@powerhousedao/reactor-api 6.2.2-dev.7 → 6.2.2-dev.71

package/dist/index.d.mts

@@ -1,26 +1,27 @@
-import { i as IPackageManagerOptions, n as IPackageLoaderOptions, r as IPackageManager, s as PackageManagerResult, t as IPackageLoader } from "./types-DnHgkahK.mjs";
+import { i as IPackageManagerOptions, n as IPackageLoaderOptions, r as IPackageManager, s as PackageManagerResult, t as IPackageLoader } from "./types-D2ZrjmCk.mjs";
 import { IAnalyticsStore } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel } from "@powerhousedao/analytics-engine-graphql";
 import * as graphql from "graphql";
 import { DocumentNode, GraphQLResolveInfo, GraphQLScalarType, GraphQLScalarTypeConfig, GraphQLSchema } from "graphql";
-import { IDocumentModelLoader, IDocumentModelRegistry, IDriveClient, IReactorClient, IRelationalDb, ISyncManager, InProcessReactorClientModule, ParsedDriveUrl, driveIdFromUrl, parseDriveUrl } from "@powerhousedao/reactor";
+import { AttachmentRef, IDocumentModelLoader, IDocumentModelRegistry, IDriveClient, IReactorClient, IReactorProcessorHostModuleBase, IRelationalDb, ISyncManager, InProcessReactorClientModule, ParsedDriveUrl, ProcessorFactoryBuilder as ProcessorFactoryBuilder$1, SyncScopeGate, driveIdFromUrl, parseDriveUrl } from "@powerhousedao/reactor";
 import { ILogger } from "document-model";
-import { DocumentModelGlobalState as DocumentModelGlobalState$1, DocumentModelModule, Operation, PHDocument, PHDocumentHeader } from "@powerhousedao/shared/document-model";
+import { GraphQLResolverMap, GraphQLSchemaModule } from "@apollo/subgraph";
+import { AuthSubject, DocumentModelGlobalState as DocumentModelGlobalState$1, DocumentModelModule, Operation, PHDocument, UpgradeManifest } from "@powerhousedao/shared/document-model";
 import * as z$1 from "zod";
 import { DocumentDriveDocument, DocumentDriveGlobalState } from "@powerhousedao/shared/document-drive";
-import { AttachmentBuildResult } from "@powerhousedao/reactor-attachments";
+import { AttachmentBuildResult, AttachmentReferenceIndexBuildResult, IAttachmentReferenceReader, IAttachmentReferenceWriter } from "@powerhousedao/reactor-attachments";
 import { IAttachmentClient } from "@powerhousedao/reactor-attachments/client";
 import { WebSocketServer } from "ws";
-import { IProcessorHostModule, IRelationalDb as IRelationalDb$1, ProcessorApp, ProcessorRecord } from "@powerhousedao/shared/processors";
+import { IRelationalDb as IRelationalDb$1, ProcessorApp, ProcessorFactory } from "@powerhousedao/shared/processors";
 import { Generated, Kysely } from "kysely";
 import { PGlite } from "@electric-sql/pglite";
 import { Knex } from "knex";
 import http from "node:http";
 import { CorsOptions } from "cors";
-import { GraphQLResolverMap, GraphQLSchemaModule } from "@apollo/subgraph/dist/schema-helper/resolverMap.js";
 import { Context as Context$1, GqlDocument as GqlDocument$1, GqlDriveDocument as GqlDriveDocument$1, GqlOperation as GqlOperation$1, GraphQLManager as GraphQLManager$1, ISubgraph as ISubgraph$1, Processor as Processor$1, SubgraphArgs as SubgraphArgs$1, SubgraphClass as SubgraphClass$1 } from "@powerhousedao/reactor-api";
 import { IncomingHttpHeaders } from "http";
 import { Pool } from "pg";
+import { PHReactorRenown } from "@powerhousedao/shared/clis";
 
 //#region src/utils/db.d.ts
 /**
@@ -63,6 +64,9 @@ interface OperationUserPermissionTable {
   createdAt: Date;
 }
 type Db = Kysely<any>;
+declare const PGLITE_UTC_PARSERS: {
+  readonly 1114: (value: string) => Date;
+};
 /**
  * Optional factory used by callers (e.g. Switchboard) to inject a
  * version-specific PGLite instance — e.g. `pglite-legacy-02` when an existing
@@ -215,7 +219,7 @@ declare class DocumentPermissionService {
  * must key on the canonical id, so branding it forces every caller to resolve a
  * slug to its id before consulting this service, closing the slug-aliasing
  * bypass (S-C1). The only sanctioned cast from string to CanonicalDocumentId
- * lives in the BaseSubgraph resolution helpers, immediately after the shared
+ * lives in createCanonicalDocumentIdResolver, immediately after the shared
  * resolveIdOrSlug lookup returns.
  */
 type CanonicalDocumentId = string & {
@@ -293,7 +297,8 @@ type Context = {
   user?: {
     address: string;
     chainId: number;
-    networkId: string;
+    networkId: string; /** The did:key of the app instance that issued this request's token. */
+    appKey: string;
   };
 };
 type ISubgraph = {
@@ -314,6 +319,12 @@ type SubgraphArgs = {
   syncManager: ISyncManager;
   documentPermissionService?: DocumentPermissionService;
   authorizationService: IAuthorizationService;
+  /**
+   * Evaluates a document's own policy when serving sync. Absent below
+   * `authEnforcement`, where there is no model to enforce and serving falls back
+   * to the host's permission tables alone.
+   */
+  syncServingGate?: SyncScopeGate;
   path?: string;
 };
 type GqlSigner = {
@@ -386,6 +397,7 @@ declare class BaseSubgraph implements ISubgraph$1 {
   syncManager: ISyncManager;
   documentPermissionService?: DocumentPermissionService;
   authorizationService: IAuthorizationService;
+  syncServingGate?: SyncScopeGate;
   constructor(args: SubgraphArgs$1);
   onSetup(): Promise<void>;
   /**
@@ -411,6 +423,17 @@ declare class BaseSubgraph implements ISubgraph$1 {
    * layer, such as a fetched document's id). Performs no slug resolution.
    */
   canReadDocument(documentId: CanonicalDocumentId, ctx: Context): Promise<boolean>;
+  /**
+   * The principal a request decides as: the authenticated caller's address, and
+   * the did:key of the app instance whose token authenticated it.
+   *
+   * Both, because a policy can name either. The key is what a document records
+   * as its creator, so a subject built without one cannot match the creator's
+   * standing permission over the auth scope -- the document's own creator would
+   * be refused an operation the write path accepts, since a signed action
+   * carries the same key. Anonymous callers supply neither.
+   */
+  protected viewSubject(ctx: Context): AuthSubject;
   /**
    * Asserts read access, resolving a slug first. Returns a handle whose
    * `fetchIdentifier` the caller reuses for the data fetch; a denial throws.
@@ -594,16 +617,35 @@ declare class AuthSubgraph extends BaseSubgraph {
 }
 //#endregion
 //#region src/services/auth.service.d.ts
+type CredentialVerifier = (params: {
+  address: string;
+  chainId: number;
+  appId: string;
+}) => Promise<boolean>;
 interface AuthConfig {
   enabled: boolean;
   admins: string[];
   skipCredentialVerification?: boolean;
   credentialVerificationCacheTtlMs?: number;
+  verifyCredential?: CredentialVerifier;
 }
 interface User {
   address: string;
   chainId: number;
   networkId: string;
+  /**
+   * The did:key of the app instance that issued this request's token, taken
+   * from the verified credential's issuer.
+   *
+   * It is the same value a signer presents as its app key when it signs an
+   * action, which is what a document records as its creator. Carrying it here
+   * is what lets a request decide as the same principal the write path
+   * presents, rather than as an address with no key.
+   *
+   * Authenticated, not asserted: the token is verified by resolving this very
+   * DID, so a caller cannot name someone else's.
+   */
+  appKey: string;
 }
 interface AuthContext {
   user?: User;
@@ -626,7 +668,12 @@ declare class AuthService {
    */
   private verifyToken;
   /**
-   * Extract user information from verification result
+   * Extract user information from verification result.
+   *
+   * The issuer is required along with the credential subject. A credential that
+   * verified must carry one -- resolving it is how the signature was checked --
+   * so this rejects a shape that cannot have come from verification rather than
+   * admitting a keyless principal.
    */
   private extractUserFromVerification;
   /**
@@ -803,6 +850,7 @@ declare class GraphQLManager {
   private readonly documentPermissionService?;
   private readonly featureFlags;
   private readonly port;
+  private readonly syncServingGate?;
   private initialized;
   private coreSubgraphsMap;
   private contextFields;
@@ -819,7 +867,7 @@ declare class GraphQLManager {
    */
   readonly reactorDriveClient?: IDriveClient;
   private readonly authorizationService;
-  constructor(path: string, httpServer: http.Server, wsServer: WebSocketServer, reactorClient: IReactorClient, relationalDb: IRelationalDb, analyticsStore: IAnalyticsStore, syncManager: ISyncManager, logger: ILogger, httpAdapter: IHttpAdapter, gatewayAdapter: IGatewayAdapter<Context$1>, authService?: AuthService | undefined, documentPermissionService?: DocumentPermissionService | undefined, featureFlags?: GraphqlManagerFeatureFlags, port?: number, authorizationService?: IAuthorizationService, reactorDriveClient?: IDriveClient);
+  constructor(path: string, httpServer: http.Server, wsServer: WebSocketServer, reactorClient: IReactorClient, relationalDb: IRelationalDb, analyticsStore: IAnalyticsStore, syncManager: ISyncManager, logger: ILogger, httpAdapter: IHttpAdapter, gatewayAdapter: IGatewayAdapter<Context$1>, authService?: AuthService | undefined, documentPermissionService?: DocumentPermissionService | undefined, featureFlags?: GraphqlManagerFeatureFlags, port?: number, authorizationService?: IAuthorizationService, reactorDriveClient?: IDriveClient, syncServingGate?: SyncScopeGate | undefined);
   init(coreSubgraphs: SubgraphClass$1[], authMiddleware?: AuthFetchMiddleware): Promise<void>;
   /**
    * Regenerate document model subgraphs when models are dynamically loaded.
@@ -842,6 +890,14 @@ declare class GraphQLManager {
    */
   getAuthorizationService(): IAuthorizationService;
   registerSubgraph(subgraph: SubgraphClass$1, supergraph?: string, core?: boolean): Promise<ISubgraph$1>;
+  /** Find a registered subgraph by name, core or package-contributed. */
+  getSubgraphByName(name: string): ISubgraph$1 | undefined;
+  /** Whether a registered subgraph has a live handler, i.e. whether
+   * {@link executeSubgraphQuery} can reach it right now. */
+  hasSubgraphHandler(name: string): boolean;
+  /** Run a query against one registered subgraph in-process: the subgraph's own
+   * handler, without a socket or the auth/drive middleware. Trusted callers. */
+  executeSubgraphQuery<T>(subgraphName: string, query: string, variables: Record<string, unknown>): Promise<T>;
   updateRouter: (immediate?: boolean) => Promise<void>;
   private _updateRouter;
   getAdditionalContextFields: () => Record<string, any>;
@@ -874,11 +930,88 @@ declare class InMemoryPackageStorage implements IPackageStorage {
   has(name: string): Promise<boolean>;
 }
 //#endregion
+//#region src/services/canonical-document-id.d.ts
+/**
+ * Raised when a caller-supplied identifier cannot be resolved to a canonical
+ * document id. Carries no detail on purpose: resolution failures must not act
+ * as a document-existence oracle, so consumers map this to their generic
+ * fail-closed response.
+ */
+declare class CanonicalDocumentIdResolutionError extends Error {
+  constructor();
+}
+type CanonicalDocumentIdResolver = (identifier: string) => Promise<CanonicalDocumentId>;
+/**
+ * The sanctioned string-to-CanonicalDocumentId cast: both the GraphQL layer
+ * and server routes must resolve caller identifiers through this helper so
+ * decision and data layers always agree on the subject document.
+ */
+declare function createCanonicalDocumentIdResolver(client: Pick<IReactorClient, "resolveIdOrSlug">): CanonicalDocumentIdResolver;
+//#endregion
+//#region src/services/attachment-access.service.d.ts
+/**
+ * Whether the active Reactor composition hosts the attachment-reference
+ * projection. Reported by the client initializer: the built-in stack always
+ * registers it, while a caller-provided Reactor may lack the live
+ * registration capability. Consumers of reference evidence must fail closed
+ * when it is unavailable.
+ */
+type AttachmentReferenceProjectionCapability = {
+  status: "available";
+} | {
+  status: "unavailable";
+  reason: "live-read-model-registration-unsupported" | "in-process-reactor-module-unavailable" | "initializer-did-not-report";
+};
+/**
+ * Outcome of an attachment read authorization. `denied` intentionally covers
+ * both an unreadable document and an absent document/ref relationship so the
+ * route layer cannot leak which check failed. `projection-unavailable` means
+ * the reference index is not being maintained in this composition; it is
+ * returned before any document-authorization or reference lookup runs.
+ */
+type AttachmentAccessResult = {
+  kind: "allowed";
+  documentId: CanonicalDocumentId;
+  ref: AttachmentRef;
+} | {
+  kind: "denied";
+} | {
+  kind: "projection-unavailable";
+};
+interface AttachmentAccessRequest {
+  documentId: string;
+  attachmentRef: string;
+  userAddress?: string;
+}
+interface IAttachmentAccessService {
+  canReadAttachment(request: AttachmentAccessRequest): Promise<AttachmentAccessResult>;
+}
+/**
+ * Composes document authorization with the projected document/ref
+ * relationship. Order is fixed: validate ref, resolve the canonical document
+ * id, check `canRead`, then check the reference index. A denied document
+ * never reaches the reference reader, and the facade never touches
+ * attachment metadata, storage backends, or presigners.
+ */
+declare class AttachmentAccessService implements IAttachmentAccessService {
+  private readonly resolveCanonicalId;
+  private readonly authorization;
+  private readonly references;
+  private readonly projection;
+  constructor(resolveCanonicalId: CanonicalDocumentIdResolver, authorization: IAuthorizationService, references: IAttachmentReferenceReader, projection: AttachmentReferenceProjectionCapability);
+  canReadAttachment(request: AttachmentAccessRequest): Promise<AttachmentAccessResult>;
+}
+//#endregion
 //#region src/types.d.ts
-interface IReactorProcessorHostModule extends IProcessorHostModule {
-  client: IReactorClient;
+/**
+ * Module hosts pass to processor factories: the reactor-level module plus the
+ * attachment client, which shared and reactor cannot name.
+ */
+interface IProcessorHostModule extends IReactorProcessorHostModuleBase {
   attachments: IAttachmentClient;
 }
+/** @deprecated Use `IProcessorHostModule`. */
+type IReactorProcessorHostModule = IProcessorHostModule;
 type ReadinessGate = {
   isReady: () => boolean;
   markReady: () => void;
@@ -888,6 +1021,8 @@ type API = {
   graphqlManager: GraphQLManager$1;
   packages: IPackageManager;
   attachments: AttachmentBuildResult;
+  attachmentReferenceIndex: AttachmentReferenceIndexBuildResult; /** Document-authorized attachment read decisions; see AttachmentAccessService. */
+  attachmentAccess: IAttachmentAccessService;
   authService: AuthService | undefined;
   /**
    * Releases resources owned by the API: shuts down the GraphQL gateway,
@@ -902,13 +1037,10 @@ type ReactorModule = {
   analyticsStore: IAnalyticsStore;
   relationalDb: IRelationalDb$1;
 };
-/** Per-drive factory after the host `module` has been applied once. */
-type ProcessorDriveFactory = (driveHeader: PHDocumentHeader) => ProcessorRecord[] | Promise<ProcessorRecord[]>;
-/**
- * Builds a per-drive factory from the host module (e.g. vetra `processorFactory`).
- * Shape: `(module) => (driveHeader) => ...`
- */
-type ProcessorFactoryBuilder = (module: IProcessorHostModule) => ProcessorDriveFactory | Promise<ProcessorDriveFactory>;
+/** @deprecated Use `ProcessorFactory`. */
+type ProcessorDriveFactory = ProcessorFactory;
+/** Builds a per-drive factory from the host module (e.g. vetra `processorFactory`). */
+type ProcessorFactoryBuilder = ProcessorFactoryBuilder$1<IProcessorHostModule>;
 /** Multiple initializers per package name (e.g. Switchboard `processors` option). */
 type Processor = ProcessorFactoryBuilder[];
 //#endregion
@@ -955,6 +1087,7 @@ declare class HttpPackageLoader implements IPackageLoader {
    */
   private parsePackageSpec;
   loadDocumentModels(packageSpec: string): Promise<DocumentModelModule[]>;
+  loadUpgradeManifests(packageSpec: string): Promise<UpgradeManifest<readonly number[]>[]>;
   loadSubgraphs(packageSpec: string): Promise<SubgraphClass$1[]>;
   loadProcessors(packageSpec: string): Promise<ProcessorFactoryBuilder | null>;
   /**
@@ -1128,12 +1261,63 @@ type Action = {
   readonly timestampUtcMs: Scalars["String"]["output"];
   readonly type: Scalars["String"]["output"];
 };
+/**
+ * One operation an authorization preflight predicts a verdict for.
+ *
+ * `input` is what a conditional grant reads, so a candidate standing for a
+ * filled-in form carries that form's input. Omitting it predicts the verdict an
+ * empty input earns, not the verdict the filled-in form will get.
+ */
+type ActionCandidateInput = {
+  readonly input?: InputMaybe<Scalars["JSONObject"]["input"]>;
+  readonly scope: Scalars["String"]["input"];
+  readonly type: Scalars["String"]["input"];
+};
 type ActionContext = {
   readonly signer?: Maybe<ReactorSigner>;
 };
+/**
+ * An action's context, as a caller submits it.
+ *
+ * Declares every field `ActionContext` carries, because an input object rejects a
+ * field it does not declare: an action stamped with the head it applies to - which
+ * is what a signing client sends - is refused outright if these are missing, and
+ * that refusal is a whole-request one, not a per-field one.
+ *
+ * `prevOpHash` and `prevOpIndex` are the scope head the action was composed
+ * against. They are recorded rather than enforced; a signature is verified from
+ * the params carried in its own tuple, which do not include them.
+ */
 type ActionContextInput = {
+  /** Covers replay of an operation that would otherwise be a no-op. */readonly nonce?: InputMaybe<Scalars["String"]["input"]>; /** The hash of the state the action applies to. */
+  readonly prevOpHash?: InputMaybe<Scalars["String"]["input"]>; /** The index of the last operation in the scope the action applies to. */
+  readonly prevOpIndex?: InputMaybe<Scalars["Int"]["input"]>;
   readonly signer?: InputMaybe<ReactorSignerInput>;
 };
+/**
+ * One candidate's predicted verdict. `reason` carries the refusal a DENY is
+ * recorded with, and is null on an ALLOW.
+ */
+type ActionEvaluation = {
+  readonly decision: AuthDecision;
+  readonly reason?: Maybe<Scalars["String"]["output"]>;
+};
+/**
+ * The predicted verdicts for a set of candidates, in the order they were given,
+ * with the aggregates a caller branches on.
+ *
+ * The aggregates are redundant -- a verdict is binary -- and all four are returned
+ * so a caller reads the one its question is phrased in rather than negating
+ * another. Over no candidates every aggregate is false: nothing is allowed and
+ * nothing is denied.
+ */
+type ActionEvaluations = {
+  readonly allAllowed: Scalars["Boolean"]["output"];
+  readonly allDenied: Scalars["Boolean"]["output"];
+  readonly anyAllowed: Scalars["Boolean"]["output"];
+  readonly anyDenied: Scalars["Boolean"]["output"];
+  readonly evaluations: ReadonlyArray<ActionEvaluation>;
+};
 type ActionInput = {
   readonly context?: InputMaybe<ActionContextInput>;
   readonly id: Scalars["String"]["input"];
@@ -1142,6 +1326,10 @@ type ActionInput = {
   readonly timestampUtcMs: Scalars["String"]["input"];
   readonly type: Scalars["String"]["input"];
 };
+declare enum AuthDecision {
+  Allow = "ALLOW",
+  Deny = "DENY"
+}
 type ChannelMeta = {
   readonly id: Scalars["String"]["output"];
 };
@@ -1152,6 +1340,12 @@ type DeadLetterInfo = {
   readonly branch: Scalars["String"]["output"];
   readonly documentId: Scalars["String"]["output"];
   readonly error: Scalars["String"]["output"];
+  /**
+   * How the origin classified the failure. A peer needs this to mirror the origin's
+   * quarantine decision; without it a held auth operation would freeze the document
+   * on the peer side while the origin kept syncing.
+   */
+  readonly errorType?: Maybe<Scalars["String"]["output"]>;
   readonly jobId: Scalars["String"]["output"];
   readonly operationCount: Scalars["Int"]["output"];
   readonly scopes: ReadonlyArray<Scalars["String"]["output"]>;
@@ -1211,7 +1405,11 @@ type JobInfo = {
   readonly createdAt: Scalars["DateTime"]["output"];
   readonly error?: Maybe<Scalars["String"]["output"]>;
   readonly id: Scalars["String"]["output"];
-  readonly result: Scalars["JSONObject"]["output"];
+  /**
+   * What the job produced, once it has produced anything. Null until then, which
+   * is the state every job is in when it is handed back from a submission.
+   */
+  readonly result?: Maybe<Scalars["JSONObject"]["output"]>;
   readonly status: Scalars["String"]["output"];
 };
 type MoveRelationshipResult = {
@@ -1224,8 +1422,30 @@ type Mutation = {
   readonly createEmptyDocument: PhDocument;
   readonly deleteDocument: Scalars["Boolean"]["output"];
   readonly deleteDocuments: Scalars["Boolean"]["output"];
-  readonly moveRelationship: MoveRelationshipResult;
-  readonly mutateDocument: PhDocument;
+  /**
+   * Applies actions to a document and waits for the result.
+   *
+   * Each action is coerced against `ActionInput`, so one missing a field the wire
+   * declares is refused before any work starts. The id in particular: it is hashed
+   * into the operation id and replay dedupes by it, so an action without one is
+   * stored under an operation id shared by every id-less operation on the same
+   * document, scope and branch.
+   *
+   * Named for `IReactorClient.execute`, which this is the wire form of. `branch`
+   * defaults to `main`.
+   */
+  readonly execute: PhDocument;
+  /**
+   * Submits actions to a document and returns the job that will apply them.
+   *
+   * Coerced exactly as `execute` is, so a malformed action is refused here rather
+   * than surfacing later as a failed job. Returns the job rather than only its id,
+   * so a caller has the status and the creation time it would otherwise have to
+   * ask for; `result` is null until the job produces one.
+   */
+  readonly executeAsync: JobInfo;
+  readonly moveRelationship: MoveRelationshipResult; /** @deprecated Use execute. Actions here are untyped, so a malformed one is refused by a hand-written check rather than by the schema, and `view.scopes` is accepted but ignored. */
+  readonly mutateDocument: PhDocument; /** @deprecated Use executeAsync, which is typed and returns the job rather than only its id. */
   readonly mutateDocumentAsync: Scalars["String"]["output"];
   readonly pushSyncEnvelopes: Scalars["Boolean"]["output"];
   readonly removeRelationship: PhDocument;
@@ -1255,6 +1475,16 @@ type MutationDeleteDocumentsArgs = {
   identifiers: ReadonlyArray<Scalars["String"]["input"]>;
   propagate?: InputMaybe<PropagationMode>;
 };
+type MutationExecuteArgs = {
+  actions: ReadonlyArray<ActionInput>;
+  branch?: InputMaybe<Scalars["String"]["input"]>;
+  documentIdentifier: Scalars["String"]["input"];
+};
+type MutationExecuteAsyncArgs = {
+  actions: ReadonlyArray<ActionInput>;
+  branch?: InputMaybe<Scalars["String"]["input"]>;
+  documentIdentifier: Scalars["String"]["input"];
+};
 type MutationMoveRelationshipArgs = {
   branch?: InputMaybe<Scalars["String"]["input"]>;
   relationshipType: Scalars["String"]["input"];
@@ -1310,6 +1540,7 @@ type OperationContextInput = {
 };
 type OperationInput = {
   readonly action: ActionInput;
+  readonly deniedReason?: InputMaybe<Scalars["String"]["input"]>;
   readonly error?: InputMaybe<Scalars["String"]["input"]>;
   readonly hash: Scalars["String"]["input"];
   readonly id?: InputMaybe<Scalars["String"]["input"]>;
@@ -1378,8 +1609,47 @@ type Query = {
   readonly documentModels: DocumentModelResultPage;
   readonly documentOperations: ReactorOperationResultPage;
   readonly documentOutgoingRelationships: PhDocumentResultPage;
+  /**
+   * Predicts whether the calling subject would be admitted to execute each of a
+   * set of candidate operations, without submitting any of them. A UI asks this to
+   * disable a control rather than offer an action that fails on submit.
+   *
+   * The answer is a prediction, not a promise:
+   *
+   * - Real admission compiles an append condition over everything it read and the
+   *   store enforces it at write time. A preflight reads no future, so a policy
+   *   change landing between this answer and the submit changes the verdict. The
+   *   submit path stays the only authority.
+   * - The verdict is evaluated at the stream heads, so it is correct for a
+   *   candidate about to be submitted. A backdated submission is out of contract;
+   *   the reactor decides that one by position.
+   * - A candidate whose verdict depends on its input has to carry that input, since
+   *   a conditional grant reads it.
+   *
+   * The subject is the authenticated caller and cannot be named in the request:
+   * answering for an arbitrary subject would disclose what a policy grants
+   * somebody else. It carries both the caller's address and the did:key of the app
+   * instance whose token authenticated the request, so a policy naming either
+   * matches the same principal the write path presents.
+   *
+   * Requires the reactor's authEnforcement feature flag. Without it the reactor
+   * holds no decision model, so this fails with extensions.code
+   * AUTH_EVALUATION_UNSUPPORTED rather than guessing.
+   */
+  readonly evaluateActions: ActionEvaluations;
   readonly findDocuments: PhDocumentResultPage;
   readonly jobStatus?: Maybe<JobInfo>;
+  /**
+   * Polls for sync envelopes from a channel.
+   *
+   * An operation stored before the API required an action id cannot be
+   * represented by this schema, and rather than serving a partial response beside
+   * a bare non-null violation, this fails with extensions.code
+   * MALFORMED_STORED_OPERATION naming the operation. That code means the failure
+   * is worth polling through: the document holding the operation needs repairing,
+   * but the channel serves every other document, and a peer that stopped polling
+   * would stop receiving those too.
+   */
   readonly pollSyncEnvelopes: PollSyncEnvelopesResult;
 };
 type QueryDocumentArgs = {
@@ -1406,6 +1676,11 @@ type QueryDocumentOutgoingRelationshipsArgs = {
   sourceIdentifier: Scalars["String"]["input"];
   view?: InputMaybe<ViewFilterInput>;
 };
+type QueryEvaluateActionsArgs = {
+  branch?: InputMaybe<Scalars["String"]["input"]>;
+  candidates: ReadonlyArray<ActionCandidateInput>;
+  documentIdentifier: Scalars["String"]["input"];
+};
 type QueryFindDocumentsArgs = {
   paging?: InputMaybe<PagingInput>;
   search?: InputMaybe<SearchFilterInput>;
@@ -1421,6 +1696,7 @@ type QueryPollSyncEnvelopesArgs = {
 };
 type ReactorOperation = {
   readonly action: Action;
+  readonly deniedReason?: Maybe<Scalars["String"]["output"]>;
   readonly error?: Maybe<Scalars["String"]["output"]>;
   readonly hash: Scalars["String"]["output"];
   readonly id?: Maybe<Scalars["String"]["output"]>;
@@ -1615,6 +1891,7 @@ type GetDocumentWithOperationsQuery = {
           readonly hash: string;
           readonly skip: number;
           readonly error?: string | null | undefined;
+          readonly deniedReason?: string | null | undefined;
           readonly id?: string | null | undefined;
           readonly action: {
             readonly id: string;
@@ -1742,6 +2019,7 @@ type GetDocumentOperationsQuery = {
       readonly hash: string;
       readonly skip: number;
       readonly error?: string | null | undefined;
+      readonly deniedReason?: string | null | undefined;
       readonly id?: string | null | undefined;
       readonly action: {
         readonly id: string;
@@ -1774,12 +2052,29 @@ type GetJobStatusQuery = {
   readonly jobStatus?: {
     readonly id: string;
     readonly status: string;
-    readonly result: NonNullable<unknown>;
+    readonly result?: NonNullable<unknown> | null | undefined;
     readonly error?: string | null | undefined;
     readonly createdAt: string | Date;
     readonly completedAt?: string | Date | null | undefined;
   } | null | undefined;
 };
+type EvaluateActionsQueryVariables = Exact<{
+  documentIdentifier: Scalars["String"]["input"];
+  branch?: InputMaybe<Scalars["String"]["input"]>;
+  candidates: ReadonlyArray<ActionCandidateInput>;
+}>;
+type EvaluateActionsQuery = {
+  readonly evaluateActions: {
+    readonly allAllowed: boolean;
+    readonly anyAllowed: boolean;
+    readonly allDenied: boolean;
+    readonly anyDenied: boolean;
+    readonly evaluations: ReadonlyArray<{
+      readonly decision: AuthDecision;
+      readonly reason?: string | null | undefined;
+    }>;
+  };
+};
 type CreateDocumentMutationVariables = Exact<{
   document: Scalars["JSONObject"]["input"];
   parentIdentifier?: InputMaybe<Scalars["String"]["input"]>;
@@ -1820,8 +2115,8 @@ type CreateEmptyDocumentMutation = {
 };
 type MutateDocumentMutationVariables = Exact<{
   documentIdentifier: Scalars["String"]["input"];
-  actions: ReadonlyArray<Scalars["JSONObject"]["input"]>;
-  view?: InputMaybe<ViewFilterInput>;
+  actions: ReadonlyArray<ActionInput>;
+  branch?: InputMaybe<Scalars["String"]["input"]>;
 }>;
 type MutateDocumentMutation = {
   readonly mutateDocument: {
@@ -1840,11 +2135,18 @@ type MutateDocumentMutation = {
 };
 type MutateDocumentAsyncMutationVariables = Exact<{
   documentIdentifier: Scalars["String"]["input"];
-  actions: ReadonlyArray<Scalars["JSONObject"]["input"]>;
-  view?: InputMaybe<ViewFilterInput>;
+  actions: ReadonlyArray<ActionInput>;
+  branch?: InputMaybe<Scalars["String"]["input"]>;
 }>;
 type MutateDocumentAsyncMutation = {
-  readonly mutateDocumentAsync: string;
+  readonly mutateDocumentAsync: {
+    readonly id: string;
+    readonly status: string;
+    readonly result?: NonNullable<unknown> | null | undefined;
+    readonly error?: string | null | undefined;
+    readonly createdAt: string | Date;
+    readonly completedAt?: string | Date | null | undefined;
+  };
 };
 type RenameDocumentMutationVariables = Exact<{
   documentIdentifier: Scalars["String"]["input"];
@@ -2039,6 +2341,7 @@ type PollSyncEnvelopesQuery = {
           readonly hash: string;
           readonly skip: number;
           readonly error?: string | null | undefined;
+          readonly deniedReason?: string | null | undefined;
           readonly id?: string | null | undefined;
           readonly action: {
             readonly id: string;
@@ -2078,6 +2381,7 @@ type PollSyncEnvelopesQuery = {
     readonly deadLetters: ReadonlyArray<{
       readonly documentId: string;
       readonly error: string;
+      readonly errorType?: string | null | undefined;
     }>;
   };
 };
@@ -2123,9 +2427,13 @@ type DirectiveResolverFn<TResult = Record<PropertyKey, never>, TParent = Record<
 /** Mapping between all available schema types and the resolvers types */
 type ResolversTypes = ResolversObject<{
   Action: ResolverTypeWrapper<Action>;
+  ActionCandidateInput: ActionCandidateInput;
   ActionContext: ResolverTypeWrapper<ActionContext>;
   ActionContextInput: ActionContextInput;
+  ActionEvaluation: ResolverTypeWrapper<ActionEvaluation>;
+  ActionEvaluations: ResolverTypeWrapper<ActionEvaluations>;
   ActionInput: ActionInput;
+  AuthDecision: AuthDecision;
   Boolean: ResolverTypeWrapper<Scalars["Boolean"]["output"]>;
   ChannelMeta: ResolverTypeWrapper<ChannelMeta>;
   ChannelMetaInput: ChannelMetaInput;
@@ -2181,8 +2489,11 @@ type ResolversTypes = ResolversObject<{
 /** Mapping between all available schema types and the resolvers parents */
 type ResolversParentTypes = ResolversObject<{
   Action: Action;
+  ActionCandidateInput: ActionCandidateInput;
   ActionContext: ActionContext;
   ActionContextInput: ActionContextInput;
+  ActionEvaluation: ActionEvaluation;
+  ActionEvaluations: ActionEvaluations;
   ActionInput: ActionInput;
   Boolean: Scalars["Boolean"]["output"];
   ChannelMeta: ChannelMeta;
@@ -2244,6 +2555,17 @@ type ActionResolvers<ContextType = Context, ParentType extends ResolversParentTy
 type ActionContextResolvers<ContextType = Context, ParentType extends ResolversParentTypes["ActionContext"] = ResolversParentTypes["ActionContext"]> = ResolversObject<{
   signer?: Resolver<Maybe<ResolversTypes["ReactorSigner"]>, ParentType, ContextType>;
 }>;
+type ActionEvaluationResolvers<ContextType = Context, ParentType extends ResolversParentTypes["ActionEvaluation"] = ResolversParentTypes["ActionEvaluation"]> = ResolversObject<{
+  decision?: Resolver<ResolversTypes["AuthDecision"], ParentType, ContextType>;
+  reason?: Resolver<Maybe<ResolversTypes["String"]>, ParentType, ContextType>;
+}>;
+type ActionEvaluationsResolvers<ContextType = Context, ParentType extends ResolversParentTypes["ActionEvaluations"] = ResolversParentTypes["ActionEvaluations"]> = ResolversObject<{
+  allAllowed?: Resolver<ResolversTypes["Boolean"], ParentType, ContextType>;
+  allDenied?: Resolver<ResolversTypes["Boolean"], ParentType, ContextType>;
+  anyAllowed?: Resolver<ResolversTypes["Boolean"], ParentType, ContextType>;
+  anyDenied?: Resolver<ResolversTypes["Boolean"], ParentType, ContextType>;
+  evaluations?: Resolver<ReadonlyArray<ResolversTypes["ActionEvaluation"]>, ParentType, ContextType>;
+}>;
 type ChannelMetaResolvers<ContextType = Context, ParentType extends ResolversParentTypes["ChannelMeta"] = ResolversParentTypes["ChannelMeta"]> = ResolversObject<{
   id?: Resolver<ResolversTypes["String"], ParentType, ContextType>;
 }>;
@@ -2254,6 +2576,7 @@ type DeadLetterInfoResolvers<ContextType = Context, ParentType extends Resolvers
   branch?: Resolver<ResolversTypes["String"], ParentType, ContextType>;
   documentId?: Resolver<ResolversTypes["String"], ParentType, ContextType>;
   error?: Resolver<ResolversTypes["String"], ParentType, ContextType>;
+  errorType?: Resolver<Maybe<ResolversTypes["String"]>, ParentType, ContextType>;
   jobId?: Resolver<ResolversTypes["String"], ParentType, ContextType>;
   operationCount?: Resolver<ResolversTypes["Int"], ParentType, ContextType>;
   scopes?: Resolver<ReadonlyArray<ResolversTypes["String"]>, ParentType, ContextType>;
@@ -2299,7 +2622,7 @@ type JobInfoResolvers<ContextType = Context, ParentType extends ResolversParentT
   createdAt?: Resolver<ResolversTypes["DateTime"], ParentType, ContextType>;
   error?: Resolver<Maybe<ResolversTypes["String"]>, ParentType, ContextType>;
   id?: Resolver<ResolversTypes["String"], ParentType, ContextType>;
-  result?: Resolver<ResolversTypes["JSONObject"], ParentType, ContextType>;
+  result?: Resolver<Maybe<ResolversTypes["JSONObject"]>, ParentType, ContextType>;
   status?: Resolver<ResolversTypes["String"], ParentType, ContextType>;
 }>;
 type MoveRelationshipResultResolvers<ContextType = Context, ParentType extends ResolversParentTypes["MoveRelationshipResult"] = ResolversParentTypes["MoveRelationshipResult"]> = ResolversObject<{
@@ -2312,6 +2635,8 @@ type MutationResolvers<ContextType = Context, ParentType extends ResolversParent
   createEmptyDocument?: Resolver<ResolversTypes["PHDocument"], ParentType, ContextType, RequireFields<MutationCreateEmptyDocumentArgs, "documentType">>;
   deleteDocument?: Resolver<ResolversTypes["Boolean"], ParentType, ContextType, RequireFields<MutationDeleteDocumentArgs, "identifier">>;
   deleteDocuments?: Resolver<ResolversTypes["Boolean"], ParentType, ContextType, RequireFields<MutationDeleteDocumentsArgs, "identifiers">>;
+  execute?: Resolver<ResolversTypes["PHDocument"], ParentType, ContextType, RequireFields<MutationExecuteArgs, "actions" | "documentIdentifier">>;
+  executeAsync?: Resolver<ResolversTypes["JobInfo"], ParentType, ContextType, RequireFields<MutationExecuteAsyncArgs, "actions" | "documentIdentifier">>;
   moveRelationship?: Resolver<ResolversTypes["MoveRelationshipResult"], ParentType, ContextType, RequireFields<MutationMoveRelationshipArgs, "relationshipType" | "sourceParentIdentifier" | "targetIdentifier" | "targetParentIdentifier">>;
   mutateDocument?: Resolver<ResolversTypes["PHDocument"], ParentType, ContextType, RequireFields<MutationMutateDocumentArgs, "actions" | "documentIdentifier">>;
   mutateDocumentAsync?: Resolver<ResolversTypes["String"], ParentType, ContextType, RequireFields<MutationMutateDocumentAsyncArgs, "actions" | "documentIdentifier">>;
@@ -2363,12 +2688,14 @@ type QueryResolvers<ContextType = Context, ParentType extends ResolversParentTyp
   documentModels?: Resolver<ResolversTypes["DocumentModelResultPage"], ParentType, ContextType, Partial<QueryDocumentModelsArgs>>;
   documentOperations?: Resolver<ResolversTypes["ReactorOperationResultPage"], ParentType, ContextType, RequireFields<QueryDocumentOperationsArgs, "filter">>;
   documentOutgoingRelationships?: Resolver<ResolversTypes["PHDocumentResultPage"], ParentType, ContextType, RequireFields<QueryDocumentOutgoingRelationshipsArgs, "relationshipType" | "sourceIdentifier">>;
+  evaluateActions?: Resolver<ResolversTypes["ActionEvaluations"], ParentType, ContextType, RequireFields<QueryEvaluateActionsArgs, "candidates" | "documentIdentifier">>;
   findDocuments?: Resolver<ResolversTypes["PHDocumentResultPage"], ParentType, ContextType, Partial<QueryFindDocumentsArgs>>;
   jobStatus?: Resolver<Maybe<ResolversTypes["JobInfo"]>, ParentType, ContextType, RequireFields<QueryJobStatusArgs, "jobId">>;
   pollSyncEnvelopes?: Resolver<ResolversTypes["PollSyncEnvelopesResult"], ParentType, ContextType, RequireFields<QueryPollSyncEnvelopesArgs, "channelId" | "outboxAck" | "outboxLatest">>;
 }>;
 type ReactorOperationResolvers<ContextType = Context, ParentType extends ResolversParentTypes["ReactorOperation"] = ResolversParentTypes["ReactorOperation"]> = ResolversObject<{
   action?: Resolver<ResolversTypes["Action"], ParentType, ContextType>;
+  deniedReason?: Resolver<Maybe<ResolversTypes["String"]>, ParentType, ContextType>;
   error?: Resolver<Maybe<ResolversTypes["String"]>, ParentType, ContextType>;
   hash?: Resolver<ResolversTypes["String"], ParentType, ContextType>;
   id?: Resolver<Maybe<ResolversTypes["String"]>, ParentType, ContextType>;
@@ -2425,6 +2752,8 @@ type TouchChannelResultResolvers<ContextType = Context, ParentType extends Resol
 type Resolvers<ContextType = Context> = ResolversObject<{
   Action?: ActionResolvers<ContextType>;
   ActionContext?: ActionContextResolvers<ContextType>;
+  ActionEvaluation?: ActionEvaluationResolvers<ContextType>;
+  ActionEvaluations?: ActionEvaluationsResolvers<ContextType>;
   ChannelMeta?: ChannelMetaResolvers<ContextType>;
   DateTime?: GraphQLScalarType;
   DeadLetterInfo?: DeadLetterInfoResolvers<ContextType>;
@@ -2459,9 +2788,11 @@ type Properties<T> = Required<{ [K in keyof T]: z$1.ZodType<T[K]> }>;
 type definedNonNullAny = {};
 declare const isDefinedNonNullAny: (v: any) => v is definedNonNullAny;
 declare const definedNonNullAnySchema: z$1.ZodAny & z$1.ZodType<definedNonNullAny, any, z$1.core.$ZodTypeInternals<definedNonNullAny, any>>;
+declare const AuthDecisionSchema: z$1.ZodEnum<typeof AuthDecision>;
 declare const DocumentChangeTypeSchema: z$1.ZodEnum<typeof DocumentChangeType>;
 declare const PropagationModeSchema: z$1.ZodEnum<typeof PropagationMode>;
 declare const SyncEnvelopeTypeSchema: z$1.ZodEnum<typeof SyncEnvelopeType>;
+declare function ActionCandidateInputSchema(): z$1.ZodObject<Properties<ActionCandidateInput>>;
 declare function ActionContextInputSchema(): z$1.ZodObject<Properties<ActionContextInput>>;
 declare function ActionInputSchema(): z$1.ZodObject<Properties<ActionInput>>;
 declare function ChannelMetaInputSchema(): z$1.ZodObject<Properties<ChannelMetaInput>>;
@@ -2489,6 +2820,7 @@ declare const GetDocumentIncomingRelationshipsDocument: DocumentNode;
 declare const FindDocumentsDocument: DocumentNode;
 declare const GetDocumentOperationsDocument: DocumentNode;
 declare const GetJobStatusDocument: DocumentNode;
+declare const EvaluateActionsDocument: DocumentNode;
 declare const CreateDocumentDocument: DocumentNode;
 declare const CreateEmptyDocumentDocument: DocumentNode;
 declare const MutateDocumentDocument: DocumentNode;
@@ -2515,6 +2847,7 @@ declare function getSdk<C>(requester: Requester<C>): {
   FindDocuments(variables?: FindDocumentsQueryVariables, options?: C): Promise<FindDocumentsQuery>;
   GetDocumentOperations(variables: GetDocumentOperationsQueryVariables, options?: C): Promise<GetDocumentOperationsQuery>;
   GetJobStatus(variables: GetJobStatusQueryVariables, options?: C): Promise<GetJobStatusQuery>;
+  EvaluateActions(variables: EvaluateActionsQueryVariables, options?: C): Promise<EvaluateActionsQuery>;
   CreateDocument(variables: CreateDocumentMutationVariables, options?: C): Promise<CreateDocumentMutation>;
   CreateEmptyDocument(variables: CreateEmptyDocumentMutationVariables, options?: C): Promise<CreateEmptyDocumentMutation>;
   MutateDocument(variables: MutateDocumentMutationVariables, options?: C): Promise<MutateDocumentMutation>;
@@ -2577,6 +2910,11 @@ declare function createReactorGraphQLClient(url: string, fetchImpl?: FetchLike,
   GetJobStatus(variables: Exact<{
     jobId: Scalars["String"]["input"];
   }>, options?: {} | undefined): Promise<GetJobStatusQuery>;
+  EvaluateActions(variables: Exact<{
+    documentIdentifier: Scalars["String"]["input"];
+    branch?: InputMaybe<Scalars["String"]["input"]>;
+    candidates: ReadonlyArray<ActionCandidateInput>;
+  }>, options?: {} | undefined): Promise<EvaluateActionsQuery>;
   CreateDocument(variables: Exact<{
     document: Scalars["JSONObject"]["input"];
     parentIdentifier?: InputMaybe<Scalars["String"]["input"]>;
@@ -2587,13 +2925,13 @@ declare function createReactorGraphQLClient(url: string, fetchImpl?: FetchLike,
   }>, options?: {} | undefined): Promise<CreateEmptyDocumentMutation>;
   MutateDocument(variables: Exact<{
     documentIdentifier: Scalars["String"]["input"];
-    actions: ReadonlyArray<Scalars["JSONObject"]["input"]>;
-    view?: InputMaybe<ViewFilterInput>;
+    actions: ReadonlyArray<ActionInput>;
+    branch?: InputMaybe<Scalars["String"]["input"]>;
   }>, options?: {} | undefined): Promise<MutateDocumentMutation>;
   MutateDocumentAsync(variables: Exact<{
     documentIdentifier: Scalars["String"]["input"];
-    actions: ReadonlyArray<Scalars["JSONObject"]["input"]>;
-    view?: InputMaybe<ViewFilterInput>;
+    actions: ReadonlyArray<ActionInput>;
+    branch?: InputMaybe<Scalars["String"]["input"]>;
   }>, options?: {} | undefined): Promise<MutateDocumentAsyncMutation>;
   RenameDocument(variables: Exact<{
     documentIdentifier: Scalars["String"]["input"];
@@ -2708,6 +3046,7 @@ declare class ImportPackageLoader implements IPackageLoader {
   private readonly logger;
   readonly name = "ImportPackageLoader";
   loadDocumentModels(identifier: string): Promise<DocumentModelModule[]>;
+  loadUpgradeManifests(identifier: string): Promise<UpgradeManifest<readonly number[]>[]>;
   loadSubgraphs(identifier: string): Promise<SubgraphClass$1[]>;
   loadProcessors(identifier: string): Promise<ProcessorFactoryBuilder | null>;
 }
@@ -2727,11 +3066,13 @@ declare class ImportPackageLoader implements IPackageLoader {
  */
 declare function isExpectedLoaderMiss(error: unknown, pkg: string): boolean;
 declare function getUniqueDocumentModels(...documentModels: readonly (readonly DocumentModelModule<any>[])[]): DocumentModelModule[];
+declare function getUniqueUpgradeManifests(...upgradeManifests: readonly (readonly UpgradeManifest<readonly number[]>[])[]): UpgradeManifest<readonly number[]>[];
 declare class PackageManager implements IPackageManager {
   protected options: IPackageManagerOptions;
   private readonly logger;
   private loaders;
   private docModelsMap;
+  private upgradeManifestsMap;
   private subgraphsMap;
   private processorMap;
   private configWatcher;
@@ -2741,6 +3082,9 @@ declare class PackageManager implements IPackageManager {
   init(): Promise<PackageManagerResult>;
   private loadPackages;
   private loadDocumentModels;
+  /** Upgrade manifests currently loaded across all packages, one per type. */
+  getUniqueUpgradeManifests(): UpgradeManifest<readonly number[]>[];
+  private loadUpgradeManifests;
   private loadSubgraphs;
   private loadProcessors;
   private maybeWarnAllLoadersFailed;
@@ -2757,6 +3101,27 @@ declare class PackageManager implements IPackageManager {
   onProcessorsChange(handler: (processors: Map<string, Processor$1>) => void): void;
 }
 //#endregion
+//#region src/services/renown-config.d.ts
+/** Where the credential check reads from: a remote Renown or Switchboard
+ * instance, or this switchboard's own renown read model. */
+type RenownSource = NonNullable<PHReactorRenown["source"]>;
+/** The `auth.renown` config block: which Renown instance to authenticate
+ * against, before env overrides are applied. */
+type RenownConfig = PHReactorRenown;
+/** Resolved renown coordinates. `url` also drives this reactor's own identity,
+ * so it stays meaningful when `source` is "self". */
+type ResolvedRenownConfig = {
+  source: RenownSource;
+  url: string | undefined;
+  switchboardUrl: string | undefined;
+};
+/** Reading credentials from this reactor's own read model needs a host-supplied
+ * verifier: core has no idea which subgraph serves that read model. */
+declare function assertCredentialVerifierForSource(source: RenownSource, hasVerifier: boolean): void;
+/** Resolve `auth.renown`; RENOWN_SOURCE / RENOWN_URL / SWITCHBOARD_URL win
+ * over the config file, which wins over the SDK defaults. */
+declare function resolveRenownConfig(configured: RenownConfig | undefined, env: NodeJS.ProcessEnv, logger: ILogger): ResolvedRenownConfig;
+//#endregion
 //#region src/server.d.ts
 type Options = {
   port?: number;
@@ -2775,6 +3140,12 @@ type Options = {
     enabled: boolean;
     admins: string[];
   };
+  /** Renown coordinates the host already resolved, used verbatim instead of
+   * resolving `auth.renown` and the env again (which would warn twice). */
+  renown?: ResolvedRenownConfig;
+  /** Credential check replacing the built-in remote Renown one; required when
+   * the resolved source is "self" (see assertCredentialVerifierForSource). */
+  verifyCredential?: CredentialVerifier;
   https?: {
     keyPath: string;
     certPath: string;
@@ -2830,14 +3201,28 @@ declare function assertSkipCredentialVerificationAllowed(authEnabled: boolean, s
 interface ClientInitializerResult {
   module: InProcessReactorClientModule;
   reactorDriveClient?: IDriveClient;
+  attachmentReferenceProjection?: AttachmentReferenceProjectionCapability;
 }
-declare function initializeAndStartAPI(clientInitializer: (documentModels: DocumentModelModule[]) => Promise<ClientInitializerResult>, options: Options, processorApp: ProcessorApp): Promise<API & {
+interface ClientInitializerDependencies {
+  attachmentReferenceWriter: IAttachmentReferenceWriter;
+  /** Upgrade manifests exported by the loaded packages, one per type. */
+  upgradeManifests: UpgradeManifest<readonly number[]>[];
+}
+declare function initializeAndStartAPI(clientInitializer: (documentModels: DocumentModelModule[], dependencies: ClientInitializerDependencies) => Promise<ClientInitializerResult>, options: Options, processorApp: ProcessorApp): Promise<API & {
   client: IReactorClient;
   syncManager: ISyncManager;
   documentModelRegistry: IDocumentModelRegistry;
   readiness: ReadinessGate;
+  attachmentReferenceProjection: AttachmentReferenceProjectionCapability;
 }>;
 //#endregion
+//#region src/services/renown-credential-verifier.d.ts
+interface RenownCredentialVerifierConfig {
+  renownUrl?: string;
+  switchboardUrl?: string;
+}
+declare function createRenownCredentialVerifier(config?: RenownCredentialVerifierConfig): Promise<CredentialVerifier>;
+//#endregion
 //#region src/utils/create-schema.d.ts
 declare const buildSubgraphSchemaModule: (documentModels: DocumentModelModule[], resolvers: GraphQLResolverMap<Context$1>, typeDefs: DocumentNode) => GraphQLSchemaModule;
 declare const createSchema: (documentModels: DocumentModelModule[], resolvers: GraphQLResolverMap<Context$1>, typeDefs: DocumentNode) => graphql.GraphQLSchema;
@@ -2871,5 +3256,5 @@ interface DocumentModelSchemaOptions {
  */
 declare function generateDocumentModelSchema(documentModel: DocumentModelGlobalState$1, options?: DocumentModelSchemaOptions): DocumentNode;
 //#endregion
-export { ADMIN_USERS, API, Action, ActionContext, ActionContextInput, ActionContextInputSchema, ActionContextResolvers, ActionInput, ActionInputSchema, ActionResolvers, AddRelationshipDocument, AddRelationshipMutation, AddRelationshipMutationVariables, AnalyticsSubgraph, AuthConfig, AuthContext, AuthFetchMiddleware, AuthService, AuthSubgraph, type AuthorizationConfig, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, type CanonicalDocumentId, ChannelMeta, ChannelMetaInput, ChannelMetaInputSchema, ChannelMetaResolvers, ClientInitializerResult, Context, CreateDocumentDocument, CreateDocumentMutation, CreateDocumentMutationVariables, CreateEmptyDocumentDocument, CreateEmptyDocumentMutation, CreateEmptyDocumentMutationVariables, DateTimeScalarConfig, DbClient, DeadLetterInfo, DeadLetterInfoResolvers, DeleteDocumentDocument, DeleteDocumentMutation, DeleteDocumentMutationVariables, DeleteDocumentsDocument, DeleteDocumentsMutation, DeleteDocumentsMutationVariables, DirectiveResolverFn, DocumentChangeContext, DocumentChangeContextResolvers, DocumentChangeEvent, DocumentChangeEventResolvers, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentChangesSubscription, DocumentChangesSubscriptionVariables, DocumentModelGlobalState, DocumentModelGlobalStateResolvers, DocumentModelResultPage, DocumentModelResultPageResolvers, DocumentModelSchemaOptions, DocumentOperationsFilterInput, DocumentOperationsFilterInputSchema, DocumentPermissionConfig, DocumentPermissionDatabase, DocumentPermissionEntry, DocumentPermissionLevel, DocumentPermissionService, DocumentPermissionTable, DocumentProtectionTable, DocumentWithChildren, DocumentWithChildrenResolvers, Exact, FetchHandler, FindDocumentsDocument, FindDocumentsQuery, FindDocumentsQueryVariables, GatewayAdapterType, GatewayContextFactory, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentIncomingRelationshipsQuery, GetDocumentIncomingRelationshipsQueryVariables, GetDocumentModelsDocument, GetDocumentModelsQuery, GetDocumentModelsQueryVariables, GetDocumentOperationsDocument, GetDocumentOperationsQuery, GetDocumentOperationsQueryVariables, GetDocumentOutgoingRelationshipsDocument, GetDocumentOutgoingRelationshipsQuery, GetDocumentOutgoingRelationshipsQueryVariables, GetDocumentQuery, GetDocumentQueryVariables, GetDocumentWithOperationsDocument, GetDocumentWithOperationsQuery, GetDocumentWithOperationsQueryVariables, GetJobStatusDocument, GetJobStatusQuery, GetJobStatusQueryVariables, GetParentIdsFn, GqlDocument, GqlDriveDocument, GqlOperation, GqlOperationContext, GqlSigner, GqlSignerApp, GqlSignerUser, GraphQLManager, GraphqlManagerFeatureFlags, HttpAdapterSetup, HttpAdapterType, HttpDocumentModelLoader, HttpPackageLoader, HttpPackageLoaderLogger, HttpPackageLoaderOptions, type IAuthorizationService, IGatewayAdapter, IHttpAdapter, type IPackageLoader, type IPackageLoaderOptions, IPackageStorage, IReactorProcessorHostModule, ISubgraph, ImportPackageLoader, InMemoryPackageStorage, Incremental, InputMaybe, InstallPackageResult, InstalledPackageInfo, IsTypeOfResolverFn, JobChangeEvent, JobChangeEventResolvers, JobChangesDocument, JobChangesSubscription, JobChangesSubscriptionVariables, JobInfo, JobInfoResolvers, JsonObjectScalarConfig, MakeEmpty, MakeMaybe, MakeOptional, Maybe, MoveRelationshipDocument, MoveRelationshipMutation, MoveRelationshipMutationVariables, MoveRelationshipResult, MoveRelationshipResultResolvers, MutateDocumentAsyncDocument, MutateDocumentAsyncMutation, MutateDocumentAsyncMutationVariables, MutateDocumentDocument, MutateDocumentMutation, MutateDocumentMutationVariables, Mutation, MutationAddRelationshipArgs, MutationCreateDocumentArgs, MutationCreateEmptyDocumentArgs, MutationDeleteDocumentArgs, MutationDeleteDocumentsArgs, MutationMoveRelationshipArgs, MutationMutateDocumentArgs, MutationMutateDocumentAsyncArgs, MutationPushSyncEnvelopesArgs, MutationRemoveRelationshipArgs, MutationRenameDocumentArgs, MutationResolvers, MutationSetPreferredEditorArgs, MutationTouchChannelArgs, NextResolverFn, OperationContext, OperationContextInput, OperationContextInputSchema, OperationContextResolvers, OperationInput, OperationInputSchema, OperationUserPermissionEntry, OperationUserPermissionTable, OperationWithContext, OperationWithContextInput, OperationWithContextInputSchema, OperationWithContextResolvers, OperationsFilterInput, OperationsFilterInputSchema, PackageManagementService, PackageManagementServiceOptions, PackageManager, PackagesSubgraph, type PackagesSubgraphArgs, PagingInput, PagingInputSchema, type ParsedDriveUrl, PgliteFactory, PhDocument, PhDocumentFieldsFragment, PhDocumentFieldsFragmentDoc, PhDocumentOperationsArgs, PhDocumentResolvers, PhDocumentResultPage, PhDocumentResultPageResolvers, PollSyncEnvelopesDocument, PollSyncEnvelopesQuery, PollSyncEnvelopesQueryVariables, PollSyncEnvelopesResult, PollSyncEnvelopesResultResolvers, Processor, ProcessorDriveFactory, ProcessorFactoryBuilder, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, PushSyncEnvelopesMutation, PushSyncEnvelopesMutationVariables, Query, QueryDocumentArgs, QueryDocumentIncomingRelationshipsArgs, QueryDocumentModelsArgs, QueryDocumentOperationsArgs, QueryDocumentOutgoingRelationshipsArgs, QueryFindDocumentsArgs, QueryJobStatusArgs, QueryPollSyncEnvelopesArgs, QueryResolvers, ReactorModule, ReactorOperation, ReactorOperationResolvers, ReactorOperationResultPage, ReactorOperationResultPageResolvers, ReactorSigner, ReactorSignerApp, ReactorSignerAppInput, ReactorSignerAppInputSchema, ReactorSignerAppResolvers, ReactorSignerInput, ReactorSignerInputSchema, ReactorSignerResolvers, ReactorSignerUser, ReactorSignerUserInput, ReactorSignerUserInputSchema, ReactorSignerUserResolvers, ReactorSubgraph, ReadinessGate, RemoteCursor, RemoteCursorInput, RemoteCursorInputSchema, RemoteCursorResolvers, RemoteFilterInput, RemoteFilterInputSchema, RemoveRelationshipDocument, RemoveRelationshipMutation, RemoveRelationshipMutationVariables, RenameDocumentDocument, RenameDocumentMutation, RenameDocumentMutationVariables, Requester, RequireFields, Resolver, ResolverFn, ResolverTypeWrapper, ResolverWithResolve, Resolvers, ResolversObject, ResolversParentTypes, ResolversTypes, Revision, RevisionResolvers, Scalars, Sdk, SearchFilterInput, SearchFilterInputSchema, SetPreferredEditorDocument, SetPreferredEditorMutation, SetPreferredEditorMutationVariables, SubgraphArgs, SubgraphClass, SubgraphDefinition, Subscription, SubscriptionDocumentChangesArgs, SubscriptionJobChangesArgs, SubscriptionObject, SubscriptionResolveFn, SubscriptionResolver, SubscriptionResolverObject, SubscriptionResolvers, SubscriptionSubscribeFn, SubscriptionSubscriberObject, SyncEnvelope, SyncEnvelopeInput, SyncEnvelopeInputSchema, SyncEnvelopeResolvers, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TlsOptions, TouchChannelDocument, TouchChannelInput, TouchChannelInputSchema, TouchChannelMutation, TouchChannelMutationVariables, TouchChannelResult, TouchChannelResultResolvers, TypeResolveFn, User, ViewFilterInput, ViewFilterInputSchema, WithIndex, WsContextFactory, WsDisposer, assertAuthRequiredForDocumentPermissions, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
+export { ADMIN_USERS, API, Action, ActionCandidateInput, ActionCandidateInputSchema, ActionContext, ActionContextInput, ActionContextInputSchema, ActionContextResolvers, ActionEvaluation, ActionEvaluationResolvers, ActionEvaluations, ActionEvaluationsResolvers, ActionInput, ActionInputSchema, ActionResolvers, AddRelationshipDocument, AddRelationshipMutation, AddRelationshipMutationVariables, AnalyticsSubgraph, AttachmentAccessRequest, AttachmentAccessResult, AttachmentAccessService, type AttachmentReferenceProjectionCapability, AuthConfig, AuthContext, AuthDecision, AuthDecisionSchema, AuthFetchMiddleware, AuthService, AuthSubgraph, type AuthorizationConfig, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, type CanonicalDocumentId, CanonicalDocumentIdResolutionError, CanonicalDocumentIdResolver, ChannelMeta, ChannelMetaInput, ChannelMetaInputSchema, ChannelMetaResolvers, ClientInitializerDependencies, ClientInitializerResult, Context, CreateDocumentDocument, CreateDocumentMutation, CreateDocumentMutationVariables, CreateEmptyDocumentDocument, CreateEmptyDocumentMutation, CreateEmptyDocumentMutationVariables, CredentialVerifier, DateTimeScalarConfig, DbClient, DeadLetterInfo, DeadLetterInfoResolvers, DeleteDocumentDocument, DeleteDocumentMutation, DeleteDocumentMutationVariables, DeleteDocumentsDocument, DeleteDocumentsMutation, DeleteDocumentsMutationVariables, DirectiveResolverFn, DocumentChangeContext, DocumentChangeContextResolvers, DocumentChangeEvent, DocumentChangeEventResolvers, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentChangesSubscription, DocumentChangesSubscriptionVariables, DocumentModelGlobalState, DocumentModelGlobalStateResolvers, DocumentModelResultPage, DocumentModelResultPageResolvers, DocumentModelSchemaOptions, DocumentOperationsFilterInput, DocumentOperationsFilterInputSchema, DocumentPermissionConfig, DocumentPermissionDatabase, DocumentPermissionEntry, DocumentPermissionLevel, DocumentPermissionService, DocumentPermissionTable, DocumentProtectionTable, DocumentWithChildren, DocumentWithChildrenResolvers, EvaluateActionsDocument, EvaluateActionsQuery, EvaluateActionsQueryVariables, Exact, FetchHandler, FindDocumentsDocument, FindDocumentsQuery, FindDocumentsQueryVariables, GatewayAdapterType, GatewayContextFactory, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentIncomingRelationshipsQuery, GetDocumentIncomingRelationshipsQueryVariables, GetDocumentModelsDocument, GetDocumentModelsQuery, GetDocumentModelsQueryVariables, GetDocumentOperationsDocument, GetDocumentOperationsQuery, GetDocumentOperationsQueryVariables, GetDocumentOutgoingRelationshipsDocument, GetDocumentOutgoingRelationshipsQuery, GetDocumentOutgoingRelationshipsQueryVariables, GetDocumentQuery, GetDocumentQueryVariables, GetDocumentWithOperationsDocument, GetDocumentWithOperationsQuery, GetDocumentWithOperationsQueryVariables, GetJobStatusDocument, GetJobStatusQuery, GetJobStatusQueryVariables, GetParentIdsFn, GqlDocument, GqlDriveDocument, GqlOperation, GqlOperationContext, GqlSigner, GqlSignerApp, GqlSignerUser, GraphQLManager, GraphqlManagerFeatureFlags, HttpAdapterSetup, HttpAdapterType, HttpDocumentModelLoader, HttpPackageLoader, HttpPackageLoaderLogger, HttpPackageLoaderOptions, IAttachmentAccessService, type IAuthorizationService, IGatewayAdapter, IHttpAdapter, type IPackageLoader, type IPackageLoaderOptions, IPackageStorage, IProcessorHostModule, IReactorProcessorHostModule, ISubgraph, ImportPackageLoader, InMemoryPackageStorage, Incremental, InputMaybe, InstallPackageResult, InstalledPackageInfo, IsTypeOfResolverFn, JobChangeEvent, JobChangeEventResolvers, JobChangesDocument, JobChangesSubscription, JobChangesSubscriptionVariables, JobInfo, JobInfoResolvers, JsonObjectScalarConfig, MakeEmpty, MakeMaybe, MakeOptional, Maybe, MoveRelationshipDocument, MoveRelationshipMutation, MoveRelationshipMutationVariables, MoveRelationshipResult, MoveRelationshipResultResolvers, MutateDocumentAsyncDocument, MutateDocumentAsyncMutation, MutateDocumentAsyncMutationVariables, MutateDocumentDocument, MutateDocumentMutation, MutateDocumentMutationVariables, Mutation, MutationAddRelationshipArgs, MutationCreateDocumentArgs, MutationCreateEmptyDocumentArgs, MutationDeleteDocumentArgs, MutationDeleteDocumentsArgs, MutationExecuteArgs, MutationExecuteAsyncArgs, MutationMoveRelationshipArgs, MutationMutateDocumentArgs, MutationMutateDocumentAsyncArgs, MutationPushSyncEnvelopesArgs, MutationRemoveRelationshipArgs, MutationRenameDocumentArgs, MutationResolvers, MutationSetPreferredEditorArgs, MutationTouchChannelArgs, NextResolverFn, OperationContext, OperationContextInput, OperationContextInputSchema, OperationContextResolvers, OperationInput, OperationInputSchema, OperationUserPermissionEntry, OperationUserPermissionTable, OperationWithContext, OperationWithContextInput, OperationWithContextInputSchema, OperationWithContextResolvers, OperationsFilterInput, OperationsFilterInputSchema, PGLITE_UTC_PARSERS, PackageManagementService, PackageManagementServiceOptions, PackageManager, PackagesSubgraph, type PackagesSubgraphArgs, PagingInput, PagingInputSchema, type ParsedDriveUrl, PgliteFactory, PhDocument, PhDocumentFieldsFragment, PhDocumentFieldsFragmentDoc, PhDocumentOperationsArgs, PhDocumentResolvers, PhDocumentResultPage, PhDocumentResultPageResolvers, PollSyncEnvelopesDocument, PollSyncEnvelopesQuery, PollSyncEnvelopesQueryVariables, PollSyncEnvelopesResult, PollSyncEnvelopesResultResolvers, Processor, ProcessorDriveFactory, ProcessorFactoryBuilder, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, PushSyncEnvelopesMutation, PushSyncEnvelopesMutationVariables, Query, QueryDocumentArgs, QueryDocumentIncomingRelationshipsArgs, QueryDocumentModelsArgs, QueryDocumentOperationsArgs, QueryDocumentOutgoingRelationshipsArgs, QueryEvaluateActionsArgs, QueryFindDocumentsArgs, QueryJobStatusArgs, QueryPollSyncEnvelopesArgs, QueryResolvers, ReactorModule, ReactorOperation, ReactorOperationResolvers, ReactorOperationResultPage, ReactorOperationResultPageResolvers, ReactorSigner, ReactorSignerApp, ReactorSignerAppInput, ReactorSignerAppInputSchema, ReactorSignerAppResolvers, ReactorSignerInput, ReactorSignerInputSchema, ReactorSignerResolvers, ReactorSignerUser, ReactorSignerUserInput, ReactorSignerUserInputSchema, ReactorSignerUserResolvers, ReactorSubgraph, ReadinessGate, RemoteCursor, RemoteCursorInput, RemoteCursorInputSchema, RemoteCursorResolvers, RemoteFilterInput, RemoteFilterInputSchema, RemoveRelationshipDocument, RemoveRelationshipMutation, RemoveRelationshipMutationVariables, RenameDocumentDocument, RenameDocumentMutation, RenameDocumentMutationVariables, RenownConfig, RenownCredentialVerifierConfig, RenownSource, Requester, RequireFields, ResolvedRenownConfig, Resolver, ResolverFn, ResolverTypeWrapper, ResolverWithResolve, Resolvers, ResolversObject, ResolversParentTypes, ResolversTypes, Revision, RevisionResolvers, Scalars, Sdk, SearchFilterInput, SearchFilterInputSchema, SetPreferredEditorDocument, SetPreferredEditorMutation, SetPreferredEditorMutationVariables, SubgraphArgs, SubgraphClass, SubgraphDefinition, Subscription, SubscriptionDocumentChangesArgs, SubscriptionJobChangesArgs, SubscriptionObject, SubscriptionResolveFn, SubscriptionResolver, SubscriptionResolverObject, SubscriptionResolvers, SubscriptionSubscribeFn, SubscriptionSubscriberObject, SyncEnvelope, SyncEnvelopeInput, SyncEnvelopeInputSchema, SyncEnvelopeResolvers, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TlsOptions, TouchChannelDocument, TouchChannelInput, TouchChannelInputSchema, TouchChannelMutation, TouchChannelMutationVariables, TouchChannelResult, TouchChannelResultResolvers, TypeResolveFn, User, ViewFilterInput, ViewFilterInputSchema, WithIndex, WsContextFactory, WsDisposer, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground, resolveRenownConfig };
 //# sourceMappingURL=index.d.mts.map