@powerhousedao/reactor-api 6.2.2-dev.53 → 6.2.2-dev.55

package/dist/index.mjs

@@ -1,11 +1,11 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3473708d-6af5-5eab-859e-41e65d41fe17")}catch(e){}}();
-import { _ as createAuthorizationService, a as isSubgraphClass, d as loadSubgraphs, f as BaseSubgraph, g as AuthorizedDocumentHandle, h as AuthorizationPolicy, i as buildGraphqlOperations, l as loadDocumentModels, m as createCanonicalDocumentIdResolver, n as buildGraphQlDriveDocument, o as debounce, p as CanonicalDocumentIdResolutionError, r as buildGraphqlOperation, s as extractUpgradeManifests, t as buildGraphQlDocument, u as loadProcessors, v as AuthEvaluationUnsupportedError } from "./utils-Tw4hVMpc.mjs";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="71eb0bed-1554-5f30-8744-63f36b8d4c0c")}catch(e){}}();
+import { _ as createAuthorizationService, a as isSubgraphClass, b as MalformedStoredOperationError, d as loadSubgraphs, f as BaseSubgraph, g as AuthorizedDocumentHandle, h as AuthorizationPolicy, i as buildGraphqlOperations, l as loadDocumentModels, m as createCanonicalDocumentIdResolver, n as buildGraphQlDriveDocument, o as debounce, p as CanonicalDocumentIdResolutionError, r as buildGraphqlOperation, s as extractUpgradeManifests, t as buildGraphQlDocument, u as loadProcessors, v as AuthEvaluationUnsupportedError, y as ForbiddenError } from "./utils-O_hBrLd0.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
 import { GraphQLError, Kind, parse, print } from "graphql";
-import { AuthEnforcementDisabledError, DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, PropagationMode as PropagationMode$1, consolidateSyncOperations, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl, syncOperationErrorType } from "@powerhousedao/reactor";
+import { AuthEnforcementDisabledError, DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, ModelReadGate, PropagationMode as PropagationMode$1, SyncScopeGate, consolidateSyncOperations, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl, readDecisionModel, syncOperationErrorType } from "@powerhousedao/reactor";
 import { ConsoleLogger, childLogger, documentModelDocumentModelModule } from "document-model";
 import path from "node:path";
 import { match } from "path-to-regexp";
@@ -13,7 +13,7 @@ import { buildSubgraphSchema } from "@apollo/subgraph";
 import { typeDefs } from "@powerhousedao/document-engineering/graphql";
 import { camelCase, kebabCase, pascalCase } from "change-case";
 import { GraphQLJSONObject } from "graphql-type-json";
-import { setName } from "@powerhousedao/shared/document-model";
+import { deserializeSignature, serializeSignature, setName } from "@powerhousedao/shared/document-model";
 import * as z$1 from "zod";
 import { z } from "zod";
 import { createHandler } from "graphql-sse/lib/use/fetch";
@@ -968,7 +968,12 @@ function ActionCandidateInputSchema() {
 	});
 }
 function ActionContextInputSchema() {
-	return z$1.object({ signer: z$1.lazy(() => ReactorSignerInputSchema().nullish()) });
+	return z$1.object({
+		nonce: z$1.string().nullish(),
+		prevOpHash: z$1.string().nullish(),
+		prevOpIndex: z$1.number().nullish(),
+		signer: z$1.lazy(() => ReactorSignerInputSchema().nullish())
+	});
 }
 function ActionInputSchema() {
 	return z$1.object({
@@ -1367,13 +1372,13 @@ const CreateEmptyDocumentDocument = gql`
 const MutateDocumentDocument = gql`
   mutation MutateDocument(
     $documentIdentifier: String!
-    $actions: [JSONObject!]!
-    $view: ViewFilterInput
+    $actions: [ActionInput!]!
+    $branch: String
   ) {
-    mutateDocument(
+    mutateDocument: execute(
       documentIdentifier: $documentIdentifier
       actions: $actions
-      view: $view
+      branch: $branch
     ) {
       ...PHDocumentFields
     }
@@ -1383,14 +1388,21 @@ const MutateDocumentDocument = gql`
 const MutateDocumentAsyncDocument = gql`
   mutation MutateDocumentAsync(
     $documentIdentifier: String!
-    $actions: [JSONObject!]!
-    $view: ViewFilterInput
+    $actions: [ActionInput!]!
+    $branch: String
   ) {
-    mutateDocumentAsync(
+    mutateDocumentAsync: executeAsync(
       documentIdentifier: $documentIdentifier
       actions: $actions
-      view: $view
-    )
+      branch: $branch
+    ) {
+      id
+      status
+      result
+      error
+      createdAt
+      completedAt
+    }
   }
 `;
 const RenameDocumentDocument = gql`
@@ -1811,22 +1823,112 @@ function toMutableArray(arr) {
 	return arr ? [...arr] : void 0;
 }
 /**
-* Validates that a JSONObject represents a valid Action structure
+* Validates that an incoming value has the structure of an Action.
+*
+* This is the whole guard on the way in. `mutateDocument` takes untyped JSON, so
+* nothing has checked these fields before a resolver runs, and the id in
+* particular has to be checked here: it is hashed into the operation id and
+* replay dedupes by it, so an action without one is stored under an operation id
+* shared by every id-less operation on the same document, scope and branch.
+*
+* The storage constraint would refuse such a row anyway, but only after a job
+* has been enqueued and failed. Refusing here answers the caller instead.
 */
 function validateActionStructure(obj) {
 	if (!obj || typeof obj !== "object") return false;
 	const action = obj;
+	if (typeof action.id !== "string" || !action.id) return false;
 	if (typeof action.type !== "string" || !action.type) return false;
 	if (typeof action.scope !== "string" || !action.scope) return false;
+	if (typeof action.timestampUtcMs !== "string" || !action.timestampUtcMs) return false;
 	if (!("input" in action)) return false;
 	return true;
 }
 /**
+* Restores an action's signatures to the tuples verification reads.
+*
+* A signature is a five-param tuple, and GraphQL declares `signatures` as a
+* list of strings, so a client joins each one for transport. The sync path
+* already splits them on arrival; this is the same step for the mutation path,
+* which had none - an action submitted there kept whatever shape it arrived in,
+* so the same signature was persisted as a tuple or as one joined string
+* depending on which door it came through.
+*
+* A tuple passes through untouched, so an in-process caller handing over real
+* signatures is unaffected.
+*/
+function withDeserializedSignatures(action) {
+	const signer = action.context?.signer;
+	if (!signer?.signatures || signer.signatures.length === 0) return action;
+	return {
+		...action,
+		context: {
+			...action.context,
+			signer: {
+				...signer,
+				signatures: signer.signatures.map(deserializeSignature)
+			}
+		}
+	};
+}
+/**
+* Converts actions the schema has already coerced into the actions the reactor
+* applies.
+*
+* The one conversion the schema cannot express is the signature: GraphQL
+* declares `signatures` as a list of strings, not of lists, so each arrives
+* joined and has to be read back as the tuple verification indexes into.
+*
+* Nothing is validated here. `ActionInput` states every field the reactor needs,
+* so anything that reached this point has them - unlike the untyped path, which
+* has to check by hand.
+*/
+function toSubmittableActions(actions) {
+	return actions.map((action) => {
+		const context = toSubmittableContext(action.context);
+		const submittable = {
+			id: action.id,
+			type: action.type,
+			timestampUtcMs: action.timestampUtcMs,
+			input: action.input,
+			scope: action.scope
+		};
+		return context ? {
+			...submittable,
+			context
+		} : submittable;
+	});
+}
+/**
+* `ReactorSignerInput` leaves `user` and `app` optional where `ActionSigner`
+* requires them, so an incomplete signer cannot be represented. It is carried
+* through as it arrived rather than filled in: the signature verifier is what
+* should refuse it, and inventing either field here would be inventing the part
+* that says who signed.
+*/
+function toSubmittableContext(context) {
+	if (!context) return;
+	const submittable = {};
+	const prevOpIndex = fromInputMaybe(context.prevOpIndex);
+	if (prevOpIndex !== void 0) submittable.prevOpIndex = prevOpIndex;
+	const prevOpHash = fromInputMaybe(context.prevOpHash);
+	if (prevOpHash !== void 0) submittable.prevOpHash = prevOpHash;
+	const nonce = fromInputMaybe(context.nonce);
+	if (nonce !== void 0) submittable.nonce = nonce;
+	const signer = fromInputMaybe(context.signer);
+	if (signer) submittable.signer = {
+		user: fromInputMaybe(signer.user),
+		app: fromInputMaybe(signer.app),
+		signatures: signer.signatures.map(deserializeSignature)
+	};
+	return Object.keys(submittable).length > 0 ? submittable : void 0;
+}
+/**
 * Converts a JSONObject to an Action, validating basic structure
 */
 function jsonObjectToAction(obj) {
-	if (!validateActionStructure(obj)) throw new GraphQLError("Invalid action structure. Actions must have: type (string), scope (string), and input (any)");
-	return obj;
+	if (!validateActionStructure(obj)) throw new GraphQLError("Invalid action structure. Actions must have: id (string), type (string), scope (string), timestampUtcMs (string), and input (any)");
+	return withDeserializedSignatures(obj);
 }
 /**
 * Validates a list of actions by converting them from JSON and checking structure
@@ -1840,10 +1942,57 @@ function validateActions(actions) {
 	}
 	return convertedActions;
 }
+/** The operation fields the schema declares non-null. */
+const REQUIRED_OPERATION_FIELDS = [
+	"index",
+	"timestampUtcMs",
+	"hash",
+	"skip"
+];
+/** The action fields the schema declares non-null. */
+const REQUIRED_ACTION_FIELDS = [
+	"id",
+	"type",
+	"timestampUtcMs",
+	"input",
+	"scope"
+];
+/**
+* Names an operation well enough to find the row it came from, without assuming
+* the fields that might be the missing ones.
+*/
+function describeOperation(stored) {
+	const parts = [typeof stored.id === "string" && stored.id ? `operation ${stored.id}` : "operation with no id"];
+	if (typeof stored.index === "number") parts.push(`index ${stored.index}`);
+	const scope = stored.action?.scope;
+	if (typeof scope === "string" && scope) parts.push(`scope ${scope}`);
+	return parts.join(", ");
+}
+/**
+* Refuses an operation the schema cannot represent, naming the field.
+*
+* The alternative is what execution does unaided: nullify the field, bubble that
+* up the non-null chain until it takes out the envelope's whole operation list,
+* and report a bare "Cannot return null for non-nullable field" with no way to
+* tell which of a hundred operations was at fault. Checked before the response
+* is built so the failure is typed and attributable.
+*
+* Presence is all that is checked. The schema's own serialization still rejects
+* a value of the wrong type, and inventing further rules here would put a second
+* contract beside the one the schema already states.
+*/
+function assertServable(operation) {
+	const stored = operation;
+	for (const field of REQUIRED_OPERATION_FIELDS) if (stored[field] === void 0 || stored[field] === null) throw new MalformedStoredOperationError(`${describeOperation(stored)} has no ${field}`);
+	const action = stored.action;
+	if (action === void 0 || action === null) throw new MalformedStoredOperationError(`${describeOperation(stored)} has no action`);
+	for (const field of REQUIRED_ACTION_FIELDS) if (action[field] === void 0 || action[field] === null) throw new MalformedStoredOperationError(`${describeOperation(stored)} has an action with no ${field}`);
+}
 /**
 * Transforms an operation to serialize signatures from tuples to strings for GraphQL compatibility.
 */
 function serializeOperationForGraphQL(operation) {
+	assertServable(operation);
 	const signer = operation.action.context?.signer;
 	if (!signer?.signatures) return operation;
 	return {
@@ -1854,7 +2003,7 @@ function serializeOperationForGraphQL(operation) {
 				...operation.action.context,
 				signer: {
 					...signer,
-					signatures: signer.signatures.map((sig) => Array.isArray(sig) ? sig.join(", ") : sig)
+					signatures: signer.signatures.map(serializeSignature)
 				}
 			}
 		}
@@ -2267,6 +2416,49 @@ async function createDocumentWithInitialState(reactorClient, args, reactorDriveC
 		throw new GraphQLError(`Failed to convert created document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
+/** The branch a mutation applies to when the caller names none. */
+const DEFAULT_BRANCH = "main";
+/**
+* Applies actions to a document and waits for the result.
+*
+* The wire form of `IReactorClient.execute`, and named for it. Takes the actions
+* already coerced against `ActionInput`, so the only conversion left is the one
+* the schema cannot express: a signature travels as one string, and verification
+* reads it as the tuple it was.
+*/
+async function execute(reactorClient, args) {
+	const actions = toSubmittableActions(args.actions);
+	const branch = fromInputMaybe(args.branch) ?? DEFAULT_BRANCH;
+	let result;
+	try {
+		result = await reactorClient.execute(args.documentIdentifier, branch, actions);
+	} catch (error) {
+		throw new GraphQLError(`Failed to execute actions: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+	try {
+		return toGqlPhDocument(result);
+	} catch (error) {
+		throw new GraphQLError(`Failed to convert executed document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+}
+/**
+* Submits actions to a document and returns the job that will apply them.
+*
+* Returns the job rather than only its id, matching
+* `IReactorClient.executeAsync`. A job handed back from a submission has no
+* result yet, which is why `JobInfo.result` is nullable.
+*/
+async function executeAsync(reactorClient, args) {
+	const actions = toSubmittableActions(args.actions);
+	const branch = fromInputMaybe(args.branch) ?? DEFAULT_BRANCH;
+	let job;
+	try {
+		job = await reactorClient.executeAsync(args.documentIdentifier, branch, actions);
+	} catch (error) {
+		throw new GraphQLError(`Failed to submit actions: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+	return toGqlJobInfo(job);
+}
 async function mutateDocument(reactorClient, args) {
 	let validatedActions;
 	try {
@@ -2400,7 +2592,14 @@ async function deleteDocuments(reactorClient, args) {
 		throw new GraphQLError(`Failed to delete documents: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function touchChannel(syncManager, args) {
+/**
+* Registers a sync channel, or reports the state of one already registered.
+*
+* `boundAddress` claims a channel at creation for the subject that created it.
+* An anonymously created channel is left unbound, which is not a permission but
+* an unanswered question: the first authenticated subject to use it adopts it.
+*/
+async function touchChannel(syncManager, args, boundAddress) {
 	try {
 		return {
 			success: true,
@@ -2412,7 +2611,10 @@ async function touchChannel(syncManager, args) {
 		scope: [...args.input.filter.scope],
 		branch: args.input.filter.branch
 	};
-	const options = { sinceTimestampUtcMs: args.input.sinceTimestampUtcMs };
+	const options = {
+		sinceTimestampUtcMs: args.input.sinceTimestampUtcMs,
+		boundAddress
+	};
 	try {
 		await syncManager.add(args.input.name, DriveCollectionId.fromKey(args.input.collectionId), {
 			type: "polling",
@@ -2427,9 +2629,50 @@ async function touchChannel(syncManager, args) {
 	};
 }
 /**
+* The sync operations in `syncOps` this subject may not be served.
+*
+* A sync operation is one document, one branch and (from the outbox) one scope,
+* so the answer is per entry rather than per operation: an entry is withheld
+* whole or served whole, which is what keeps a scope's operation sequence
+* unbroken for whoever does receive it. A dead letter can name several scopes,
+* and is withheld only when the policy serves none of them -- the metadata
+* scopes are readable by every holder, so in practice a dead letter naming one
+* is always served.
+*
+* The policy is read once per document and branch, and the memo lives no longer
+* than this call: a poll must not answer from a policy that changed between
+* polls, since the widening case is exactly the one holding exists to serve.
+*
+* A read that fails for any reason other than the document being absent is
+* allowed to propagate. The poll then fails, the puller retries, and nothing is
+* served in the meantime -- which is the safe direction, and a visible one.
+*/
+async function collectHeldSyncOperations(syncOps, gate, subject, signal) {
+	const held = /* @__PURE__ */ new Set();
+	const predicates = /* @__PURE__ */ new Map();
+	for (const syncOp of syncOps) {
+		const key = `${syncOp.documentId}\u0000${syncOp.branch}`;
+		let predicate = predicates.get(key);
+		if (!predicate) {
+			predicate = gate.scopePredicateById(syncOp.documentId, subject, syncOp.branch, signal);
+			predicates.set(key, predicate);
+		}
+		const readable = await predicate;
+		if (!syncOp.scopes.some((scope) => readable(scope))) held.add(syncOp.id);
+	}
+	return held;
+}
+/**
 * Polls the switchboard for new sync envelopes and acknowledges previously
 * received operations.
 *
+* `forbiddenIds` and `heldOpIds` are two different refusals. A forbidden
+* document is consumed: its delivery counters are advanced as though it had
+* been sent, so it is never reconsidered. A held sync operation is withheld:
+* nothing about it is touched, so a policy that later widens serves it whole on
+* a subsequent poll. Which one applies is the caller's decision, and the two
+* are intersected, so a document refused either way is not served.
+*
 * Ordinal frames of reference:
 * - `outboxAck` / `outboxLatest`: switchboard's ordinals (used to trim/filter
 *   the switchboard's outbox)
@@ -2437,14 +2680,14 @@ async function touchChannel(syncManager, args) {
 *   client ordinal the switchboard has successfully applied, so the client
 *   can trim its own outbox)
 */
-function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new Set()) {
+function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new Set(), heldOpIds = /* @__PURE__ */ new Set()) {
 	let remote;
 	try {
 		remote = syncManager.getById(args.channelId);
 	} catch (error) {
 		throw new GraphQLError(`Channel not found: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
-	const deadLetters = remote.channel.deadLetter.items.filter((syncOp) => !forbiddenIds.has(syncOp.documentId)).map((syncOp) => ({
+	const deadLetters = remote.channel.deadLetter.items.filter((syncOp) => !forbiddenIds.has(syncOp.documentId) && !heldOpIds.has(syncOp.id)).map((syncOp) => ({
 		documentId: syncOp.documentId,
 		error: syncOp.error?.message ?? "Unknown error",
 		errorType: syncOperationErrorType(syncOp.error),
@@ -2493,6 +2736,7 @@ function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new
 			hasMore = true;
 			break;
 		}
+		if (heldOpIds.has(syncOp.id)) continue;
 		syncOp.deliveredCount ??= 0;
 		syncOp.emittedCount ??= 0;
 		while (syncOp.deliveredCount < syncOp.emittedCount && syncOp.operations[syncOp.deliveredCount].context.ordinal <= args.outboxLatest) syncOp.deliveredCount += 1;
@@ -2986,7 +3230,7 @@ var GraphQLManager = class {
 	*/
 	reactorDriveClient;
 	authorizationService;
-	constructor(path, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, logger, httpAdapter, gatewayAdapter, authService, documentPermissionService, featureFlags = DefaultFeatureFlags, port = 4001, authorizationService, reactorDriveClient) {
+	constructor(path, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, logger, httpAdapter, gatewayAdapter, authService, documentPermissionService, featureFlags = DefaultFeatureFlags, port = 4001, authorizationService, reactorDriveClient, syncServingGate) {
 		this.path = path;
 		this.httpServer = httpServer;
 		this.wsServer = wsServer;
@@ -3001,6 +3245,7 @@ var GraphQLManager = class {
 		this.documentPermissionService = documentPermissionService;
 		this.featureFlags = featureFlags;
 		this.port = port;
+		this.syncServingGate = syncServingGate;
 		if (!authorizationService) throw new Error("GraphQLManager requires an authorizationService");
 		this.authorizationService = authorizationService;
 		this.reactorDriveClient = reactorDriveClient;
@@ -3086,7 +3331,8 @@ var GraphQLManager = class {
 					syncManager: this.syncManager,
 					path: this.path,
 					documentPermissionService: this.documentPermissionService,
-					authorizationService: this.authorizationService
+					authorizationService: this.authorizationService,
+					syncServingGate: this.syncServingGate
 				});
 				await this.#addSubgraphInstance(subgraphInstance, supergraph, false);
 			} catch (error) {
@@ -3140,7 +3386,8 @@ var GraphQLManager = class {
 			syncManager: this.syncManager,
 			path: this.path,
 			documentPermissionService: this.documentPermissionService,
-			authorizationService: this.authorizationService
+			authorizationService: this.authorizationService,
+			syncServingGate: this.syncServingGate
 		});
 		return this.#addSubgraphInstance(subgraphInstance, supergraph, core);
 	}
@@ -3802,7 +4049,7 @@ function createReactorGraphQLClient(url, fetchImpl = fetch, headers) {
 }
 //#endregion
 //#region src/graphql/reactor/schema.graphql
-var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  \"\"\"\n  How the origin classified the failure. A peer needs this to mirror the origin's\n  quarantine decision; without it a held auth operation would freeze the document\n  on the peer side while the origin kept syncing.\n  \"\"\"\n  errorType: String\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n  result: JSONObject!\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n  result: JSONObject!\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n\"\"\"\nOne operation an authorization preflight predicts a verdict for.\n\n`input` is what a conditional grant reads, so a candidate standing for a\nfilled-in form carries that form's input. Omitting it predicts the verdict an\nempty input earns, not the verdict the filled-in form will get.\n\"\"\"\ninput ActionCandidateInput {\n  scope: String!\n  type: String!\n  input: JSONObject\n}\n\nenum AuthDecision {\n  ALLOW\n  DENY\n}\n\n\"\"\"\nOne candidate's predicted verdict. `reason` carries the refusal a DENY is\nrecorded with, and is null on an ALLOW.\n\"\"\"\ntype ActionEvaluation {\n  decision: AuthDecision!\n  reason: String\n}\n\n\"\"\"\nThe predicted verdicts for a set of candidates, in the order they were given,\nwith the aggregates a caller branches on.\n\nThe aggregates are redundant -- a verdict is binary -- and all four are returned\nso a caller reads the one its question is phrased in rather than negating\nanother. Over no candidates every aggregate is false: nothing is allowed and\nnothing is denied.\n\"\"\"\ntype ActionEvaluations {\n  evaluations: [ActionEvaluation!]!\n  allAllowed: Boolean!\n  anyAllowed: Boolean!\n  allDenied: Boolean!\n  anyDenied: Boolean!\n}\n\n# Input types for sync operations\ninput ActionContextInput {\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  \"\"\"\n  Predicts whether the calling subject would be admitted to execute each of a\n  set of candidate operations, without submitting any of them. A UI asks this to\n  disable a control rather than offer an action that fails on submit.\n\n  The answer is a prediction, not a promise:\n\n  - Real admission compiles an append condition over everything it read and the\n    store enforces it at write time. A preflight reads no future, so a policy\n    change landing between this answer and the submit changes the verdict. The\n    submit path stays the only authority.\n  - The verdict is evaluated at the stream heads, so it is correct for a\n    candidate about to be submitted. A backdated submission is out of contract;\n    the reactor decides that one by position.\n  - A candidate whose verdict depends on its input has to carry that input, since\n    a conditional grant reads it.\n\n  The subject is the authenticated caller and cannot be named in the request:\n  answering for an arbitrary subject would disclose what a policy grants\n  somebody else. It carries both the caller's address and the did:key of the app\n  instance whose token authenticated the request, so a policy naming either\n  matches the same principal the write path presents.\n\n  Requires the reactor's authEnforcement feature flag. Without it the reactor\n  holds no decision model, so this fails with extensions.code\n  AUTH_EVALUATION_UNSUPPORTED rather than guessing.\n  \"\"\"\n  evaluateActions(\n    documentIdentifier: String!\n    branch: String\n    candidates: [ActionCandidateInput!]!\n  ): ActionEvaluations!\n\n  # Poll for sync envelopes from a channel\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
+var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  \"\"\"\n  How the origin classified the failure. A peer needs this to mirror the origin's\n  quarantine decision; without it a held auth operation would freeze the document\n  on the peer side while the origin kept syncing.\n  \"\"\"\n  errorType: String\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Null until then, which\n  is the state every job is in when it is handed back from a submission.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n  result: JSONObject!\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n\"\"\"\nOne operation an authorization preflight predicts a verdict for.\n\n`input` is what a conditional grant reads, so a candidate standing for a\nfilled-in form carries that form's input. Omitting it predicts the verdict an\nempty input earns, not the verdict the filled-in form will get.\n\"\"\"\ninput ActionCandidateInput {\n  scope: String!\n  type: String!\n  input: JSONObject\n}\n\nenum AuthDecision {\n  ALLOW\n  DENY\n}\n\n\"\"\"\nOne candidate's predicted verdict. `reason` carries the refusal a DENY is\nrecorded with, and is null on an ALLOW.\n\"\"\"\ntype ActionEvaluation {\n  decision: AuthDecision!\n  reason: String\n}\n\n\"\"\"\nThe predicted verdicts for a set of candidates, in the order they were given,\nwith the aggregates a caller branches on.\n\nThe aggregates are redundant -- a verdict is binary -- and all four are returned\nso a caller reads the one its question is phrased in rather than negating\nanother. Over no candidates every aggregate is false: nothing is allowed and\nnothing is denied.\n\"\"\"\ntype ActionEvaluations {\n  evaluations: [ActionEvaluation!]!\n  allAllowed: Boolean!\n  anyAllowed: Boolean!\n  allDenied: Boolean!\n  anyDenied: Boolean!\n}\n\n# Input types for sync operations\n\"\"\"\nAn action's context, as a caller submits it.\n\nDeclares every field `ActionContext` carries, because an input object rejects a\nfield it does not declare: an action stamped with the head it applies to - which\nis what a signing client sends - is refused outright if these are missing, and\nthat refusal is a whole-request one, not a per-field one.\n\n`prevOpHash` and `prevOpIndex` are the scope head the action was composed\nagainst. They are recorded rather than enforced; a signature is verified from\nthe params carried in its own tuple, which do not include them.\n\"\"\"\ninput ActionContextInput {\n  \"\"\"The index of the last operation in the scope the action applies to.\"\"\"\n  prevOpIndex: Int\n\n  \"\"\"The hash of the state the action applies to.\"\"\"\n  prevOpHash: String\n\n  \"\"\"Covers replay of an operation that would otherwise be a no-op.\"\"\"\n  nonce: String\n\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  \"\"\"\n  Predicts whether the calling subject would be admitted to execute each of a\n  set of candidate operations, without submitting any of them. A UI asks this to\n  disable a control rather than offer an action that fails on submit.\n\n  The answer is a prediction, not a promise:\n\n  - Real admission compiles an append condition over everything it read and the\n    store enforces it at write time. A preflight reads no future, so a policy\n    change landing between this answer and the submit changes the verdict. The\n    submit path stays the only authority.\n  - The verdict is evaluated at the stream heads, so it is correct for a\n    candidate about to be submitted. A backdated submission is out of contract;\n    the reactor decides that one by position.\n  - A candidate whose verdict depends on its input has to carry that input, since\n    a conditional grant reads it.\n\n  The subject is the authenticated caller and cannot be named in the request:\n  answering for an arbitrary subject would disclose what a policy grants\n  somebody else. It carries both the caller's address and the did:key of the app\n  instance whose token authenticated the request, so a policy naming either\n  matches the same principal the write path presents.\n\n  Requires the reactor's authEnforcement feature flag. Without it the reactor\n  holds no decision model, so this fails with extensions.code\n  AUTH_EVALUATION_UNSUPPORTED rather than guessing.\n  \"\"\"\n  evaluateActions(\n    documentIdentifier: String!\n    branch: String\n    candidates: [ActionCandidateInput!]!\n  ): ActionEvaluations!\n\n  \"\"\"\n  Polls for sync envelopes from a channel.\n\n  An operation stored before the API required an action id cannot be\n  represented by this schema, and rather than serving a partial response beside\n  a bare non-null violation, this fails with extensions.code\n  MALFORMED_STORED_OPERATION naming the operation. That code means the failure\n  is worth polling through: the document holding the operation needs repairing,\n  but the channel serves every other document, and a peer that stopped polling\n  would stop receiving those too.\n  \"\"\"\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  \"\"\"\n  Applies actions to a document and waits for the result.\n\n  Each action is coerced against `ActionInput`, so one missing a field the wire\n  declares is refused before any work starts. The id in particular: it is hashed\n  into the operation id and replay dedupes by it, so an action without one is\n  stored under an operation id shared by every id-less operation on the same\n  document, scope and branch.\n\n  Named for `IReactorClient.execute`, which this is the wire form of. `branch`\n  defaults to `main`.\n  \"\"\"\n  execute(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): PHDocument!\n\n  \"\"\"\n  Submits actions to a document and returns the job that will apply them.\n\n  Coerced exactly as `execute` is, so a malformed action is refused here rather\n  than surfacing later as a failed job. Returns the job rather than only its id,\n  so a caller has the status and the creation time it would otherwise have to\n  ask for; `result` is null until the job produces one.\n  \"\"\"\n  executeAsync(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): JobInfo!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n    @deprecated(\n      reason: \"Use execute. Actions here are untyped, so a malformed one is refused by a hand-written check rather than by the schema, and `view.scopes` is accepted but ignored.\"\n    )\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n    @deprecated(\n      reason: \"Use executeAsync, which is typed and returns the job rather than only its id.\"\n    )\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
 //#endregion
 //#region src/graphql/reactor/pubsub.ts
 const pubSub = new PubSub();
@@ -3940,6 +4187,46 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			if (!await this.canReadDocument(documentId, ctx)) forbidden.add(documentId);
 		}
 	}
+	/**
+	* Enforces which subject a sync channel answers to, adopting an unclaimed one.
+	*
+	* A channel is a private queue: it names a collection, and it accumulates
+	* exactly the operations one subject is owed, so serving it to a second
+	* subject would hand over that subject's cursor as well as its contents. An
+	* unbound channel -- created anonymously, or created before binding existed --
+	* is claimed by the first authenticated subject to use it, and answers to that
+	* address alone thereafter. Adoption is safe precisely because serving
+	* withholds rather than consumes: before it was claimed the channel served
+	* only what an anonymous subject may read, and everything withheld is still
+	* queued for the adopter.
+	*
+	* The refusal is the shape a read denial takes, so a puller treats it as a
+	* signal to authenticate again rather than as a transport failure.
+	*
+	* Nothing is enforced or adopted without a serving gate. Below
+	* `authEnforcement` there is no policy being enforced for the channel to
+	* belong to, and refusing a poll there would break sync for no gain.
+	*/
+	async #bindOrRefuseChannel(channelId, ctx) {
+		if (!this.syncServingGate) return;
+		let remote;
+		try {
+			remote = this.syncManager.getById(channelId);
+		} catch {
+			return;
+		}
+		const bound = remote.meta.options.boundAddress;
+		const address = ctx.user?.address;
+		if (bound === void 0) {
+			if (address !== void 0) await this.syncManager.bindRemote(channelId, address);
+			return;
+		}
+		if (bound !== address) throw new ForbiddenError("to poll this sync channel");
+	}
+	/** The address a channel created by this request belongs to, if any. */
+	#creatorBinding(ctx) {
+		return this.syncServingGate ? ctx.user?.address : void 0;
+	}
 	typeDefs = gql(schema_default);
 	resolvers = {
 		PHDocument: { operations: async (parent, args, ctx) => {
@@ -4093,12 +4380,14 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					const driveId = remote.meta.collectionId.driveId;
 					const isAdmin = this.authorizationService.isSupremeAdmin(ctx.user?.address);
 					if (!isAdmin) await this.assertCanReadCanonical(driveId, ctx);
+					await this.#bindOrRefuseChannel(args.channelId, ctx);
 					const forbiddenIds = /* @__PURE__ */ new Set();
 					if (!isAdmin) {
 						if (await this.authorizationService.canRead(driveId, void 0)) await this.#collectForbiddenDocuments(remote.channel.outbox.items, forbiddenIds, ctx);
 						await this.#collectForbiddenDocuments(remote.channel.deadLetter.items, forbiddenIds, ctx);
 					}
-					const { envelopes, ackOrdinal, deadLetters, hasMore } = pollSyncEnvelopes(this.syncManager, args, forbiddenIds);
+					const heldOpIds = this.syncServingGate ? await collectHeldSyncOperations([...remote.channel.outbox.items, ...remote.channel.deadLetter.items], this.syncServingGate, this.viewSubject(ctx)) : /* @__PURE__ */ new Set();
+					const { envelopes, ackOrdinal, deadLetters, hasMore } = pollSyncEnvelopes(this.syncManager, args, forbiddenIds, heldOpIds);
 					return {
 						envelopes,
 						ackOrdinal,
@@ -4144,6 +4433,32 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					throw error;
 				}
 			},
+			execute: async (_parent, args, ctx) => {
+				this.logger.debug("execute(@args)", args);
+				try {
+					const handle = await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
+					return await execute(this.reactorClient, {
+						...args,
+						documentIdentifier: handle.fetchIdentifier
+					});
+				} catch (error) {
+					this.logger.error("Error in execute(@args): @Error", args, error);
+					throw error;
+				}
+			},
+			executeAsync: async (_parent, args, ctx) => {
+				this.logger.debug("executeAsync(@args)", args);
+				try {
+					const handle = await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
+					return await executeAsync(this.reactorClient, {
+						...args,
+						documentIdentifier: handle.fetchIdentifier
+					});
+				} catch (error) {
+					this.logger.error("Error in executeAsync(@args): @Error", args, error);
+					throw error;
+				}
+			},
 			mutateDocument: async (_parent, args, ctx) => {
 				this.logger.debug("mutateDocument(@args)", args);
 				try {
@@ -4277,7 +4592,8 @@ var ReactorSubgraph = class extends BaseSubgraph {
 						const driveId = DriveCollectionId.fromKey(args.input.collectionId).driveId;
 						await this.assertCanReadCanonical(driveId, ctx);
 					}
-					return await touchChannel(this.syncManager, args);
+					await this.#bindOrRefuseChannel(args.input.id, ctx);
+					return await touchChannel(this.syncManager, args, this.#creatorBinding(ctx));
 				} catch (error) {
 					this.logger.error("Error in touchChannel(@args): @Error", args, error);
 					throw error;
@@ -4389,10 +4705,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.2-dev.53";
+	return "6.2.2-dev.55";
 }
 function getGitHash() {
-	return "0d0b7e3227c12c038a0c44dd17c3ef450498dd33";
+	return "a81c8b2f0201aedffc227bccabd49ceffa3806de";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -5905,10 +6221,31 @@ function makeDbClosers(knexInstance, pglite) {
 	return closers;
 }
 /**
+* The gate sync serving evaluates a document's own policy through, or undefined
+* when there is none to evaluate.
+*
+* It is built here rather than taken off the reactor client because it is not
+* the same gate reads use: it carries the host's closes-by-default setting,
+* which withholds the domain scopes of a document nobody has policied yet. That
+* answer belongs to serving alone -- replay must keep reading an uninitialized
+* document in full -- so the two gates are deliberately separate objects over
+* the same model.
+*
+* Undefined below `authEnforcement`, where the registered model ignores the auth
+* scope: gating through it would serve every domain scope of a policied document
+* to anyone, which is worse than not gating at all.
+*/
+function buildSyncServingGate(reactorModule, authorizationConfig, logger) {
+	if (!reactorModule) return;
+	const model = readDecisionModel(reactorModule.featureFlags, reactorModule.documentModelRegistry);
+	if (!model) return;
+	return new SyncScopeGate(new ModelReadGate(model, reactorModule.documentView, reactorModule.featureFlags.authGroups, reactorModule.operationIndex, logger, { withholdUninitialized: authorizationConfig.defaultProtection }), reactorModule.documentView, logger);
+}
+/**
 * Sets up the subgraph manager and registers subgraphs
 */
-async function setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient) {
-	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter("apollo", logger), authService, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient);
+async function setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate) {
+	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter("apollo", logger), authService, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient, syncServingGate);
 	await graphqlManager.init(subgraphs.core, authFetchMiddleware);
 	for (const [, collection] of subgraphs.extended.entries()) for (const subgraph of collection) await graphqlManager.registerSubgraph(subgraph, "graphql");
 	await graphqlManager.updateRouter();
@@ -6104,7 +6441,7 @@ async function _setupCommonInfrastructure(options) {
 /**
 * Private helper function containing common setup logic for API initialization
 */
-async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient) {
+async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient, syncServingGate) {
 	const hostModule = {
 		relationalDb,
 		analyticsStore,
@@ -6161,7 +6498,7 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	const graphqlManager = await setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, {
 		extended: subgraphs,
 		core: coreSubgraphs
-	}, logger.child(["graphql-manager"]), authorizationService, authService, documentPermissionService, options.enableDocumentModelSubgraphs, port, reactorDriveClient);
+	}, logger.child(["graphql-manager"]), authorizationService, authService, documentPermissionService, options.enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate);
 	setupEventListeners(packages, graphqlManager, reactorProcessorManager, hostModule, documentModelRegistry);
 	if (mcpServerEnabled) {
 		await setupMcpServer({
@@ -6243,7 +6580,7 @@ async function initializeAndStartAPI(clientInitializer, options, processorApp) {
 	const documentModelRegistry = reactorClientModule.reactorModule?.documentModelRegistry;
 	if (!documentModelRegistry) throw new Error("DocumentModelRegistry not available from InProcessReactorClientModule");
 	return {
-		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient),
+		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient, buildSyncServingGate(reactorClientModule.reactorModule, authorizationConfig, options.logger ?? defaultLogger)),
 		client: reactorClient,
 		syncManager,
 		documentModelRegistry,
@@ -6355,4 +6692,4 @@ var PackageManagementService = class {
 export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthDecision, AuthDecisionSchema, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, EvaluateActionsDocument, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground, resolveRenownConfig };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=3473708d-6af5-5eab-859e-41e65d41fe17
+//# debugId=71eb0bed-1554-5f30-8744-63f36b8d4c0c