageManagementService = class {
 	}
 };
 //#endregion
-export { ADMIN_USERS, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, assertAuthRequiredForDocumentPermissions, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
+export { ADMIN_USERS, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, assertAuthRequiredForDocumentPermissions, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=d32f41ec-9597-5e2f-a869-2434aaab2bd1
+//# debugId=cb4acb17-dffb-5545-a8f2-04134029dcb8