@powerhousedao/reactor-api 6.2.2-dev.9 → 6.2.2-staging.0

package/dist/index.d.mts

@@ -1,26 +1,27 @@
-import { i as IPackageManagerOptions, n as IPackageLoaderOptions, r as IPackageManager, s as PackageManagerResult, t as IPackageLoader } from "./types-DnHgkahK.mjs";
+import { i as IPackageManagerOptions, n as IPackageLoaderOptions, r as IPackageManager, s as PackageManagerResult, t as IPackageLoader } from "./types-Bz2niABC.mjs";
 import { IAnalyticsStore } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel } from "@powerhousedao/analytics-engine-graphql";
 import * as graphql from "graphql";
 import { DocumentNode, GraphQLResolveInfo, GraphQLScalarType, GraphQLScalarTypeConfig, GraphQLSchema } from "graphql";
-import { IDocumentModelLoader, IDocumentModelRegistry, IDriveClient, IReactorClient, IRelationalDb, ISyncManager, InProcessReactorClientModule, ParsedDriveUrl, driveIdFromUrl, parseDriveUrl } from "@powerhousedao/reactor";
+import { AttachmentRef, IDocumentModelLoader, IDocumentModelRegistry, IDriveClient, IReactorClient, IReactorProcessorHostModuleBase, IRelationalDb, ISyncManager, InProcessReactorClientModule, ParsedDriveUrl, ProcessorFactoryBuilder as ProcessorFactoryBuilder$1, SyncScopeGate, driveIdFromUrl, parseDriveUrl } from "@powerhousedao/reactor";
 import { ILogger } from "document-model";
-import { DocumentModelGlobalState as DocumentModelGlobalState$1, DocumentModelModule, Operation, PHDocument, PHDocumentHeader } from "@powerhousedao/shared/document-model";
+import { GraphQLResolverMap, GraphQLSchemaModule } from "@apollo/subgraph";
+import { AuthSubject, DocumentModelGlobalState as DocumentModelGlobalState$1, DocumentModelModule, Operation, PHDocument, UpgradeManifest } from "@powerhousedao/shared/document-model";
 import * as z$1 from "zod";
 import { DocumentDriveDocument, DocumentDriveGlobalState } from "@powerhousedao/shared/document-drive";
-import { AttachmentBuildResult } from "@powerhousedao/reactor-attachments";
+import { AttachmentBuildResult, AttachmentReferenceIndexBuildResult, IAttachmentReferenceReader, IAttachmentReferenceWriter } from "@powerhousedao/reactor-attachments";
 import { IAttachmentClient } from "@powerhousedao/reactor-attachments/client";
 import { WebSocketServer } from "ws";
-import { IProcessorHostModule, IRelationalDb as IRelationalDb$1, ProcessorApp, ProcessorRecord } from "@powerhousedao/shared/processors";
+import { IRelationalDb as IRelationalDb$1, ProcessorApp, ProcessorFactory } from "@powerhousedao/shared/processors";
 import { Generated, Kysely } from "kysely";
 import { PGlite } from "@electric-sql/pglite";
 import { Knex } from "knex";
 import http from "node:http";
 import { CorsOptions } from "cors";
-import { GraphQLResolverMap, GraphQLSchemaModule } from "@apollo/subgraph/dist/schema-helper/resolverMap.js";
 import { Context as Context$1, GqlDocument as GqlDocument$1, GqlDriveDocument as GqlDriveDocument$1, GqlOperation as GqlOperation$1, GraphQLManager as GraphQLManager$1, ISubgraph as ISubgraph$1, Processor as Processor$1, SubgraphArgs as SubgraphArgs$1, SubgraphClass as SubgraphClass$1 } from "@powerhousedao/reactor-api";
 import { IncomingHttpHeaders } from "http";
 import { Pool } from "pg";
+import { PHReactorRenown } from "@powerhousedao/shared/clis";
 
 //#region src/utils/db.d.ts
 /**
@@ -63,6 +64,9 @@ interface OperationUserPermissionTable {
   createdAt: Date;
 }
 type Db = Kysely<any>;
+declare const PGLITE_UTC_PARSERS: {
+  readonly 1114: (value: string) => Date;
+};
 /**
  * Optional factory used by callers (e.g. Switchboard) to inject a
  * version-specific PGLite instance — e.g. `pglite-legacy-02` when an existing
@@ -215,7 +219,7 @@ declare class DocumentPermissionService {
  * must key on the canonical id, so branding it forces every caller to resolve a
  * slug to its id before consulting this service, closing the slug-aliasing
  * bypass (S-C1). The only sanctioned cast from string to CanonicalDocumentId
- * lives in the BaseSubgraph resolution helpers, immediately after the shared
+ * lives in createCanonicalDocumentIdResolver, immediately after the shared
  * resolveIdOrSlug lookup returns.
  */
 type CanonicalDocumentId = string & {
@@ -293,11 +297,19 @@ type Context = {
   user?: {
     address: string;
     chainId: number;
-    networkId: string;
+    networkId: string; /** The did:key of the app instance that issued this request's token. */
+    appKey: string;
   };
 };
 type ISubgraph = {
   name: string;
+  /**
+   * @deprecated The GraphQL manager mounts every subgraph under its own base
+   * path and does not consult this field for routing, so the value a
+   * subgraph holds (including one overwritten by a field initializer after
+   * `super()`) has no effect on where it is mounted. Retained for source
+   * compatibility.
+   */
   path?: string;
   resolvers: Record<string, any>;
   typeDefs: DocumentNode;
@@ -305,6 +317,7 @@ type ISubgraph = {
   relationalDb: IRelationalDb;
   hasSubscriptions?: boolean;
   onSetup?: () => Promise<void>;
+  onDisconnect?: () => Promise<void>;
 };
 type SubgraphArgs = {
   reactorClient: IReactorClient;
@@ -314,6 +327,17 @@ type SubgraphArgs = {
   syncManager: ISyncManager;
   documentPermissionService?: DocumentPermissionService;
   authorizationService: IAuthorizationService;
+  /**
+   * Evaluates a document's own policy when serving sync. Absent below
+   * `authEnforcement`, where there is no model to enforce and serving falls back
+   * to the host's permission tables alone.
+   */
+  syncServingGate?: SyncScopeGate;
+  /**
+   * The host's base path, injected by the GraphQL manager when it constructs
+   * a subgraph. Subgraph code may read it, but routing ignores it: every
+   * subgraph is mounted under the manager's own base path.
+   */
   path?: string;
 };
 type GqlSigner = {
@@ -386,8 +410,10 @@ declare class BaseSubgraph implements ISubgraph$1 {
   syncManager: ISyncManager;
   documentPermissionService?: DocumentPermissionService;
   authorizationService: IAuthorizationService;
+  syncServingGate?: SyncScopeGate;
   constructor(args: SubgraphArgs$1);
   onSetup(): Promise<void>;
+  onDisconnect(): Promise<void>;
   /**
    * Resolves a caller-supplied identifier (id or slug) to its canonical
    * document id, memoized per request. Both the decision layer and the data
@@ -411,6 +437,17 @@ declare class BaseSubgraph implements ISubgraph$1 {
    * layer, such as a fetched document's id). Performs no slug resolution.
    */
   canReadDocument(documentId: CanonicalDocumentId, ctx: Context): Promise<boolean>;
+  /**
+   * The principal a request decides as: the authenticated caller's address, and
+   * the did:key of the app instance whose token authenticated it.
+   *
+   * Both, because a policy can name either. The key is what a document records
+   * as its creator, so a subject built without one cannot match the creator's
+   * standing permission over the auth scope -- the document's own creator would
+   * be refused an operation the write path accepts, since a signed action
+   * carries the same key. Anonymous callers supply neither.
+   */
+  protected viewSubject(ctx: Context): AuthSubject;
   /**
    * Asserts read access, resolving a slug first. Returns a handle whose
    * `fetchIdentifier` the caller reuses for the data fetch; a denial throws.
@@ -594,16 +631,56 @@ declare class AuthSubgraph extends BaseSubgraph {
 }
 //#endregion
 //#region src/services/auth.service.d.ts
+type CredentialVerifier = (params: {
+  address: string;
+  chainId: number;
+  appId: string;
+}) => Promise<boolean>;
 interface AuthConfig {
+  /**
+   * Whether the authorization policy enforces anything: it selects `ADMIN_ONLY`
+   * over `OPEN`, and it is what `AuthContext.auth_enabled` reports to callers
+   * that gate on "is authentication being enforced" (the attachment routes do).
+   *
+   * It does NOT decide whether the bearer is read — see {@link resolveIdentity}.
+   */
   enabled: boolean;
+  /**
+   * Whether the bearer is verified and `AuthContext.user` populated at all.
+   *
+   * Defaults to {@link enabled}, which is the behaviour every deployment had
+   * before this option existed. Setting it independently is what lets a server
+   * know who is calling while leaving the policy `OPEN` — resolving an identity
+   * and enforcing one are different concerns, and welding them together left
+   * consumers choosing between an unauthenticated caller and locking every
+   * non-admin out.
+   *
+   * It resolves an identity and enforces nothing: a request with no token is
+   * still admitted, with no user.
+   */
+  resolveIdentity?: boolean;
   admins: string[];
   skipCredentialVerification?: boolean;
   credentialVerificationCacheTtlMs?: number;
+  verifyCredential?: CredentialVerifier;
 }
 interface User {
   address: string;
   chainId: number;
   networkId: string;
+  /**
+   * The did:key of the app instance that issued this request's token, taken
+   * from the verified credential's issuer.
+   *
+   * It is the same value a signer presents as its app key when it signs an
+   * action, which is what a document records as its creator. Carrying it here
+   * is what lets a request decide as the same principal the write path
+   * presents, rather than as an address with no key.
+   *
+   * Authenticated, not asserted: the token is verified by resolving this very
+   * DID, so a caller cannot name someone else's.
+   */
+  appKey: string;
 }
 interface AuthContext {
   user?: User;
@@ -614,6 +691,13 @@ declare class AuthService {
   private readonly config;
   private readonly credentialCache;
   constructor(config: AuthConfig);
+  /**
+   * Whether this service reads the bearer at all. Defaults to `enabled`, so a
+   * config written before `resolveIdentity` existed behaves exactly as it did.
+   */
+  private get resolvesIdentity();
+  /** The context an unresolved request gets: no user, and no admin list to match against. */
+  private anonymousContext;
   authenticateRequest(request: globalThis.Request): Promise<AuthContext | globalThis.Response>;
   /**
    * Verify a Bearer token regardless of HTTP method. Use this from non-GraphQL
@@ -626,7 +710,12 @@ declare class AuthService {
    */
   private verifyToken;
   /**
-   * Extract user information from verification result
+   * Extract user information from verification result.
+   *
+   * The issuer is required along with the credential subject. A credential that
+   * verified must carry one -- resolving it is how the signature was checked --
+   * so this rejects a shape that cannot have come from verification rather than
+   * admitting a keyless principal.
    */
   private extractUserFromVerification;
   /**
@@ -663,6 +752,12 @@ type WsDisposer = {
   dispose: () => void | Promise<void>;
 };
 type FetchHandler = (request: Request) => Promise<Response>;
+/**
+ * Opaque identifier for a registered route. Returned by `mount()`,
+ * `getRoute()`, and `mountNodeRoute()`; pass it to `unmount()` to remove
+ * the route.
+ */
+type RouteHandle = number;
 /**
  * A framework-agnostic description of a federated subgraph service.
  * Used by IGatewayAdapter.createSupergraphHandler() to compose the supergraph SDL.
@@ -702,19 +797,21 @@ interface IHttpAdapter {
     bodyLimit?: string;
   }): void;
   /**
-   * Mount a Fetch API handler.
-   * - exact = false (default): exact path match via internal dispatch map.
-   * - exact = true: prefix match - handler also receives all sub-paths
-   *   (uses framework router.use() semantics).
+   * Mount a Fetch API handler. Returns a handle for {@link unmount}.
+   * - exact = false (default): exact path match.
+   * - exact = true: prefix match - handler also receives all sub-paths.
+   *
+   * Mounting a path that already holds a fetch mount of the same kind
+   * replaces the previous one (last write wins).
    */
   mount(path: string, handler: FetchHandler, options?: {
     exact?: boolean;
-  }): void;
+  }): RouteHandle;
   /**
-   * Register a GET route that returns a Fetch Response (for health, explorer, etc.).
-   * Registered directly on the underlying framework app, bypassing the sub-router.
+   * Register a GET-only route that returns a Fetch Response (for health,
+   * explorer, etc.). Returns a handle for {@link unmount}.
    */
-  getRoute(path: string, handler: (request: Request) => Response | Promise<Response>): void;
+  getRoute(path: string, handler: (request: Request) => Response | Promise<Response>): RouteHandle;
   /**
    * Start listening on the given port. Returns the underlying http.Server
    * so callers can attach WebSocket servers.
@@ -732,9 +829,19 @@ interface IHttpAdapter {
    * protocols that require direct access to IncomingMessage/ServerResponse).
    *
    * The req/res objects are `http.IncomingMessage`/`http.ServerResponse`
-   * (Express Request/Response are compatible subtypes).
+   * (Express Request/Response are compatible subtypes). Returns a handle
+   * for {@link unmount}.
    */
-  mountNodeRoute(method: "DELETE" | "GET" | "HEAD" | "POST" | "PUT", path: string, handler: (req: http.IncomingMessage, res: http.ServerResponse, body?: unknown) => void | Promise<void>): void;
+  mountNodeRoute(method: "DELETE" | "GET" | "HEAD" | "POST" | "PUT", path: string, handler: (req: http.IncomingMessage, res: http.ServerResponse, body?: unknown) => void | Promise<void>): RouteHandle;
+  /**
+   * Remove a route registered by `mount()`, `getRoute()`, or
+   * `mountNodeRoute()`, identified by the handle that call returned.
+   * No-op for unknown or already-removed handles.
+   *
+   * `mountRawMiddleware` is intentionally not removable: raw framework
+   * middleware (e.g. a Vite dev server) is not a single route.
+   */
+  unmount(handle: RouteHandle): void;
   /**
    * Register framework-specific Sentry error-capturing middleware after all routes
    * are mounted. Each adapter calls the Sentry setup function appropriate for its
@@ -783,6 +890,9 @@ declare class DriveOwnershipCache {
   size(): number;
 }
 //#endregion
+//#region src/graphql/gateway/require-auth-middleware.d.ts
+type RequireAuthFetchMiddleware = (handler: FetchHandler) => FetchHandler;
+//#endregion
 //#region src/graphql/graphql-manager.d.ts
 type GraphqlManagerFeatureFlags = {
   enableDocumentModelSubgraphs?: boolean;
@@ -803,6 +913,7 @@ declare class GraphQLManager {
   private readonly documentPermissionService?;
   private readonly featureFlags;
   private readonly port;
+  private readonly syncServingGate?;
   private initialized;
   private coreSubgraphsMap;
   private contextFields;
@@ -812,6 +923,16 @@ declare class GraphQLManager {
   /** Cached document models for schema generation - updated on init and regenerate */
   private cachedDocumentModels;
   private readonly subgraphHandlerCache;
+  /** subgraphPath → the http adapter handle of its mounted route. */
+  private readonly subgraphRouteHandles;
+  /** Handle of the currently mounted supergraph SSE route, if any. */
+  private sseRouteHandle;
+  /**
+   * Package name → the subgraph instances registered from it, keyed by
+   * subgraph name. Tracks the package association so that removed packages
+   * can be torn down (see unregisterPackage / prunePackageSubgraphs).
+   */
+  private readonly packageSubgraphs;
   /**
    * Optional reactor-drive client. When the switchboard is configured with a
    * reactor-drive container, this is provided and the resolvers dispatch to
@@ -819,8 +940,8 @@ declare class GraphQLManager {
    */
   readonly reactorDriveClient?: IDriveClient;
   private readonly authorizationService;
-  constructor(path: string, httpServer: http.Server, wsServer: WebSocketServer, reactorClient: IReactorClient, relationalDb: IRelationalDb, analyticsStore: IAnalyticsStore, syncManager: ISyncManager, logger: ILogger, httpAdapter: IHttpAdapter, gatewayAdapter: IGatewayAdapter<Context$1>, authService?: AuthService | undefined, documentPermissionService?: DocumentPermissionService | undefined, featureFlags?: GraphqlManagerFeatureFlags, port?: number, authorizationService?: IAuthorizationService, reactorDriveClient?: IDriveClient);
-  init(coreSubgraphs: SubgraphClass$1[], authMiddleware?: AuthFetchMiddleware): Promise<void>;
+  constructor(path: string, httpServer: http.Server, wsServer: WebSocketServer, reactorClient: IReactorClient, relationalDb: IRelationalDb, analyticsStore: IAnalyticsStore, syncManager: ISyncManager, logger: ILogger, httpAdapter: IHttpAdapter, gatewayAdapter: IGatewayAdapter<Context$1>, authService?: AuthService | undefined, documentPermissionService?: DocumentPermissionService | undefined, featureFlags?: GraphqlManagerFeatureFlags, port?: number, authorizationService?: IAuthorizationService, reactorDriveClient?: IDriveClient, syncServingGate?: SyncScopeGate | undefined);
+  init(coreSubgraphs: SubgraphClass$1[], authMiddleware?: AuthFetchMiddleware, requireAuthMiddleware?: RequireAuthFetchMiddleware): Promise<void>;
   /**
    * Regenerate document model subgraphs when models are dynamically loaded.
    * Fetches current modules from reactor client (source of truth).
@@ -830,7 +951,7 @@ declare class GraphQLManager {
    * Register a pre-constructed subgraph instance.
    * Use this when you need to pass custom dependencies to a subgraph.
    */
-  registerSubgraphInstance(subgraphInstance: ISubgraph$1, supergraph?: string, core?: boolean): Promise<ISubgraph$1>;
+  registerSubgraphInstance(subgraphInstance: ISubgraph$1, supergraph?: string, core?: boolean): Promise<ISubgraph$1 | undefined>;
   /**
    * Get the base path used for subgraph registration.
    */
@@ -841,7 +962,35 @@ declare class GraphQLManager {
    * {@link registerSubgraphInstance}.
    */
   getAuthorizationService(): IAuthorizationService;
-  registerSubgraph(subgraph: SubgraphClass$1, supergraph?: string, core?: boolean): Promise<ISubgraph$1>;
+  /**
+   * Register a subgraph class. `packageName` labels the resulting instance
+   * with its contributing package so the instance can be torn down when the
+   * package is removed or drops the subgraph (see unregisterPackage and
+   * prunePackageSubgraphs).
+   */
+  registerSubgraph(subgraph: SubgraphClass$1, supergraph?: string, core?: boolean, packageName?: string): Promise<ISubgraph$1 | undefined>;
+  /**
+   * Tear down every subgraph instance registered from `packageName`:
+   * disconnects the instances, unmounts their routes, disposes their
+   * WebSocket handlers, then refreshes the router so the supergraph SDL and
+   * the supergraph SSE handler no longer reference them. No-op if the
+   * package has no registered subgraphs.
+   */
+  unregisterPackage(packageName: string): Promise<void>;
+  /**
+   * Remove this package's registered subgraphs whose names are not in
+   * `keepNames` — the package is still loaded but dropped some of its
+   * subgraphs. Refreshes the router if anything was removed.
+   */
+  prunePackageSubgraphs(packageName: string, keepNames: ReadonlySet<string>): Promise<void>;
+  /** Find a registered subgraph by name, core or package-contributed. */
+  getSubgraphByName(name: string): ISubgraph$1 | undefined;
+  /** Whether a registered subgraph has a live handler, i.e. whether
+   * {@link executeSubgraphQuery} can reach it right now. */
+  hasSubgraphHandler(name: string): boolean;
+  /** Run a query against one registered subgraph in-process: the subgraph's own
+   * handler, without a socket or the auth/drive middleware. Trusted callers. */
+  executeSubgraphQuery<T>(subgraphName: string, query: string, variables: Record<string, unknown>): Promise<T>;
   updateRouter: (immediate?: boolean) => Promise<void>;
   private _updateRouter;
   getAdditionalContextFields: () => Record<string, any>;
@@ -874,11 +1023,88 @@ declare class InMemoryPackageStorage implements IPackageStorage {
   has(name: string): Promise<boolean>;
 }
 //#endregion
+//#region src/services/canonical-document-id.d.ts
+/**
+ * Raised when a caller-supplied identifier cannot be resolved to a canonical
+ * document id. Carries no detail on purpose: resolution failures must not act
+ * as a document-existence oracle, so consumers map this to their generic
+ * fail-closed response.
+ */
+declare class CanonicalDocumentIdResolutionError extends Error {
+  constructor();
+}
+type CanonicalDocumentIdResolver = (identifier: string) => Promise<CanonicalDocumentId>;
+/**
+ * The sanctioned string-to-CanonicalDocumentId cast: both the GraphQL layer
+ * and server routes must resolve caller identifiers through this helper so
+ * decision and data layers always agree on the subject document.
+ */
+declare function createCanonicalDocumentIdResolver(client: Pick<IReactorClient, "resolveIdOrSlug">): CanonicalDocumentIdResolver;
+//#endregion
+//#region src/services/attachment-access.service.d.ts
+/**
+ * Whether the active Reactor composition hosts the attachment-reference
+ * projection. Reported by the client initializer: the built-in stack always
+ * registers it, while a caller-provided Reactor may lack the live
+ * registration capability. Consumers of reference evidence must fail closed
+ * when it is unavailable.
+ */
+type AttachmentReferenceProjectionCapability = {
+  status: "available";
+} | {
+  status: "unavailable";
+  reason: "live-read-model-registration-unsupported" | "in-process-reactor-module-unavailable" | "initializer-did-not-report";
+};
+/**
+ * Outcome of an attachment read authorization. `denied` intentionally covers
+ * both an unreadable document and an absent document/ref relationship so the
+ * route layer cannot leak which check failed. `projection-unavailable` means
+ * the reference index is not being maintained in this composition; it is
+ * returned before any document-authorization or reference lookup runs.
+ */
+type AttachmentAccessResult = {
+  kind: "allowed";
+  documentId: CanonicalDocumentId;
+  ref: AttachmentRef;
+} | {
+  kind: "denied";
+} | {
+  kind: "projection-unavailable";
+};
+interface AttachmentAccessRequest {
+  documentId: string;
+  attachmentRef: string;
+  userAddress?: string;
+}
+interface IAttachmentAccessService {
+  canReadAttachment(request: AttachmentAccessRequest): Promise<AttachmentAccessResult>;
+}
+/**
+ * Composes document authorization with the projected document/ref
+ * relationship. Order is fixed: validate ref, resolve the canonical document
+ * id, check `canRead`, then check the reference index. A denied document
+ * never reaches the reference reader, and the facade never touches
+ * attachment metadata, storage backends, or presigners.
+ */
+declare class AttachmentAccessService implements IAttachmentAccessService {
+  private readonly resolveCanonicalId;
+  private readonly authorization;
+  private readonly references;
+  private readonly projection;
+  constructor(resolveCanonicalId: CanonicalDocumentIdResolver, authorization: IAuthorizationService, references: IAttachmentReferenceReader, projection: AttachmentReferenceProjectionCapability);
+  canReadAttachment(request: AttachmentAccessRequest): Promise<AttachmentAccessResult>;
+}
+//#endregion
 //#region src/types.d.ts
-interface IReactorProcessorHostModule extends IProcessorHostModule {
-  client: IReactorClient;
+/**
+ * Module hosts pass to processor factories: the reactor-level module plus the
+ * attachment client, which shared and reactor cannot name.
+ */
+interface IProcessorHostModule extends IReactorProcessorHostModuleBase {
   attachments: IAttachmentClient;
 }
+/** @deprecated Use `IProcessorHostModule`. */
+type IReactorProcessorHostModule = IProcessorHostModule;
 type ReadinessGate = {
   isReady: () => boolean;
   markReady: () => void;
@@ -888,6 +1114,8 @@ type API = {
   graphqlManager: GraphQLManager$1;
   packages: IPackageManager;
   attachments: AttachmentBuildResult;
+  attachmentReferenceIndex: AttachmentReferenceIndexBuildResult; /** Document-authorized attachment read decisions; see AttachmentAccessService. */
+  attachmentAccess: IAttachmentAccessService;
   authService: AuthService | undefined;
   /**
    * Releases resources owned by the API: shuts down the GraphQL gateway,
@@ -902,13 +1130,10 @@ type ReactorModule = {
   analyticsStore: IAnalyticsStore;
   relationalDb: IRelationalDb$1;
 };
-/** Per-drive factory after the host `module` has been applied once. */
-type ProcessorDriveFactory = (driveHeader: PHDocumentHeader) => ProcessorRecord[] | Promise<ProcessorRecord[]>;
-/**
- * Builds a per-drive factory from the host module (e.g. vetra `processorFactory`).
- * Shape: `(module) => (driveHeader) => ...`
- */
-type ProcessorFactoryBuilder = (module: IProcessorHostModule) => ProcessorDriveFactory | Promise<ProcessorDriveFactory>;
+/** @deprecated Use `ProcessorFactory`. */
+type ProcessorDriveFactory = ProcessorFactory;
+/** Builds a per-drive factory from the host module (e.g. vetra `processorFactory`). */
+type ProcessorFactoryBuilder = ProcessorFactoryBuilder$1<IProcessorHostModule>;
 /** Multiple initializers per package name (e.g. Switchboard `processors` option). */
 type Processor = ProcessorFactoryBuilder[];
 //#endregion
@@ -955,6 +1180,7 @@ declare class HttpPackageLoader implements IPackageLoader {
    */
   private parsePackageSpec;
   loadDocumentModels(packageSpec: string): Promise<DocumentModelModule[]>;
+  loadUpgradeManifests(packageSpec: string): Promise<UpgradeManifest<readonly number[]>[]>;
   loadSubgraphs(packageSpec: string): Promise<SubgraphClass$1[]>;
   loadProcessors(packageSpec: string): Promise<ProcessorFactoryBuilder | null>;
   /**
@@ -996,12 +1222,14 @@ interface PackageManagementServiceOptions {
   defaultRegistryUrl?: string;
   httpLoader?: HttpPackageLoader;
   documentModelRegistry?: IDocumentModelRegistry;
+  packageManager?: IPackageManager;
 }
 declare class PackageManagementService {
   private readonly storage;
   private readonly defaultRegistryUrl?;
   private readonly httpLoader?;
   private readonly documentModelRegistry?;
+  private readonly packageManager?;
   private readonly logger;
   private onModelsChanged?;
   private loadedModulesCache;
@@ -1074,7 +1302,27 @@ declare class PackagesSubgraph extends BaseSubgraph {
 }
 //#endregion
 //#region src/graphql/playground.d.ts
-declare function renderGraphqlPlayground(url: string, query?: string, headers?: Record<string, string>): string;
+/**
+ * The lz-compressed `explorerURLState` parameter carried by switchboard
+ * explorer URLs: the JSON payload produced by
+ * `buildDocumentSubgraphQuery` in `@powerhousedao/reactor-browser`,
+ * `{ document, variables, headers? }` with `variables` and `headers`
+ * already JSON-stringified.
+ */
+interface ExplorerUrlState {
+  /** The GraphQL query to prefill in GraphiQL. */
+  query: string;
+  /** JSON-stringified variables, as stored in the payload. */
+  variables?: string;
+  /** Request headers for the GraphiQL fetcher (e.g. Authorization). */
+  headers?: Record<string, string>;
+}
+/**
+ * Decodes an `explorerURLState` URL parameter. Returns `null` for anything
+ * that is not a valid lz-compressed payload with a non-empty `document`.
+ */
+declare function decodeExplorerUrlState(encoded: string): ExplorerUrlState | null;
+declare function renderGraphqlPlayground(url: string, query?: string, headers?: Record<string, string>, variables?: string): string;
 //#endregion
 //#region src/graphql/reactor/gen/graphql.d.ts
 type Maybe<T> = T | null | undefined;
@@ -1128,12 +1376,63 @@ type Action = {
   readonly timestampUtcMs: Scalars["String"]["output"];
   readonly type: Scalars["String"]["output"];
 };
+/**
+ * One operation an authorization preflight predicts a verdict for.
+ *
+ * `input` is what a conditional grant reads, so a candidate standing for a
+ * filled-in form carries that form's input. Omitting it predicts the verdict an
+ * empty input earns, not the verdict the filled-in form will get.
+ */
+type ActionCandidateInput = {
+  readonly input?: InputMaybe<Scalars["JSONObject"]["input"]>;
+  readonly scope: Scalars["String"]["input"];
+  readonly type: Scalars["String"]["input"];
+};
 type ActionContext = {
   readonly signer?: Maybe<ReactorSigner>;
 };
+/**
+ * An action's context, as a caller submits it.
+ *
+ * Declares every field `ActionContext` carries, because an input object rejects a
+ * field it does not declare: an action stamped with the head it applies to - which
+ * is what a signing client sends - is refused outright if these are missing, and
+ * that refusal is a whole-request one, not a per-field one.
+ *
+ * `prevOpHash` and `prevOpIndex` are the scope head the action was composed
+ * against. They are recorded rather than enforced; a signature is verified from
+ * the params carried in its own tuple, which do not include them.
+ */
 type ActionContextInput = {
+  /** Covers replay of an operation that would otherwise be a no-op. */readonly nonce?: InputMaybe<Scalars["String"]["input"]>; /** The hash of the state the action applies to. */
+  readonly prevOpHash?: InputMaybe<Scalars["String"]["input"]>; /** The index of the last operation in the scope the action applies to. */
+  readonly prevOpIndex?: InputMaybe<Scalars["Int"]["input"]>;
   readonly signer?: InputMaybe<ReactorSignerInput>;
 };
+/**
+ * One candidate's predicted verdict. `reason` carries the refusal a DENY is
+ * recorded with, and is null on an ALLOW.
+ */
+type ActionEvaluation = {
+  readonly decision: AuthDecision;
+  readonly reason?: Maybe<Scalars["String"]["output"]>;
+};
+/**
+ * The predicted verdicts for a set of candidates, in the order they were given,
+ * with the aggregates a caller branches on.
+ *
+ * The aggregates are redundant -- a verdict is binary -- and all four are returned
+ * so a caller reads the one its question is phrased in rather than negating
+ * another. Over no candidates every aggregate is false: nothing is allowed and
+ * nothing is denied.
+ */
+type ActionEvaluations = {
+  readonly allAllowed: Scalars["Boolean"]["output"];
+  readonly allDenied: Scalars["Boolean"]["output"];
+  readonly anyAllowed: Scalars["Boolean"]["output"];
+  readonly anyDenied: Scalars["Boolean"]["output"];
+  readonly evaluations: ReadonlyArray<ActionEvaluation>;
+};
 type ActionInput = {
   readonly context?: InputMaybe<ActionContextInput>;
   readonly id: Scalars["String"]["input"];
@@ -1142,6 +1441,10 @@ type ActionInput = {
   readonly timestampUtcMs: Scalars["String"]["input"];
   readonly type: Scalars["String"]["input"];
 };
+declare enum AuthDecision {
+  Allow = "ALLOW",
+  Deny = "DENY"
+}
 type ChannelMeta = {
   readonly id: Scalars["String"]["output"];
 };
@@ -1152,6 +1455,12 @@ type DeadLetterInfo = {
   readonly branch: Scalars["String"]["output"];
   readonly documentId: Scalars["String"]["output"];
   readonly error: Scalars["String"]["output"];
+  /**
+   * How the origin classified the failure. A peer needs this to mirror the origin's
+   * quarantine decision; without it a held auth operation would freeze the document
+   * on the peer side while the origin kept syncing.
+   */
+  readonly errorType?: Maybe<Scalars["String"]["output"]>;
   readonly jobId: Scalars["String"]["output"];
   readonly operationCount: Scalars["Int"]["output"];
   readonly scopes: ReadonlyArray<Scalars["String"]["output"]>;
@@ -1211,7 +1520,11 @@ type JobInfo = {
   readonly createdAt: Scalars["DateTime"]["output"];
   readonly error?: Maybe<Scalars["String"]["output"]>;
   readonly id: Scalars["String"]["output"];
-  readonly result: Scalars["JSONObject"]["output"];
+  /**
+   * What the job produced, once it has produced anything. Null until then, which
+   * is the state every job is in when it is handed back from a submission.
+   */
+  readonly result?: Maybe<Scalars["JSONObject"]["output"]>;
   readonly status: Scalars["String"]["output"];
 };
 type MoveRelationshipResult = {
@@ -1224,8 +1537,30 @@ type Mutation = {
   readonly createEmptyDocument: PhDocument;
   readonly deleteDocument: Scalars["Boolean"]["output"];
   readonly deleteDocuments: Scalars["Boolean"]["output"];
-  readonly moveRelationship: MoveRelationshipResult;
-  readonly mutateDocument: PhDocument;
+  /**
+   * Applies actions to a document and waits for the result.
+   *
+   * Each action is coerced against `ActionInput`, so one missing a field the wire
+   * declares is refused before any work starts. The id in particular: it is hashed
+   * into the operation id and replay dedupes by it, so an action without one is
+   * stored under an operation id shared by every id-less operation on the same
+   * document, scope and branch.
+   *
+   * Named for `IReactorClient.execute`, which this is the wire form of. `branch`
+   * defaults to `main`.
+   */
+  readonly execute: PhDocument;
+  /**
+   * Submits actions to a document and returns the job that will apply them.
+   *
+   * Coerced exactly as `execute` is, so a malformed action is refused here rather
+   * than surfacing later as a failed job. Returns the job rather than only its id,
+   * so a caller has the status and the creation time it would otherwise have to
+   * ask for; `result` is null until the job produces one.
+   */
+  readonly executeAsync: JobInfo;
+  readonly moveRelationship: MoveRelationshipResult; /** @deprecated Use execute. Actions here are untyped, so a malformed one is refused by a hand-written check rather than by the schema, and `view.scopes` is accepted but ignored. */
+  readonly mutateDocument: PhDocument; /** @deprecated Use executeAsync, which is typed and returns the job rather than only its id. */
   readonly mutateDocumentAsync: Scalars["String"]["output"];
   readonly pushSyncEnvelopes: Scalars["Boolean"]["output"];
   readonly removeRelationship: PhDocument;
@@ -1255,6 +1590,16 @@ type MutationDeleteDocumentsArgs = {
   identifiers: ReadonlyArray<Scalars["String"]["input"]>;
   propagate?: InputMaybe<PropagationMode>;
 };
+type MutationExecuteArgs = {
+  actions: ReadonlyArray<ActionInput>;
+  branch?: InputMaybe<Scalars["String"]["input"]>;
+  documentIdentifier: Scalars["String"]["input"];
+};
+type MutationExecuteAsyncArgs = {
+  actions: ReadonlyArray<ActionInput>;
+  branch?: InputMaybe<Scalars["String"]["input"]>;
+  documentIdentifier: Scalars["String"]["input"];
+};
 type MutationMoveRelationshipArgs = {
   branch?: InputMaybe<Scalars["String"]["input"]>;
   relationshipType: Scalars["String"]["input"];
@@ -1310,6 +1655,7 @@ type OperationContextInput = {
 };
 type OperationInput = {
   readonly action: ActionInput;
+  readonly deniedReason?: InputMaybe<Scalars["String"]["input"]>;
   readonly error?: InputMaybe<Scalars["String"]["input"]>;
   readonly hash: Scalars["String"]["input"];
   readonly id?: InputMaybe<Scalars["String"]["input"]>;
@@ -1378,8 +1724,47 @@ type Query = {
   readonly documentModels: DocumentModelResultPage;
   readonly documentOperations: ReactorOperationResultPage;
   readonly documentOutgoingRelationships: PhDocumentResultPage;
+  /**
+   * Predicts whether the calling subject would be admitted to execute each of a
+   * set of candidate operations, without submitting any of them. A UI asks this to
+   * disable a control rather than offer an action that fails on submit.
+   *
+   * The answer is a prediction, not a promise:
+   *
+   * - Real admission compiles an append condition over everything it read and the
+   *   store enforces it at write time. A preflight reads no future, so a policy
+   *   change landing between this answer and the submit changes the verdict. The
+   *   submit path stays the only authority.
+   * - The verdict is evaluated at the stream heads, so it is correct for a
+   *   candidate about to be submitted. A backdated submission is out of contract;
+   *   the reactor decides that one by position.
+   * - A candidate whose verdict depends on its input has to carry that input, since
+   *   a conditional grant reads it.
+   *
+   * The subject is the authenticated caller and cannot be named in the request:
+   * answering for an arbitrary subject would disclose what a policy grants
+   * somebody else. It carries both the caller's address and the did:key of the app
+   * instance whose token authenticated the request, so a policy naming either
+   * matches the same principal the write path presents.
+   *
+   * Requires the reactor's authEnforcement feature flag. Without it the reactor
+   * holds no decision model, so this fails with extensions.code
+   * AUTH_EVALUATION_UNSUPPORTED rather than guessing.
+   */
+  readonly evaluateActions: ActionEvaluations;
   readonly findDocuments: PhDocumentResultPage;
   readonly jobStatus?: Maybe<JobInfo>;
+  /**
+   * Polls for sync envelopes from a channel.
+   *
+   * An operation stored before the API required an action id cannot be
+   * represented by this schema, and rather than serving a partial response beside
+   * a bare non-null violation, this fails with extensions.code
+   * MALFORMED_STORED_OPERATION naming the operation. That code means the failure
+   * is worth polling through: the document holding the operation needs repairing,
+   * but the channel serves every other document, and a peer that stopped polling
+   * would stop receiving those too.
+   */
   readonly pollSyncEnvelopes: PollSyncEnvelopesResult;
 };
 type QueryDocumentArgs = {
@@ -1406,6 +1791,11 @@ type QueryDocumentOutgoingRelationshipsArgs = {
   sourceIdentifier: Scalars["String"]["input"];
   view?: InputMaybe<ViewFilterInput>;
 };
+type QueryEvaluateActionsArgs = {
+  branch?: InputMaybe<Scalars["String"]["input"]>;
+  candidates: ReadonlyArray<ActionCandidateInput>;
+  documentIdentifier: Scalars["String"]["input"];
+};
 type QueryFindDocumentsArgs = {
   paging?: InputMaybe<PagingInput>;
   search?: InputMaybe<SearchFilterInput>;
@@ -1421,6 +1811,7 @@ type QueryPollSyncEnvelopesArgs = {
 };
 type ReactorOperation = {
   readonly action: Action;
+  readonly deniedReason?: Maybe<Scalars["String"]["output"]>;
   readonly error?: Maybe<Scalars["String"]["output"]>;
   readonly hash: Scalars["String"]["output"];
   readonly id?: Maybe<Scalars["String"]["output"]>;
@@ -1615,6 +2006,7 @@ type GetDocumentWithOperationsQuery = {
           readonly hash: string;
           readonly skip: number;
           readonly error?: string | null | undefined;
+          readonly deniedReason?: string | null | undefined;
           readonly id?: string | null | undefined;
           readonly action: {
             readonly id: string;
@@ -1742,6 +2134,7 @@ type GetDocumentOperationsQuery = {
       readonly hash: string;
       readonly skip: number;
       readonly error?: string | null | undefined;
+      readonly deniedReason?: string | null | undefined;
       readonly id?: string | null | undefined;
       readonly action: {
         readonly id: string;
@@ -1774,12 +2167,29 @@ type GetJobStatusQuery = {
   readonly jobStatus?: {
     readonly id: string;
     readonly status: string;
-    readonly result: NonNullable<unknown>;
+    readonly result?: NonNullable<unknown> | null | undefined;
     readonly error?: string | null | undefined;
     readonly createdAt: string | Date;
     readonly completedAt?: string | Date | null | undefined;
   } | null | undefined;
 };
+type EvaluateActionsQueryVariables = Exact<{
+  documentIdentifier: Scalars["String"]["input"];
+  branch?: InputMaybe<Scalars["String"]["input"]>;
+  candidates: ReadonlyArray<ActionCandidateInput>;
+}>;
+type EvaluateActionsQuery = {
+  readonly evaluateActions: {
+    readonly allAllowed: boolean;
+    readonly anyAllowed: boolean;
+    readonly allDenied: boolean;
+    readonly anyDenied: boolean;
+    readonly evaluations: ReadonlyArray<{
+      readonly decision: AuthDecision;
+      readonly reason?: string | null | undefined;
+    }>;
+  };
+};
 type CreateDocumentMutationVariables = Exact<{
   document: Scalars["JSONObject"]["input"];
   parentIdentifier?: InputMaybe<Scalars["String"]["input"]>;
@@ -1820,8 +2230,8 @@ type CreateEmptyDocumentMutation = {
 };
 type MutateDocumentMutationVariables = Exact<{
   documentIdentifier: Scalars["String"]["input"];
-  actions: ReadonlyArray<Scalars["JSONObject"]["input"]>;
-  view?: InputMaybe<ViewFilterInput>;
+  actions: ReadonlyArray<ActionInput>;
+  branch?: InputMaybe<Scalars["String"]["input"]>;
 }>;
 type MutateDocumentMutation = {
   readonly mutateDocument: {
@@ -1840,11 +2250,18 @@ type MutateDocumentMutation = {
 };
 type MutateDocumentAsyncMutationVariables = Exact<{
   documentIdentifier: Scalars["String"]["input"];
-  actions: ReadonlyArray<Scalars["JSONObject"]["input"]>;
-  view?: InputMaybe<ViewFilterInput>;
+  actions: ReadonlyArray<ActionInput>;
+  branch?: InputMaybe<Scalars["String"]["input"]>;
 }>;
 type MutateDocumentAsyncMutation = {
-  readonly mutateDocumentAsync: string;
+  readonly mutateDocumentAsync: {
+    readonly id: string;
+    readonly status: string;
+    readonly result?: NonNullable<unknown> | null | undefined;
+    readonly error?: string | null | undefined;
+    readonly createdAt: string | Date;
+    readonly completedAt?: string | Date | null | undefined;
+  };
 };
 type RenameDocumentMutationVariables = Exact<{
   documentIdentifier: Scalars["String"]["input"];
@@ -2039,6 +2456,7 @@ type PollSyncEnvelopesQuery = {
           readonly hash: string;
           readonly skip: number;
           readonly error?: string | null | undefined;
+          readonly deniedReason?: string | null | undefined;
           readonly id?: string | null | undefined;
           readonly action: {
             readonly id: string;
@@ -2078,6 +2496,7 @@ type PollSyncEnvelopesQuery = {
     readonly deadLetters: ReadonlyArray<{
       readonly documentId: string;
       readonly error: string;
+      readonly errorType?: string | null | undefined;
     }>;
   };
 };
@@ -2123,9 +2542,13 @@ type DirectiveResolverFn<TResult = Record<PropertyKey, never>, TParent = Record<
 /** Mapping between all available schema types and the resolvers types */
 type ResolversTypes = ResolversObject<{
   Action: ResolverTypeWrapper<Action>;
+  ActionCandidateInput: ActionCandidateInput;
   ActionContext: ResolverTypeWrapper<ActionContext>;
   ActionContextInput: ActionContextInput;
+  ActionEvaluation: ResolverTypeWrapper<ActionEvaluation>;
+  ActionEvaluations: ResolverTypeWrapper<ActionEvaluations>;
   ActionInput: ActionInput;
+  AuthDecision: AuthDecision;
   Boolean: ResolverTypeWrapper<Scalars["Boolean"]["output"]>;
   ChannelMeta: ResolverTypeWrapper<ChannelMeta>;
   ChannelMetaInput: ChannelMetaInput;
@@ -2181,8 +2604,11 @@ type ResolversTypes = ResolversObject<{
 /** Mapping between all available schema types and the resolvers parents */
 type ResolversParentTypes = ResolversObject<{
   Action: Action;
+  ActionCandidateInput: ActionCandidateInput;
   ActionContext: ActionContext;
   ActionContextInput: ActionContextInput;
+  ActionEvaluation: ActionEvaluation;
+  ActionEvaluations: ActionEvaluations;
   ActionInput: ActionInput;
   Boolean: Scalars["Boolean"]["output"];
   ChannelMeta: ChannelMeta;
@@ -2244,6 +2670,17 @@ type ActionResolvers<ContextType = Context, ParentType extends ResolversParentTy
 type ActionContextResolvers<ContextType = Context, ParentType extends ResolversParentTypes["ActionContext"] = ResolversParentTypes["ActionContext"]> = ResolversObject<{
   signer?: Resolver<Maybe<ResolversTypes["ReactorSigner"]>, ParentType, ContextType>;
 }>;
+type ActionEvaluationResolvers<ContextType = Context, ParentType extends ResolversParentTypes["ActionEvaluation"] = ResolversParentTypes["ActionEvaluation"]> = ResolversObject<{
+  decision?: Resolver<ResolversTypes["AuthDecision"], ParentType, ContextType>;
+  reason?: Resolver<Maybe<ResolversTypes["String"]>, ParentType, ContextType>;
+}>;
+type ActionEvaluationsResolvers<ContextType = Context, ParentType extends ResolversParentTypes["ActionEvaluations"] = ResolversParentTypes["ActionEvaluations"]> = ResolversObject<{
+  allAllowed?: Resolver<ResolversTypes["Boolean"], ParentType, ContextType>;
+  allDenied?: Resolver<ResolversTypes["Boolean"], ParentType, ContextType>;
+  anyAllowed?: Resolver<ResolversTypes["Boolean"], ParentType, ContextType>;
+  anyDenied?: Resolver<ResolversTypes["Boolean"], ParentType, ContextType>;
+  evaluations?: Resolver<ReadonlyArray<ResolversTypes["ActionEvaluation"]>, ParentType, ContextType>;
+}>;
 type ChannelMetaResolvers<ContextType = Context, ParentType extends ResolversParentTypes["ChannelMeta"] = ResolversParentTypes["ChannelMeta"]> = ResolversObject<{
   id?: Resolver<ResolversTypes["String"], ParentType, ContextType>;
 }>;
@@ -2254,6 +2691,7 @@ type DeadLetterInfoResolvers<ContextType = Context, ParentType extends Resolvers
   branch?: Resolver<ResolversTypes["String"], ParentType, ContextType>;
   documentId?: Resolver<ResolversTypes["String"], ParentType, ContextType>;
   error?: Resolver<ResolversTypes["String"], ParentType, ContextType>;
+  errorType?: Resolver<Maybe<ResolversTypes["String"]>, ParentType, ContextType>;
   jobId?: Resolver<ResolversTypes["String"], ParentType, ContextType>;
   operationCount?: Resolver<ResolversTypes["Int"], ParentType, ContextType>;
   scopes?: Resolver<ReadonlyArray<ResolversTypes["String"]>, ParentType, ContextType>;
@@ -2299,7 +2737,7 @@ type JobInfoResolvers<ContextType = Context, ParentType extends ResolversParentT
   createdAt?: Resolver<ResolversTypes["DateTime"], ParentType, ContextType>;
   error?: Resolver<Maybe<ResolversTypes["String"]>, ParentType, ContextType>;
   id?: Resolver<ResolversTypes["String"], ParentType, ContextType>;
-  result?: Resolver<ResolversTypes["JSONObject"], ParentType, ContextType>;
+  result?: Resolver<Maybe<ResolversTypes["JSONObject"]>, ParentType, ContextType>;
   status?: Resolver<ResolversTypes["String"], ParentType, ContextType>;
 }>;
 type MoveRelationshipResultResolvers<ContextType = Context, ParentType extends ResolversParentTypes["MoveRelationshipResult"] = ResolversParentTypes["MoveRelationshipResult"]> = ResolversObject<{
@@ -2312,6 +2750,8 @@ type MutationResolvers<ContextType = Context, ParentType extends ResolversParent
   createEmptyDocument?: Resolver<ResolversTypes["PHDocument"], ParentType, ContextType, RequireFields<MutationCreateEmptyDocumentArgs, "documentType">>;
   deleteDocument?: Resolver<ResolversTypes["Boolean"], ParentType, ContextType, RequireFields<MutationDeleteDocumentArgs, "identifier">>;
   deleteDocuments?: Resolver<ResolversTypes["Boolean"], ParentType, ContextType, RequireFields<MutationDeleteDocumentsArgs, "identifiers">>;
+  execute?: Resolver<ResolversTypes["PHDocument"], ParentType, ContextType, RequireFields<MutationExecuteArgs, "actions" | "documentIdentifier">>;
+  executeAsync?: Resolver<ResolversTypes["JobInfo"], ParentType, ContextType, RequireFields<MutationExecuteAsyncArgs, "actions" | "documentIdentifier">>;
   moveRelationship?: Resolver<ResolversTypes["MoveRelationshipResult"], ParentType, ContextType, RequireFields<MutationMoveRelationshipArgs, "relationshipType" | "sourceParentIdentifier" | "targetIdentifier" | "targetParentIdentifier">>;
   mutateDocument?: Resolver<ResolversTypes["PHDocument"], ParentType, ContextType, RequireFields<MutationMutateDocumentArgs, "actions" | "documentIdentifier">>;
   mutateDocumentAsync?: Resolver<ResolversTypes["String"], ParentType, ContextType, RequireFields<MutationMutateDocumentAsyncArgs, "actions" | "documentIdentifier">>;
@@ -2363,12 +2803,14 @@ type QueryResolvers<ContextType = Context, ParentType extends ResolversParentTyp
   documentModels?: Resolver<ResolversTypes["DocumentModelResultPage"], ParentType, ContextType, Partial<QueryDocumentModelsArgs>>;
   documentOperations?: Resolver<ResolversTypes["ReactorOperationResultPage"], ParentType, ContextType, RequireFields<QueryDocumentOperationsArgs, "filter">>;
   documentOutgoingRelationships?: Resolver<ResolversTypes["PHDocumentResultPage"], ParentType, ContextType, RequireFields<QueryDocumentOutgoingRelationshipsArgs, "relationshipType" | "sourceIdentifier">>;
+  evaluateActions?: Resolver<ResolversTypes["ActionEvaluations"], ParentType, ContextType, RequireFields<QueryEvaluateActionsArgs, "candidates" | "documentIdentifier">>;
   findDocuments?: Resolver<ResolversTypes["PHDocumentResultPage"], ParentType, ContextType, Partial<QueryFindDocumentsArgs>>;
   jobStatus?: Resolver<Maybe<ResolversTypes["JobInfo"]>, ParentType, ContextType, RequireFields<QueryJobStatusArgs, "jobId">>;
   pollSyncEnvelopes?: Resolver<ResolversTypes["PollSyncEnvelopesResult"], ParentType, ContextType, RequireFields<QueryPollSyncEnvelopesArgs, "channelId" | "outboxAck" | "outboxLatest">>;
 }>;
 type ReactorOperationResolvers<ContextType = Context, ParentType extends ResolversParentTypes["ReactorOperation"] = ResolversParentTypes["ReactorOperation"]> = ResolversObject<{
   action?: Resolver<ResolversTypes["Action"], ParentType, ContextType>;
+  deniedReason?: Resolver<Maybe<ResolversTypes["String"]>, ParentType, ContextType>;
   error?: Resolver<Maybe<ResolversTypes["String"]>, ParentType, ContextType>;
   hash?: Resolver<ResolversTypes["String"], ParentType, ContextType>;
   id?: Resolver<Maybe<ResolversTypes["String"]>, ParentType, ContextType>;
@@ -2425,6 +2867,8 @@ type TouchChannelResultResolvers<ContextType = Context, ParentType extends Resol
 type Resolvers<ContextType = Context> = ResolversObject<{
   Action?: ActionResolvers<ContextType>;
   ActionContext?: ActionContextResolvers<ContextType>;
+  ActionEvaluation?: ActionEvaluationResolvers<ContextType>;
+  ActionEvaluations?: ActionEvaluationsResolvers<ContextType>;
   ChannelMeta?: ChannelMetaResolvers<ContextType>;
   DateTime?: GraphQLScalarType;
   DeadLetterInfo?: DeadLetterInfoResolvers<ContextType>;
@@ -2459,9 +2903,11 @@ type Properties<T> = Required<{ [K in keyof T]: z$1.ZodType<T[K]> }>;
 type definedNonNullAny = {};
 declare const isDefinedNonNullAny: (v: any) => v is definedNonNullAny;
 declare const definedNonNullAnySchema: z$1.ZodAny & z$1.ZodType<definedNonNullAny, any, z$1.core.$ZodTypeInternals<definedNonNullAny, any>>;
+declare const AuthDecisionSchema: z$1.ZodEnum<typeof AuthDecision>;
 declare const DocumentChangeTypeSchema: z$1.ZodEnum<typeof DocumentChangeType>;
 declare const PropagationModeSchema: z$1.ZodEnum<typeof PropagationMode>;
 declare const SyncEnvelopeTypeSchema: z$1.ZodEnum<typeof SyncEnvelopeType>;
+declare function ActionCandidateInputSchema(): z$1.ZodObject<Properties<ActionCandidateInput>>;
 declare function ActionContextInputSchema(): z$1.ZodObject<Properties<ActionContextInput>>;
 declare function ActionInputSchema(): z$1.ZodObject<Properties<ActionInput>>;
 declare function ChannelMetaInputSchema(): z$1.ZodObject<Properties<ChannelMetaInput>>;
@@ -2489,6 +2935,7 @@ declare const GetDocumentIncomingRelationshipsDocument: DocumentNode;
 declare const FindDocumentsDocument: DocumentNode;
 declare const GetDocumentOperationsDocument: DocumentNode;
 declare const GetJobStatusDocument: DocumentNode;
+declare const EvaluateActionsDocument: DocumentNode;
 declare const CreateDocumentDocument: DocumentNode;
 declare const CreateEmptyDocumentDocument: DocumentNode;
 declare const MutateDocumentDocument: DocumentNode;
@@ -2515,6 +2962,7 @@ declare function getSdk<C>(requester: Requester<C>): {
   FindDocuments(variables?: FindDocumentsQueryVariables, options?: C): Promise<FindDocumentsQuery>;
   GetDocumentOperations(variables: GetDocumentOperationsQueryVariables, options?: C): Promise<GetDocumentOperationsQuery>;
   GetJobStatus(variables: GetJobStatusQueryVariables, options?: C): Promise<GetJobStatusQuery>;
+  EvaluateActions(variables: EvaluateActionsQueryVariables, options?: C): Promise<EvaluateActionsQuery>;
   CreateDocument(variables: CreateDocumentMutationVariables, options?: C): Promise<CreateDocumentMutation>;
   CreateEmptyDocument(variables: CreateEmptyDocumentMutationVariables, options?: C): Promise<CreateEmptyDocumentMutation>;
   MutateDocument(variables: MutateDocumentMutationVariables, options?: C): Promise<MutateDocumentMutation>;
@@ -2577,6 +3025,11 @@ declare function createReactorGraphQLClient(url: string, fetchImpl?: FetchLike,
   GetJobStatus(variables: Exact<{
     jobId: Scalars["String"]["input"];
   }>, options?: {} | undefined): Promise<GetJobStatusQuery>;
+  EvaluateActions(variables: Exact<{
+    documentIdentifier: Scalars["String"]["input"];
+    branch?: InputMaybe<Scalars["String"]["input"]>;
+    candidates: ReadonlyArray<ActionCandidateInput>;
+  }>, options?: {} | undefined): Promise<EvaluateActionsQuery>;
   CreateDocument(variables: Exact<{
     document: Scalars["JSONObject"]["input"];
     parentIdentifier?: InputMaybe<Scalars["String"]["input"]>;
@@ -2587,13 +3040,13 @@ declare function createReactorGraphQLClient(url: string, fetchImpl?: FetchLike,
   }>, options?: {} | undefined): Promise<CreateEmptyDocumentMutation>;
   MutateDocument(variables: Exact<{
     documentIdentifier: Scalars["String"]["input"];
-    actions: ReadonlyArray<Scalars["JSONObject"]["input"]>;
-    view?: InputMaybe<ViewFilterInput>;
+    actions: ReadonlyArray<ActionInput>;
+    branch?: InputMaybe<Scalars["String"]["input"]>;
   }>, options?: {} | undefined): Promise<MutateDocumentMutation>;
   MutateDocumentAsync(variables: Exact<{
     documentIdentifier: Scalars["String"]["input"];
-    actions: ReadonlyArray<Scalars["JSONObject"]["input"]>;
-    view?: InputMaybe<ViewFilterInput>;
+    actions: ReadonlyArray<ActionInput>;
+    branch?: InputMaybe<Scalars["String"]["input"]>;
   }>, options?: {} | undefined): Promise<MutateDocumentAsyncMutation>;
   RenameDocument(variables: Exact<{
     documentIdentifier: Scalars["String"]["input"];
@@ -2708,6 +3161,7 @@ declare class ImportPackageLoader implements IPackageLoader {
   private readonly logger;
   readonly name = "ImportPackageLoader";
   loadDocumentModels(identifier: string): Promise<DocumentModelModule[]>;
+  loadUpgradeManifests(identifier: string): Promise<UpgradeManifest<readonly number[]>[]>;
   loadSubgraphs(identifier: string): Promise<SubgraphClass$1[]>;
   loadProcessors(identifier: string): Promise<ProcessorFactoryBuilder | null>;
 }
@@ -2727,11 +3181,13 @@ declare class ImportPackageLoader implements IPackageLoader {
  */
 declare function isExpectedLoaderMiss(error: unknown, pkg: string): boolean;
 declare function getUniqueDocumentModels(...documentModels: readonly (readonly DocumentModelModule<any>[])[]): DocumentModelModule[];
+declare function getUniqueUpgradeManifests(...upgradeManifests: readonly (readonly UpgradeManifest<readonly number[]>[])[]): UpgradeManifest<readonly number[]>[];
 declare class PackageManager implements IPackageManager {
   protected options: IPackageManagerOptions;
   private readonly logger;
   private loaders;
   private docModelsMap;
+  private upgradeManifestsMap;
   private subgraphsMap;
   private processorMap;
   private configWatcher;
@@ -2741,10 +3197,17 @@ declare class PackageManager implements IPackageManager {
   init(): Promise<PackageManagerResult>;
   private loadPackages;
   private loadDocumentModels;
+  /** Upgrade manifests currently loaded across all packages, one per type. */
+  getUniqueUpgradeManifests(): UpgradeManifest<readonly number[]>[];
+  private loadUpgradeManifests;
   private loadSubgraphs;
   private loadProcessors;
   private maybeWarnAllLoadersFailed;
   private updateDocumentModelsForPackage;
+  private updateSubgraphsForPackage;
+  private updateProcessorsForPackage;
+  /** Debounced per key so repeated subscribePackages calls reuse one timer. */
+  private getDebouncedUpdateCallback;
   private subscribePackages;
   private getAllPackageNames;
   private getPackageNamesFromConfigFile;
@@ -2752,11 +3215,39 @@ declare class PackageManager implements IPackageManager {
   private updatePackagesMap;
   private updateSubgraphsMap;
   private updateProcessorsMap;
+  /**
+   * Remove `pkg` from all package maps and emit the change events, tearing
+   * down everything the package registered (subgraphs, processors, document
+   * models). For an uninstalled package no loader can serve it again, so
+   * nothing can re-add it.
+   */
+  removePackage(pkg: string): void;
   onDocumentModelsChange(handler: (documentModels: Record<string, DocumentModelModule[]>) => void): void;
   onSubgraphsChange(handler: (subgraphs: Map<string, SubgraphClass$1[]>) => void): void;
   onProcessorsChange(handler: (processors: Map<string, Processor$1>) => void): void;
 }
 //#endregion
+//#region src/services/renown-config.d.ts
+/** Where the credential check reads from: a remote Renown or Switchboard
+ * instance, or this switchboard's own renown read model. */
+type RenownSource = NonNullable<PHReactorRenown["source"]>;
+/** The `auth.renown` config block: which Renown instance to authenticate
+ * against, before env overrides are applied. */
+type RenownConfig = PHReactorRenown;
+/** Resolved renown coordinates. `url` also drives this reactor's own identity,
+ * so it stays meaningful when `source` is "self". */
+type ResolvedRenownConfig = {
+  source: RenownSource;
+  url: string | undefined;
+  switchboardUrl: string | undefined;
+};
+/** Reading credentials from this reactor's own read model needs a host-supplied
+ * verifier: core has no idea which subgraph serves that read model. */
+declare function assertCredentialVerifierForSource(source: RenownSource, hasVerifier: boolean): void;
+/** Resolve `auth.renown`; RENOWN_SOURCE / RENOWN_URL / SWITCHBOARD_URL win
+ * over the config file, which wins over the SDK defaults. */
+declare function resolveRenownConfig(configured: RenownConfig | undefined, env: NodeJS.ProcessEnv, logger: ILogger): ResolvedRenownConfig;
+//#endregion
 //#region src/server.d.ts
 type Options = {
   port?: number;
@@ -2774,7 +3265,20 @@ type Options = {
   auth?: {
     enabled: boolean;
     admins: string[];
+    /** Read the bearer and populate `ctx.user` independently of `enabled`.
+     *  Defaults to `enabled`; `RESOLVE_CALLER_IDENTITY` overrides either. */
+    resolveIdentity?: boolean;
+    /** Reject anonymous callers with a 401 before any subgraph sees the
+     *  request. Off by default; `REQUIRE_AUTHENTICATED_CALLER` overrides.
+     *  Requires identity resolution to be on — refused at boot without it. */
+    requireAuthenticatedCaller?: boolean;
   };
+  /** Renown coordinates the host already resolved, used verbatim instead of
+   * resolving `auth.renown` and the env again (which would warn twice). */
+  renown?: ResolvedRenownConfig;
+  /** Credential check replacing the built-in remote Renown one; required when
+   * the resolved source is "self" (see assertCredentialVerifierForSource). */
+  verifyCredential?: CredentialVerifier;
   https?: {
     keyPath: string;
     certPath: string;
@@ -2811,7 +3315,22 @@ declare function assertAuthRequiredForDocumentPermissions(authEnabled: boolean,
  * opt-in: it removes the only binding between a token's claimed address and its
  * signing key. Fail-closed — unset NODE_ENV counts as production.
  */
-declare function assertSkipCredentialVerificationAllowed(authEnabled: boolean, skipCredentialVerification: boolean, env: NodeJS.ProcessEnv): void;
+declare function assertSkipCredentialVerificationAllowed(resolvesCallerIdentity: boolean, skipCredentialVerification: boolean, env: NodeJS.ProcessEnv): void;
+/**
+ * Requiring an authenticated caller requires identity resolution to exist at
+ * all: with neither AUTH_ENABLED nor RESOLVE_CALLER_IDENTITY the middleware
+ * never reads a bearer, no `user` is ever resolved, and the
+ * require-authenticated-caller middleware would reject every caller —
+ * authenticated ones included. Refuse to boot rather than run broken.
+ */
+declare function assertRequireAuthenticatedCallerAllowed(requireAuthenticatedCaller: boolean, resolvesCallerIdentity: boolean): void;
+/**
+ * The GraphiQL explorer page's mount prefix. `path.posix.join` normalizes the
+ * join with `basePath` — a naive template literal would produce `//explorer`
+ * for the default `/` basePath, which express compiles into a route that only
+ * matches `//explorer`, leaving `GET /explorer` a 404.
+ */
+declare function getExplorerPrefix(basePath: string): string;
 /**
  * Initializes and starts the API server using an initializer function.
  * This function first loads packages to get document models, then calls the initializer function
@@ -2830,14 +3349,29 @@ declare function assertSkipCredentialVerificationAllowed(authEnabled: boolean, s
 interface ClientInitializerResult {
   module: InProcessReactorClientModule;
   reactorDriveClient?: IDriveClient;
+  attachmentReferenceProjection?: AttachmentReferenceProjectionCapability;
+}
+interface ClientInitializerDependencies {
+  attachmentReferenceWriter: IAttachmentReferenceWriter;
+  /** Upgrade manifests exported by the loaded packages, one per type. */
+  upgradeManifests: UpgradeManifest<readonly number[]>[];
 }
-declare function initializeAndStartAPI(clientInitializer: (documentModels: DocumentModelModule[]) => Promise<ClientInitializerResult>, options: Options, processorApp: ProcessorApp): Promise<API & {
+declare function initializeAndStartAPI(clientInitializer: (documentModels: DocumentModelModule[], dependencies: ClientInitializerDependencies) => Promise<ClientInitializerResult>, options: Options, processorApp: ProcessorApp): Promise<API & {
   client: IReactorClient;
   syncManager: ISyncManager;
   documentModelRegistry: IDocumentModelRegistry;
   readiness: ReadinessGate;
+  attachmentReferenceProjection: AttachmentReferenceProjectionCapability;
+  packageManager: PackageManager;
 }>;
 //#endregion
+//#region src/services/renown-credential-verifier.d.ts
+interface RenownCredentialVerifierConfig {
+  renownUrl?: string;
+  switchboardUrl?: string;
+}
+declare function createRenownCredentialVerifier(config?: RenownCredentialVerifierConfig): Promise<CredentialVerifier>;
+//#endregion
 //#region src/utils/create-schema.d.ts
 declare const buildSubgraphSchemaModule: (documentModels: DocumentModelModule[], resolvers: GraphQLResolverMap<Context$1>, typeDefs: DocumentNode) => GraphQLSchemaModule;
 declare const createSchema: (documentModels: DocumentModelModule[], resolvers: GraphQLResolverMap<Context$1>, typeDefs: DocumentNode) => graphql.GraphQLSchema;
@@ -2871,5 +3405,5 @@ interface DocumentModelSchemaOptions {
  */
 declare function generateDocumentModelSchema(documentModel: DocumentModelGlobalState$1, options?: DocumentModelSchemaOptions): DocumentNode;
 //#endregion
-export { ADMIN_USERS, API, Action, ActionContext, ActionContextInput, ActionContextInputSchema, ActionContextResolvers, ActionInput, ActionInputSchema, ActionResolvers, AddRelationshipDocument, AddRelationshipMutation, AddRelationshipMutationVariables, AnalyticsSubgraph, AuthConfig, AuthContext, AuthFetchMiddleware, AuthService, AuthSubgraph, type AuthorizationConfig, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, type CanonicalDocumentId, ChannelMeta, ChannelMetaInput, ChannelMetaInputSchema, ChannelMetaResolvers, ClientInitializerResult, Context, CreateDocumentDocument, CreateDocumentMutation, CreateDocumentMutationVariables, CreateEmptyDocumentDocument, CreateEmptyDocumentMutation, CreateEmptyDocumentMutationVariables, DateTimeScalarConfig, DbClient, DeadLetterInfo, DeadLetterInfoResolvers, DeleteDocumentDocument, DeleteDocumentMutation, DeleteDocumentMutationVariables, DeleteDocumentsDocument, DeleteDocumentsMutation, DeleteDocumentsMutationVariables, DirectiveResolverFn, DocumentChangeContext, DocumentChangeContextResolvers, DocumentChangeEvent, DocumentChangeEventResolvers, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentChangesSubscription, DocumentChangesSubscriptionVariables, DocumentModelGlobalState, DocumentModelGlobalStateResolvers, DocumentModelResultPage, DocumentModelResultPageResolvers, DocumentModelSchemaOptions, DocumentOperationsFilterInput, DocumentOperationsFilterInputSchema, DocumentPermissionConfig, DocumentPermissionDatabase, DocumentPermissionEntry, DocumentPermissionLevel, DocumentPermissionService, DocumentPermissionTable, DocumentProtectionTable, DocumentWithChildren, DocumentWithChildrenResolvers, Exact, FetchHandler, FindDocumentsDocument, FindDocumentsQuery, FindDocumentsQueryVariables, GatewayAdapterType, GatewayContextFactory, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentIncomingRelationshipsQuery, GetDocumentIncomingRelationshipsQueryVariables, GetDocumentModelsDocument, GetDocumentModelsQuery, GetDocumentModelsQueryVariables, GetDocumentOperationsDocument, GetDocumentOperationsQuery, GetDocumentOperationsQueryVariables, GetDocumentOutgoingRelationshipsDocument, GetDocumentOutgoingRelationshipsQuery, GetDocumentOutgoingRelationshipsQueryVariables, GetDocumentQuery, GetDocumentQueryVariables, GetDocumentWithOperationsDocument, GetDocumentWithOperationsQuery, GetDocumentWithOperationsQueryVariables, GetJobStatusDocument, GetJobStatusQuery, GetJobStatusQueryVariables, GetParentIdsFn, GqlDocument, GqlDriveDocument, GqlOperation, GqlOperationContext, GqlSigner, GqlSignerApp, GqlSignerUser, GraphQLManager, GraphqlManagerFeatureFlags, HttpAdapterSetup, HttpAdapterType, HttpDocumentModelLoader, HttpPackageLoader, HttpPackageLoaderLogger, HttpPackageLoaderOptions, type IAuthorizationService, IGatewayAdapter, IHttpAdapter, type IPackageLoader, type IPackageLoaderOptions, IPackageStorage, IReactorProcessorHostModule, ISubgraph, ImportPackageLoader, InMemoryPackageStorage, Incremental, InputMaybe, InstallPackageResult, InstalledPackageInfo, IsTypeOfResolverFn, JobChangeEvent, JobChangeEventResolvers, JobChangesDocument, JobChangesSubscription, JobChangesSubscriptionVariables, JobInfo, JobInfoResolvers, JsonObjectScalarConfig, MakeEmpty, MakeMaybe, MakeOptional, Maybe, MoveRelationshipDocument, MoveRelationshipMutation, MoveRelationshipMutationVariables, MoveRelationshipResult, MoveRelationshipResultResolvers, MutateDocumentAsyncDocument, MutateDocumentAsyncMutation, MutateDocumentAsyncMutationVariables, MutateDocumentDocument, MutateDocumentMutation, MutateDocumentMutationVariables, Mutation, MutationAddRelationshipArgs, MutationCreateDocumentArgs, MutationCreateEmptyDocumentArgs, MutationDeleteDocumentArgs, MutationDeleteDocumentsArgs, MutationMoveRelationshipArgs, MutationMutateDocumentArgs, MutationMutateDocumentAsyncArgs, MutationPushSyncEnvelopesArgs, MutationRemoveRelationshipArgs, MutationRenameDocumentArgs, MutationResolvers, MutationSetPreferredEditorArgs, MutationTouchChannelArgs, NextResolverFn, OperationContext, OperationContextInput, OperationContextInputSchema, OperationContextResolvers, OperationInput, OperationInputSchema, OperationUserPermissionEntry, OperationUserPermissionTable, OperationWithContext, OperationWithContextInput, OperationWithContextInputSchema, OperationWithContextResolvers, OperationsFilterInput, OperationsFilterInputSchema, PackageManagementService, PackageManagementServiceOptions, PackageManager, PackagesSubgraph, type PackagesSubgraphArgs, PagingInput, PagingInputSchema, type ParsedDriveUrl, PgliteFactory, PhDocument, PhDocumentFieldsFragment, PhDocumentFieldsFragmentDoc, PhDocumentOperationsArgs, PhDocumentResolvers, PhDocumentResultPage, PhDocumentResultPageResolvers, PollSyncEnvelopesDocument, PollSyncEnvelopesQuery, PollSyncEnvelopesQueryVariables, PollSyncEnvelopesResult, PollSyncEnvelopesResultResolvers, Processor, ProcessorDriveFactory, ProcessorFactoryBuilder, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, PushSyncEnvelopesMutation, PushSyncEnvelopesMutationVariables, Query, QueryDocumentArgs, QueryDocumentIncomingRelationshipsArgs, QueryDocumentModelsArgs, QueryDocumentOperationsArgs, QueryDocumentOutgoingRelationshipsArgs, QueryFindDocumentsArgs, QueryJobStatusArgs, QueryPollSyncEnvelopesArgs, QueryResolvers, ReactorModule, ReactorOperation, ReactorOperationResolvers, ReactorOperationResultPage, ReactorOperationResultPageResolvers, ReactorSigner, ReactorSignerApp, ReactorSignerAppInput, ReactorSignerAppInputSchema, ReactorSignerAppResolvers, ReactorSignerInput, ReactorSignerInputSchema, ReactorSignerResolvers, ReactorSignerUser, ReactorSignerUserInput, ReactorSignerUserInputSchema, ReactorSignerUserResolvers, ReactorSubgraph, ReadinessGate, RemoteCursor, RemoteCursorInput, RemoteCursorInputSchema, RemoteCursorResolvers, RemoteFilterInput, RemoteFilterInputSchema, RemoveRelationshipDocument, RemoveRelationshipMutation, RemoveRelationshipMutationVariables, RenameDocumentDocument, RenameDocumentMutation, RenameDocumentMutationVariables, Requester, RequireFields, Resolver, ResolverFn, ResolverTypeWrapper, ResolverWithResolve, Resolvers, ResolversObject, ResolversParentTypes, ResolversTypes, Revision, RevisionResolvers, Scalars, Sdk, SearchFilterInput, SearchFilterInputSchema, SetPreferredEditorDocument, SetPreferredEditorMutation, SetPreferredEditorMutationVariables, SubgraphArgs, SubgraphClass, SubgraphDefinition, Subscription, SubscriptionDocumentChangesArgs, SubscriptionJobChangesArgs, SubscriptionObject, SubscriptionResolveFn, SubscriptionResolver, SubscriptionResolverObject, SubscriptionResolvers, SubscriptionSubscribeFn, SubscriptionSubscriberObject, SyncEnvelope, SyncEnvelopeInput, SyncEnvelopeInputSchema, SyncEnvelopeResolvers, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TlsOptions, TouchChannelDocument, TouchChannelInput, TouchChannelInputSchema, TouchChannelMutation, TouchChannelMutationVariables, TouchChannelResult, TouchChannelResultResolvers, TypeResolveFn, User, ViewFilterInput, ViewFilterInputSchema, WithIndex, WsContextFactory, WsDisposer, assertAuthRequiredForDocumentPermissions, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
+export { ADMIN_USERS, API, Action, ActionCandidateInput, ActionCandidateInputSchema, ActionContext, ActionContextInput, ActionContextInputSchema, ActionContextResolvers, ActionEvaluation, ActionEvaluationResolvers, ActionEvaluations, ActionEvaluationsResolvers, ActionInput, ActionInputSchema, ActionResolvers, AddRelationshipDocument, AddRelationshipMutation, AddRelationshipMutationVariables, AnalyticsSubgraph, AttachmentAccessRequest, AttachmentAccessResult, AttachmentAccessService, type AttachmentReferenceProjectionCapability, AuthConfig, AuthContext, AuthDecision, AuthDecisionSchema, AuthFetchMiddleware, AuthService, AuthSubgraph, type AuthorizationConfig, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, type CanonicalDocumentId, CanonicalDocumentIdResolutionError, CanonicalDocumentIdResolver, ChannelMeta, ChannelMetaInput, ChannelMetaInputSchema, ChannelMetaResolvers, ClientInitializerDependencies, ClientInitializerResult, Context, CreateDocumentDocument, CreateDocumentMutation, CreateDocumentMutationVariables, CreateEmptyDocumentDocument, CreateEmptyDocumentMutation, CreateEmptyDocumentMutationVariables, CredentialVerifier, DateTimeScalarConfig, DbClient, DeadLetterInfo, DeadLetterInfoResolvers, DeleteDocumentDocument, DeleteDocumentMutation, DeleteDocumentMutationVariables, DeleteDocumentsDocument, DeleteDocumentsMutation, DeleteDocumentsMutationVariables, DirectiveResolverFn, DocumentChangeContext, DocumentChangeContextResolvers, DocumentChangeEvent, DocumentChangeEventResolvers, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentChangesSubscription, DocumentChangesSubscriptionVariables, DocumentModelGlobalState, DocumentModelGlobalStateResolvers, DocumentModelResultPage, DocumentModelResultPageResolvers, DocumentModelSchemaOptions, DocumentOperationsFilterInput, DocumentOperationsFilterInputSchema, DocumentPermissionConfig, DocumentPermissionDatabase, DocumentPermissionEntry, DocumentPermissionLevel, DocumentPermissionService, DocumentPermissionTable, DocumentProtectionTable, DocumentWithChildren, DocumentWithChildrenResolvers, EvaluateActionsDocument, EvaluateActionsQuery, EvaluateActionsQueryVariables, Exact, ExplorerUrlState, FetchHandler, FindDocumentsDocument, FindDocumentsQuery, FindDocumentsQueryVariables, GatewayAdapterType, GatewayContextFactory, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentIncomingRelationshipsQuery, GetDocumentIncomingRelationshipsQueryVariables, GetDocumentModelsDocument, GetDocumentModelsQuery, GetDocumentModelsQueryVariables, GetDocumentOperationsDocument, GetDocumentOperationsQuery, GetDocumentOperationsQueryVariables, GetDocumentOutgoingRelationshipsDocument, GetDocumentOutgoingRelationshipsQuery, GetDocumentOutgoingRelationshipsQueryVariables, GetDocumentQuery, GetDocumentQueryVariables, GetDocumentWithOperationsDocument, GetDocumentWithOperationsQuery, GetDocumentWithOperationsQueryVariables, GetJobStatusDocument, GetJobStatusQuery, GetJobStatusQueryVariables, GetParentIdsFn, GqlDocument, GqlDriveDocument, GqlOperation, GqlOperationContext, GqlSigner, GqlSignerApp, GqlSignerUser, GraphQLManager, GraphqlManagerFeatureFlags, HttpAdapterSetup, HttpAdapterType, HttpDocumentModelLoader, HttpPackageLoader, HttpPackageLoaderLogger, HttpPackageLoaderOptions, IAttachmentAccessService, type IAuthorizationService, IGatewayAdapter, IHttpAdapter, type IPackageLoader, type IPackageLoaderOptions, IPackageStorage, IProcessorHostModule, IReactorProcessorHostModule, ISubgraph, ImportPackageLoader, InMemoryPackageStorage, Incremental, InputMaybe, InstallPackageResult, InstalledPackageInfo, IsTypeOfResolverFn, JobChangeEvent, JobChangeEventResolvers, JobChangesDocument, JobChangesSubscription, JobChangesSubscriptionVariables, JobInfo, JobInfoResolvers, JsonObjectScalarConfig, MakeEmpty, MakeMaybe, MakeOptional, Maybe, MoveRelationshipDocument, MoveRelationshipMutation, MoveRelationshipMutationVariables, MoveRelationshipResult, MoveRelationshipResultResolvers, MutateDocumentAsyncDocument, MutateDocumentAsyncMutation, MutateDocumentAsyncMutationVariables, MutateDocumentDocument, MutateDocumentMutation, MutateDocumentMutationVariables, Mutation, MutationAddRelationshipArgs, MutationCreateDocumentArgs, MutationCreateEmptyDocumentArgs, MutationDeleteDocumentArgs, MutationDeleteDocumentsArgs, MutationExecuteArgs, MutationExecuteAsyncArgs, MutationMoveRelationshipArgs, MutationMutateDocumentArgs, MutationMutateDocumentAsyncArgs, MutationPushSyncEnvelopesArgs, MutationRemoveRelationshipArgs, MutationRenameDocumentArgs, MutationResolvers, MutationSetPreferredEditorArgs, MutationTouchChannelArgs, NextResolverFn, OperationContext, OperationContextInput, OperationContextInputSchema, OperationContextResolvers, OperationInput, OperationInputSchema, OperationUserPermissionEntry, OperationUserPermissionTable, OperationWithContext, OperationWithContextInput, OperationWithContextInputSchema, OperationWithContextResolvers, OperationsFilterInput, OperationsFilterInputSchema, PGLITE_UTC_PARSERS, PackageManagementService, PackageManagementServiceOptions, PackageManager, PackagesSubgraph, type PackagesSubgraphArgs, PagingInput, PagingInputSchema, type ParsedDriveUrl, PgliteFactory, PhDocument, PhDocumentFieldsFragment, PhDocumentFieldsFragmentDoc, PhDocumentOperationsArgs, PhDocumentResolvers, PhDocumentResultPage, PhDocumentResultPageResolvers, PollSyncEnvelopesDocument, PollSyncEnvelopesQuery, PollSyncEnvelopesQueryVariables, PollSyncEnvelopesResult, PollSyncEnvelopesResultResolvers, Processor, ProcessorDriveFactory, ProcessorFactoryBuilder, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, PushSyncEnvelopesMutation, PushSyncEnvelopesMutationVariables, Query, QueryDocumentArgs, QueryDocumentIncomingRelationshipsArgs, QueryDocumentModelsArgs, QueryDocumentOperationsArgs, QueryDocumentOutgoingRelationshipsArgs, QueryEvaluateActionsArgs, QueryFindDocumentsArgs, QueryJobStatusArgs, QueryPollSyncEnvelopesArgs, QueryResolvers, ReactorModule, ReactorOperation, ReactorOperationResolvers, ReactorOperationResultPage, ReactorOperationResultPageResolvers, ReactorSigner, ReactorSignerApp, ReactorSignerAppInput, ReactorSignerAppInputSchema, ReactorSignerAppResolvers, ReactorSignerInput, ReactorSignerInputSchema, ReactorSignerResolvers, ReactorSignerUser, ReactorSignerUserInput, ReactorSignerUserInputSchema, ReactorSignerUserResolvers, ReactorSubgraph, ReadinessGate, RemoteCursor, RemoteCursorInput, RemoteCursorInputSchema, RemoteCursorResolvers, RemoteFilterInput, RemoteFilterInputSchema, RemoveRelationshipDocument, RemoveRelationshipMutation, RemoveRelationshipMutationVariables, RenameDocumentDocument, RenameDocumentMutation, RenameDocumentMutationVariables, RenownConfig, RenownCredentialVerifierConfig, RenownSource, Requester, RequireFields, ResolvedRenownConfig, Resolver, ResolverFn, ResolverTypeWrapper, ResolverWithResolve, Resolvers, ResolversObject, ResolversParentTypes, ResolversTypes, Revision, RevisionResolvers, RouteHandle, Scalars, Sdk, SearchFilterInput, SearchFilterInputSchema, SetPreferredEditorDocument, SetPreferredEditorMutation, SetPreferredEditorMutationVariables, SubgraphArgs, SubgraphClass, SubgraphDefinition, Subscription, SubscriptionDocumentChangesArgs, SubscriptionJobChangesArgs, SubscriptionObject, SubscriptionResolveFn, SubscriptionResolver, SubscriptionResolverObject, SubscriptionResolvers, SubscriptionSubscribeFn, SubscriptionSubscriberObject, SyncEnvelope, SyncEnvelopeInput, SyncEnvelopeInputSchema, SyncEnvelopeResolvers, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TlsOptions, TouchChannelDocument, TouchChannelInput, TouchChannelInputSchema, TouchChannelMutation, TouchChannelMutationVariables, TouchChannelResult, TouchChannelResultResolvers, TypeResolveFn, User, ViewFilterInput, ViewFilterInputSchema, WithIndex, WsContextFactory, WsDisposer, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground, resolveRenownConfig };
 //# sourceMappingURL=index.d.mts.map