@powerhousedao/reactor-api 6.2.2-dev.5 → 6.2.2-dev.50

package/dist/index.mjs

@@ -1,11 +1,11 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e58cea2c-2319-52a8-90cd-3e99d94ba98f")}catch(e){}}();
-import { a as isSubgraphClass, c as loadDocumentModels, d as BaseSubgraph, f as AuthorizationPolicy, i as buildGraphqlOperations, l as loadProcessors, m as createAuthorizationService, n as buildGraphQlDriveDocument, o as debounce, p as AuthorizedDocumentHandle, r as buildGraphqlOperation, t as buildGraphQlDocument, u as loadSubgraphs } from "./utils-iibOQ50e.mjs";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0fa604a4-1713-5d00-989b-ce10e0cf5cdb")}catch(e){}}();
+import { _ as createAuthorizationService, a as isSubgraphClass, d as loadSubgraphs, f as BaseSubgraph, g as AuthorizedDocumentHandle, h as AuthorizationPolicy, i as buildGraphqlOperations, l as loadDocumentModels, m as createCanonicalDocumentIdResolver, n as buildGraphQlDriveDocument, o as debounce, p as CanonicalDocumentIdResolutionError, r as buildGraphqlOperation, s as extractUpgradeManifests, t as buildGraphQlDocument, u as loadProcessors } from "./utils-bcfC5Kc1.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
 import { GraphQLError, Kind, parse, print } from "graphql";
-import { DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, PropagationMode as PropagationMode$1, consolidateSyncOperations, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl } from "@powerhousedao/reactor";
+import { DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, PropagationMode as PropagationMode$1, consolidateSyncOperations, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl, syncOperationErrorType } from "@powerhousedao/reactor";
 import { ConsoleLogger, childLogger, documentModelDocumentModelModule } from "document-model";
 import path from "node:path";
 import { match } from "path-to-regexp";
@@ -22,11 +22,12 @@ import dotenv from "dotenv";
 import { buildTreeUrl } from "@powerhousedao/shared";
 import { getConfig } from "@powerhousedao/config/node";
 import { reactorDriveDocumentModelModule } from "@powerhousedao/reactor-drive";
+import { ReactorGroupV1 } from "@powerhousedao/reactor-group";
 import { driveDocumentModelModule } from "@powerhousedao/shared/document-drive";
 import EventEmitter from "node:events";
 import fs, { watchFile } from "node:fs";
 import { PostgresAnalyticsStore } from "@powerhousedao/analytics-engine-pg";
-import { AttachmentBuilder } from "@powerhousedao/reactor-attachments";
+import { AttachmentBuilder, AttachmentReferenceIndexBuilder, createRef, createS3AttachmentBackend, parseAttachmentStorageConfig, parseRef } from "@powerhousedao/reactor-attachments";
 import { createAttachmentClient } from "@powerhousedao/reactor-attachments/client";
 import { setupMcpServer } from "@powerhousedao/reactor-mcp";
 import { mkdir } from "node:fs/promises";
@@ -34,7 +35,7 @@ import { tmpdir } from "node:os";
 import { WebSocketServer } from "ws";
 import { createRelationalDb } from "@powerhousedao/shared/processors";
 import { Kysely, Migrator, sql } from "kysely";
-import { fetchDelegationCredential, verifyAuthBearerToken } from "@renown/sdk";
+import { fetchDelegationCredential, resolveSwitchboardEndpoint, verifyAuthBearerToken } from "@renown/sdk";
 import { PGlite } from "@electric-sql/pglite";
 import { AtomicNodeFs } from "@powerhousedao/pglite-fs";
 import knex from "knex";
@@ -460,6 +461,7 @@ const getDocumentModelTypeDefs = (documentModels, typeDefs$1) => {
 	});
 	return dedupeTypeDefinitions(gql`
     scalar JSONObject
+    scalar AttachmentRef
     ${typeDefs.join("\n").replaceAll(";", "")}
 
     type PHOperationContext {
@@ -878,6 +880,7 @@ function generateNewApiSchema(documentName, specification, _stateSchemaTypes, pr
 	return gql`
     scalar DateTime
     scalar JSONObject
+    scalar AttachmentRef
 
     ${revisionType}
 
@@ -989,6 +992,7 @@ function OperationContextInputSchema() {
 function OperationInputSchema() {
 	return z$1.object({
 		action: z$1.lazy(() => ActionInputSchema()),
+		deniedReason: z$1.string().nullish(),
 		error: z$1.string().nullish(),
 		hash: z$1.string(),
 		id: z$1.string().nullish(),
@@ -1147,6 +1151,7 @@ const GetDocumentWithOperationsDocument = gql`
             hash
             skip
             error
+            deniedReason
             id
             action {
               id
@@ -1259,6 +1264,7 @@ const GetDocumentOperationsDocument = gql`
         hash
         skip
         error
+        deniedReason
         id
         action {
           id
@@ -1509,6 +1515,7 @@ const PollSyncEnvelopesDocument = gql`
             hash
             skip
             error
+            deniedReason
             id
             action {
               id
@@ -1551,6 +1558,7 @@ const PollSyncEnvelopesDocument = gql`
       deadLetters {
         documentId
         error
+        errorType
       }
       hasMore
     }
@@ -1904,9 +1912,10 @@ async function documentModels(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert document models to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function document(reactorClient, args) {
-	let view;
+async function document(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -1931,9 +1940,10 @@ async function document(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function documentOutgoingRelationships(reactorClient, args) {
-	let view;
+async function documentOutgoingRelationships(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -1958,9 +1968,10 @@ async function documentOutgoingRelationships(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert outgoing relationships to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function documentIncomingRelationships(reactorClient, args) {
-	let view;
+async function documentIncomingRelationships(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -1985,9 +1996,10 @@ async function documentIncomingRelationships(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert incoming relationships to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function findDocuments(reactorClient, args) {
-	let view;
+async function findDocuments(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -2029,11 +2041,12 @@ async function jobStatus(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert job status to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function documentOperations(reactorClient, args) {
-	let view;
+async function documentOperations(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	const branch = fromInputMaybe(args.filter.branch);
 	const scopes = toMutableArray(fromInputMaybe(args.filter.scopes));
 	if (branch || scopes) view = {
+		subject,
 		branch,
 		scopes
 	};
@@ -2347,6 +2360,7 @@ function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new
 	const deadLetters = remote.channel.deadLetter.items.filter((syncOp) => !forbiddenIds.has(syncOp.documentId)).map((syncOp) => ({
 		documentId: syncOp.documentId,
 		error: syncOp.error?.message ?? "Unknown error",
+		errorType: syncOperationErrorType(syncOp.error),
 		jobId: syncOp.jobId,
 		branch: syncOp.branch,
 		scopes: syncOp.scopes,
@@ -3631,7 +3645,7 @@ function createReactorGraphQLClient(url, fetchImpl = fetch, headers) {
 }
 //#endregion
 //#region src/graphql/reactor/schema.graphql
-var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n  result: JSONObject!\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n  result: JSONObject!\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n# Input types for sync operations\ninput ActionContextInput {\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  # Poll for sync envelopes from a channel\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
+var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  \"\"\"\n  How the origin classified the failure. A peer needs this to mirror the origin's\n  quarantine decision; without it a held auth operation would freeze the document\n  on the peer side while the origin kept syncing.\n  \"\"\"\n  errorType: String\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n  result: JSONObject!\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n  result: JSONObject!\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n# Input types for sync operations\ninput ActionContextInput {\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  # Poll for sync envelopes from a channel\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
 //#endregion
 //#region src/graphql/reactor/pubsub.ts
 const pubSub = new PubSub();
@@ -3787,7 +3801,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 				return await documentOperations(this.reactorClient, {
 					filter,
 					paging: args.paging
-				});
+				}, this.viewSubject(ctx));
 			} catch (error) {
 				this.logger.error("Error in PHDocument.operations: @Error", error);
 				throw error;
@@ -3810,7 +3824,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await document(this.reactorClient, {
 						...args,
 						identifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in document: @Error", error);
 					throw error;
@@ -3823,7 +3837,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await documentOutgoingRelationships(this.reactorClient, {
 						...args,
 						sourceIdentifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in documentOutgoingRelationships: @Error", error);
 					throw error;
@@ -3836,7 +3850,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					const result = await documentIncomingRelationships(this.reactorClient, {
 						...args,
 						targetIdentifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
@@ -3857,7 +3871,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					const result = await findDocuments(this.reactorClient, {
 						...args,
 						search: args.search ?? {}
-					});
+					}, this.viewSubject(ctx));
 					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
@@ -3891,7 +3905,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 							...args.filter,
 							documentId: handle.fetchIdentifier
 						}
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in documentOperations: @Error", error);
 					throw error;
@@ -4205,10 +4219,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.2-dev.5";
+	return "6.2.2-dev.50";
 }
 function getGitHash() {
-	return "3e3d6f16e8cc52be039a91438fcb45a85afb08a9";
+	return "3c0b735b95e21535a33d3cbe71f7478bd68c45f1";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -4306,6 +4320,13 @@ var HttpPackageLoader = class {
 		this.logger.verbose(`Loaded ${models.length} document models from ${packageName}`);
 		return models;
 	}
+	async loadUpgradeManifests(packageSpec) {
+		const { name: packageName } = this.parsePackageSpec(packageSpec);
+		if (!this.isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
+		const manifests = extractUpgradeManifests(await import(`${this.registryUrl}-/cdn/${packageSpec}/node/document-models/index.mjs`));
+		if (manifests.length > 0) this.logger.verbose(`Loaded ${manifests.length} upgrade manifests from ${packageName}`);
+		return manifests;
+	}
 	async loadSubgraphs(packageSpec) {
 		const { name: packageName } = this.parsePackageSpec(packageSpec);
 		if (!this.isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
@@ -4431,7 +4452,7 @@ var ImportPackageLoader = class {
 		this.logger.verbose(`Loading document models from package: ${identifier}`);
 		const pkgModule = await loadDocumentModels(identifier);
 		if (pkgModule) {
-			const models = Object.values(pkgModule);
+			const models = Object.values(pkgModule).filter((m) => m !== null && typeof m === "object" && "documentModel" in m);
 			this.logger.verbose(`  ➜  Loaded ${models.length} Document Models from: ${identifier}`);
 			return models;
 		} else {
@@ -4439,6 +4460,13 @@ var ImportPackageLoader = class {
 			return [];
 		}
 	}
+	async loadUpgradeManifests(identifier) {
+		const pkgModule = await loadDocumentModels(identifier);
+		if (!pkgModule) return [];
+		const manifests = extractUpgradeManifests(pkgModule);
+		if (manifests.length > 0) this.logger.verbose(`  ➜  Loaded ${manifests.length} Upgrade Manifests from: ${identifier}`);
+		return manifests;
+	}
 	async loadSubgraphs(identifier) {
 		this.logger.verbose(`Loading subgraphs from package: ${identifier}`);
 		const pkgModule = await loadSubgraphs(identifier);
@@ -4487,13 +4515,19 @@ function isExpectedLoaderMiss(error, pkg) {
 }
 function getUniqueDocumentModels(...documentModels) {
 	const uniqueModels = /* @__PURE__ */ new Map();
-	for (const models of documentModels) for (const model of models) uniqueModels.set(model.documentModel.global.id, model);
+	for (const models of documentModels) for (const model of models) uniqueModels.set(`${model.documentModel.global.id}@${model.version ?? 1}`, model);
 	return Array.from(uniqueModels.values());
 }
+function getUniqueUpgradeManifests(...upgradeManifests) {
+	const uniqueManifests = /* @__PURE__ */ new Map();
+	for (const manifests of upgradeManifests) for (const manifest of manifests) uniqueManifests.set(manifest.documentType, manifest);
+	return Array.from(uniqueManifests.values());
+}
 var PackageManager = class {
 	logger = childLogger(["reactor-api", "package-manager"]);
 	loaders;
 	docModelsMap = /* @__PURE__ */ new Map();
+	upgradeManifestsMap = /* @__PURE__ */ new Map();
 	subgraphsMap = /* @__PURE__ */ new Map();
 	processorMap = /* @__PURE__ */ new Map();
 	configWatcher;
@@ -4511,8 +4545,10 @@ var PackageManager = class {
 	async loadPackages(packages) {
 		this.logger.info("Loading packages: @packages", packages.join(", "));
 		const documentModelsMap = await this.loadDocumentModels(packages);
+		const upgradeManifestsMap = await this.loadUpgradeManifests(packages);
 		const subgraphsMap = await this.loadSubgraphs(packages);
 		const processorsMap = await this.loadProcessors(packages);
+		this.upgradeManifestsMap = upgradeManifestsMap;
 		this.updatePackagesMap(documentModelsMap);
 		this.updateSubgraphsMap(subgraphsMap);
 		this.updateProcessorsMap(processorsMap);
@@ -4523,6 +4559,7 @@ var PackageManager = class {
 		}
 		return {
 			documentModels: getUniqueDocumentModels(...Array.from(documentModelsMap.values())),
+			upgradeManifests: this.getUniqueUpgradeManifests(),
 			subgraphs: subgraphsMap,
 			processors: processorsMap
 		};
@@ -4533,6 +4570,7 @@ var PackageManager = class {
 		documentModelModuleMap.set("document-drive", [driveDocumentModelModule]);
 		documentModelModuleMap.set("document-model", [documentModelDocumentModelModule]);
 		documentModelModuleMap.set("reactor-drive", [reactorDriveDocumentModelModule]);
+		documentModelModuleMap.set("reactor-group", [ReactorGroupV1]);
 		for (const pkg of packages) {
 			const allDocumentModels = [];
 			const failures = [];
@@ -4555,6 +4593,26 @@ var PackageManager = class {
 		}
 		return documentModelModuleMap;
 	}
+	/** Upgrade manifests currently loaded across all packages, one per type. */
+	getUniqueUpgradeManifests() {
+		return getUniqueUpgradeManifests(...Array.from(this.upgradeManifestsMap.values()));
+	}
+	async loadUpgradeManifests(packages) {
+		const manifestsMap = /* @__PURE__ */ new Map();
+		for (const pkg of packages) for (const loader of this.loaders) {
+			if (!loader.loadUpgradeManifests) continue;
+			try {
+				const manifests = await loader.loadUpgradeManifests(pkg);
+				if (manifests.length > 0) {
+					manifestsMap.set(pkg, manifests);
+					break;
+				}
+			} catch (error) {
+				this.logger.debug(`[${loader.name}] Failed to load upgrade manifests from package @pkg: @error`, pkg, error);
+			}
+		}
+		return manifestsMap;
+	}
 	async loadSubgraphs(packages) {
 		this.logger.debug(`Loading subgraphs from packages: ${packages.join(", ")}`);
 		const subgraphsMap = /* @__PURE__ */ new Map();
@@ -4616,6 +4674,10 @@ var PackageManager = class {
 	async updateDocumentModelsForPackage(pkg) {
 		this.logger.debug(`Updating document models for package: ${pkg}`);
 		const documentModels = await this.loadDocumentModels([pkg]);
+		const upgradeManifests = await this.loadUpgradeManifests([pkg]);
+		const upgradeManifestsMap = new Map(this.upgradeManifestsMap);
+		upgradeManifestsMap.set(pkg, upgradeManifests.get(pkg) ?? []);
+		this.upgradeManifestsMap = upgradeManifestsMap;
 		const documentModelsMap = new Map(this.docModelsMap);
 		documentModelsMap.set(pkg, documentModels.get(pkg) ?? []);
 		this.updatePackagesMap(documentModelsMap);
@@ -4695,6 +4757,70 @@ var PackageManager = class {
 const config = { basePath: process.env.BASE_PATH || "/" };
 const DefaultCoreSubgraphs = [AnalyticsSubgraph, SystemSubgraph];
 //#endregion
+//#region src/attachment-backend.ts
+/** Filesystem is the default; explicit S3 is readiness-gated without fallback. */
+async function createStartupAttachmentBackend({ db, env = process.env, s3Dependencies }) {
+	const storage = parseAttachmentStorageConfig(env);
+	if (storage.kind === "filesystem") return void 0;
+	const backend = createS3AttachmentBackend(db.withSchema("attachments"), storage.s3, s3Dependencies);
+	if (!(await backend.health()).ready) throw new Error("S3 attachment backend readiness check failed");
+	return backend;
+}
+//#endregion
+//#region src/services/attachment-access.service.ts
+const HASH_PATTERN = /^[a-f0-9]{64}$/;
+/**
+* Composes document authorization with the projected document/ref
+* relationship. Order is fixed: validate ref, resolve the canonical document
+* id, check `canRead`, then check the reference index. A denied document
+* never reaches the reference reader, and the facade never touches
+* attachment metadata, storage backends, or presigners.
+*/
+var AttachmentAccessService = class {
+	constructor(resolveCanonicalId, authorization, references, projection) {
+		this.resolveCanonicalId = resolveCanonicalId;
+		this.authorization = authorization;
+		this.references = references;
+		this.projection = projection;
+	}
+	async canReadAttachment(request) {
+		if (this.projection.status !== "available") return { kind: "projection-unavailable" };
+		const ref = normalizeAttachmentRef(request.attachmentRef);
+		if (ref === null) return { kind: "denied" };
+		let documentId;
+		try {
+			documentId = await this.resolveCanonicalId(request.documentId);
+		} catch {
+			return { kind: "denied" };
+		}
+		if (!await this.authorization.canRead(documentId, request.userAddress)) return { kind: "denied" };
+		if (!await this.references.hasReference(documentId, ref)) return { kind: "denied" };
+		return {
+			kind: "allowed",
+			documentId,
+			ref
+		};
+	}
+};
+/**
+* Parses and canonicalizes a caller-supplied ref through the shared parser.
+* Returns null for anything that is not a v1 ref over a 64-char SHA-256 hex
+* hash; hex case is normalized so index lookups use the canonical form.
+*/
+function normalizeAttachmentRef(value) {
+	let hash;
+	let version;
+	try {
+		const parsed = parseRef(value);
+		hash = parsed.hash.toLowerCase();
+		version = parsed.version;
+	} catch {
+		return null;
+	}
+	if (version !== 1 || !HASH_PATTERN.test(hash)) return null;
+	return createRef(hash, version);
+}
+//#endregion
 //#region src/migrations/001_create_document_permissions.ts
 var _001_create_document_permissions_exports = /* @__PURE__ */ __exportAll({
 	down: () => down$2,
@@ -5042,14 +5168,33 @@ var AuthService = class {
 		}
 	}
 	async fetchCredentialExists(address, chainId, appId) {
-		return await fetchDelegationCredential({
+		if (!this.config.verifyCredential) throw new Error("AuthService: credential verification is enabled but no verifyCredential was provided");
+		return this.config.verifyCredential({
 			address,
 			chainId,
-			appDid: appId
-		}) !== void 0;
+			appId
+		});
 	}
 };
 //#endregion
+//#region src/services/renown-credential-verifier.ts
+async function createRenownCredentialVerifier(config = {}) {
+	const switchboardUrl = await resolveSwitchboardEndpoint({
+		switchboardUrl: config.switchboardUrl,
+		baseUrl: config.renownUrl
+	});
+	return async ({ address, chainId, appId }) => {
+		return await fetchDelegationCredential({
+			address,
+			chainId,
+			appDid: appId,
+			switchboardUrl,
+			baseUrl: switchboardUrl ? void 0 : config.renownUrl,
+			discover: false
+		}) !== void 0;
+	};
+}
+//#endregion
 //#region src/services/document-permission.service.ts
 /**
 * Service for managing document-level permissions.
@@ -5568,15 +5713,20 @@ async function setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer,
 function setupEventListeners(pkgManager, graphqlManager, reactorProcessorManager, module, documentModelRegistry) {
 	pkgManager.onDocumentModelsChange((packagedModels) => {
 		if (documentModelRegistry) {
-			const newModules = Object.values(packagedModels).flat();
-			const registeredModules = documentModelRegistry.getAllModules();
-			const registeredTypes = new Set(registeredModules.map((m) => m.documentModel.global.id));
-			const modulesToRegister = newModules.filter((mod) => !registeredTypes.has(mod.documentModel.global.id));
-			if (modulesToRegister.length > 0) {
-				const results = documentModelRegistry.registerModules(...modulesToRegister);
-				for (const result of results) if (result.status === "success") defaultLogger.info(`Registered new document model: ${result.item.documentModel.global.id}`);
+			const newModules = getUniqueDocumentModels(Object.values(packagedModels).flat());
+			const incomingTypes = new Set(newModules.map((m) => m.documentModel.global.id));
+			if (incomingTypes.size > 0) {
+				documentModelRegistry.unregisterModules(...incomingTypes);
+				const results = documentModelRegistry.registerModules(...newModules);
+				for (const result of results) if (result.status === "success") defaultLogger.info(`Registered document model: ${result.item.documentModel.global.id} v${result.item.version ?? 1}`);
 				else defaultLogger.error(`Failed to register document model: ${result.error.message}`);
 			}
+			const manifests = pkgManager.getUniqueUpgradeManifests();
+			if (manifests.length > 0) {
+				documentModelRegistry.unregisterUpgradeManifests(...manifests.map((m) => m.documentType));
+				const manifestResults = documentModelRegistry.registerUpgradeManifests(...manifests);
+				for (const result of manifestResults) if (result.status === "error") defaultLogger.error(`Failed to register upgrade manifest: ${result.error.message}`);
+			}
 		}
 		graphqlManager.regenerateDocumentModelSubgraphs();
 	});
@@ -5641,7 +5791,7 @@ async function _setupCommonInfrastructure(options) {
 		admins = options.auth.admins.map((a) => a.toLowerCase());
 		authEnabled = options.auth.enabled;
 	}
-	const { AUTH_ENABLED, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION, CREDENTIAL_VERIFICATION_CACHE_TTL_MS } = process.env;
+	const { AUTH_ENABLED, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION, CREDENTIAL_VERIFICATION_CACHE_TTL_MS, RENOWN_URL, SWITCHBOARD_URL } = process.env;
 	if (AUTH_ENABLED !== void 0) authEnabled = AUTH_ENABLED === "true";
 	if (ADMINS !== void 0) admins = ADMINS.split(",").map((a) => a.toLowerCase());
 	let defaultProtection = false;
@@ -5677,7 +5827,11 @@ async function _setupCommonInfrastructure(options) {
 			enabled: authEnabled,
 			admins,
 			skipCredentialVerification,
-			credentialVerificationCacheTtlMs
+			credentialVerificationCacheTtlMs,
+			verifyCredential: await createRenownCredentialVerifier({
+				renownUrl: RENOWN_URL,
+				switchboardUrl: SWITCHBOARD_URL
+			})
 		});
 		authFetchMiddleware = createAuthFetchMiddleware(authService);
 	}
@@ -5703,7 +5857,12 @@ async function _setupCommonInfrastructure(options) {
 	await mkdir(attachmentStoragePath, { recursive: true });
 	const { db: attachmentDb, knex: attachmentKnex, pglite: attachmentPglite } = getDbClient(options.dbPath, options.pgliteFactory);
 	dbClosers.push(...makeDbClosers(attachmentKnex, attachmentPglite));
-	const attachments = await new AttachmentBuilder(attachmentDb, attachmentStoragePath).withReservationSweepMs(3600 * 1e3).build();
+	const ATTACHMENT_SWEEP_INTERVAL_MS = 3600 * 1e3;
+	const attachmentBackend = await createStartupAttachmentBackend({ db: attachmentDb });
+	const attachmentBuilder = new AttachmentBuilder(attachmentDb, attachmentStoragePath).withReservationSweepMs(ATTACHMENT_SWEEP_INTERVAL_MS);
+	if (attachmentBackend) attachmentBuilder.withBackend(attachmentBackend);
+	const attachments = await attachmentBuilder.build();
+	const attachmentReferenceIndex = await new AttachmentReferenceIndexBuilder(attachmentDb).build();
 	dbClosers.push(() => {
 		attachments.destroy();
 		return Promise.resolve();
@@ -5723,6 +5882,7 @@ async function _setupCommonInfrastructure(options) {
 		documentPermissionService,
 		authorizationConfig,
 		attachments,
+		attachmentReferenceIndex,
 		packages,
 		dbClosers,
 		readiness
@@ -5731,7 +5891,7 @@ async function _setupCommonInfrastructure(options) {
 /**
 * Private helper function containing common setup logic for API initialization
 */
-async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient) {
+async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient) {
 	const hostModule = {
 		relationalDb,
 		analyticsStore,
@@ -5778,6 +5938,7 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	const { httpServer, wsServer } = await startServer(httpAdapter, port, options.https, logger);
 	const authorizationService = createAuthorizationService(authorizationConfig, documentPermissionService, createGetParentIdsFn(reactorClient));
 	logger.info(`Authorization service initialized (policy: ${authorizationConfig.policy})`);
+	const attachmentAccess = new AttachmentAccessService(createCanonicalDocumentIdResolver(reactorClient), authorizationService, attachmentReferenceIndex.store, attachmentReferenceProjection);
 	const coreSubgraphs = DefaultCoreSubgraphs.slice();
 	coreSubgraphs.push(ReactorSubgraph);
 	if (documentPermissionService) {
@@ -5802,6 +5963,8 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 		graphqlManager,
 		packages,
 		attachments,
+		attachmentReferenceIndex,
+		attachmentAccess,
 		authService,
 		dispose: buildApiDispose({
 			graphqlManager,
@@ -5850,9 +6013,15 @@ function buildApiDispose(args) {
 	};
 }
 async function initializeAndStartAPI(clientInitializer, options, processorApp) {
-	const { port, httpAdapter, authFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
-	const { documentModels, processors, subgraphs } = await packages.init();
-	const { module: reactorClientModule, reactorDriveClient } = await clientInitializer(documentModels);
+	const { port, httpAdapter, authFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, attachmentReferenceIndex, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
+	const { documentModels, upgradeManifests, processors, subgraphs } = await packages.init();
+	const { module: reactorClientModule, reactorDriveClient, attachmentReferenceProjection = {
+		status: "unavailable",
+		reason: "initializer-did-not-report"
+	} } = await clientInitializer(documentModels, {
+		attachmentReferenceWriter: attachmentReferenceIndex.store,
+		upgradeManifests
+	});
 	const reactorClient = reactorClientModule.client;
 	const syncManager = reactorClientModule.reactorModule?.syncModule?.syncManager;
 	if (!syncManager) throw new Error("SyncManager not available from InProcessReactorClientModule");
@@ -5861,11 +6030,12 @@ async function initializeAndStartAPI(clientInitializer, options, processorApp) {
 	const documentModelRegistry = reactorClientModule.reactorModule?.documentModelRegistry;
 	if (!documentModelRegistry) throw new Error("DocumentModelRegistry not available from InProcessReactorClientModule");
 	return {
-		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient),
+		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient),
 		client: reactorClient,
 		syncManager,
 		documentModelRegistry,
-		readiness
+		readiness,
+		attachmentReferenceProjection
 	};
 }
 //#endregion
@@ -5969,7 +6139,7 @@ var PackageManagementService = class {
 	}
 };
 //#endregion
-export { ADMIN_USERS, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, assertAuthRequiredForDocumentPermissions, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
+export { ADMIN_USERS, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, assertAuthRequiredForDocumentPermissions, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=e58cea2c-2319-52a8-90cd-3e99d94ba98f
+//# debugId=0fa604a4-1713-5d00-989b-ce10e0cf5cdb