@powerhousedao/reactor-api 6.2.2-dev.5 → 6.2.2-dev.51

package/dist/index.mjs

@@ -1,11 +1,11 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e58cea2c-2319-52a8-90cd-3e99d94ba98f")}catch(e){}}();
-import { a as isSubgraphClass, c as loadDocumentModels, d as BaseSubgraph, f as AuthorizationPolicy, i as buildGraphqlOperations, l as loadProcessors, m as createAuthorizationService, n as buildGraphQlDriveDocument, o as debounce, p as AuthorizedDocumentHandle, r as buildGraphqlOperation, t as buildGraphQlDocument, u as loadSubgraphs } from "./utils-iibOQ50e.mjs";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="50fb0cae-c1a3-5acc-9be1-417f9b1814c6")}catch(e){}}();
+import { _ as createAuthorizationService, a as isSubgraphClass, d as loadSubgraphs, f as BaseSubgraph, g as AuthorizedDocumentHandle, h as AuthorizationPolicy, i as buildGraphqlOperations, l as loadDocumentModels, m as createCanonicalDocumentIdResolver, n as buildGraphQlDriveDocument, o as debounce, p as CanonicalDocumentIdResolutionError, r as buildGraphqlOperation, s as extractUpgradeManifests, t as buildGraphQlDocument, u as loadProcessors, v as AuthEvaluationUnsupportedError } from "./utils-Tw4hVMpc.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
 import { GraphQLError, Kind, parse, print } from "graphql";
-import { DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, PropagationMode as PropagationMode$1, consolidateSyncOperations, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl } from "@powerhousedao/reactor";
+import { AuthEnforcementDisabledError, DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, PropagationMode as PropagationMode$1, consolidateSyncOperations, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl, syncOperationErrorType } from "@powerhousedao/reactor";
 import { ConsoleLogger, childLogger, documentModelDocumentModelModule } from "document-model";
 import path from "node:path";
 import { match } from "path-to-regexp";
@@ -22,11 +22,12 @@ import dotenv from "dotenv";
 import { buildTreeUrl } from "@powerhousedao/shared";
 import { getConfig } from "@powerhousedao/config/node";
 import { reactorDriveDocumentModelModule } from "@powerhousedao/reactor-drive";
+import { ReactorGroupV1 } from "@powerhousedao/reactor-group";
 import { driveDocumentModelModule } from "@powerhousedao/shared/document-drive";
 import EventEmitter from "node:events";
 import fs, { watchFile } from "node:fs";
 import { PostgresAnalyticsStore } from "@powerhousedao/analytics-engine-pg";
-import { AttachmentBuilder } from "@powerhousedao/reactor-attachments";
+import { AttachmentBuilder, AttachmentReferenceIndexBuilder, createRef, createS3AttachmentBackend, parseAttachmentStorageConfig, parseRef } from "@powerhousedao/reactor-attachments";
 import { createAttachmentClient } from "@powerhousedao/reactor-attachments/client";
 import { setupMcpServer } from "@powerhousedao/reactor-mcp";
 import { mkdir } from "node:fs/promises";
@@ -34,7 +35,7 @@ import { tmpdir } from "node:os";
 import { WebSocketServer } from "ws";
 import { createRelationalDb } from "@powerhousedao/shared/processors";
 import { Kysely, Migrator, sql } from "kysely";
-import { fetchDelegationCredential, verifyAuthBearerToken } from "@renown/sdk";
+import { fetchDelegationCredential, resolveSwitchboardEndpoint, verifyAuthBearerToken } from "@renown/sdk";
 import { PGlite } from "@electric-sql/pglite";
 import { AtomicNodeFs } from "@powerhousedao/pglite-fs";
 import knex from "knex";
@@ -460,6 +461,7 @@ const getDocumentModelTypeDefs = (documentModels, typeDefs$1) => {
 	});
 	return dedupeTypeDefinitions(gql`
     scalar JSONObject
+    scalar AttachmentRef
     ${typeDefs.join("\n").replaceAll(";", "")}
 
     type PHOperationContext {
@@ -878,6 +880,7 @@ function generateNewApiSchema(documentName, specification, _stateSchemaTypes, pr
 	return gql`
     scalar DateTime
     scalar JSONObject
+    scalar AttachmentRef
 
     ${revisionType}
 
@@ -926,6 +929,11 @@ function generateNewApiSchema(documentName, specification, _stateSchemaTypes, pr
 }
 //#endregion
 //#region src/graphql/reactor/gen/graphql.ts
+let AuthDecision = /* @__PURE__ */ function(AuthDecision) {
+	AuthDecision["Allow"] = "ALLOW";
+	AuthDecision["Deny"] = "DENY";
+	return AuthDecision;
+}({});
 let DocumentChangeType = /* @__PURE__ */ function(DocumentChangeType) {
 	DocumentChangeType["ChildAdded"] = "CHILD_ADDED";
 	DocumentChangeType["ChildRemoved"] = "CHILD_REMOVED";
@@ -948,9 +956,17 @@ let SyncEnvelopeType = /* @__PURE__ */ function(SyncEnvelopeType) {
 }({});
 const isDefinedNonNullAny = (v) => v !== void 0 && v !== null;
 const definedNonNullAnySchema = z$1.any().refine((v) => isDefinedNonNullAny(v));
+const AuthDecisionSchema = z$1.enum(AuthDecision);
 const DocumentChangeTypeSchema = z$1.enum(DocumentChangeType);
 const PropagationModeSchema = z$1.enum(PropagationMode);
 const SyncEnvelopeTypeSchema = z$1.enum(SyncEnvelopeType);
+function ActionCandidateInputSchema() {
+	return z$1.object({
+		input: z$1.custom((v) => v != null).nullish(),
+		scope: z$1.string(),
+		type: z$1.string()
+	});
+}
 function ActionContextInputSchema() {
 	return z$1.object({ signer: z$1.lazy(() => ReactorSignerInputSchema().nullish()) });
 }
@@ -989,6 +1005,7 @@ function OperationContextInputSchema() {
 function OperationInputSchema() {
 	return z$1.object({
 		action: z$1.lazy(() => ActionInputSchema()),
+		deniedReason: z$1.string().nullish(),
 		error: z$1.string().nullish(),
 		hash: z$1.string(),
 		id: z$1.string().nullish(),
@@ -1147,6 +1164,7 @@ const GetDocumentWithOperationsDocument = gql`
             hash
             skip
             error
+            deniedReason
             id
             action {
               id
@@ -1259,6 +1277,7 @@ const GetDocumentOperationsDocument = gql`
         hash
         skip
         error
+        deniedReason
         id
         action {
           id
@@ -1301,6 +1320,28 @@ const GetJobStatusDocument = gql`
     }
   }
 `;
+const EvaluateActionsDocument = gql`
+  query EvaluateActions(
+    $documentIdentifier: String!
+    $branch: String
+    $candidates: [ActionCandidateInput!]!
+  ) {
+    evaluateActions(
+      documentIdentifier: $documentIdentifier
+      branch: $branch
+      candidates: $candidates
+    ) {
+      evaluations {
+        decision
+        reason
+      }
+      allAllowed
+      anyAllowed
+      allDenied
+      anyDenied
+    }
+  }
+`;
 const CreateDocumentDocument = gql`
   mutation CreateDocument($document: JSONObject!, $parentIdentifier: String) {
     createDocument(document: $document, parentIdentifier: $parentIdentifier) {
@@ -1509,6 +1550,7 @@ const PollSyncEnvelopesDocument = gql`
             hash
             skip
             error
+            deniedReason
             id
             action {
               id
@@ -1551,6 +1593,7 @@ const PollSyncEnvelopesDocument = gql`
       deadLetters {
         documentId
         error
+        errorType
       }
       hasMore
     }
@@ -1595,6 +1638,9 @@ function getSdk(requester) {
 		GetJobStatus(variables, options) {
 			return requester(GetJobStatusDocument, variables, options);
 		},
+		EvaluateActions(variables, options) {
+			return requester(EvaluateActionsDocument, variables, options);
+		},
 		CreateDocument(variables, options) {
 			return requester(CreateDocumentDocument, variables, options);
 		},
@@ -1745,6 +1791,20 @@ function toReactorPropagationMode(gqlMode) {
 	}
 }
 /**
+* Maps one predicted verdict to its GraphQL shape. A refusal's reason is the
+* consensus string the reactor would record for it, carried through verbatim so
+* a client can tell a deletion refusal from a missing grant; an allow has none.
+*/
+function toGqlActionEvaluation(evaluation) {
+	return evaluation.decision === "allow" ? {
+		decision: AuthDecision.Allow,
+		reason: null
+	} : {
+		decision: AuthDecision.Deny,
+		reason: evaluation.reason
+	};
+}
+/**
 * Converts readonly arrays to mutable arrays for ReactorClient
 */
 function toMutableArray(arr) {
@@ -1904,9 +1964,10 @@ async function documentModels(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert document models to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function document(reactorClient, args) {
-	let view;
+async function document(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -1931,9 +1992,10 @@ async function document(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function documentOutgoingRelationships(reactorClient, args) {
-	let view;
+async function documentOutgoingRelationships(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -1958,9 +2020,10 @@ async function documentOutgoingRelationships(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert outgoing relationships to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function documentIncomingRelationships(reactorClient, args) {
-	let view;
+async function documentIncomingRelationships(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -1985,9 +2048,10 @@ async function documentIncomingRelationships(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert incoming relationships to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function findDocuments(reactorClient, args) {
-	let view;
+async function findDocuments(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -2029,11 +2093,12 @@ async function jobStatus(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert job status to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function documentOperations(reactorClient, args) {
-	let view;
+async function documentOperations(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	const branch = fromInputMaybe(args.filter.branch);
 	const scopes = toMutableArray(fromInputMaybe(args.filter.scopes));
 	if (branch || scopes) view = {
+		subject,
 		branch,
 		scopes
 	};
@@ -2069,6 +2134,41 @@ async function documentOperations(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert operations to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
+/**
+* Predicts the admission verdict for each candidate operation, deciding against
+* the document policy through the reactor's own decision model.
+*
+* The subject is supplied by the subgraph from the authenticated request, never
+* by the caller: answering for an arbitrary subject would disclose what a policy
+* grants somebody else. It carries the caller's address and the app key their
+* token authenticated with, which is the same pair a signed action presents, so
+* a grant naming either matches here exactly as it would at admission.
+*
+* A reactor without authEnforcement raises the named error, which becomes an
+* "unsupported" code rather than a denial.
+*/
+async function evaluateActions(reactorClient, args, subject) {
+	const branch = fromInputMaybe(args.branch) ?? "main";
+	const candidates = args.candidates.map((candidate) => ({
+		scope: candidate.scope,
+		type: candidate.type,
+		input: fromInputMaybe(candidate.input)
+	}));
+	let result;
+	try {
+		result = await reactorClient.evaluateActions(args.documentIdentifier, branch, candidates, subject);
+	} catch (error) {
+		if (AuthEnforcementDisabledError.isError(error)) throw new AuthEvaluationUnsupportedError();
+		throw new GraphQLError(`Failed to evaluate actions: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+	return {
+		evaluations: result.evaluations.map(toGqlActionEvaluation),
+		allAllowed: result.allAllowed,
+		anyAllowed: result.anyAllowed,
+		allDenied: result.allDenied,
+		anyDenied: result.anyDenied
+	};
+}
 async function createDocument(reactorClient, args, reactorDriveClient) {
 	if (!args.document || typeof args.document !== "object") throw new GraphQLError("Invalid document: must be an object");
 	const document = args.document;
@@ -2347,6 +2447,7 @@ function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new
 	const deadLetters = remote.channel.deadLetter.items.filter((syncOp) => !forbiddenIds.has(syncOp.documentId)).map((syncOp) => ({
 		documentId: syncOp.documentId,
 		error: syncOp.error?.message ?? "Unknown error",
+		errorType: syncOperationErrorType(syncOp.error),
 		jobId: syncOp.jobId,
 		branch: syncOp.branch,
 		scopes: syncOp.scopes,
@@ -3536,6 +3637,17 @@ const DocumentChangeEventDTO = z.object({
 	documents: z.array(PHDocumentDTO),
 	context: DocumentChangeContextDTO.nullable().optional()
 }).strip();
+const ActionEvaluationDTO = z.object({
+	decision: z.enum(["ALLOW", "DENY"]),
+	reason: z.string().nullable().optional()
+}).strip();
+const ActionEvaluationsDTO = z.object({
+	evaluations: z.array(ActionEvaluationDTO),
+	allAllowed: z.boolean(),
+	anyAllowed: z.boolean(),
+	allDenied: z.boolean(),
+	anyDenied: z.boolean()
+}).strip();
 const JobChangeEventDTO = z.object({
 	jobId: z.string(),
 	status: z.string(),
@@ -3569,6 +3681,9 @@ const operationValidators = {
 	GetJobStatus: (data) => {
 		if (data.jobStatus) JobInfoDTO.parse(data.jobStatus);
 	},
+	EvaluateActions: (data) => {
+		if (data.evaluateActions) ActionEvaluationsDTO.parse(data.evaluateActions);
+	},
 	CreateDocument: (data) => {
 		if (data.createDocument) PHDocumentDTO.parse(data.createDocument);
 	},
@@ -3631,7 +3746,7 @@ function createReactorGraphQLClient(url, fetchImpl = fetch, headers) {
 }
 //#endregion
 //#region src/graphql/reactor/schema.graphql
-var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n  result: JSONObject!\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n  result: JSONObject!\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n# Input types for sync operations\ninput ActionContextInput {\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  # Poll for sync envelopes from a channel\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
+var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  \"\"\"\n  How the origin classified the failure. A peer needs this to mirror the origin's\n  quarantine decision; without it a held auth operation would freeze the document\n  on the peer side while the origin kept syncing.\n  \"\"\"\n  errorType: String\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n  result: JSONObject!\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n  result: JSONObject!\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n\"\"\"\nOne operation an authorization preflight predicts a verdict for.\n\n`input` is what a conditional grant reads, so a candidate standing for a\nfilled-in form carries that form's input. Omitting it predicts the verdict an\nempty input earns, not the verdict the filled-in form will get.\n\"\"\"\ninput ActionCandidateInput {\n  scope: String!\n  type: String!\n  input: JSONObject\n}\n\nenum AuthDecision {\n  ALLOW\n  DENY\n}\n\n\"\"\"\nOne candidate's predicted verdict. `reason` carries the refusal a DENY is\nrecorded with, and is null on an ALLOW.\n\"\"\"\ntype ActionEvaluation {\n  decision: AuthDecision!\n  reason: String\n}\n\n\"\"\"\nThe predicted verdicts for a set of candidates, in the order they were given,\nwith the aggregates a caller branches on.\n\nThe aggregates are redundant -- a verdict is binary -- and all four are returned\nso a caller reads the one its question is phrased in rather than negating\nanother. Over no candidates every aggregate is false: nothing is allowed and\nnothing is denied.\n\"\"\"\ntype ActionEvaluations {\n  evaluations: [ActionEvaluation!]!\n  allAllowed: Boolean!\n  anyAllowed: Boolean!\n  allDenied: Boolean!\n  anyDenied: Boolean!\n}\n\n# Input types for sync operations\ninput ActionContextInput {\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  \"\"\"\n  Predicts whether the calling subject would be admitted to execute each of a\n  set of candidate operations, without submitting any of them. A UI asks this to\n  disable a control rather than offer an action that fails on submit.\n\n  The answer is a prediction, not a promise:\n\n  - Real admission compiles an append condition over everything it read and the\n    store enforces it at write time. A preflight reads no future, so a policy\n    change landing between this answer and the submit changes the verdict. The\n    submit path stays the only authority.\n  - The verdict is evaluated at the stream heads, so it is correct for a\n    candidate about to be submitted. A backdated submission is out of contract;\n    the reactor decides that one by position.\n  - A candidate whose verdict depends on its input has to carry that input, since\n    a conditional grant reads it.\n\n  The subject is the authenticated caller and cannot be named in the request:\n  answering for an arbitrary subject would disclose what a policy grants\n  somebody else. It carries both the caller's address and the did:key of the app\n  instance whose token authenticated the request, so a policy naming either\n  matches the same principal the write path presents.\n\n  Requires the reactor's authEnforcement feature flag. Without it the reactor\n  holds no decision model, so this fails with extensions.code\n  AUTH_EVALUATION_UNSUPPORTED rather than guessing.\n  \"\"\"\n  evaluateActions(\n    documentIdentifier: String!\n    branch: String\n    candidates: [ActionCandidateInput!]!\n  ): ActionEvaluations!\n\n  # Poll for sync envelopes from a channel\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
 //#endregion
 //#region src/graphql/reactor/pubsub.ts
 const pubSub = new PubSub();
@@ -3787,7 +3902,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 				return await documentOperations(this.reactorClient, {
 					filter,
 					paging: args.paging
-				});
+				}, this.viewSubject(ctx));
 			} catch (error) {
 				this.logger.error("Error in PHDocument.operations: @Error", error);
 				throw error;
@@ -3810,7 +3925,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await document(this.reactorClient, {
 						...args,
 						identifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in document: @Error", error);
 					throw error;
@@ -3823,7 +3938,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await documentOutgoingRelationships(this.reactorClient, {
 						...args,
 						sourceIdentifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in documentOutgoingRelationships: @Error", error);
 					throw error;
@@ -3836,7 +3951,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					const result = await documentIncomingRelationships(this.reactorClient, {
 						...args,
 						targetIdentifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
@@ -3857,7 +3972,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					const result = await findDocuments(this.reactorClient, {
 						...args,
 						search: args.search ?? {}
-					});
+					}, this.viewSubject(ctx));
 					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
@@ -3891,12 +4006,25 @@ var ReactorSubgraph = class extends BaseSubgraph {
 							...args.filter,
 							documentId: handle.fetchIdentifier
 						}
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in documentOperations: @Error", error);
 					throw error;
 				}
 			},
+			evaluateActions: async (_parent, args, ctx) => {
+				this.logger.debug("evaluateActions(@args)", args);
+				try {
+					const handle = await this.assertCanRead(args.documentIdentifier, ctx);
+					return await evaluateActions(this.reactorClient, {
+						...args,
+						documentIdentifier: handle.fetchIdentifier
+					}, this.viewSubject(ctx));
+				} catch (error) {
+					this.logger.error("Error in evaluateActions: @Error", error);
+					throw error;
+				}
+			},
 			pollSyncEnvelopes: async (_parent, args, ctx) => {
 				this.logger.debug("pollSyncEnvelopes(@args)", args);
 				try {
@@ -4205,10 +4333,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.2-dev.5";
+	return "6.2.2-dev.51";
 }
 function getGitHash() {
-	return "3e3d6f16e8cc52be039a91438fcb45a85afb08a9";
+	return "e1c387c6abfd3750231ee194f945b058c07d0002";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -4306,6 +4434,13 @@ var HttpPackageLoader = class {
 		this.logger.verbose(`Loaded ${models.length} document models from ${packageName}`);
 		return models;
 	}
+	async loadUpgradeManifests(packageSpec) {
+		const { name: packageName } = this.parsePackageSpec(packageSpec);
+		if (!this.isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
+		const manifests = extractUpgradeManifests(await import(`${this.registryUrl}-/cdn/${packageSpec}/node/document-models/index.mjs`));
+		if (manifests.length > 0) this.logger.verbose(`Loaded ${manifests.length} upgrade manifests from ${packageName}`);
+		return manifests;
+	}
 	async loadSubgraphs(packageSpec) {
 		const { name: packageName } = this.parsePackageSpec(packageSpec);
 		if (!this.isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
@@ -4431,7 +4566,7 @@ var ImportPackageLoader = class {
 		this.logger.verbose(`Loading document models from package: ${identifier}`);
 		const pkgModule = await loadDocumentModels(identifier);
 		if (pkgModule) {
-			const models = Object.values(pkgModule);
+			const models = Object.values(pkgModule).filter((m) => m !== null && typeof m === "object" && "documentModel" in m);
 			this.logger.verbose(`  ➜  Loaded ${models.length} Document Models from: ${identifier}`);
 			return models;
 		} else {
@@ -4439,6 +4574,13 @@ var ImportPackageLoader = class {
 			return [];
 		}
 	}
+	async loadUpgradeManifests(identifier) {
+		const pkgModule = await loadDocumentModels(identifier);
+		if (!pkgModule) return [];
+		const manifests = extractUpgradeManifests(pkgModule);
+		if (manifests.length > 0) this.logger.verbose(`  ➜  Loaded ${manifests.length} Upgrade Manifests from: ${identifier}`);
+		return manifests;
+	}
 	async loadSubgraphs(identifier) {
 		this.logger.verbose(`Loading subgraphs from package: ${identifier}`);
 		const pkgModule = await loadSubgraphs(identifier);
@@ -4487,13 +4629,19 @@ function isExpectedLoaderMiss(error, pkg) {
 }
 function getUniqueDocumentModels(...documentModels) {
 	const uniqueModels = /* @__PURE__ */ new Map();
-	for (const models of documentModels) for (const model of models) uniqueModels.set(model.documentModel.global.id, model);
+	for (const models of documentModels) for (const model of models) uniqueModels.set(`${model.documentModel.global.id}@${model.version ?? 1}`, model);
 	return Array.from(uniqueModels.values());
 }
+function getUniqueUpgradeManifests(...upgradeManifests) {
+	const uniqueManifests = /* @__PURE__ */ new Map();
+	for (const manifests of upgradeManifests) for (const manifest of manifests) uniqueManifests.set(manifest.documentType, manifest);
+	return Array.from(uniqueManifests.values());
+}
 var PackageManager = class {
 	logger = childLogger(["reactor-api", "package-manager"]);
 	loaders;
 	docModelsMap = /* @__PURE__ */ new Map();
+	upgradeManifestsMap = /* @__PURE__ */ new Map();
 	subgraphsMap = /* @__PURE__ */ new Map();
 	processorMap = /* @__PURE__ */ new Map();
 	configWatcher;
@@ -4511,8 +4659,10 @@ var PackageManager = class {
 	async loadPackages(packages) {
 		this.logger.info("Loading packages: @packages", packages.join(", "));
 		const documentModelsMap = await this.loadDocumentModels(packages);
+		const upgradeManifestsMap = await this.loadUpgradeManifests(packages);
 		const subgraphsMap = await this.loadSubgraphs(packages);
 		const processorsMap = await this.loadProcessors(packages);
+		this.upgradeManifestsMap = upgradeManifestsMap;
 		this.updatePackagesMap(documentModelsMap);
 		this.updateSubgraphsMap(subgraphsMap);
 		this.updateProcessorsMap(processorsMap);
@@ -4523,6 +4673,7 @@ var PackageManager = class {
 		}
 		return {
 			documentModels: getUniqueDocumentModels(...Array.from(documentModelsMap.values())),
+			upgradeManifests: this.getUniqueUpgradeManifests(),
 			subgraphs: subgraphsMap,
 			processors: processorsMap
 		};
@@ -4533,6 +4684,7 @@ var PackageManager = class {
 		documentModelModuleMap.set("document-drive", [driveDocumentModelModule]);
 		documentModelModuleMap.set("document-model", [documentModelDocumentModelModule]);
 		documentModelModuleMap.set("reactor-drive", [reactorDriveDocumentModelModule]);
+		documentModelModuleMap.set("reactor-group", [ReactorGroupV1]);
 		for (const pkg of packages) {
 			const allDocumentModels = [];
 			const failures = [];
@@ -4555,6 +4707,26 @@ var PackageManager = class {
 		}
 		return documentModelModuleMap;
 	}
+	/** Upgrade manifests currently loaded across all packages, one per type. */
+	getUniqueUpgradeManifests() {
+		return getUniqueUpgradeManifests(...Array.from(this.upgradeManifestsMap.values()));
+	}
+	async loadUpgradeManifests(packages) {
+		const manifestsMap = /* @__PURE__ */ new Map();
+		for (const pkg of packages) for (const loader of this.loaders) {
+			if (!loader.loadUpgradeManifests) continue;
+			try {
+				const manifests = await loader.loadUpgradeManifests(pkg);
+				if (manifests.length > 0) {
+					manifestsMap.set(pkg, manifests);
+					break;
+				}
+			} catch (error) {
+				this.logger.debug(`[${loader.name}] Failed to load upgrade manifests from package @pkg: @error`, pkg, error);
+			}
+		}
+		return manifestsMap;
+	}
 	async loadSubgraphs(packages) {
 		this.logger.debug(`Loading subgraphs from packages: ${packages.join(", ")}`);
 		const subgraphsMap = /* @__PURE__ */ new Map();
@@ -4616,6 +4788,10 @@ var PackageManager = class {
 	async updateDocumentModelsForPackage(pkg) {
 		this.logger.debug(`Updating document models for package: ${pkg}`);
 		const documentModels = await this.loadDocumentModels([pkg]);
+		const upgradeManifests = await this.loadUpgradeManifests([pkg]);
+		const upgradeManifestsMap = new Map(this.upgradeManifestsMap);
+		upgradeManifestsMap.set(pkg, upgradeManifests.get(pkg) ?? []);
+		this.upgradeManifestsMap = upgradeManifestsMap;
 		const documentModelsMap = new Map(this.docModelsMap);
 		documentModelsMap.set(pkg, documentModels.get(pkg) ?? []);
 		this.updatePackagesMap(documentModelsMap);
@@ -4695,6 +4871,70 @@ var PackageManager = class {
 const config = { basePath: process.env.BASE_PATH || "/" };
 const DefaultCoreSubgraphs = [AnalyticsSubgraph, SystemSubgraph];
 //#endregion
+//#region src/attachment-backend.ts
+/** Filesystem is the default; explicit S3 is readiness-gated without fallback. */
+async function createStartupAttachmentBackend({ db, env = process.env, s3Dependencies }) {
+	const storage = parseAttachmentStorageConfig(env);
+	if (storage.kind === "filesystem") return void 0;
+	const backend = createS3AttachmentBackend(db.withSchema("attachments"), storage.s3, s3Dependencies);
+	if (!(await backend.health()).ready) throw new Error("S3 attachment backend readiness check failed");
+	return backend;
+}
+//#endregion
+//#region src/services/attachment-access.service.ts
+const HASH_PATTERN = /^[a-f0-9]{64}$/;
+/**
+* Composes document authorization with the projected document/ref
+* relationship. Order is fixed: validate ref, resolve the canonical document
+* id, check `canRead`, then check the reference index. A denied document
+* never reaches the reference reader, and the facade never touches
+* attachment metadata, storage backends, or presigners.
+*/
+var AttachmentAccessService = class {
+	constructor(resolveCanonicalId, authorization, references, projection) {
+		this.resolveCanonicalId = resolveCanonicalId;
+		this.authorization = authorization;
+		this.references = references;
+		this.projection = projection;
+	}
+	async canReadAttachment(request) {
+		if (this.projection.status !== "available") return { kind: "projection-unavailable" };
+		const ref = normalizeAttachmentRef(request.attachmentRef);
+		if (ref === null) return { kind: "denied" };
+		let documentId;
+		try {
+			documentId = await this.resolveCanonicalId(request.documentId);
+		} catch {
+			return { kind: "denied" };
+		}
+		if (!await this.authorization.canRead(documentId, request.userAddress)) return { kind: "denied" };
+		if (!await this.references.hasReference(documentId, ref)) return { kind: "denied" };
+		return {
+			kind: "allowed",
+			documentId,
+			ref
+		};
+	}
+};
+/**
+* Parses and canonicalizes a caller-supplied ref through the shared parser.
+* Returns null for anything that is not a v1 ref over a 64-char SHA-256 hex
+* hash; hex case is normalized so index lookups use the canonical form.
+*/
+function normalizeAttachmentRef(value) {
+	let hash;
+	let version;
+	try {
+		const parsed = parseRef(value);
+		hash = parsed.hash.toLowerCase();
+		version = parsed.version;
+	} catch {
+		return null;
+	}
+	if (version !== 1 || !HASH_PATTERN.test(hash)) return null;
+	return createRef(hash, version);
+}
+//#endregion
 //#region src/migrations/001_create_document_permissions.ts
 var _001_create_document_permissions_exports = /* @__PURE__ */ __exportAll({
 	down: () => down$2,
@@ -4921,8 +5161,7 @@ var AuthService = class {
 			admins: [],
 			auth_enabled: false
 		};
-		const method = request.method;
-		if (method === "OPTIONS" || method === "GET") return {
+		if (request.method === "OPTIONS") return {
 			user: void 0,
 			admins: this.config.admins,
 			auth_enabled: true
@@ -4984,16 +5223,23 @@ var AuthService = class {
 		return await verifyAuthBearerToken(token);
 	}
 	/**
-	* Extract user information from verification result
+	* Extract user information from verification result.
+	*
+	* The issuer is required along with the credential subject. A credential that
+	* verified must carry one -- resolving it is how the signature was checked --
+	* so this rejects a shape that cannot have come from verification rather than
+	* admitting a keyless principal.
 	*/
 	extractUserFromVerification(verified) {
 		try {
 			const { address, chainId, networkId } = verified.verifiableCredential.credentialSubject;
-			if (!address || !chainId || !networkId) return null;
+			const appKey = verified.issuer;
+			if (!address || !chainId || !networkId || !appKey) return null;
 			return {
 				address,
 				chainId,
-				networkId
+				networkId,
+				appKey
 			};
 		} catch {
 			return null;
@@ -5042,14 +5288,33 @@ var AuthService = class {
 		}
 	}
 	async fetchCredentialExists(address, chainId, appId) {
-		return await fetchDelegationCredential({
+		if (!this.config.verifyCredential) throw new Error("AuthService: credential verification is enabled but no verifyCredential was provided");
+		return this.config.verifyCredential({
 			address,
 			chainId,
-			appDid: appId
-		}) !== void 0;
+			appId
+		});
 	}
 };
 //#endregion
+//#region src/services/renown-credential-verifier.ts
+async function createRenownCredentialVerifier(config = {}) {
+	const switchboardUrl = await resolveSwitchboardEndpoint({
+		switchboardUrl: config.switchboardUrl,
+		baseUrl: config.renownUrl
+	});
+	return async ({ address, chainId, appId }) => {
+		return await fetchDelegationCredential({
+			address,
+			chainId,
+			appDid: appId,
+			switchboardUrl,
+			baseUrl: switchboardUrl ? void 0 : config.renownUrl,
+			discover: false
+		}) !== void 0;
+	};
+}
+//#endregion
 //#region src/services/document-permission.service.ts
 /**
 * Service for managing document-level permissions.
@@ -5568,15 +5833,20 @@ async function setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer,
 function setupEventListeners(pkgManager, graphqlManager, reactorProcessorManager, module, documentModelRegistry) {
 	pkgManager.onDocumentModelsChange((packagedModels) => {
 		if (documentModelRegistry) {
-			const newModules = Object.values(packagedModels).flat();
-			const registeredModules = documentModelRegistry.getAllModules();
-			const registeredTypes = new Set(registeredModules.map((m) => m.documentModel.global.id));
-			const modulesToRegister = newModules.filter((mod) => !registeredTypes.has(mod.documentModel.global.id));
-			if (modulesToRegister.length > 0) {
-				const results = documentModelRegistry.registerModules(...modulesToRegister);
-				for (const result of results) if (result.status === "success") defaultLogger.info(`Registered new document model: ${result.item.documentModel.global.id}`);
+			const newModules = getUniqueDocumentModels(Object.values(packagedModels).flat());
+			const incomingTypes = new Set(newModules.map((m) => m.documentModel.global.id));
+			if (incomingTypes.size > 0) {
+				documentModelRegistry.unregisterModules(...incomingTypes);
+				const results = documentModelRegistry.registerModules(...newModules);
+				for (const result of results) if (result.status === "success") defaultLogger.info(`Registered document model: ${result.item.documentModel.global.id} v${result.item.version ?? 1}`);
 				else defaultLogger.error(`Failed to register document model: ${result.error.message}`);
 			}
+			const manifests = pkgManager.getUniqueUpgradeManifests();
+			if (manifests.length > 0) {
+				documentModelRegistry.unregisterUpgradeManifests(...manifests.map((m) => m.documentType));
+				const manifestResults = documentModelRegistry.registerUpgradeManifests(...manifests);
+				for (const result of manifestResults) if (result.status === "error") defaultLogger.error(`Failed to register upgrade manifest: ${result.error.message}`);
+			}
 		}
 		graphqlManager.regenerateDocumentModelSubgraphs();
 	});
@@ -5641,7 +5911,7 @@ async function _setupCommonInfrastructure(options) {
 		admins = options.auth.admins.map((a) => a.toLowerCase());
 		authEnabled = options.auth.enabled;
 	}
-	const { AUTH_ENABLED, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION, CREDENTIAL_VERIFICATION_CACHE_TTL_MS } = process.env;
+	const { AUTH_ENABLED, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION, CREDENTIAL_VERIFICATION_CACHE_TTL_MS, RENOWN_URL, SWITCHBOARD_URL } = process.env;
 	if (AUTH_ENABLED !== void 0) authEnabled = AUTH_ENABLED === "true";
 	if (ADMINS !== void 0) admins = ADMINS.split(",").map((a) => a.toLowerCase());
 	let defaultProtection = false;
@@ -5677,7 +5947,11 @@ async function _setupCommonInfrastructure(options) {
 			enabled: authEnabled,
 			admins,
 			skipCredentialVerification,
-			credentialVerificationCacheTtlMs
+			credentialVerificationCacheTtlMs,
+			verifyCredential: await createRenownCredentialVerifier({
+				renownUrl: RENOWN_URL,
+				switchboardUrl: SWITCHBOARD_URL
+			})
 		});
 		authFetchMiddleware = createAuthFetchMiddleware(authService);
 	}
@@ -5703,7 +5977,12 @@ async function _setupCommonInfrastructure(options) {
 	await mkdir(attachmentStoragePath, { recursive: true });
 	const { db: attachmentDb, knex: attachmentKnex, pglite: attachmentPglite } = getDbClient(options.dbPath, options.pgliteFactory);
 	dbClosers.push(...makeDbClosers(attachmentKnex, attachmentPglite));
-	const attachments = await new AttachmentBuilder(attachmentDb, attachmentStoragePath).withReservationSweepMs(3600 * 1e3).build();
+	const ATTACHMENT_SWEEP_INTERVAL_MS = 3600 * 1e3;
+	const attachmentBackend = await createStartupAttachmentBackend({ db: attachmentDb });
+	const attachmentBuilder = new AttachmentBuilder(attachmentDb, attachmentStoragePath).withReservationSweepMs(ATTACHMENT_SWEEP_INTERVAL_MS);
+	if (attachmentBackend) attachmentBuilder.withBackend(attachmentBackend);
+	const attachments = await attachmentBuilder.build();
+	const attachmentReferenceIndex = await new AttachmentReferenceIndexBuilder(attachmentDb).build();
 	dbClosers.push(() => {
 		attachments.destroy();
 		return Promise.resolve();
@@ -5723,6 +6002,7 @@ async function _setupCommonInfrastructure(options) {
 		documentPermissionService,
 		authorizationConfig,
 		attachments,
+		attachmentReferenceIndex,
 		packages,
 		dbClosers,
 		readiness
@@ -5731,7 +6011,7 @@ async function _setupCommonInfrastructure(options) {
 /**
 * Private helper function containing common setup logic for API initialization
 */
-async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient) {
+async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient) {
 	const hostModule = {
 		relationalDb,
 		analyticsStore,
@@ -5778,6 +6058,7 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	const { httpServer, wsServer } = await startServer(httpAdapter, port, options.https, logger);
 	const authorizationService = createAuthorizationService(authorizationConfig, documentPermissionService, createGetParentIdsFn(reactorClient));
 	logger.info(`Authorization service initialized (policy: ${authorizationConfig.policy})`);
+	const attachmentAccess = new AttachmentAccessService(createCanonicalDocumentIdResolver(reactorClient), authorizationService, attachmentReferenceIndex.store, attachmentReferenceProjection);
 	const coreSubgraphs = DefaultCoreSubgraphs.slice();
 	coreSubgraphs.push(ReactorSubgraph);
 	if (documentPermissionService) {
@@ -5802,6 +6083,8 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 		graphqlManager,
 		packages,
 		attachments,
+		attachmentReferenceIndex,
+		attachmentAccess,
 		authService,
 		dispose: buildApiDispose({
 			graphqlManager,
@@ -5850,9 +6133,15 @@ function buildApiDispose(args) {
 	};
 }
 async function initializeAndStartAPI(clientInitializer, options, processorApp) {
-	const { port, httpAdapter, authFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
-	const { documentModels, processors, subgraphs } = await packages.init();
-	const { module: reactorClientModule, reactorDriveClient } = await clientInitializer(documentModels);
+	const { port, httpAdapter, authFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, attachmentReferenceIndex, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
+	const { documentModels, upgradeManifests, processors, subgraphs } = await packages.init();
+	const { module: reactorClientModule, reactorDriveClient, attachmentReferenceProjection = {
+		status: "unavailable",
+		reason: "initializer-did-not-report"
+	} } = await clientInitializer(documentModels, {
+		attachmentReferenceWriter: attachmentReferenceIndex.store,
+		upgradeManifests
+	});
 	const reactorClient = reactorClientModule.client;
 	const syncManager = reactorClientModule.reactorModule?.syncModule?.syncManager;
 	if (!syncManager) throw new Error("SyncManager not available from InProcessReactorClientModule");
@@ -5861,11 +6150,12 @@ async function initializeAndStartAPI(clientInitializer, options, processorApp) {
 	const documentModelRegistry = reactorClientModule.reactorModule?.documentModelRegistry;
 	if (!documentModelRegistry) throw new Error("DocumentModelRegistry not available from InProcessReactorClientModule");
 	return {
-		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient),
+		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient),
 		client: reactorClient,
 		syncManager,
 		documentModelRegistry,
-		readiness
+		readiness,
+		attachmentReferenceProjection
 	};
 }
 //#endregion
@@ -5969,7 +6259,7 @@ var PackageManagementService = class {
 	}
 };
 //#endregion
-export { ADMIN_USERS, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, assertAuthRequiredForDocumentPermissions, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
+export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthDecision, AuthDecisionSchema, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, EvaluateActionsDocument, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, assertAuthRequiredForDocumentPermissions, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=e58cea2c-2319-52a8-90cd-3e99d94ba98f
+//# debugId=50fb0cae-c1a3-5acc-9be1-417f9b1814c6