@powerhousedao/reactor-api 6.2.2-dev.7 → 6.2.2-dev.70

package/dist/index.mjs

@@ -1,11 +1,11 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e58cea2c-2319-52a8-90cd-3e99d94ba98f")}catch(e){}}();
-import { a as isSubgraphClass, c as loadDocumentModels, d as BaseSubgraph, f as AuthorizationPolicy, i as buildGraphqlOperations, l as loadProcessors, m as createAuthorizationService, n as buildGraphQlDriveDocument, o as debounce, p as AuthorizedDocumentHandle, r as buildGraphqlOperation, t as buildGraphQlDocument, u as loadSubgraphs } from "./utils-iibOQ50e.mjs";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="42c7ea6f-655f-5a4b-84ac-b7870ee17334")}catch(e){}}();
+import { _ as createAuthorizationService, a as isSubgraphClass, b as MalformedStoredOperationError, d as loadSubgraphs, f as BaseSubgraph, g as AuthorizedDocumentHandle, h as AuthorizationPolicy, i as buildGraphqlOperations, l as loadDocumentModels, m as createCanonicalDocumentIdResolver, n as buildGraphQlDriveDocument, o as debounce, p as CanonicalDocumentIdResolutionError, r as buildGraphqlOperation, s as extractUpgradeManifests, t as buildGraphQlDocument, u as loadProcessors, v as AuthEvaluationUnsupportedError, y as ForbiddenError } from "./utils-DeM5P0e8.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
 import { GraphQLError, Kind, parse, print } from "graphql";
-import { DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, PropagationMode as PropagationMode$1, consolidateSyncOperations, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl } from "@powerhousedao/reactor";
+import { AuthEnforcementDisabledError, DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, ModelReadGate, PropagationMode as PropagationMode$1, SyncScopeGate, consolidateSyncOperations, createReactorHostModuleBase, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl, readDecisionModel, syncOperationErrorType } from "@powerhousedao/reactor";
 import { ConsoleLogger, childLogger, documentModelDocumentModelModule } from "document-model";
 import path from "node:path";
 import { match } from "path-to-regexp";
@@ -13,7 +13,7 @@ import { buildSubgraphSchema } from "@apollo/subgraph";
 import { typeDefs } from "@powerhousedao/document-engineering/graphql";
 import { camelCase, kebabCase, pascalCase } from "change-case";
 import { GraphQLJSONObject } from "graphql-type-json";
-import { setName } from "@powerhousedao/shared/document-model";
+import { deserializeSignature, serializeSignature, setName } from "@powerhousedao/shared/document-model";
 import * as z$1 from "zod";
 import { z } from "zod";
 import { createHandler } from "graphql-sse/lib/use/fetch";
@@ -22,11 +22,12 @@ import dotenv from "dotenv";
 import { buildTreeUrl } from "@powerhousedao/shared";
 import { getConfig } from "@powerhousedao/config/node";
 import { reactorDriveDocumentModelModule } from "@powerhousedao/reactor-drive";
+import { ReactorGroupV1 } from "@powerhousedao/reactor-group";
 import { driveDocumentModelModule } from "@powerhousedao/shared/document-drive";
 import EventEmitter from "node:events";
 import fs, { watchFile } from "node:fs";
 import { PostgresAnalyticsStore } from "@powerhousedao/analytics-engine-pg";
-import { AttachmentBuilder } from "@powerhousedao/reactor-attachments";
+import { AttachmentBuilder, AttachmentReferenceIndexBuilder, createRef, createS3AttachmentBackend, parseAttachmentStorageConfig, parseRef } from "@powerhousedao/reactor-attachments";
 import { createAttachmentClient } from "@powerhousedao/reactor-attachments/client";
 import { setupMcpServer } from "@powerhousedao/reactor-mcp";
 import { mkdir } from "node:fs/promises";
@@ -34,7 +35,7 @@ import { tmpdir } from "node:os";
 import { WebSocketServer } from "ws";
 import { createRelationalDb } from "@powerhousedao/shared/processors";
 import { Kysely, Migrator, sql } from "kysely";
-import { fetchDelegationCredential, verifyAuthBearerToken } from "@renown/sdk";
+import { fetchDelegationCredential, resolveSwitchboardEndpoint, verifyAuthBearerToken } from "@renown/sdk";
 import { PGlite } from "@electric-sql/pglite";
 import { AtomicNodeFs } from "@powerhousedao/pglite-fs";
 import knex from "knex";
@@ -305,7 +306,7 @@ function createAuthFetchMiddleware(authService) {
 async function createGatewayAdapter(type, logger) {
 	switch (type) {
 		case "apollo": {
-			const { ApolloGatewayAdapter } = await import("./adapter-gateway-apollo-CxV_hMTv.mjs");
+			const { ApolloGatewayAdapter } = await import("./adapter-gateway-apollo-DKR6jpFf.mjs");
 			return new ApolloGatewayAdapter(logger);
 		}
 		case "mercurius": {
@@ -404,7 +405,7 @@ const buildSubgraphSchemaModule = (documentModels, resolvers, typeDefs) => {
 	};
 };
 const createSchema = (documentModels, resolvers, typeDefs) => {
-	return buildSubgraphSchema(buildSubgraphSchemaModule(documentModels, resolvers, typeDefs));
+	return buildSubgraphSchema([buildSubgraphSchemaModule(documentModels, resolvers, typeDefs)]);
 };
 /**
 * Create a merged GraphQL schema from multiple subgraph modules.
@@ -460,6 +461,7 @@ const getDocumentModelTypeDefs = (documentModels, typeDefs$1) => {
 	});
 	return dedupeTypeDefinitions(gql`
     scalar JSONObject
+    scalar AttachmentRef
     ${typeDefs.join("\n").replaceAll(";", "")}
 
     type PHOperationContext {
@@ -878,6 +880,7 @@ function generateNewApiSchema(documentName, specification, _stateSchemaTypes, pr
 	return gql`
     scalar DateTime
     scalar JSONObject
+    scalar AttachmentRef
 
     ${revisionType}
 
@@ -926,6 +929,11 @@ function generateNewApiSchema(documentName, specification, _stateSchemaTypes, pr
 }
 //#endregion
 //#region src/graphql/reactor/gen/graphql.ts
+let AuthDecision = /* @__PURE__ */ function(AuthDecision) {
+	AuthDecision["Allow"] = "ALLOW";
+	AuthDecision["Deny"] = "DENY";
+	return AuthDecision;
+}({});
 let DocumentChangeType = /* @__PURE__ */ function(DocumentChangeType) {
 	DocumentChangeType["ChildAdded"] = "CHILD_ADDED";
 	DocumentChangeType["ChildRemoved"] = "CHILD_REMOVED";
@@ -948,11 +956,24 @@ let SyncEnvelopeType = /* @__PURE__ */ function(SyncEnvelopeType) {
 }({});
 const isDefinedNonNullAny = (v) => v !== void 0 && v !== null;
 const definedNonNullAnySchema = z$1.any().refine((v) => isDefinedNonNullAny(v));
+const AuthDecisionSchema = z$1.enum(AuthDecision);
 const DocumentChangeTypeSchema = z$1.enum(DocumentChangeType);
 const PropagationModeSchema = z$1.enum(PropagationMode);
 const SyncEnvelopeTypeSchema = z$1.enum(SyncEnvelopeType);
+function ActionCandidateInputSchema() {
+	return z$1.object({
+		input: z$1.custom((v) => v != null).nullish(),
+		scope: z$1.string(),
+		type: z$1.string()
+	});
+}
 function ActionContextInputSchema() {
-	return z$1.object({ signer: z$1.lazy(() => ReactorSignerInputSchema().nullish()) });
+	return z$1.object({
+		nonce: z$1.string().nullish(),
+		prevOpHash: z$1.string().nullish(),
+		prevOpIndex: z$1.number().nullish(),
+		signer: z$1.lazy(() => ReactorSignerInputSchema().nullish())
+	});
 }
 function ActionInputSchema() {
 	return z$1.object({
@@ -989,6 +1010,7 @@ function OperationContextInputSchema() {
 function OperationInputSchema() {
 	return z$1.object({
 		action: z$1.lazy(() => ActionInputSchema()),
+		deniedReason: z$1.string().nullish(),
 		error: z$1.string().nullish(),
 		hash: z$1.string(),
 		id: z$1.string().nullish(),
@@ -1147,6 +1169,7 @@ const GetDocumentWithOperationsDocument = gql`
             hash
             skip
             error
+            deniedReason
             id
             action {
               id
@@ -1259,6 +1282,7 @@ const GetDocumentOperationsDocument = gql`
         hash
         skip
         error
+        deniedReason
         id
         action {
           id
@@ -1301,6 +1325,28 @@ const GetJobStatusDocument = gql`
     }
   }
 `;
+const EvaluateActionsDocument = gql`
+  query EvaluateActions(
+    $documentIdentifier: String!
+    $branch: String
+    $candidates: [ActionCandidateInput!]!
+  ) {
+    evaluateActions(
+      documentIdentifier: $documentIdentifier
+      branch: $branch
+      candidates: $candidates
+    ) {
+      evaluations {
+        decision
+        reason
+      }
+      allAllowed
+      anyAllowed
+      allDenied
+      anyDenied
+    }
+  }
+`;
 const CreateDocumentDocument = gql`
   mutation CreateDocument($document: JSONObject!, $parentIdentifier: String) {
     createDocument(document: $document, parentIdentifier: $parentIdentifier) {
@@ -1326,13 +1372,13 @@ const CreateEmptyDocumentDocument = gql`
 const MutateDocumentDocument = gql`
   mutation MutateDocument(
     $documentIdentifier: String!
-    $actions: [JSONObject!]!
-    $view: ViewFilterInput
+    $actions: [ActionInput!]!
+    $branch: String
   ) {
-    mutateDocument(
+    mutateDocument: execute(
       documentIdentifier: $documentIdentifier
       actions: $actions
-      view: $view
+      branch: $branch
     ) {
       ...PHDocumentFields
     }
@@ -1342,14 +1388,21 @@ const MutateDocumentDocument = gql`
 const MutateDocumentAsyncDocument = gql`
   mutation MutateDocumentAsync(
     $documentIdentifier: String!
-    $actions: [JSONObject!]!
-    $view: ViewFilterInput
+    $actions: [ActionInput!]!
+    $branch: String
   ) {
-    mutateDocumentAsync(
+    mutateDocumentAsync: executeAsync(
       documentIdentifier: $documentIdentifier
       actions: $actions
-      view: $view
-    )
+      branch: $branch
+    ) {
+      id
+      status
+      result
+      error
+      createdAt
+      completedAt
+    }
   }
 `;
 const RenameDocumentDocument = gql`
@@ -1509,6 +1562,7 @@ const PollSyncEnvelopesDocument = gql`
             hash
             skip
             error
+            deniedReason
             id
             action {
               id
@@ -1551,6 +1605,7 @@ const PollSyncEnvelopesDocument = gql`
       deadLetters {
         documentId
         error
+        errorType
       }
       hasMore
     }
@@ -1595,6 +1650,9 @@ function getSdk(requester) {
 		GetJobStatus(variables, options) {
 			return requester(GetJobStatusDocument, variables, options);
 		},
+		EvaluateActions(variables, options) {
+			return requester(EvaluateActionsDocument, variables, options);
+		},
 		CreateDocument(variables, options) {
 			return requester(CreateDocumentDocument, variables, options);
 		},
@@ -1745,28 +1803,132 @@ function toReactorPropagationMode(gqlMode) {
 	}
 }
 /**
+* Maps one predicted verdict to its GraphQL shape. A refusal's reason is the
+* consensus string the reactor would record for it, carried through verbatim so
+* a client can tell a deletion refusal from a missing grant; an allow has none.
+*/
+function toGqlActionEvaluation(evaluation) {
+	return evaluation.decision === "allow" ? {
+		decision: AuthDecision.Allow,
+		reason: null
+	} : {
+		decision: AuthDecision.Deny,
+		reason: evaluation.reason
+	};
+}
+/**
 * Converts readonly arrays to mutable arrays for ReactorClient
 */
 function toMutableArray(arr) {
 	return arr ? [...arr] : void 0;
 }
 /**
-* Validates that a JSONObject represents a valid Action structure
+* Validates that an incoming value has the structure of an Action.
+*
+* This is the whole guard on the way in. `mutateDocument` takes untyped JSON, so
+* nothing has checked these fields before a resolver runs, and the id in
+* particular has to be checked here: it is hashed into the operation id and
+* replay dedupes by it, so an action without one is stored under an operation id
+* shared by every id-less operation on the same document, scope and branch.
+*
+* The storage constraint would refuse such a row anyway, but only after a job
+* has been enqueued and failed. Refusing here answers the caller instead.
 */
 function validateActionStructure(obj) {
 	if (!obj || typeof obj !== "object") return false;
 	const action = obj;
+	if (typeof action.id !== "string" || !action.id) return false;
 	if (typeof action.type !== "string" || !action.type) return false;
 	if (typeof action.scope !== "string" || !action.scope) return false;
+	if (typeof action.timestampUtcMs !== "string" || !action.timestampUtcMs) return false;
 	if (!("input" in action)) return false;
 	return true;
 }
 /**
+* Restores an action's signatures to the tuples verification reads.
+*
+* A signature is a five-param tuple, and GraphQL declares `signatures` as a
+* list of strings, so a client joins each one for transport. The sync path
+* already splits them on arrival; this is the same step for the mutation path,
+* which had none - an action submitted there kept whatever shape it arrived in,
+* so the same signature was persisted as a tuple or as one joined string
+* depending on which door it came through.
+*
+* A tuple passes through untouched, so an in-process caller handing over real
+* signatures is unaffected.
+*/
+function withDeserializedSignatures(action) {
+	const signer = action.context?.signer;
+	if (!signer?.signatures || signer.signatures.length === 0) return action;
+	return {
+		...action,
+		context: {
+			...action.context,
+			signer: {
+				...signer,
+				signatures: signer.signatures.map(deserializeSignature)
+			}
+		}
+	};
+}
+/**
+* Converts actions the schema has already coerced into the actions the reactor
+* applies.
+*
+* The one conversion the schema cannot express is the signature: GraphQL
+* declares `signatures` as a list of strings, not of lists, so each arrives
+* joined and has to be read back as the tuple verification indexes into.
+*
+* Nothing is validated here. `ActionInput` states every field the reactor needs,
+* so anything that reached this point has them - unlike the untyped path, which
+* has to check by hand.
+*/
+function toSubmittableActions(actions) {
+	return actions.map((action) => {
+		const context = toSubmittableContext(action.context);
+		const submittable = {
+			id: action.id,
+			type: action.type,
+			timestampUtcMs: action.timestampUtcMs,
+			input: action.input,
+			scope: action.scope
+		};
+		return context ? {
+			...submittable,
+			context
+		} : submittable;
+	});
+}
+/**
+* `ReactorSignerInput` leaves `user` and `app` optional where `ActionSigner`
+* requires them, so an incomplete signer cannot be represented. It is carried
+* through as it arrived rather than filled in: the signature verifier is what
+* should refuse it, and inventing either field here would be inventing the part
+* that says who signed.
+*/
+function toSubmittableContext(context) {
+	if (!context) return;
+	const submittable = {};
+	const prevOpIndex = fromInputMaybe(context.prevOpIndex);
+	if (prevOpIndex !== void 0) submittable.prevOpIndex = prevOpIndex;
+	const prevOpHash = fromInputMaybe(context.prevOpHash);
+	if (prevOpHash !== void 0) submittable.prevOpHash = prevOpHash;
+	const nonce = fromInputMaybe(context.nonce);
+	if (nonce !== void 0) submittable.nonce = nonce;
+	const signer = fromInputMaybe(context.signer);
+	if (signer) submittable.signer = {
+		user: fromInputMaybe(signer.user),
+		app: fromInputMaybe(signer.app),
+		signatures: signer.signatures.map(deserializeSignature)
+	};
+	return Object.keys(submittable).length > 0 ? submittable : void 0;
+}
+/**
 * Converts a JSONObject to an Action, validating basic structure
 */
 function jsonObjectToAction(obj) {
-	if (!validateActionStructure(obj)) throw new GraphQLError("Invalid action structure. Actions must have: type (string), scope (string), and input (any)");
-	return obj;
+	if (!validateActionStructure(obj)) throw new GraphQLError("Invalid action structure. Actions must have: id (string), type (string), scope (string), timestampUtcMs (string), and input (any)");
+	return withDeserializedSignatures(obj);
 }
 /**
 * Validates a list of actions by converting them from JSON and checking structure
@@ -1780,10 +1942,57 @@ function validateActions(actions) {
 	}
 	return convertedActions;
 }
+/** The operation fields the schema declares non-null. */
+const REQUIRED_OPERATION_FIELDS = [
+	"index",
+	"timestampUtcMs",
+	"hash",
+	"skip"
+];
+/** The action fields the schema declares non-null. */
+const REQUIRED_ACTION_FIELDS = [
+	"id",
+	"type",
+	"timestampUtcMs",
+	"input",
+	"scope"
+];
+/**
+* Names an operation well enough to find the row it came from, without assuming
+* the fields that might be the missing ones.
+*/
+function describeOperation(stored) {
+	const parts = [typeof stored.id === "string" && stored.id ? `operation ${stored.id}` : "operation with no id"];
+	if (typeof stored.index === "number") parts.push(`index ${stored.index}`);
+	const scope = stored.action?.scope;
+	if (typeof scope === "string" && scope) parts.push(`scope ${scope}`);
+	return parts.join(", ");
+}
+/**
+* Refuses an operation the schema cannot represent, naming the field.
+*
+* The alternative is what execution does unaided: nullify the field, bubble that
+* up the non-null chain until it takes out the envelope's whole operation list,
+* and report a bare "Cannot return null for non-nullable field" with no way to
+* tell which of a hundred operations was at fault. Checked before the response
+* is built so the failure is typed and attributable.
+*
+* Presence is all that is checked. The schema's own serialization still rejects
+* a value of the wrong type, and inventing further rules here would put a second
+* contract beside the one the schema already states.
+*/
+function assertServable(operation) {
+	const stored = operation;
+	for (const field of REQUIRED_OPERATION_FIELDS) if (stored[field] === void 0 || stored[field] === null) throw new MalformedStoredOperationError(`${describeOperation(stored)} has no ${field}`);
+	const action = stored.action;
+	if (action === void 0 || action === null) throw new MalformedStoredOperationError(`${describeOperation(stored)} has no action`);
+	for (const field of REQUIRED_ACTION_FIELDS) if (action[field] === void 0 || action[field] === null) throw new MalformedStoredOperationError(`${describeOperation(stored)} has an action with no ${field}`);
+}
 /**
 * Transforms an operation to serialize signatures from tuples to strings for GraphQL compatibility.
 */
 function serializeOperationForGraphQL(operation) {
+	assertServable(operation);
 	const signer = operation.action.context?.signer;
 	if (!signer?.signatures) return operation;
 	return {
@@ -1794,7 +2003,7 @@ function serializeOperationForGraphQL(operation) {
 				...operation.action.context,
 				signer: {
 					...signer,
-					signatures: signer.signatures.map((sig) => Array.isArray(sig) ? sig.join(", ") : sig)
+					signatures: signer.signatures.map(serializeSignature)
 				}
 			}
 		}
@@ -1904,9 +2113,10 @@ async function documentModels(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert document models to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function document(reactorClient, args) {
-	let view;
+async function document(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -1931,9 +2141,10 @@ async function document(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function documentOutgoingRelationships(reactorClient, args) {
-	let view;
+async function documentOutgoingRelationships(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -1958,9 +2169,10 @@ async function documentOutgoingRelationships(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert outgoing relationships to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function documentIncomingRelationships(reactorClient, args) {
-	let view;
+async function documentIncomingRelationships(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -1985,9 +2197,10 @@ async function documentIncomingRelationships(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert incoming relationships to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function findDocuments(reactorClient, args) {
-	let view;
+async function findDocuments(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -2029,11 +2242,12 @@ async function jobStatus(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert job status to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function documentOperations(reactorClient, args) {
-	let view;
+async function documentOperations(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	const branch = fromInputMaybe(args.filter.branch);
 	const scopes = toMutableArray(fromInputMaybe(args.filter.scopes));
 	if (branch || scopes) view = {
+		subject,
 		branch,
 		scopes
 	};
@@ -2069,6 +2283,41 @@ async function documentOperations(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert operations to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
+/**
+* Predicts the admission verdict for each candidate operation, deciding against
+* the document policy through the reactor's own decision model.
+*
+* The subject is supplied by the subgraph from the authenticated request, never
+* by the caller: answering for an arbitrary subject would disclose what a policy
+* grants somebody else. It carries the caller's address and the app key their
+* token authenticated with, which is the same pair a signed action presents, so
+* a grant naming either matches here exactly as it would at admission.
+*
+* A reactor without authEnforcement raises the named error, which becomes an
+* "unsupported" code rather than a denial.
+*/
+async function evaluateActions(reactorClient, args, subject) {
+	const branch = fromInputMaybe(args.branch) ?? "main";
+	const candidates = args.candidates.map((candidate) => ({
+		scope: candidate.scope,
+		type: candidate.type,
+		input: fromInputMaybe(candidate.input)
+	}));
+	let result;
+	try {
+		result = await reactorClient.evaluateActions(args.documentIdentifier, branch, candidates, subject);
+	} catch (error) {
+		if (AuthEnforcementDisabledError.isError(error)) throw new AuthEvaluationUnsupportedError();
+		throw new GraphQLError(`Failed to evaluate actions: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+	return {
+		evaluations: result.evaluations.map(toGqlActionEvaluation),
+		allAllowed: result.allAllowed,
+		anyAllowed: result.anyAllowed,
+		allDenied: result.allDenied,
+		anyDenied: result.anyDenied
+	};
+}
 async function createDocument(reactorClient, args, reactorDriveClient) {
 	if (!args.document || typeof args.document !== "object") throw new GraphQLError("Invalid document: must be an object");
 	const document = args.document;
@@ -2167,6 +2416,49 @@ async function createDocumentWithInitialState(reactorClient, args, reactorDriveC
 		throw new GraphQLError(`Failed to convert created document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
+/** The branch a mutation applies to when the caller names none. */
+const DEFAULT_BRANCH = "main";
+/**
+* Applies actions to a document and waits for the result.
+*
+* The wire form of `IReactorClient.execute`, and named for it. Takes the actions
+* already coerced against `ActionInput`, so the only conversion left is the one
+* the schema cannot express: a signature travels as one string, and verification
+* reads it as the tuple it was.
+*/
+async function execute(reactorClient, args) {
+	const actions = toSubmittableActions(args.actions);
+	const branch = fromInputMaybe(args.branch) ?? DEFAULT_BRANCH;
+	let result;
+	try {
+		result = await reactorClient.execute(args.documentIdentifier, branch, actions);
+	} catch (error) {
+		throw new GraphQLError(`Failed to execute actions: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+	try {
+		return toGqlPhDocument(result);
+	} catch (error) {
+		throw new GraphQLError(`Failed to convert executed document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+}
+/**
+* Submits actions to a document and returns the job that will apply them.
+*
+* Returns the job rather than only its id, matching
+* `IReactorClient.executeAsync`. A job handed back from a submission has no
+* result yet, which is why `JobInfo.result` is nullable.
+*/
+async function executeAsync(reactorClient, args) {
+	const actions = toSubmittableActions(args.actions);
+	const branch = fromInputMaybe(args.branch) ?? DEFAULT_BRANCH;
+	let job;
+	try {
+		job = await reactorClient.executeAsync(args.documentIdentifier, branch, actions);
+	} catch (error) {
+		throw new GraphQLError(`Failed to submit actions: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+	return toGqlJobInfo(job);
+}
 async function mutateDocument(reactorClient, args) {
 	let validatedActions;
 	try {
@@ -2300,7 +2592,14 @@ async function deleteDocuments(reactorClient, args) {
 		throw new GraphQLError(`Failed to delete documents: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function touchChannel(syncManager, args) {
+/**
+* Registers a sync channel, or reports the state of one already registered.
+*
+* `boundAddress` claims a channel at creation for the subject that created it.
+* An anonymously created channel is left unbound, which is not a permission but
+* an unanswered question: the first authenticated subject to use it adopts it.
+*/
+async function touchChannel(syncManager, args, boundAddress) {
 	try {
 		return {
 			success: true,
@@ -2312,7 +2611,10 @@ async function touchChannel(syncManager, args) {
 		scope: [...args.input.filter.scope],
 		branch: args.input.filter.branch
 	};
-	const options = { sinceTimestampUtcMs: args.input.sinceTimestampUtcMs };
+	const options = {
+		sinceTimestampUtcMs: args.input.sinceTimestampUtcMs,
+		boundAddress
+	};
 	try {
 		await syncManager.add(args.input.name, DriveCollectionId.fromKey(args.input.collectionId), {
 			type: "polling",
@@ -2327,9 +2629,50 @@ async function touchChannel(syncManager, args) {
 	};
 }
 /**
+* The sync operations in `syncOps` this subject may not be served.
+*
+* A sync operation is one document, one branch and (from the outbox) one scope,
+* so the answer is per entry rather than per operation: an entry is withheld
+* whole or served whole, which is what keeps a scope's operation sequence
+* unbroken for whoever does receive it. A dead letter can name several scopes,
+* and is withheld only when the policy serves none of them -- the metadata
+* scopes are readable by every holder, so in practice a dead letter naming one
+* is always served.
+*
+* The policy is read once per document and branch, and the memo lives no longer
+* than this call: a poll must not answer from a policy that changed between
+* polls, since the widening case is exactly the one holding exists to serve.
+*
+* A read that fails for any reason other than the document being absent is
+* allowed to propagate. The poll then fails, the puller retries, and nothing is
+* served in the meantime -- which is the safe direction, and a visible one.
+*/
+async function collectHeldSyncOperations(syncOps, gate, subject, signal) {
+	const held = /* @__PURE__ */ new Set();
+	const predicates = /* @__PURE__ */ new Map();
+	for (const syncOp of syncOps) {
+		const key = `${syncOp.documentId}\u0000${syncOp.branch}`;
+		let predicate = predicates.get(key);
+		if (!predicate) {
+			predicate = gate.scopePredicateById(syncOp.documentId, subject, syncOp.branch, signal);
+			predicates.set(key, predicate);
+		}
+		const readable = await predicate;
+		if (!syncOp.scopes.some((scope) => readable(scope))) held.add(syncOp.id);
+	}
+	return held;
+}
+/**
 * Polls the switchboard for new sync envelopes and acknowledges previously
 * received operations.
 *
+* `forbiddenIds` and `heldOpIds` are two different refusals. A forbidden
+* document is consumed: its delivery counters are advanced as though it had
+* been sent, so it is never reconsidered. A held sync operation is withheld:
+* nothing about it is touched, so a policy that later widens serves it whole on
+* a subsequent poll. Which one applies is the caller's decision, and the two
+* are intersected, so a document refused either way is not served.
+*
 * Ordinal frames of reference:
 * - `outboxAck` / `outboxLatest`: switchboard's ordinals (used to trim/filter
 *   the switchboard's outbox)
@@ -2337,16 +2680,17 @@ async function touchChannel(syncManager, args) {
 *   client ordinal the switchboard has successfully applied, so the client
 *   can trim its own outbox)
 */
-function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new Set()) {
+function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new Set(), heldOpIds = /* @__PURE__ */ new Set()) {
 	let remote;
 	try {
 		remote = syncManager.getById(args.channelId);
 	} catch (error) {
 		throw new GraphQLError(`Channel not found: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
-	const deadLetters = remote.channel.deadLetter.items.filter((syncOp) => !forbiddenIds.has(syncOp.documentId)).map((syncOp) => ({
+	const deadLetters = remote.channel.deadLetter.items.filter((syncOp) => !forbiddenIds.has(syncOp.documentId) && !heldOpIds.has(syncOp.id)).map((syncOp) => ({
 		documentId: syncOp.documentId,
 		error: syncOp.error?.message ?? "Unknown error",
+		errorType: syncOperationErrorType(syncOp.error),
 		jobId: syncOp.jobId,
 		branch: syncOp.branch,
 		scopes: syncOp.scopes,
@@ -2392,6 +2736,7 @@ function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new
 			hasMore = true;
 			break;
 		}
+		if (heldOpIds.has(syncOp.id)) continue;
 		syncOp.deliveredCount ??= 0;
 		syncOp.emittedCount ??= 0;
 		while (syncOp.deliveredCount < syncOp.emittedCount && syncOp.operations[syncOp.deliveredCount].context.ordinal <= args.outboxLatest) syncOp.deliveredCount += 1;
@@ -2875,6 +3220,9 @@ var GraphQLManager = class {
 	/** Cached document models for schema generation - updated on init and regenerate */
 	cachedDocumentModels = [];
 	subgraphHandlerCache = /* @__PURE__ */ new Map();
+	/** Per-subgraph handlers by name, before auth/drive middleware is applied,
+	* for in-process queries by trusted internals. */
+	#internalSubgraphHandlers = /* @__PURE__ */ new Map();
 	/**
 	* Optional reactor-drive client. When the switchboard is configured with a
 	* reactor-drive container, this is provided and the resolvers dispatch to
@@ -2882,7 +3230,7 @@ var GraphQLManager = class {
 	*/
 	reactorDriveClient;
 	authorizationService;
-	constructor(path, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, logger, httpAdapter, gatewayAdapter, authService, documentPermissionService, featureFlags = DefaultFeatureFlags, port = 4001, authorizationService, reactorDriveClient) {
+	constructor(path, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, logger, httpAdapter, gatewayAdapter, authService, documentPermissionService, featureFlags = DefaultFeatureFlags, port = 4001, authorizationService, reactorDriveClient, syncServingGate) {
 		this.path = path;
 		this.httpServer = httpServer;
 		this.wsServer = wsServer;
@@ -2897,6 +3245,7 @@ var GraphQLManager = class {
 		this.documentPermissionService = documentPermissionService;
 		this.featureFlags = featureFlags;
 		this.port = port;
+		this.syncServingGate = syncServingGate;
 		if (!authorizationService) throw new Error("GraphQLManager requires an authorizationService");
 		this.authorizationService = authorizationService;
 		this.reactorDriveClient = reactorDriveClient;
@@ -2914,7 +3263,7 @@ var GraphQLManager = class {
 		if (!models.find((it) => it.documentModel.global.name === "DocumentDrive")) throw new Error("DocumentDrive model required");
 		await this.gatewayAdapter.start(this.httpServer);
 		this.httpAdapter.setupMiddleware({ bodyLimit: "50mb" });
-		const driveRoutePath = path.join(this.path, "d/:drive");
+		const driveRoutePath = path.posix.join(this.path, "d/:drive");
 		const driveMatcher = match(driveRoutePath);
 		this.httpAdapter.mount(driveRoutePath, async (request) => {
 			const url = new URL(request.url);
@@ -2982,7 +3331,8 @@ var GraphQLManager = class {
 					syncManager: this.syncManager,
 					path: this.path,
 					documentPermissionService: this.documentPermissionService,
-					authorizationService: this.authorizationService
+					authorizationService: this.authorizationService,
+					syncServingGate: this.syncServingGate
 				});
 				await this.#addSubgraphInstance(subgraphInstance, supergraph, false);
 			} catch (error) {
@@ -3036,10 +3386,49 @@ var GraphQLManager = class {
 			syncManager: this.syncManager,
 			path: this.path,
 			documentPermissionService: this.documentPermissionService,
-			authorizationService: this.authorizationService
+			authorizationService: this.authorizationService,
+			syncServingGate: this.syncServingGate
 		});
 		return this.#addSubgraphInstance(subgraphInstance, supergraph, core);
 	}
+	/** Find a registered subgraph by name, core or package-contributed. */
+	getSubgraphByName(name) {
+		for (const subgraphs of [...this.coreSubgraphsMap.values(), ...this.subgraphs.values()]) {
+			const found = subgraphs.find((subgraph) => subgraph.name === name);
+			if (found) return found;
+		}
+	}
+	/** Whether a registered subgraph has a live handler, i.e. whether
+	* {@link executeSubgraphQuery} can reach it right now. */
+	hasSubgraphHandler(name) {
+		return this.#internalSubgraphHandlers.has(name);
+	}
+	/** Run a query against one registered subgraph in-process: the subgraph's own
+	* handler, without a socket or the auth/drive middleware. Trusted callers. */
+	async executeSubgraphQuery(subgraphName, query, variables) {
+		const entry = this.#internalSubgraphHandlers.get(subgraphName);
+		if (!entry) throw new Error(this.getSubgraphByName(subgraphName) ? `Subgraph "${subgraphName}" is registered but has no handler yet` : `Subgraph "${subgraphName}" is not registered`);
+		const url = new URL(entry.path, `http://localhost:${this.port}/`);
+		const response = await entry.handler(new Request(url, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				accept: "application/json"
+			},
+			body: JSON.stringify({
+				query,
+				variables
+			})
+		}));
+		if (!response.ok) {
+			const detail = await response.text().catch(() => "");
+			throw new Error(`Subgraph "${subgraphName}" query failed: ${response.status}${detail ? ` ${detail}` : ""}`);
+		}
+		const body = await response.json();
+		if (body.errors?.length) throw new Error(body.errors.map((error) => error.message).join("; "));
+		if (!body.data) throw new Error(`Subgraph "${subgraphName}" returned no data`);
+		return body.data;
+	}
 	updateRouter = debounce(this._updateRouter.bind(this), 1e3);
 	async _updateRouter() {
 		this.logger.debug("Updating router");
@@ -3050,7 +3439,7 @@ var GraphQLManager = class {
 		} catch (error) {
 			this.logger.error("Failed to update Apollo Gateway supergraph: @error", error);
 		}
-		const superGraphPath = path.join(this.path, "graphql");
+		const superGraphPath = path.posix.join(this.path, "graphql");
 		this.#setupSupergraphSSE(superGraphPath);
 	}
 	getAdditionalContextFields = () => {
@@ -3113,7 +3502,21 @@ var GraphQLManager = class {
 		});
 	}
 	#getSubgraphPath(subgraph, supergraph) {
-		return path.join(subgraph.path ?? "", supergraph, subgraph.name);
+		return path.posix.join(subgraph.path ?? "", supergraph, subgraph.name);
+	}
+	/** The in-process handler map is keyed by bare name, so two distinct
+	* subgraphs sharing one name would shadow each other: keep the first. */
+	#setInternalSubgraphHandler(subgraph, subgraphPath, handler) {
+		const existing = this.#internalSubgraphHandlers.get(subgraph.name);
+		if (existing && existing.subgraph !== subgraph) {
+			this.logger.warn("Two subgraphs are named @name (@kept and @ignored); in-process queries keep the first", subgraph.name, existing.path, subgraphPath);
+			return;
+		}
+		this.#internalSubgraphHandlers.set(subgraph.name, {
+			subgraph,
+			path: subgraphPath,
+			handler
+		});
 	}
 	async #setupSubgraphs(subgraphsMap) {
 		for (const [supergraph, subgraphs] of subgraphsMap.entries()) for (const subgraph of subgraphs) {
@@ -3125,6 +3528,7 @@ var GraphQLManager = class {
 				const rawHandler = await this.gatewayAdapter.createHandler(schema, this.#makeContextFactory());
 				const fetchHandler = this.#composeFetchMiddleware(rawHandler);
 				this.subgraphHandlerCache.set(subgraphPath, fetchHandler);
+				this.#setInternalSubgraphHandler(subgraph, subgraphPath, rawHandler);
 				this.httpAdapter.mount(subgraphPath, fetchHandler);
 				if (subgraph.hasSubscriptions) {
 					try {
@@ -3171,7 +3575,7 @@ var GraphQLManager = class {
 		}));
 	}
 	async #createSupergraphGateway() {
-		const superGraphPath = path.join(this.path, "graphql");
+		const superGraphPath = path.posix.join(this.path, "graphql");
 		const rawHandler = await this.gatewayAdapter.createSupergraphHandler(() => this.#getSubgraphDefinitions(), this.httpServer, this.#makeContextFactory());
 		const fetchHandler = this.#composeFetchMiddleware(rawHandler);
 		this.httpAdapter.mount(superGraphPath, fetchHandler);
@@ -3536,6 +3940,17 @@ const DocumentChangeEventDTO = z.object({
 	documents: z.array(PHDocumentDTO),
 	context: DocumentChangeContextDTO.nullable().optional()
 }).strip();
+const ActionEvaluationDTO = z.object({
+	decision: z.enum(["ALLOW", "DENY"]),
+	reason: z.string().nullable().optional()
+}).strip();
+const ActionEvaluationsDTO = z.object({
+	evaluations: z.array(ActionEvaluationDTO),
+	allAllowed: z.boolean(),
+	anyAllowed: z.boolean(),
+	allDenied: z.boolean(),
+	anyDenied: z.boolean()
+}).strip();
 const JobChangeEventDTO = z.object({
 	jobId: z.string(),
 	status: z.string(),
@@ -3569,6 +3984,9 @@ const operationValidators = {
 	GetJobStatus: (data) => {
 		if (data.jobStatus) JobInfoDTO.parse(data.jobStatus);
 	},
+	EvaluateActions: (data) => {
+		if (data.evaluateActions) ActionEvaluationsDTO.parse(data.evaluateActions);
+	},
 	CreateDocument: (data) => {
 		if (data.createDocument) PHDocumentDTO.parse(data.createDocument);
 	},
@@ -3631,7 +4049,7 @@ function createReactorGraphQLClient(url, fetchImpl = fetch, headers) {
 }
 //#endregion
 //#region src/graphql/reactor/schema.graphql
-var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n  result: JSONObject!\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n  result: JSONObject!\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n# Input types for sync operations\ninput ActionContextInput {\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  # Poll for sync envelopes from a channel\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
+var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  \"\"\"\n  How the origin classified the failure. A peer needs this to mirror the origin's\n  quarantine decision; without it a held auth operation would freeze the document\n  on the peer side while the origin kept syncing.\n  \"\"\"\n  errorType: String\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Null until then, which\n  is the state every job is in when it is handed back from a submission.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n  result: JSONObject!\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n\"\"\"\nOne operation an authorization preflight predicts a verdict for.\n\n`input` is what a conditional grant reads, so a candidate standing for a\nfilled-in form carries that form's input. Omitting it predicts the verdict an\nempty input earns, not the verdict the filled-in form will get.\n\"\"\"\ninput ActionCandidateInput {\n  scope: String!\n  type: String!\n  input: JSONObject\n}\n\nenum AuthDecision {\n  ALLOW\n  DENY\n}\n\n\"\"\"\nOne candidate's predicted verdict. `reason` carries the refusal a DENY is\nrecorded with, and is null on an ALLOW.\n\"\"\"\ntype ActionEvaluation {\n  decision: AuthDecision!\n  reason: String\n}\n\n\"\"\"\nThe predicted verdicts for a set of candidates, in the order they were given,\nwith the aggregates a caller branches on.\n\nThe aggregates are redundant -- a verdict is binary -- and all four are returned\nso a caller reads the one its question is phrased in rather than negating\nanother. Over no candidates every aggregate is false: nothing is allowed and\nnothing is denied.\n\"\"\"\ntype ActionEvaluations {\n  evaluations: [ActionEvaluation!]!\n  allAllowed: Boolean!\n  anyAllowed: Boolean!\n  allDenied: Boolean!\n  anyDenied: Boolean!\n}\n\n# Input types for sync operations\n\"\"\"\nAn action's context, as a caller submits it.\n\nDeclares every field `ActionContext` carries, because an input object rejects a\nfield it does not declare: an action stamped with the head it applies to - which\nis what a signing client sends - is refused outright if these are missing, and\nthat refusal is a whole-request one, not a per-field one.\n\n`prevOpHash` and `prevOpIndex` are the scope head the action was composed\nagainst. They are recorded rather than enforced; a signature is verified from\nthe params carried in its own tuple, which do not include them.\n\"\"\"\ninput ActionContextInput {\n  \"\"\"The index of the last operation in the scope the action applies to.\"\"\"\n  prevOpIndex: Int\n\n  \"\"\"The hash of the state the action applies to.\"\"\"\n  prevOpHash: String\n\n  \"\"\"Covers replay of an operation that would otherwise be a no-op.\"\"\"\n  nonce: String\n\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  \"\"\"\n  Predicts whether the calling subject would be admitted to execute each of a\n  set of candidate operations, without submitting any of them. A UI asks this to\n  disable a control rather than offer an action that fails on submit.\n\n  The answer is a prediction, not a promise:\n\n  - Real admission compiles an append condition over everything it read and the\n    store enforces it at write time. A preflight reads no future, so a policy\n    change landing between this answer and the submit changes the verdict. The\n    submit path stays the only authority.\n  - The verdict is evaluated at the stream heads, so it is correct for a\n    candidate about to be submitted. A backdated submission is out of contract;\n    the reactor decides that one by position.\n  - A candidate whose verdict depends on its input has to carry that input, since\n    a conditional grant reads it.\n\n  The subject is the authenticated caller and cannot be named in the request:\n  answering for an arbitrary subject would disclose what a policy grants\n  somebody else. It carries both the caller's address and the did:key of the app\n  instance whose token authenticated the request, so a policy naming either\n  matches the same principal the write path presents.\n\n  Requires the reactor's authEnforcement feature flag. Without it the reactor\n  holds no decision model, so this fails with extensions.code\n  AUTH_EVALUATION_UNSUPPORTED rather than guessing.\n  \"\"\"\n  evaluateActions(\n    documentIdentifier: String!\n    branch: String\n    candidates: [ActionCandidateInput!]!\n  ): ActionEvaluations!\n\n  \"\"\"\n  Polls for sync envelopes from a channel.\n\n  An operation stored before the API required an action id cannot be\n  represented by this schema, and rather than serving a partial response beside\n  a bare non-null violation, this fails with extensions.code\n  MALFORMED_STORED_OPERATION naming the operation. That code means the failure\n  is worth polling through: the document holding the operation needs repairing,\n  but the channel serves every other document, and a peer that stopped polling\n  would stop receiving those too.\n  \"\"\"\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  \"\"\"\n  Applies actions to a document and waits for the result.\n\n  Each action is coerced against `ActionInput`, so one missing a field the wire\n  declares is refused before any work starts. The id in particular: it is hashed\n  into the operation id and replay dedupes by it, so an action without one is\n  stored under an operation id shared by every id-less operation on the same\n  document, scope and branch.\n\n  Named for `IReactorClient.execute`, which this is the wire form of. `branch`\n  defaults to `main`.\n  \"\"\"\n  execute(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): PHDocument!\n\n  \"\"\"\n  Submits actions to a document and returns the job that will apply them.\n\n  Coerced exactly as `execute` is, so a malformed action is refused here rather\n  than surfacing later as a failed job. Returns the job rather than only its id,\n  so a caller has the status and the creation time it would otherwise have to\n  ask for; `result` is null until the job produces one.\n  \"\"\"\n  executeAsync(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): JobInfo!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n    @deprecated(\n      reason: \"Use execute. Actions here are untyped, so a malformed one is refused by a hand-written check rather than by the schema, and `view.scopes` is accepted but ignored.\"\n    )\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n    @deprecated(\n      reason: \"Use executeAsync, which is typed and returns the job rather than only its id.\"\n    )\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
 //#endregion
 //#region src/graphql/reactor/pubsub.ts
 const pubSub = new PubSub();
@@ -3769,6 +4187,46 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			if (!await this.canReadDocument(documentId, ctx)) forbidden.add(documentId);
 		}
 	}
+	/**
+	* Enforces which subject a sync channel answers to, adopting an unclaimed one.
+	*
+	* A channel is a private queue: it names a collection, and it accumulates
+	* exactly the operations one subject is owed, so serving it to a second
+	* subject would hand over that subject's cursor as well as its contents. An
+	* unbound channel -- created anonymously, or created before binding existed --
+	* is claimed by the first authenticated subject to use it, and answers to that
+	* address alone thereafter. Adoption is safe precisely because serving
+	* withholds rather than consumes: before it was claimed the channel served
+	* only what an anonymous subject may read, and everything withheld is still
+	* queued for the adopter.
+	*
+	* The refusal is the shape a read denial takes, so a puller treats it as a
+	* signal to authenticate again rather than as a transport failure.
+	*
+	* Nothing is enforced or adopted without a serving gate. Below
+	* `authEnforcement` there is no policy being enforced for the channel to
+	* belong to, and refusing a poll there would break sync for no gain.
+	*/
+	async #bindOrRefuseChannel(channelId, ctx) {
+		if (!this.syncServingGate) return;
+		let remote;
+		try {
+			remote = this.syncManager.getById(channelId);
+		} catch {
+			return;
+		}
+		const bound = remote.meta.options.boundAddress;
+		const address = ctx.user?.address;
+		if (bound === void 0) {
+			if (address !== void 0) await this.syncManager.bindRemote(channelId, address);
+			return;
+		}
+		if (bound !== address) throw new ForbiddenError("to poll this sync channel");
+	}
+	/** The address a channel created by this request belongs to, if any. */
+	#creatorBinding(ctx) {
+		return this.syncServingGate ? ctx.user?.address : void 0;
+	}
 	typeDefs = gql(schema_default);
 	resolvers = {
 		PHDocument: { operations: async (parent, args, ctx) => {
@@ -3787,7 +4245,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 				return await documentOperations(this.reactorClient, {
 					filter,
 					paging: args.paging
-				});
+				}, this.viewSubject(ctx));
 			} catch (error) {
 				this.logger.error("Error in PHDocument.operations: @Error", error);
 				throw error;
@@ -3810,7 +4268,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await document(this.reactorClient, {
 						...args,
 						identifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in document: @Error", error);
 					throw error;
@@ -3823,7 +4281,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await documentOutgoingRelationships(this.reactorClient, {
 						...args,
 						sourceIdentifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in documentOutgoingRelationships: @Error", error);
 					throw error;
@@ -3836,7 +4294,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					const result = await documentIncomingRelationships(this.reactorClient, {
 						...args,
 						targetIdentifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
@@ -3857,7 +4315,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					const result = await findDocuments(this.reactorClient, {
 						...args,
 						search: args.search ?? {}
-					});
+					}, this.viewSubject(ctx));
 					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
@@ -3891,12 +4349,25 @@ var ReactorSubgraph = class extends BaseSubgraph {
 							...args.filter,
 							documentId: handle.fetchIdentifier
 						}
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in documentOperations: @Error", error);
 					throw error;
 				}
 			},
+			evaluateActions: async (_parent, args, ctx) => {
+				this.logger.debug("evaluateActions(@args)", args);
+				try {
+					const handle = await this.assertCanRead(args.documentIdentifier, ctx);
+					return await evaluateActions(this.reactorClient, {
+						...args,
+						documentIdentifier: handle.fetchIdentifier
+					}, this.viewSubject(ctx));
+				} catch (error) {
+					this.logger.error("Error in evaluateActions: @Error", error);
+					throw error;
+				}
+			},
 			pollSyncEnvelopes: async (_parent, args, ctx) => {
 				this.logger.debug("pollSyncEnvelopes(@args)", args);
 				try {
@@ -3909,12 +4380,14 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					const driveId = remote.meta.collectionId.driveId;
 					const isAdmin = this.authorizationService.isSupremeAdmin(ctx.user?.address);
 					if (!isAdmin) await this.assertCanReadCanonical(driveId, ctx);
+					await this.#bindOrRefuseChannel(args.channelId, ctx);
 					const forbiddenIds = /* @__PURE__ */ new Set();
 					if (!isAdmin) {
 						if (await this.authorizationService.canRead(driveId, void 0)) await this.#collectForbiddenDocuments(remote.channel.outbox.items, forbiddenIds, ctx);
 						await this.#collectForbiddenDocuments(remote.channel.deadLetter.items, forbiddenIds, ctx);
 					}
-					const { envelopes, ackOrdinal, deadLetters, hasMore } = pollSyncEnvelopes(this.syncManager, args, forbiddenIds);
+					const heldOpIds = this.syncServingGate ? await collectHeldSyncOperations([...remote.channel.outbox.items, ...remote.channel.deadLetter.items], this.syncServingGate, this.viewSubject(ctx)) : /* @__PURE__ */ new Set();
+					const { envelopes, ackOrdinal, deadLetters, hasMore } = pollSyncEnvelopes(this.syncManager, args, forbiddenIds, heldOpIds);
 					return {
 						envelopes,
 						ackOrdinal,
@@ -3960,6 +4433,32 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					throw error;
 				}
 			},
+			execute: async (_parent, args, ctx) => {
+				this.logger.debug("execute(@args)", args);
+				try {
+					const handle = await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
+					return await execute(this.reactorClient, {
+						...args,
+						documentIdentifier: handle.fetchIdentifier
+					});
+				} catch (error) {
+					this.logger.error("Error in execute(@args): @Error", args, error);
+					throw error;
+				}
+			},
+			executeAsync: async (_parent, args, ctx) => {
+				this.logger.debug("executeAsync(@args)", args);
+				try {
+					const handle = await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
+					return await executeAsync(this.reactorClient, {
+						...args,
+						documentIdentifier: handle.fetchIdentifier
+					});
+				} catch (error) {
+					this.logger.error("Error in executeAsync(@args): @Error", args, error);
+					throw error;
+				}
+			},
 			mutateDocument: async (_parent, args, ctx) => {
 				this.logger.debug("mutateDocument(@args)", args);
 				try {
@@ -4093,7 +4592,8 @@ var ReactorSubgraph = class extends BaseSubgraph {
 						const driveId = DriveCollectionId.fromKey(args.input.collectionId).driveId;
 						await this.assertCanReadCanonical(driveId, ctx);
 					}
-					return await touchChannel(this.syncManager, args);
+					await this.#bindOrRefuseChannel(args.input.id, ctx);
+					return await touchChannel(this.syncManager, args, this.#creatorBinding(ctx));
 				} catch (error) {
 					this.logger.error("Error in touchChannel(@args): @Error", args, error);
 					throw error;
@@ -4205,10 +4705,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.2-dev.7";
+	return "6.2.2-dev.70";
 }
 function getGitHash() {
-	return "cf61e36ec3ba12c9edb828e6e9870842ce2388e4";
+	return "da05f917d6912bc30c5c944823c216ec47e19fa8";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -4306,6 +4806,13 @@ var HttpPackageLoader = class {
 		this.logger.verbose(`Loaded ${models.length} document models from ${packageName}`);
 		return models;
 	}
+	async loadUpgradeManifests(packageSpec) {
+		const { name: packageName } = this.parsePackageSpec(packageSpec);
+		if (!this.isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
+		const manifests = extractUpgradeManifests(await import(`${this.registryUrl}-/cdn/${packageSpec}/node/document-models/index.mjs`));
+		if (manifests.length > 0) this.logger.verbose(`Loaded ${manifests.length} upgrade manifests from ${packageName}`);
+		return manifests;
+	}
 	async loadSubgraphs(packageSpec) {
 		const { name: packageName } = this.parsePackageSpec(packageSpec);
 		if (!this.isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
@@ -4431,7 +4938,7 @@ var ImportPackageLoader = class {
 		this.logger.verbose(`Loading document models from package: ${identifier}`);
 		const pkgModule = await loadDocumentModels(identifier);
 		if (pkgModule) {
-			const models = Object.values(pkgModule);
+			const models = Object.values(pkgModule).filter((m) => m !== null && typeof m === "object" && "documentModel" in m);
 			this.logger.verbose(`  ➜  Loaded ${models.length} Document Models from: ${identifier}`);
 			return models;
 		} else {
@@ -4439,6 +4946,13 @@ var ImportPackageLoader = class {
 			return [];
 		}
 	}
+	async loadUpgradeManifests(identifier) {
+		const pkgModule = await loadDocumentModels(identifier);
+		if (!pkgModule) return [];
+		const manifests = extractUpgradeManifests(pkgModule);
+		if (manifests.length > 0) this.logger.verbose(`  ➜  Loaded ${manifests.length} Upgrade Manifests from: ${identifier}`);
+		return manifests;
+	}
 	async loadSubgraphs(identifier) {
 		this.logger.verbose(`Loading subgraphs from package: ${identifier}`);
 		const pkgModule = await loadSubgraphs(identifier);
@@ -4487,13 +5001,19 @@ function isExpectedLoaderMiss(error, pkg) {
 }
 function getUniqueDocumentModels(...documentModels) {
 	const uniqueModels = /* @__PURE__ */ new Map();
-	for (const models of documentModels) for (const model of models) uniqueModels.set(model.documentModel.global.id, model);
+	for (const models of documentModels) for (const model of models) uniqueModels.set(`${model.documentModel.global.id}@${model.version ?? 1}`, model);
 	return Array.from(uniqueModels.values());
 }
+function getUniqueUpgradeManifests(...upgradeManifests) {
+	const uniqueManifests = /* @__PURE__ */ new Map();
+	for (const manifests of upgradeManifests) for (const manifest of manifests) uniqueManifests.set(manifest.documentType, manifest);
+	return Array.from(uniqueManifests.values());
+}
 var PackageManager = class {
 	logger = childLogger(["reactor-api", "package-manager"]);
 	loaders;
 	docModelsMap = /* @__PURE__ */ new Map();
+	upgradeManifestsMap = /* @__PURE__ */ new Map();
 	subgraphsMap = /* @__PURE__ */ new Map();
 	processorMap = /* @__PURE__ */ new Map();
 	configWatcher;
@@ -4511,8 +5031,10 @@ var PackageManager = class {
 	async loadPackages(packages) {
 		this.logger.info("Loading packages: @packages", packages.join(", "));
 		const documentModelsMap = await this.loadDocumentModels(packages);
+		const upgradeManifestsMap = await this.loadUpgradeManifests(packages);
 		const subgraphsMap = await this.loadSubgraphs(packages);
 		const processorsMap = await this.loadProcessors(packages);
+		this.upgradeManifestsMap = upgradeManifestsMap;
 		this.updatePackagesMap(documentModelsMap);
 		this.updateSubgraphsMap(subgraphsMap);
 		this.updateProcessorsMap(processorsMap);
@@ -4523,6 +5045,7 @@ var PackageManager = class {
 		}
 		return {
 			documentModels: getUniqueDocumentModels(...Array.from(documentModelsMap.values())),
+			upgradeManifests: this.getUniqueUpgradeManifests(),
 			subgraphs: subgraphsMap,
 			processors: processorsMap
 		};
@@ -4533,6 +5056,7 @@ var PackageManager = class {
 		documentModelModuleMap.set("document-drive", [driveDocumentModelModule]);
 		documentModelModuleMap.set("document-model", [documentModelDocumentModelModule]);
 		documentModelModuleMap.set("reactor-drive", [reactorDriveDocumentModelModule]);
+		documentModelModuleMap.set("reactor-group", [ReactorGroupV1]);
 		for (const pkg of packages) {
 			const allDocumentModels = [];
 			const failures = [];
@@ -4555,6 +5079,26 @@ var PackageManager = class {
 		}
 		return documentModelModuleMap;
 	}
+	/** Upgrade manifests currently loaded across all packages, one per type. */
+	getUniqueUpgradeManifests() {
+		return getUniqueUpgradeManifests(...Array.from(this.upgradeManifestsMap.values()));
+	}
+	async loadUpgradeManifests(packages) {
+		const manifestsMap = /* @__PURE__ */ new Map();
+		for (const pkg of packages) for (const loader of this.loaders) {
+			if (!loader.loadUpgradeManifests) continue;
+			try {
+				const manifests = await loader.loadUpgradeManifests(pkg);
+				if (manifests.length > 0) {
+					manifestsMap.set(pkg, manifests);
+					break;
+				}
+			} catch (error) {
+				this.logger.debug(`[${loader.name}] Failed to load upgrade manifests from package @pkg: @error`, pkg, error);
+			}
+		}
+		return manifestsMap;
+	}
 	async loadSubgraphs(packages) {
 		this.logger.debug(`Loading subgraphs from packages: ${packages.join(", ")}`);
 		const subgraphsMap = /* @__PURE__ */ new Map();
@@ -4616,6 +5160,10 @@ var PackageManager = class {
 	async updateDocumentModelsForPackage(pkg) {
 		this.logger.debug(`Updating document models for package: ${pkg}`);
 		const documentModels = await this.loadDocumentModels([pkg]);
+		const upgradeManifests = await this.loadUpgradeManifests([pkg]);
+		const upgradeManifestsMap = new Map(this.upgradeManifestsMap);
+		upgradeManifestsMap.set(pkg, upgradeManifests.get(pkg) ?? []);
+		this.upgradeManifestsMap = upgradeManifestsMap;
 		const documentModelsMap = new Map(this.docModelsMap);
 		documentModelsMap.set(pkg, documentModels.get(pkg) ?? []);
 		this.updatePackagesMap(documentModelsMap);
@@ -4695,6 +5243,70 @@ var PackageManager = class {
 const config = { basePath: process.env.BASE_PATH || "/" };
 const DefaultCoreSubgraphs = [AnalyticsSubgraph, SystemSubgraph];
 //#endregion
+//#region src/attachment-backend.ts
+/** Filesystem is the default; explicit S3 is readiness-gated without fallback. */
+async function createStartupAttachmentBackend({ db, env = process.env, s3Dependencies }) {
+	const storage = parseAttachmentStorageConfig(env);
+	if (storage.kind === "filesystem") return void 0;
+	const backend = createS3AttachmentBackend(db.withSchema("attachments"), storage.s3, s3Dependencies);
+	if (!(await backend.health()).ready) throw new Error("S3 attachment backend readiness check failed");
+	return backend;
+}
+//#endregion
+//#region src/services/attachment-access.service.ts
+const HASH_PATTERN = /^[a-f0-9]{64}$/;
+/**
+* Composes document authorization with the projected document/ref
+* relationship. Order is fixed: validate ref, resolve the canonical document
+* id, check `canRead`, then check the reference index. A denied document
+* never reaches the reference reader, and the facade never touches
+* attachment metadata, storage backends, or presigners.
+*/
+var AttachmentAccessService = class {
+	constructor(resolveCanonicalId, authorization, references, projection) {
+		this.resolveCanonicalId = resolveCanonicalId;
+		this.authorization = authorization;
+		this.references = references;
+		this.projection = projection;
+	}
+	async canReadAttachment(request) {
+		if (this.projection.status !== "available") return { kind: "projection-unavailable" };
+		const ref = normalizeAttachmentRef(request.attachmentRef);
+		if (ref === null) return { kind: "denied" };
+		let documentId;
+		try {
+			documentId = await this.resolveCanonicalId(request.documentId);
+		} catch {
+			return { kind: "denied" };
+		}
+		if (!await this.authorization.canRead(documentId, request.userAddress)) return { kind: "denied" };
+		if (!await this.references.hasReference(documentId, ref)) return { kind: "denied" };
+		return {
+			kind: "allowed",
+			documentId,
+			ref
+		};
+	}
+};
+/**
+* Parses and canonicalizes a caller-supplied ref through the shared parser.
+* Returns null for anything that is not a v1 ref over a 64-char SHA-256 hex
+* hash; hex case is normalized so index lookups use the canonical form.
+*/
+function normalizeAttachmentRef(value) {
+	let hash;
+	let version;
+	try {
+		const parsed = parseRef(value);
+		hash = parsed.hash.toLowerCase();
+		version = parsed.version;
+	} catch {
+		return null;
+	}
+	if (version !== 1 || !HASH_PATTERN.test(hash)) return null;
+	return createRef(hash, version);
+}
+//#endregion
 //#region src/migrations/001_create_document_permissions.ts
 var _001_create_document_permissions_exports = /* @__PURE__ */ __exportAll({
 	down: () => down$2,
@@ -4921,8 +5533,7 @@ var AuthService = class {
 			admins: [],
 			auth_enabled: false
 		};
-		const method = request.method;
-		if (method === "OPTIONS" || method === "GET") return {
+		if (request.method === "OPTIONS") return {
 			user: void 0,
 			admins: this.config.admins,
 			auth_enabled: true
@@ -4984,16 +5595,23 @@ var AuthService = class {
 		return await verifyAuthBearerToken(token);
 	}
 	/**
-	* Extract user information from verification result
+	* Extract user information from verification result.
+	*
+	* The issuer is required along with the credential subject. A credential that
+	* verified must carry one -- resolving it is how the signature was checked --
+	* so this rejects a shape that cannot have come from verification rather than
+	* admitting a keyless principal.
 	*/
 	extractUserFromVerification(verified) {
 		try {
 			const { address, chainId, networkId } = verified.verifiableCredential.credentialSubject;
-			if (!address || !chainId || !networkId) return null;
+			const appKey = verified.issuer;
+			if (!address || !chainId || !networkId || !appKey) return null;
 			return {
 				address,
 				chainId,
-				networkId
+				networkId,
+				appKey
 			};
 		} catch {
 			return null;
@@ -5042,14 +5660,33 @@ var AuthService = class {
 		}
 	}
 	async fetchCredentialExists(address, chainId, appId) {
-		return await fetchDelegationCredential({
+		if (!this.config.verifyCredential) throw new Error("AuthService: credential verification is enabled but no verifyCredential was provided");
+		return this.config.verifyCredential({
 			address,
 			chainId,
-			appDid: appId
-		}) !== void 0;
+			appId
+		});
 	}
 };
 //#endregion
+//#region src/services/renown-credential-verifier.ts
+async function createRenownCredentialVerifier(config = {}) {
+	const switchboardUrl = await resolveSwitchboardEndpoint({
+		switchboardUrl: config.switchboardUrl,
+		baseUrl: config.renownUrl
+	});
+	return async ({ address, chainId, appId }) => {
+		return await fetchDelegationCredential({
+			address,
+			chainId,
+			appDid: appId,
+			switchboardUrl,
+			baseUrl: switchboardUrl ? void 0 : config.renownUrl,
+			discover: false
+		}) !== void 0;
+	};
+}
+//#endregion
 //#region src/services/document-permission.service.ts
 /**
 * Service for managing document-level permissions.
@@ -5365,7 +6002,35 @@ function createMcpRequestAuthorizer(authService, authorizationService) {
 	};
 }
 //#endregion
+//#region src/services/renown-config.ts
+/** Reading credentials from this reactor's own read model needs a host-supplied
+* verifier: core has no idea which subgraph serves that read model. */
+function assertCredentialVerifierForSource(source, hasVerifier) {
+	if (source !== "self" || hasVerifier) return;
+	throw new Error("Renown credential verification is set to \"self\" (auth.renown.source or RENOWN_SOURCE) but no verifyCredential was provided. A host that reads its own read model must pass one — see apps/switchboard, which builds it from @renown/sdk createLocalCredentialVerifier — or set RENOWN_SOURCE=remote to verify against a Renown instance.");
+}
+function envOverride(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
+}
+/** Resolve `auth.renown`; RENOWN_SOURCE / RENOWN_URL / SWITCHBOARD_URL win
+* over the config file, which wins over the SDK defaults. */
+function resolveRenownConfig(configured, env, logger) {
+	return {
+		source: resolveRenownSource(envOverride(env.RENOWN_SOURCE) ?? configured?.source, logger),
+		url: envOverride(env.RENOWN_URL) ?? configured?.url,
+		switchboardUrl: envOverride(env.SWITCHBOARD_URL) ?? configured?.switchboardUrl
+	};
+}
+function resolveRenownSource(value, logger) {
+	if (value === void 0 || value === null) return "remote";
+	if (value === "self" || value === "remote") return value;
+	logger.warn(`Ignoring invalid renown source "${value}" (expected "self" or "remote") — using "remote"`);
+	return "remote";
+}
+//#endregion
 //#region src/utils/db.ts
+const PGLITE_UTC_PARSERS = { 1114: (value) => /* @__PURE__ */ new Date(`${value.replace(" ", "T")}Z`) };
 function isPG(connectionString) {
 	if (connectionString.startsWith("postgresql://") || connectionString.startsWith("postgres://")) return true;
 	return false;
@@ -5396,7 +6061,10 @@ function getDbClient(connectionString = void 0, pgliteFactory) {
 	if (cached) return cached;
 	const isPg = connectionString && isPG(connectionString);
 	const client = isPg ? "pg" : ClientPgLite;
-	const pgliteInstance = isPg ? void 0 : pgliteFactory ? pgliteFactory(connectionString) : connectionString ? new PGlite({ fs: new AtomicNodeFs(connectionString) }) : new PGlite();
+	const pgliteInstance = isPg ? void 0 : pgliteFactory ? pgliteFactory(connectionString) : connectionString ? new PGlite({
+		fs: new AtomicNodeFs(connectionString),
+		parsers: PGLITE_UTC_PARSERS
+	}) : new PGlite({ parsers: PGLITE_UTC_PARSERS });
 	const connection = isPg ? { connectionString } : { pglite: pgliteInstance };
 	if (connectionString && !isPg) {
 		const dirPath = path.resolve(connectionString, "..");
@@ -5553,10 +6221,31 @@ function makeDbClosers(knexInstance, pglite) {
 	return closers;
 }
 /**
+* The gate sync serving evaluates a document's own policy through, or undefined
+* when there is none to evaluate.
+*
+* It is built here rather than taken off the reactor client because it is not
+* the same gate reads use: it carries the host's closes-by-default setting,
+* which withholds the domain scopes of a document nobody has policied yet. That
+* answer belongs to serving alone -- replay must keep reading an uninitialized
+* document in full -- so the two gates are deliberately separate objects over
+* the same model.
+*
+* Undefined below `authEnforcement`, where the registered model ignores the auth
+* scope: gating through it would serve every domain scope of a policied document
+* to anyone, which is worse than not gating at all.
+*/
+function buildSyncServingGate(reactorModule, authorizationConfig, logger) {
+	if (!reactorModule) return;
+	const model = readDecisionModel(reactorModule.featureFlags, reactorModule.documentModelRegistry);
+	if (!model) return;
+	return new SyncScopeGate(new ModelReadGate(model, reactorModule.documentView, reactorModule.featureFlags.authGroups, reactorModule.operationIndex, logger, { withholdUninitialized: authorizationConfig.defaultProtection }), reactorModule.documentView, logger);
+}
+/**
 * Sets up the subgraph manager and registers subgraphs
 */
-async function setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient) {
-	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter("apollo", logger), authService, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient);
+async function setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate) {
+	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter("apollo", logger), authService, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient, syncServingGate);
 	await graphqlManager.init(subgraphs.core, authFetchMiddleware);
 	for (const [, collection] of subgraphs.extended.entries()) for (const subgraph of collection) await graphqlManager.registerSubgraph(subgraph, "graphql");
 	await graphqlManager.updateRouter();
@@ -5568,15 +6257,20 @@ async function setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer,
 function setupEventListeners(pkgManager, graphqlManager, reactorProcessorManager, module, documentModelRegistry) {
 	pkgManager.onDocumentModelsChange((packagedModels) => {
 		if (documentModelRegistry) {
-			const newModules = Object.values(packagedModels).flat();
-			const registeredModules = documentModelRegistry.getAllModules();
-			const registeredTypes = new Set(registeredModules.map((m) => m.documentModel.global.id));
-			const modulesToRegister = newModules.filter((mod) => !registeredTypes.has(mod.documentModel.global.id));
-			if (modulesToRegister.length > 0) {
-				const results = documentModelRegistry.registerModules(...modulesToRegister);
-				for (const result of results) if (result.status === "success") defaultLogger.info(`Registered new document model: ${result.item.documentModel.global.id}`);
+			const newModules = getUniqueDocumentModels(Object.values(packagedModels).flat());
+			const incomingTypes = new Set(newModules.map((m) => m.documentModel.global.id));
+			if (incomingTypes.size > 0) {
+				documentModelRegistry.unregisterModules(...incomingTypes);
+				const results = documentModelRegistry.registerModules(...newModules);
+				for (const result of results) if (result.status === "success") defaultLogger.info(`Registered document model: ${result.item.documentModel.global.id} v${result.item.version ?? 1}`);
 				else defaultLogger.error(`Failed to register document model: ${result.error.message}`);
 			}
+			const manifests = pkgManager.getUniqueUpgradeManifests();
+			if (manifests.length > 0) {
+				documentModelRegistry.unregisterUpgradeManifests(...manifests.map((m) => m.documentType));
+				const manifestResults = documentModelRegistry.registerUpgradeManifests(...manifests);
+				for (const result of manifestResults) if (result.status === "error") defaultLogger.error(`Failed to register upgrade manifest: ${result.error.message}`);
+			}
 		}
 		graphqlManager.regenerateDocumentModelSubgraphs();
 	});
@@ -5633,10 +6327,12 @@ async function _setupCommonInfrastructure(options) {
 	const logger = options.logger ?? defaultLogger;
 	let admins = [];
 	let authEnabled = false;
+	let configuredRenown;
 	if (options.configFile) {
 		const config = getConfig(options.configFile);
 		admins = config.auth?.admins.map((a) => a.toLowerCase()) ?? [];
 		authEnabled = config.auth?.enabled ?? false;
+		configuredRenown = config.auth?.renown;
 	} else if (options.auth) {
 		admins = options.auth.admins.map((a) => a.toLowerCase());
 		authEnabled = options.auth.enabled;
@@ -5673,11 +6369,19 @@ async function _setupCommonInfrastructure(options) {
 	let authService;
 	if (authEnabled) {
 		logger.info("Setting up Auth middleware");
+		const renown = options.renown ?? resolveRenownConfig(configuredRenown, process.env, logger);
+		assertCredentialVerifierForSource(renown.source, options.verifyCredential !== void 0);
+		if (options.verifyCredential) logger.info("Renown credentials will be verified by the host's verifier");
+		else logger.info("Renown credentials will be verified against @url", renown.switchboardUrl ?? renown.url ?? "the default Renown instance");
 		authService = new AuthService({
 			enabled: authEnabled,
 			admins,
 			skipCredentialVerification,
-			credentialVerificationCacheTtlMs
+			credentialVerificationCacheTtlMs,
+			verifyCredential: options.verifyCredential ?? await createRenownCredentialVerifier({
+				renownUrl: renown.url,
+				switchboardUrl: renown.switchboardUrl
+			})
 		});
 		authFetchMiddleware = createAuthFetchMiddleware(authService);
 	}
@@ -5703,7 +6407,12 @@ async function _setupCommonInfrastructure(options) {
 	await mkdir(attachmentStoragePath, { recursive: true });
 	const { db: attachmentDb, knex: attachmentKnex, pglite: attachmentPglite } = getDbClient(options.dbPath, options.pgliteFactory);
 	dbClosers.push(...makeDbClosers(attachmentKnex, attachmentPglite));
-	const attachments = await new AttachmentBuilder(attachmentDb, attachmentStoragePath).withReservationSweepMs(3600 * 1e3).build();
+	const ATTACHMENT_SWEEP_INTERVAL_MS = 3600 * 1e3;
+	const attachmentBackend = await createStartupAttachmentBackend({ db: attachmentDb });
+	const attachmentBuilder = new AttachmentBuilder(attachmentDb, attachmentStoragePath).withReservationSweepMs(ATTACHMENT_SWEEP_INTERVAL_MS);
+	if (attachmentBackend) attachmentBuilder.withBackend(attachmentBackend);
+	const attachments = await attachmentBuilder.build();
+	const attachmentReferenceIndex = await new AttachmentReferenceIndexBuilder(attachmentDb).build();
 	dbClosers.push(() => {
 		attachments.destroy();
 		return Promise.resolve();
@@ -5723,6 +6432,7 @@ async function _setupCommonInfrastructure(options) {
 		documentPermissionService,
 		authorizationConfig,
 		attachments,
+		attachmentReferenceIndex,
 		packages,
 		dbClosers,
 		readiness
@@ -5731,26 +6441,17 @@ async function _setupCommonInfrastructure(options) {
 /**
 * Private helper function containing common setup logic for API initialization
 */
-async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient) {
+async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient, syncServingGate) {
 	const hostModule = {
-		relationalDb,
-		analyticsStore,
-		processorApp,
-		config: options.processorConfig,
-		client: reactorClient,
-		attachments: createAttachmentClient(attachments.service),
-		dispatch: { async execute(docId, branch, actions, signal) {
-			const jobInfo = await reactorClient.executeAsync(docId, branch, actions, signal);
-			return {
-				id: jobInfo.id,
-				status: jobInfo.status
-			};
-		} },
-		getReadModel(name) {
-			const model = readModels.find((m) => m.name === name);
-			if (!model) throw new Error(`Read model "${name}" not found`);
-			return model;
-		}
+		...createReactorHostModuleBase({
+			client: reactorClient,
+			readModels,
+			relationalDb,
+			analyticsStore,
+			processorApp,
+			config: options.processorConfig
+		}),
+		attachments: createAttachmentClient(attachments.service)
 	};
 	const mcpServerEnabled = options.mcp ?? true;
 	const logger = options.logger ?? defaultLogger;
@@ -5778,6 +6479,7 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	const { httpServer, wsServer } = await startServer(httpAdapter, port, options.https, logger);
 	const authorizationService = createAuthorizationService(authorizationConfig, documentPermissionService, createGetParentIdsFn(reactorClient));
 	logger.info(`Authorization service initialized (policy: ${authorizationConfig.policy})`);
+	const attachmentAccess = new AttachmentAccessService(createCanonicalDocumentIdResolver(reactorClient), authorizationService, attachmentReferenceIndex.store, attachmentReferenceProjection);
 	const coreSubgraphs = DefaultCoreSubgraphs.slice();
 	coreSubgraphs.push(ReactorSubgraph);
 	if (documentPermissionService) {
@@ -5787,7 +6489,7 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	const graphqlManager = await setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, {
 		extended: subgraphs,
 		core: coreSubgraphs
-	}, logger.child(["graphql-manager"]), authorizationService, authService, documentPermissionService, options.enableDocumentModelSubgraphs, port, reactorDriveClient);
+	}, logger.child(["graphql-manager"]), authorizationService, authService, documentPermissionService, options.enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate);
 	setupEventListeners(packages, graphqlManager, reactorProcessorManager, hostModule, documentModelRegistry);
 	if (mcpServerEnabled) {
 		await setupMcpServer({
@@ -5802,6 +6504,8 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 		graphqlManager,
 		packages,
 		attachments,
+		attachmentReferenceIndex,
+		attachmentAccess,
 		authService,
 		dispose: buildApiDispose({
 			graphqlManager,
@@ -5850,9 +6554,15 @@ function buildApiDispose(args) {
 	};
 }
 async function initializeAndStartAPI(clientInitializer, options, processorApp) {
-	const { port, httpAdapter, authFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
-	const { documentModels, processors, subgraphs } = await packages.init();
-	const { module: reactorClientModule, reactorDriveClient } = await clientInitializer(documentModels);
+	const { port, httpAdapter, authFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, attachmentReferenceIndex, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
+	const { documentModels, upgradeManifests, processors, subgraphs } = await packages.init();
+	const { module: reactorClientModule, reactorDriveClient, attachmentReferenceProjection = {
+		status: "unavailable",
+		reason: "initializer-did-not-report"
+	} } = await clientInitializer(documentModels, {
+		attachmentReferenceWriter: attachmentReferenceIndex.store,
+		upgradeManifests
+	});
 	const reactorClient = reactorClientModule.client;
 	const syncManager = reactorClientModule.reactorModule?.syncModule?.syncManager;
 	if (!syncManager) throw new Error("SyncManager not available from InProcessReactorClientModule");
@@ -5861,11 +6571,12 @@ async function initializeAndStartAPI(clientInitializer, options, processorApp) {
 	const documentModelRegistry = reactorClientModule.reactorModule?.documentModelRegistry;
 	if (!documentModelRegistry) throw new Error("DocumentModelRegistry not available from InProcessReactorClientModule");
 	return {
-		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient),
+		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient, buildSyncServingGate(reactorClientModule.reactorModule, authorizationConfig, options.logger ?? defaultLogger)),
 		client: reactorClient,
 		syncManager,
 		documentModelRegistry,
-		readiness
+		readiness,
+		attachmentReferenceProjection
 	};
 }
 //#endregion
@@ -5969,7 +6680,7 @@ var PackageManagementService = class {
 	}
 };
 //#endregion
-export { ADMIN_USERS, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, assertAuthRequiredForDocumentPermissions, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
+export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthDecision, AuthDecisionSchema, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, EvaluateActionsDocument, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground, resolveRenownConfig };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=e58cea2c-2319-52a8-90cd-3e99d94ba98f
+//# debugId=42c7ea6f-655f-5a4b-84ac-b7870ee17334