@powerhousedao/reactor-api 6.2.2-dev.9 → 6.2.2

package/dist/index.mjs

@@ -1,32 +1,34 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e58cea2c-2319-52a8-90cd-3e99d94ba98f")}catch(e){}}();
-import { a as isSubgraphClass, c as loadDocumentModels, d as BaseSubgraph, f as AuthorizationPolicy, i as buildGraphqlOperations, l as loadProcessors, m as createAuthorizationService, n as buildGraphQlDriveDocument, o as debounce, p as AuthorizedDocumentHandle, r as buildGraphqlOperation, t as buildGraphQlDocument, u as loadSubgraphs } from "./utils-iibOQ50e.mjs";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f43e08dc-7398-57dd-8824-db5d97ccc6ca")}catch(e){}}();
+import { _ as createAuthorizationService, a as isSubgraphClass, b as MalformedStoredOperationError, d as loadSubgraphs, f as BaseSubgraph, g as AuthorizedDocumentHandle, h as AuthorizationPolicy, i as buildGraphqlOperations, l as loadDocumentModels, m as createCanonicalDocumentIdResolver, n as buildGraphQlDriveDocument, o as debounce, p as CanonicalDocumentIdResolutionError, r as buildGraphqlOperation, s as extractUpgradeManifests, t as buildGraphQlDocument, u as loadProcessors, v as AuthEvaluationUnsupportedError, y as ForbiddenError } from "./utils-lHoPB-ft.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
 import { GraphQLError, Kind, parse, print } from "graphql";
-import { DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, PropagationMode as PropagationMode$1, consolidateSyncOperations, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl } from "@powerhousedao/reactor";
+import { AuthEnforcementDisabledError, DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, ModelReadGate, PropagationMode as PropagationMode$1, SyncScopeGate, consolidateSyncOperations, createReactorHostModuleBase, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl, readDecisionModel, syncOperationErrorType } from "@powerhousedao/reactor";
 import { ConsoleLogger, childLogger, documentModelDocumentModelModule } from "document-model";
 import path from "node:path";
 import { match } from "path-to-regexp";
 import { buildSubgraphSchema } from "@apollo/subgraph";
 import { typeDefs } from "@powerhousedao/document-engineering/graphql";
 import { camelCase, kebabCase, pascalCase } from "change-case";
-import { GraphQLJSONObject } from "graphql-type-json";
-import { setName } from "@powerhousedao/shared/document-model";
+import { GraphQLJSON, GraphQLJSONObject } from "graphql-type-json";
+import { deserializeSignature, serializeSignature, setName } from "@powerhousedao/shared/document-model";
 import * as z$1 from "zod";
 import { z } from "zod";
 import { createHandler } from "graphql-sse/lib/use/fetch";
+import lzString from "lz-string";
 import { PubSub, withFilter } from "graphql-subscriptions";
 import dotenv from "dotenv";
 import { buildTreeUrl } from "@powerhousedao/shared";
 import { getConfig } from "@powerhousedao/config/node";
 import { reactorDriveDocumentModelModule } from "@powerhousedao/reactor-drive";
+import { ReactorGroupV1 } from "@powerhousedao/reactor-group";
 import { driveDocumentModelModule } from "@powerhousedao/shared/document-drive";
 import EventEmitter from "node:events";
 import fs, { watchFile } from "node:fs";
 import { PostgresAnalyticsStore } from "@powerhousedao/analytics-engine-pg";
-import { AttachmentBuilder } from "@powerhousedao/reactor-attachments";
+import { AttachmentBuilder, AttachmentReferenceIndexBuilder, createRef, createS3AttachmentBackend, parseAttachmentStorageConfig, parseRef } from "@powerhousedao/reactor-attachments";
 import { createAttachmentClient } from "@powerhousedao/reactor-attachments/client";
 import { setupMcpServer } from "@powerhousedao/reactor-mcp";
 import { mkdir } from "node:fs/promises";
@@ -34,7 +36,7 @@ import { tmpdir } from "node:os";
 import { WebSocketServer } from "ws";
 import { createRelationalDb } from "@powerhousedao/shared/processors";
 import { Kysely, Migrator, sql } from "kysely";
-import { fetchDelegationCredential, verifyAuthBearerToken } from "@renown/sdk";
+import { fetchDelegationCredential, resolveSwitchboardEndpoint, verifyAuthBearerToken } from "@renown/sdk";
 import { PGlite } from "@electric-sql/pglite";
 import { AtomicNodeFs } from "@powerhousedao/pglite-fs";
 import knex from "knex";
@@ -305,7 +307,7 @@ function createAuthFetchMiddleware(authService) {
 async function createGatewayAdapter(type, logger) {
 	switch (type) {
 		case "apollo": {
-			const { ApolloGatewayAdapter } = await import("./adapter-gateway-apollo-CxV_hMTv.mjs");
+			const { ApolloGatewayAdapter } = await import("./adapter-gateway-apollo-DdamNLPT.mjs");
 			return new ApolloGatewayAdapter(logger);
 		}
 		case "mercurius": {
@@ -317,11 +319,11 @@ async function createGatewayAdapter(type, logger) {
 async function createHttpAdapter(type) {
 	switch (type) {
 		case "express": {
-			const { createExpressHttpAdapter } = await import("./adapter-http-express-D5OpUIbV.mjs");
+			const { createExpressHttpAdapter } = await import("./adapter-http-express-CgVPgEMm.mjs");
 			return createExpressHttpAdapter();
 		}
 		case "fastify": {
-			const { createFastifyHttpAdapter } = await import("./adapter-http-fastify-B248RJtm.mjs");
+			const { createFastifyHttpAdapter } = await import("./adapter-http-fastify-D98iRljY.mjs");
 			return createFastifyHttpAdapter();
 		}
 	}
@@ -396,7 +398,8 @@ const dedupeTypeDefinitions = (doc) => {
 const buildSubgraphSchemaModule = (documentModels, resolvers, typeDefs) => {
 	const newResolvers = {
 		...resolvers,
-		JSONObject: GraphQLJSONObject
+		JSONObject: GraphQLJSONObject,
+		Unknown: GraphQLJSON
 	};
 	return {
 		typeDefs: getDocumentModelTypeDefs(documentModels, typeDefs),
@@ -404,7 +407,7 @@ const buildSubgraphSchemaModule = (documentModels, resolvers, typeDefs) => {
 	};
 };
 const createSchema = (documentModels, resolvers, typeDefs) => {
-	return buildSubgraphSchema(buildSubgraphSchemaModule(documentModels, resolvers, typeDefs));
+	return buildSubgraphSchema([buildSubgraphSchemaModule(documentModels, resolvers, typeDefs)]);
 };
 /**
 * Create a merged GraphQL schema from multiple subgraph modules.
@@ -460,6 +463,10 @@ const getDocumentModelTypeDefs = (documentModels, typeDefs$1) => {
 	});
 	return dedupeTypeDefinitions(gql`
     scalar JSONObject
+    scalar AttachmentRef
+    # Codegen scalars not in the document-engineering set.
+    scalar Unknown
+    scalar Address
     ${typeDefs.join("\n").replaceAll(";", "")}
 
     type PHOperationContext {
@@ -878,6 +885,7 @@ function generateNewApiSchema(documentName, specification, _stateSchemaTypes, pr
 	return gql`
     scalar DateTime
     scalar JSONObject
+    scalar AttachmentRef
 
     ${revisionType}
 
@@ -926,6 +934,11 @@ function generateNewApiSchema(documentName, specification, _stateSchemaTypes, pr
 }
 //#endregion
 //#region src/graphql/reactor/gen/graphql.ts
+let AuthDecision = /* @__PURE__ */ function(AuthDecision) {
+	AuthDecision["Allow"] = "ALLOW";
+	AuthDecision["Deny"] = "DENY";
+	return AuthDecision;
+}({});
 let DocumentChangeType = /* @__PURE__ */ function(DocumentChangeType) {
 	DocumentChangeType["ChildAdded"] = "CHILD_ADDED";
 	DocumentChangeType["ChildRemoved"] = "CHILD_REMOVED";
@@ -948,11 +961,24 @@ let SyncEnvelopeType = /* @__PURE__ */ function(SyncEnvelopeType) {
 }({});
 const isDefinedNonNullAny = (v) => v !== void 0 && v !== null;
 const definedNonNullAnySchema = z$1.any().refine((v) => isDefinedNonNullAny(v));
+const AuthDecisionSchema = z$1.enum(AuthDecision);
 const DocumentChangeTypeSchema = z$1.enum(DocumentChangeType);
 const PropagationModeSchema = z$1.enum(PropagationMode);
 const SyncEnvelopeTypeSchema = z$1.enum(SyncEnvelopeType);
+function ActionCandidateInputSchema() {
+	return z$1.object({
+		input: z$1.custom((v) => v != null).nullish(),
+		scope: z$1.string(),
+		type: z$1.string()
+	});
+}
 function ActionContextInputSchema() {
-	return z$1.object({ signer: z$1.lazy(() => ReactorSignerInputSchema().nullish()) });
+	return z$1.object({
+		nonce: z$1.string().nullish(),
+		prevOpHash: z$1.string().nullish(),
+		prevOpIndex: z$1.number().nullish(),
+		signer: z$1.lazy(() => ReactorSignerInputSchema().nullish())
+	});
 }
 function ActionInputSchema() {
 	return z$1.object({
@@ -989,6 +1015,7 @@ function OperationContextInputSchema() {
 function OperationInputSchema() {
 	return z$1.object({
 		action: z$1.lazy(() => ActionInputSchema()),
+		deniedReason: z$1.string().nullish(),
 		error: z$1.string().nullish(),
 		hash: z$1.string(),
 		id: z$1.string().nullish(),
@@ -1147,6 +1174,7 @@ const GetDocumentWithOperationsDocument = gql`
             hash
             skip
             error
+            deniedReason
             id
             action {
               id
@@ -1259,6 +1287,7 @@ const GetDocumentOperationsDocument = gql`
         hash
         skip
         error
+        deniedReason
         id
         action {
           id
@@ -1301,6 +1330,28 @@ const GetJobStatusDocument = gql`
     }
   }
 `;
+const EvaluateActionsDocument = gql`
+  query EvaluateActions(
+    $documentIdentifier: String!
+    $branch: String
+    $candidates: [ActionCandidateInput!]!
+  ) {
+    evaluateActions(
+      documentIdentifier: $documentIdentifier
+      branch: $branch
+      candidates: $candidates
+    ) {
+      evaluations {
+        decision
+        reason
+      }
+      allAllowed
+      anyAllowed
+      allDenied
+      anyDenied
+    }
+  }
+`;
 const CreateDocumentDocument = gql`
   mutation CreateDocument($document: JSONObject!, $parentIdentifier: String) {
     createDocument(document: $document, parentIdentifier: $parentIdentifier) {
@@ -1326,13 +1377,13 @@ const CreateEmptyDocumentDocument = gql`
 const MutateDocumentDocument = gql`
   mutation MutateDocument(
     $documentIdentifier: String!
-    $actions: [JSONObject!]!
-    $view: ViewFilterInput
+    $actions: [ActionInput!]!
+    $branch: String
   ) {
-    mutateDocument(
+    mutateDocument: execute(
       documentIdentifier: $documentIdentifier
       actions: $actions
-      view: $view
+      branch: $branch
     ) {
       ...PHDocumentFields
     }
@@ -1342,14 +1393,21 @@ const MutateDocumentDocument = gql`
 const MutateDocumentAsyncDocument = gql`
   mutation MutateDocumentAsync(
     $documentIdentifier: String!
-    $actions: [JSONObject!]!
-    $view: ViewFilterInput
+    $actions: [ActionInput!]!
+    $branch: String
   ) {
-    mutateDocumentAsync(
+    mutateDocumentAsync: executeAsync(
       documentIdentifier: $documentIdentifier
       actions: $actions
-      view: $view
-    )
+      branch: $branch
+    ) {
+      id
+      status
+      result
+      error
+      createdAt
+      completedAt
+    }
   }
 `;
 const RenameDocumentDocument = gql`
@@ -1509,6 +1567,7 @@ const PollSyncEnvelopesDocument = gql`
             hash
             skip
             error
+            deniedReason
             id
             action {
               id
@@ -1551,6 +1610,7 @@ const PollSyncEnvelopesDocument = gql`
       deadLetters {
         documentId
         error
+        errorType
       }
       hasMore
     }
@@ -1595,6 +1655,9 @@ function getSdk(requester) {
 		GetJobStatus(variables, options) {
 			return requester(GetJobStatusDocument, variables, options);
 		},
+		EvaluateActions(variables, options) {
+			return requester(EvaluateActionsDocument, variables, options);
+		},
 		CreateDocument(variables, options) {
 			return requester(CreateDocumentDocument, variables, options);
 		},
@@ -1745,28 +1808,132 @@ function toReactorPropagationMode(gqlMode) {
 	}
 }
 /**
+* Maps one predicted verdict to its GraphQL shape. A refusal's reason is the
+* consensus string the reactor would record for it, carried through verbatim so
+* a client can tell a deletion refusal from a missing grant; an allow has none.
+*/
+function toGqlActionEvaluation(evaluation) {
+	return evaluation.decision === "allow" ? {
+		decision: AuthDecision.Allow,
+		reason: null
+	} : {
+		decision: AuthDecision.Deny,
+		reason: evaluation.reason
+	};
+}
+/**
 * Converts readonly arrays to mutable arrays for ReactorClient
 */
 function toMutableArray(arr) {
 	return arr ? [...arr] : void 0;
 }
 /**
-* Validates that a JSONObject represents a valid Action structure
+* Validates that an incoming value has the structure of an Action.
+*
+* This is the whole guard on the way in. `mutateDocument` takes untyped JSON, so
+* nothing has checked these fields before a resolver runs, and the id in
+* particular has to be checked here: it is hashed into the operation id and
+* replay dedupes by it, so an action without one is stored under an operation id
+* shared by every id-less operation on the same document, scope and branch.
+*
+* The storage constraint would refuse such a row anyway, but only after a job
+* has been enqueued and failed. Refusing here answers the caller instead.
 */
 function validateActionStructure(obj) {
 	if (!obj || typeof obj !== "object") return false;
 	const action = obj;
+	if (typeof action.id !== "string" || !action.id) return false;
 	if (typeof action.type !== "string" || !action.type) return false;
 	if (typeof action.scope !== "string" || !action.scope) return false;
+	if (typeof action.timestampUtcMs !== "string" || !action.timestampUtcMs) return false;
 	if (!("input" in action)) return false;
 	return true;
 }
 /**
+* Restores an action's signatures to the tuples verification reads.
+*
+* A signature is a five-param tuple, and GraphQL declares `signatures` as a
+* list of strings, so a client joins each one for transport. The sync path
+* already splits them on arrival; this is the same step for the mutation path,
+* which had none - an action submitted there kept whatever shape it arrived in,
+* so the same signature was persisted as a tuple or as one joined string
+* depending on which door it came through.
+*
+* A tuple passes through untouched, so an in-process caller handing over real
+* signatures is unaffected.
+*/
+function withDeserializedSignatures(action) {
+	const signer = action.context?.signer;
+	if (!signer?.signatures || signer.signatures.length === 0) return action;
+	return {
+		...action,
+		context: {
+			...action.context,
+			signer: {
+				...signer,
+				signatures: signer.signatures.map(deserializeSignature)
+			}
+		}
+	};
+}
+/**
+* Converts actions the schema has already coerced into the actions the reactor
+* applies.
+*
+* The one conversion the schema cannot express is the signature: GraphQL
+* declares `signatures` as a list of strings, not of lists, so each arrives
+* joined and has to be read back as the tuple verification indexes into.
+*
+* Nothing is validated here. `ActionInput` states every field the reactor needs,
+* so anything that reached this point has them - unlike the untyped path, which
+* has to check by hand.
+*/
+function toSubmittableActions(actions) {
+	return actions.map((action) => {
+		const context = toSubmittableContext(action.context);
+		const submittable = {
+			id: action.id,
+			type: action.type,
+			timestampUtcMs: action.timestampUtcMs,
+			input: action.input,
+			scope: action.scope
+		};
+		return context ? {
+			...submittable,
+			context
+		} : submittable;
+	});
+}
+/**
+* `ReactorSignerInput` leaves `user` and `app` optional where `ActionSigner`
+* requires them, so an incomplete signer cannot be represented. It is carried
+* through as it arrived rather than filled in: the signature verifier is what
+* should refuse it, and inventing either field here would be inventing the part
+* that says who signed.
+*/
+function toSubmittableContext(context) {
+	if (!context) return;
+	const submittable = {};
+	const prevOpIndex = fromInputMaybe(context.prevOpIndex);
+	if (prevOpIndex !== void 0) submittable.prevOpIndex = prevOpIndex;
+	const prevOpHash = fromInputMaybe(context.prevOpHash);
+	if (prevOpHash !== void 0) submittable.prevOpHash = prevOpHash;
+	const nonce = fromInputMaybe(context.nonce);
+	if (nonce !== void 0) submittable.nonce = nonce;
+	const signer = fromInputMaybe(context.signer);
+	if (signer) submittable.signer = {
+		user: fromInputMaybe(signer.user),
+		app: fromInputMaybe(signer.app),
+		signatures: signer.signatures.map(deserializeSignature)
+	};
+	return Object.keys(submittable).length > 0 ? submittable : void 0;
+}
+/**
 * Converts a JSONObject to an Action, validating basic structure
 */
 function jsonObjectToAction(obj) {
-	if (!validateActionStructure(obj)) throw new GraphQLError("Invalid action structure. Actions must have: type (string), scope (string), and input (any)");
-	return obj;
+	if (!validateActionStructure(obj)) throw new GraphQLError("Invalid action structure. Actions must have: id (string), type (string), scope (string), timestampUtcMs (string), and input (any)");
+	return withDeserializedSignatures(obj);
 }
 /**
 * Validates a list of actions by converting them from JSON and checking structure
@@ -1780,10 +1947,57 @@ function validateActions(actions) {
 	}
 	return convertedActions;
 }
+/** The operation fields the schema declares non-null. */
+const REQUIRED_OPERATION_FIELDS = [
+	"index",
+	"timestampUtcMs",
+	"hash",
+	"skip"
+];
+/** The action fields the schema declares non-null. */
+const REQUIRED_ACTION_FIELDS = [
+	"id",
+	"type",
+	"timestampUtcMs",
+	"input",
+	"scope"
+];
+/**
+* Names an operation well enough to find the row it came from, without assuming
+* the fields that might be the missing ones.
+*/
+function describeOperation(stored) {
+	const parts = [typeof stored.id === "string" && stored.id ? `operation ${stored.id}` : "operation with no id"];
+	if (typeof stored.index === "number") parts.push(`index ${stored.index}`);
+	const scope = stored.action?.scope;
+	if (typeof scope === "string" && scope) parts.push(`scope ${scope}`);
+	return parts.join(", ");
+}
+/**
+* Refuses an operation the schema cannot represent, naming the field.
+*
+* The alternative is what execution does unaided: nullify the field, bubble that
+* up the non-null chain until it takes out the envelope's whole operation list,
+* and report a bare "Cannot return null for non-nullable field" with no way to
+* tell which of a hundred operations was at fault. Checked before the response
+* is built so the failure is typed and attributable.
+*
+* Presence is all that is checked. The schema's own serialization still rejects
+* a value of the wrong type, and inventing further rules here would put a second
+* contract beside the one the schema already states.
+*/
+function assertServable(operation) {
+	const stored = operation;
+	for (const field of REQUIRED_OPERATION_FIELDS) if (stored[field] === void 0 || stored[field] === null) throw new MalformedStoredOperationError(`${describeOperation(stored)} has no ${field}`);
+	const action = stored.action;
+	if (action === void 0 || action === null) throw new MalformedStoredOperationError(`${describeOperation(stored)} has no action`);
+	for (const field of REQUIRED_ACTION_FIELDS) if (action[field] === void 0 || action[field] === null) throw new MalformedStoredOperationError(`${describeOperation(stored)} has an action with no ${field}`);
+}
 /**
 * Transforms an operation to serialize signatures from tuples to strings for GraphQL compatibility.
 */
 function serializeOperationForGraphQL(operation) {
+	assertServable(operation);
 	const signer = operation.action.context?.signer;
 	if (!signer?.signatures) return operation;
 	return {
@@ -1794,7 +2008,7 @@ function serializeOperationForGraphQL(operation) {
 				...operation.action.context,
 				signer: {
 					...signer,
-					signatures: signer.signatures.map((sig) => Array.isArray(sig) ? sig.join(", ") : sig)
+					signatures: signer.signatures.map(serializeSignature)
 				}
 			}
 		}
@@ -1904,9 +2118,10 @@ async function documentModels(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert document models to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function document(reactorClient, args) {
-	let view;
+async function document(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -1931,9 +2146,10 @@ async function document(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function documentOutgoingRelationships(reactorClient, args) {
-	let view;
+async function documentOutgoingRelationships(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -1958,9 +2174,10 @@ async function documentOutgoingRelationships(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert outgoing relationships to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function documentIncomingRelationships(reactorClient, args) {
-	let view;
+async function documentIncomingRelationships(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -1985,9 +2202,10 @@ async function documentIncomingRelationships(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert incoming relationships to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function findDocuments(reactorClient, args) {
-	let view;
+async function findDocuments(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
+		subject,
 		branch: fromInputMaybe(args.view.branch),
 		scopes: toMutableArray(fromInputMaybe(args.view.scopes))
 	};
@@ -2029,11 +2247,12 @@ async function jobStatus(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert job status to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function documentOperations(reactorClient, args) {
-	let view;
+async function documentOperations(reactorClient, args, subject) {
+	let view = subject ? { subject } : void 0;
 	const branch = fromInputMaybe(args.filter.branch);
 	const scopes = toMutableArray(fromInputMaybe(args.filter.scopes));
 	if (branch || scopes) view = {
+		subject,
 		branch,
 		scopes
 	};
@@ -2069,6 +2288,41 @@ async function documentOperations(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert operations to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
+/**
+* Predicts the admission verdict for each candidate operation, deciding against
+* the document policy through the reactor's own decision model.
+*
+* The subject is supplied by the subgraph from the authenticated request, never
+* by the caller: answering for an arbitrary subject would disclose what a policy
+* grants somebody else. It carries the caller's address and the app key their
+* token authenticated with, which is the same pair a signed action presents, so
+* a grant naming either matches here exactly as it would at admission.
+*
+* A reactor without authEnforcement raises the named error, which becomes an
+* "unsupported" code rather than a denial.
+*/
+async function evaluateActions(reactorClient, args, subject) {
+	const branch = fromInputMaybe(args.branch) ?? "main";
+	const candidates = args.candidates.map((candidate) => ({
+		scope: candidate.scope,
+		type: candidate.type,
+		input: fromInputMaybe(candidate.input)
+	}));
+	let result;
+	try {
+		result = await reactorClient.evaluateActions(args.documentIdentifier, branch, candidates, subject);
+	} catch (error) {
+		if (AuthEnforcementDisabledError.isError(error)) throw new AuthEvaluationUnsupportedError();
+		throw new GraphQLError(`Failed to evaluate actions: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+	return {
+		evaluations: result.evaluations.map(toGqlActionEvaluation),
+		allAllowed: result.allAllowed,
+		anyAllowed: result.anyAllowed,
+		allDenied: result.allDenied,
+		anyDenied: result.anyDenied
+	};
+}
 async function createDocument(reactorClient, args, reactorDriveClient) {
 	if (!args.document || typeof args.document !== "object") throw new GraphQLError("Invalid document: must be an object");
 	const document = args.document;
@@ -2167,6 +2421,49 @@ async function createDocumentWithInitialState(reactorClient, args, reactorDriveC
 		throw new GraphQLError(`Failed to convert created document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
+/** The branch a mutation applies to when the caller names none. */
+const DEFAULT_BRANCH = "main";
+/**
+* Applies actions to a document and waits for the result.
+*
+* The wire form of `IReactorClient.execute`, and named for it. Takes the actions
+* already coerced against `ActionInput`, so the only conversion left is the one
+* the schema cannot express: a signature travels as one string, and verification
+* reads it as the tuple it was.
+*/
+async function execute(reactorClient, args) {
+	const actions = toSubmittableActions(args.actions);
+	const branch = fromInputMaybe(args.branch) ?? DEFAULT_BRANCH;
+	let result;
+	try {
+		result = await reactorClient.execute(args.documentIdentifier, branch, actions);
+	} catch (error) {
+		throw new GraphQLError(`Failed to execute actions: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+	try {
+		return toGqlPhDocument(result);
+	} catch (error) {
+		throw new GraphQLError(`Failed to convert executed document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+}
+/**
+* Submits actions to a document and returns the job that will apply them.
+*
+* Returns the job rather than only its id, matching
+* `IReactorClient.executeAsync`. A job handed back from a submission has no
+* result yet, which is why `JobInfo.result` is nullable.
+*/
+async function executeAsync(reactorClient, args) {
+	const actions = toSubmittableActions(args.actions);
+	const branch = fromInputMaybe(args.branch) ?? DEFAULT_BRANCH;
+	let job;
+	try {
+		job = await reactorClient.executeAsync(args.documentIdentifier, branch, actions);
+	} catch (error) {
+		throw new GraphQLError(`Failed to submit actions: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+	return toGqlJobInfo(job);
+}
 async function mutateDocument(reactorClient, args) {
 	let validatedActions;
 	try {
@@ -2300,7 +2597,14 @@ async function deleteDocuments(reactorClient, args) {
 		throw new GraphQLError(`Failed to delete documents: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function touchChannel(syncManager, args) {
+/**
+* Registers a sync channel, or reports the state of one already registered.
+*
+* `boundAddress` claims a channel at creation for the subject that created it.
+* An anonymously created channel is left unbound, which is not a permission but
+* an unanswered question: the first authenticated subject to use it adopts it.
+*/
+async function touchChannel(syncManager, args, boundAddress) {
 	try {
 		return {
 			success: true,
@@ -2312,7 +2616,10 @@ async function touchChannel(syncManager, args) {
 		scope: [...args.input.filter.scope],
 		branch: args.input.filter.branch
 	};
-	const options = { sinceTimestampUtcMs: args.input.sinceTimestampUtcMs };
+	const options = {
+		sinceTimestampUtcMs: args.input.sinceTimestampUtcMs,
+		boundAddress
+	};
 	try {
 		await syncManager.add(args.input.name, DriveCollectionId.fromKey(args.input.collectionId), {
 			type: "polling",
@@ -2327,9 +2634,50 @@ async function touchChannel(syncManager, args) {
 	};
 }
 /**
+* The sync operations in `syncOps` this subject may not be served.
+*
+* A sync operation is one document, one branch and (from the outbox) one scope,
+* so the answer is per entry rather than per operation: an entry is withheld
+* whole or served whole, which is what keeps a scope's operation sequence
+* unbroken for whoever does receive it. A dead letter can name several scopes,
+* and is withheld only when the policy serves none of them -- the metadata
+* scopes are readable by every holder, so in practice a dead letter naming one
+* is always served.
+*
+* The policy is read once per document and branch, and the memo lives no longer
+* than this call: a poll must not answer from a policy that changed between
+* polls, since the widening case is exactly the one holding exists to serve.
+*
+* A read that fails for any reason other than the document being absent is
+* allowed to propagate. The poll then fails, the puller retries, and nothing is
+* served in the meantime -- which is the safe direction, and a visible one.
+*/
+async function collectHeldSyncOperations(syncOps, gate, subject, signal) {
+	const held = /* @__PURE__ */ new Set();
+	const predicates = /* @__PURE__ */ new Map();
+	for (const syncOp of syncOps) {
+		const key = `${syncOp.documentId}\u0000${syncOp.branch}`;
+		let predicate = predicates.get(key);
+		if (!predicate) {
+			predicate = gate.scopePredicateById(syncOp.documentId, subject, syncOp.branch, signal);
+			predicates.set(key, predicate);
+		}
+		const readable = await predicate;
+		if (!syncOp.scopes.some((scope) => readable(scope))) held.add(syncOp.id);
+	}
+	return held;
+}
+/**
 * Polls the switchboard for new sync envelopes and acknowledges previously
 * received operations.
 *
+* `forbiddenIds` and `heldOpIds` are two different refusals. A forbidden
+* document is consumed: its delivery counters are advanced as though it had
+* been sent, so it is never reconsidered. A held sync operation is withheld:
+* nothing about it is touched, so a policy that later widens serves it whole on
+* a subsequent poll. Which one applies is the caller's decision, and the two
+* are intersected, so a document refused either way is not served.
+*
 * Ordinal frames of reference:
 * - `outboxAck` / `outboxLatest`: switchboard's ordinals (used to trim/filter
 *   the switchboard's outbox)
@@ -2337,16 +2685,17 @@ async function touchChannel(syncManager, args) {
 *   client ordinal the switchboard has successfully applied, so the client
 *   can trim its own outbox)
 */
-function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new Set()) {
+function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new Set(), heldOpIds = /* @__PURE__ */ new Set()) {
 	let remote;
 	try {
 		remote = syncManager.getById(args.channelId);
 	} catch (error) {
 		throw new GraphQLError(`Channel not found: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
-	const deadLetters = remote.channel.deadLetter.items.filter((syncOp) => !forbiddenIds.has(syncOp.documentId)).map((syncOp) => ({
+	const deadLetters = remote.channel.deadLetter.items.filter((syncOp) => !forbiddenIds.has(syncOp.documentId) && !heldOpIds.has(syncOp.id)).map((syncOp) => ({
 		documentId: syncOp.documentId,
 		error: syncOp.error?.message ?? "Unknown error",
+		errorType: syncOperationErrorType(syncOp.error),
 		jobId: syncOp.jobId,
 		branch: syncOp.branch,
 		scopes: syncOp.scopes,
@@ -2392,6 +2741,7 @@ function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new
 			hasMore = true;
 			break;
 		}
+		if (heldOpIds.has(syncOp.id)) continue;
 		syncOp.deliveredCount ??= 0;
 		syncOp.emittedCount ??= 0;
 		while (syncOp.deliveredCount < syncOp.emittedCount && syncOp.operations[syncOp.deliveredCount].context.ordinal <= args.outboxLatest) syncOp.deliveredCount += 1;
@@ -2863,6 +3213,12 @@ function filterLatestDocumentModelVersions(documentModels) {
 	return Array.from(latestByName.values());
 }
 const DefaultFeatureFlags = { enableDocumentModelSubgraphs: true };
+/**
+* The registration-source label for document-model-generated subgraphs, so
+* they can be pruned like package-contributed ones (see
+* regenerateDocumentModelSubgraphs).
+*/
+const DOCUMENT_MODEL_SUBGRAPH_SOURCE = "document-models";
 var GraphQLManager = class {
 	initialized = false;
 	coreSubgraphsMap = /* @__PURE__ */ new Map();
@@ -2870,11 +3226,25 @@ var GraphQLManager = class {
 	subgraphs = /* @__PURE__ */ new Map();
 	subgraphWsDisposers = /* @__PURE__ */ new Map();
 	#authMiddleware;
+	#requireAuthMiddleware;
 	#driveMiddleware;
 	driveOwnershipCache;
 	/** Cached document models for schema generation - updated on init and regenerate */
 	cachedDocumentModels = [];
 	subgraphHandlerCache = /* @__PURE__ */ new Map();
+	/** subgraphPath → the http adapter handle of its mounted route. */
+	subgraphRouteHandles = /* @__PURE__ */ new Map();
+	/** Handle of the currently mounted supergraph SSE route, if any. */
+	sseRouteHandle;
+	/**
+	* Package name → the subgraph instances registered from it, keyed by
+	* subgraph name. Tracks the package association so that removed packages
+	* can be torn down (see unregisterPackage / prunePackageSubgraphs).
+	*/
+	packageSubgraphs = /* @__PURE__ */ new Map();
+	/** Per-subgraph handlers by name, before auth/drive middleware is applied,
+	* for in-process queries by trusted internals. */
+	#internalSubgraphHandlers = /* @__PURE__ */ new Map();
 	/**
 	* Optional reactor-drive client. When the switchboard is configured with a
 	* reactor-drive container, this is provided and the resolvers dispatch to
@@ -2882,7 +3252,7 @@ var GraphQLManager = class {
 	*/
 	reactorDriveClient;
 	authorizationService;
-	constructor(path, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, logger, httpAdapter, gatewayAdapter, authService, documentPermissionService, featureFlags = DefaultFeatureFlags, port = 4001, authorizationService, reactorDriveClient) {
+	constructor(path, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, logger, httpAdapter, gatewayAdapter, authService, documentPermissionService, featureFlags = DefaultFeatureFlags, port = 4001, authorizationService, reactorDriveClient, syncServingGate) {
 		this.path = path;
 		this.httpServer = httpServer;
 		this.wsServer = wsServer;
@@ -2897,14 +3267,16 @@ var GraphQLManager = class {
 		this.documentPermissionService = documentPermissionService;
 		this.featureFlags = featureFlags;
 		this.port = port;
+		this.syncServingGate = syncServingGate;
 		if (!authorizationService) throw new Error("GraphQLManager requires an authorizationService");
 		this.authorizationService = authorizationService;
 		this.reactorDriveClient = reactorDriveClient;
 		this.driveOwnershipCache = new DriveOwnershipCache(this.reactorClient);
 		this.wsServer.setMaxListeners(0);
 	}
-	async init(coreSubgraphs, authMiddleware) {
+	async init(coreSubgraphs, authMiddleware, requireAuthMiddleware) {
 		this.#authMiddleware = authMiddleware;
+		this.#requireAuthMiddleware = requireAuthMiddleware;
 		this.logger.debug(`Initializing Subgraph Manager...`);
 		await this.driveOwnershipCache.init();
 		this.#driveMiddleware = createDriveFetchMiddleware(this.driveOwnershipCache);
@@ -2914,7 +3286,7 @@ var GraphQLManager = class {
 		if (!models.find((it) => it.documentModel.global.name === "DocumentDrive")) throw new Error("DocumentDrive model required");
 		await this.gatewayAdapter.start(this.httpServer);
 		this.httpAdapter.setupMiddleware({ bodyLimit: "50mb" });
-		const driveRoutePath = path.join(this.path, "d/:drive");
+		const driveRoutePath = path.posix.join(this.path, "d/:drive");
 		const driveMatcher = match(driveRoutePath);
 		this.httpAdapter.mount(driveRoutePath, async (request) => {
 			const url = new URL(request.url);
@@ -2952,7 +3324,8 @@ var GraphQLManager = class {
 		try {
 			const models = (await this.reactorClient.getDocumentModelModules()).results;
 			this.cachedDocumentModels = models;
-			await this.#setupDocumentModelSubgraphs("graphql", models);
+			const registeredNames = await this.#setupDocumentModelSubgraphs("graphql", models);
+			await this.prunePackageSubgraphs(DOCUMENT_MODEL_SUBGRAPH_SOURCE, registeredNames);
 			await this.updateRouter();
 			this.logger.info("Regenerated document model subgraphs with @count models", models.length);
 		} catch (error) {
@@ -2970,6 +3343,7 @@ var GraphQLManager = class {
 	}
 	async #setupDocumentModelSubgraphs(supergraph, documentModels) {
 		const latestDocumentModels = filterLatestDocumentModelVersions(documentModels);
+		const registeredNames = /* @__PURE__ */ new Set();
 		for (const documentModel of latestDocumentModels) {
 			if (DOCUMENT_MODELS_TO_EXCLUDE.includes(documentModel.documentModel.global.id)) continue;
 			if (!hasOperationSchemas(documentModel)) continue;
@@ -2982,31 +3356,92 @@ var GraphQLManager = class {
 					syncManager: this.syncManager,
 					path: this.path,
 					documentPermissionService: this.documentPermissionService,
-					authorizationService: this.authorizationService
+					authorizationService: this.authorizationService,
+					syncServingGate: this.syncServingGate
 				});
-				await this.#addSubgraphInstance(subgraphInstance, supergraph, false);
+				await this.#addSubgraphInstance(subgraphInstance, supergraph, false, DOCUMENT_MODEL_SUBGRAPH_SOURCE);
+				registeredNames.add(subgraphInstance.name);
 			} catch (error) {
 				this.logger.error(`Failed to setup document model subgraph for ${documentModel.documentModel.global.id}`, error instanceof Error ? error.message : error);
 				this.logger.debug("@error", error);
 			}
 		}
+		return registeredNames;
+	}
+	/** Core subgraph names are reserved: they register with core=true during
+	* init() and no package subgraph may take one of their names. */
+	#isCoreNameReserved(name) {
+		for (const subgraphs of this.coreSubgraphsMap.values()) if (subgraphs.some((it) => it.name === name)) return true;
+		return false;
 	}
-	async #addSubgraphInstance(subgraphInstance, supergraph = "", core = false) {
+	async #addSubgraphInstance(subgraphInstance, supergraph = "", core = false, packageName) {
+		if (!core && this.#isCoreNameReserved(subgraphInstance.name)) {
+			this.logger.error("Rejecting subgraph @name: name is reserved by a registered core subgraph", subgraphInstance.name);
+			return;
+		}
 		const subgraphsMap = core ? this.coreSubgraphsMap : this.subgraphs;
-		const subgraphs = subgraphsMap.get(supergraph) ?? [];
-		const existingSubgraph = subgraphs.find((it) => it.name === subgraphInstance.name);
-		if (existingSubgraph) {
+		const existingSubgraph = subgraphsMap.get(supergraph)?.find((it) => it.name === subgraphInstance.name);
+		if (existingSubgraph === subgraphInstance) {
 			this.logger.debug(`Skipping duplicate subgraph: ${subgraphInstance.name}`);
 			return existingSubgraph;
 		}
+		if (existingSubgraph) await this.#removeSubgraphInstance(existingSubgraph);
 		await subgraphInstance.onSetup?.();
+		const subgraphs = subgraphsMap.get(supergraph) ?? [];
 		subgraphs.push(subgraphInstance);
 		subgraphsMap.set(supergraph, subgraphs);
 		if (supergraph !== "" && supergraph !== "graphql") subgraphsMap.get("graphql")?.push(subgraphInstance);
-		this.logger.info(`Registered ${this.path.endsWith("/") ? this.path : this.path + "/"}${supergraph ? supergraph + "/" : ""}${subgraphInstance.name} subgraph.`);
+		if (packageName !== void 0) {
+			let byName = this.packageSubgraphs.get(packageName);
+			if (!byName) {
+				byName = /* @__PURE__ */ new Map();
+				this.packageSubgraphs.set(packageName, byName);
+			}
+			byName.set(subgraphInstance.name, subgraphInstance);
+		}
+		this.logger.info(`${existingSubgraph ? "Replaced" : "Registered"} ${this.path.endsWith("/") ? this.path : this.path + "/"}${supergraph ? supergraph + "/" : ""}${subgraphInstance.name} subgraph.`);
 		return subgraphInstance;
 	}
 	/**
+	* Tear down a subgraph instance: disconnect it, drop it from every
+	* bucket, unmount its route, dispose its WebSocket handler, and remove
+	* its internal handler. Used when a subgraph is replaced or its package
+	* is removed; #setupSubgraphs then never re-mounts it.
+	*/
+	async #removeSubgraphInstance(instance) {
+		try {
+			await instance.onDisconnect?.();
+		} catch (error) {
+			this.logger.error("Error disconnecting subgraph @name: @error", instance.name, error);
+		}
+		for (const subgraphsMap of [this.coreSubgraphsMap, this.subgraphs]) for (const [bucket, subgraphs] of subgraphsMap.entries()) {
+			if (!subgraphs.includes(instance)) continue;
+			subgraphsMap.set(bucket, subgraphs.filter((it) => it !== instance));
+			const subgraphPath = this.#getSubgraphPath(instance, bucket);
+			this.subgraphHandlerCache.delete(subgraphPath);
+			const routeHandle = this.subgraphRouteHandles.get(subgraphPath);
+			if (routeHandle !== void 0) {
+				this.httpAdapter.unmount(routeHandle);
+				this.subgraphRouteHandles.delete(subgraphPath);
+			}
+			const wsDisposer = this.subgraphWsDisposers.get(subgraphPath);
+			if (wsDisposer) {
+				this.subgraphWsDisposers.delete(subgraphPath);
+				try {
+					await wsDisposer.dispose();
+				} catch (error) {
+					this.logger.error("Error disposing subgraph websocket @name: @error", instance.name, error);
+				}
+			}
+		}
+		if (this.#internalSubgraphHandlers.get(instance.name)?.subgraph === instance) this.#internalSubgraphHandlers.delete(instance.name);
+		for (const [packageName, byName] of this.packageSubgraphs) {
+			if (byName.get(instance.name) !== instance) continue;
+			byName.delete(instance.name);
+			if (byName.size === 0) this.packageSubgraphs.delete(packageName);
+		}
+	}
+	/**
 	* Register a pre-constructed subgraph instance.
 	* Use this when you need to pass custom dependencies to a subgraph.
 	*/
@@ -3027,7 +3462,13 @@ var GraphQLManager = class {
 	getAuthorizationService() {
 		return this.authorizationService;
 	}
-	async registerSubgraph(subgraph, supergraph = "", core = false) {
+	/**
+	* Register a subgraph class. `packageName` labels the resulting instance
+	* with its contributing package so the instance can be torn down when the
+	* package is removed or drops the subgraph (see unregisterPackage and
+	* prunePackageSubgraphs).
+	*/
+	async registerSubgraph(subgraph, supergraph = "", core = false, packageName) {
 		const subgraphInstance = new subgraph({
 			relationalDb: this.relationalDb,
 			analyticsStore: this.analyticsStore,
@@ -3036,9 +3477,76 @@ var GraphQLManager = class {
 			syncManager: this.syncManager,
 			path: this.path,
 			documentPermissionService: this.documentPermissionService,
-			authorizationService: this.authorizationService
+			authorizationService: this.authorizationService,
+			syncServingGate: this.syncServingGate
 		});
-		return this.#addSubgraphInstance(subgraphInstance, supergraph, core);
+		return this.#addSubgraphInstance(subgraphInstance, supergraph, core, packageName);
+	}
+	/**
+	* Tear down every subgraph instance registered from `packageName`:
+	* disconnects the instances, unmounts their routes, disposes their
+	* WebSocket handlers, then refreshes the router so the supergraph SDL and
+	* the supergraph SSE handler no longer reference them. No-op if the
+	* package has no registered subgraphs.
+	*/
+	async unregisterPackage(packageName) {
+		const byName = this.packageSubgraphs.get(packageName);
+		if (!byName || byName.size === 0) return;
+		for (const instance of Array.from(byName.values())) await this.#removeSubgraphInstance(instance);
+		await this.updateRouter();
+	}
+	/**
+	* Remove this package's registered subgraphs whose names are not in
+	* `keepNames` — the package is still loaded but dropped some of its
+	* subgraphs. Refreshes the router if anything was removed.
+	*/
+	async prunePackageSubgraphs(packageName, keepNames) {
+		const byName = this.packageSubgraphs.get(packageName);
+		if (!byName) return;
+		let removed = 0;
+		for (const [name, instance] of Array.from(byName.entries())) if (!keepNames.has(name)) {
+			await this.#removeSubgraphInstance(instance);
+			removed++;
+		}
+		if (removed > 0) await this.updateRouter();
+	}
+	/** Find a registered subgraph by name, core or package-contributed. */
+	getSubgraphByName(name) {
+		for (const subgraphs of [...this.coreSubgraphsMap.values(), ...this.subgraphs.values()]) {
+			const found = subgraphs.find((subgraph) => subgraph.name === name);
+			if (found) return found;
+		}
+	}
+	/** Whether a registered subgraph has a live handler, i.e. whether
+	* {@link executeSubgraphQuery} can reach it right now. */
+	hasSubgraphHandler(name) {
+		return this.#internalSubgraphHandlers.has(name);
+	}
+	/** Run a query against one registered subgraph in-process: the subgraph's own
+	* handler, without a socket or the auth/drive middleware. Trusted callers. */
+	async executeSubgraphQuery(subgraphName, query, variables) {
+		const entry = this.#internalSubgraphHandlers.get(subgraphName);
+		if (!entry) throw new Error(this.getSubgraphByName(subgraphName) ? `Subgraph "${subgraphName}" is registered but has no handler yet` : `Subgraph "${subgraphName}" is not registered`);
+		const url = new URL(entry.path, `http://localhost:${this.port}/`);
+		const response = await entry.handler(new Request(url, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				accept: "application/json"
+			},
+			body: JSON.stringify({
+				query,
+				variables
+			})
+		}));
+		if (!response.ok) {
+			const detail = await response.text().catch(() => "");
+			throw new Error(`Subgraph "${subgraphName}" query failed: ${response.status}${detail ? ` ${detail}` : ""}`);
+		}
+		const body = await response.json();
+		if (body.errors?.length) throw new Error(body.errors.map((error) => error.message).join("; "));
+		if (!body.data) throw new Error(`Subgraph "${subgraphName}" returned no data`);
+		return body.data;
 	}
 	updateRouter = debounce(this._updateRouter.bind(this), 1e3);
 	async _updateRouter() {
@@ -3050,7 +3558,7 @@ var GraphQLManager = class {
 		} catch (error) {
 			this.logger.error("Failed to update Apollo Gateway supergraph: @error", error);
 		}
-		const superGraphPath = path.join(this.path, "graphql");
+		const superGraphPath = path.posix.join(this.path, "graphql");
 		this.#setupSupergraphSSE(superGraphPath);
 	}
 	getAdditionalContextFields = () => {
@@ -3094,10 +3602,18 @@ var GraphQLManager = class {
 		return (connectionParams) => this.#createWebSocketContext(connectionParams);
 	}
 	setSupergraph(supergraph, subgraphs) {
-		this.subgraphs.set(supergraph, subgraphs);
+		const accepted = [];
+		for (const subgraph of subgraphs) {
+			if (this.#isCoreNameReserved(subgraph.name)) {
+				this.logger.error("Rejecting subgraph @name: name is reserved by a registered core subgraph", subgraph.name);
+				continue;
+			}
+			accepted.push(subgraph);
+		}
+		this.subgraphs.set(supergraph, accepted);
 		const globalSubgraphs = this.subgraphs.get("graphql");
-		if (globalSubgraphs) this.subgraphs.set("graphql", [...globalSubgraphs, ...subgraphs]);
-		else this.subgraphs.set("graphql", subgraphs);
+		if (globalSubgraphs) this.subgraphs.set("graphql", [...globalSubgraphs, ...accepted]);
+		else this.subgraphs.set("graphql", accepted);
 		return this.updateRouter();
 	}
 	async shutdown() {
@@ -3113,19 +3629,41 @@ var GraphQLManager = class {
 		});
 	}
 	#getSubgraphPath(subgraph, supergraph) {
-		return path.join(subgraph.path ?? "", supergraph, subgraph.name);
+		return path.posix.join(this.path, supergraph, subgraph.name);
+	}
+	/** The in-process handler map is keyed by bare name, so two distinct
+	* subgraphs sharing one name would shadow each other: keep the first. */
+	#setInternalSubgraphHandler(subgraph, subgraphPath, handler) {
+		const existing = this.#internalSubgraphHandlers.get(subgraph.name);
+		if (existing && existing.subgraph !== subgraph) {
+			this.logger.warn("Two subgraphs are named @name (@kept and @ignored); in-process queries keep the first", subgraph.name, existing.path, subgraphPath);
+			return;
+		}
+		this.#internalSubgraphHandlers.set(subgraph.name, {
+			subgraph,
+			path: subgraphPath,
+			handler
+		});
 	}
 	async #setupSubgraphs(subgraphsMap) {
 		for (const [supergraph, subgraphs] of subgraphsMap.entries()) for (const subgraph of subgraphs) {
 			this.logger.debug(`Setting up subgraph ${subgraph.name}`);
 			const subgraphPath = this.#getSubgraphPath(subgraph, supergraph);
 			try {
-				if (this.subgraphHandlerCache.has(subgraphPath)) continue;
+				const cached = this.subgraphHandlerCache.get(subgraphPath);
+				if (cached) {
+					if (cached.subgraph !== subgraph) this.logger.warn("Subgraph path @path already mounted by @kept; @name is shadowed and will not be mounted", subgraphPath, cached.subgraph.name, subgraph.name);
+					continue;
+				}
 				const schema = createSchema(this.cachedDocumentModels, subgraph.resolvers, subgraph.typeDefs);
 				const rawHandler = await this.gatewayAdapter.createHandler(schema, this.#makeContextFactory());
 				const fetchHandler = this.#composeFetchMiddleware(rawHandler);
-				this.subgraphHandlerCache.set(subgraphPath, fetchHandler);
-				this.httpAdapter.mount(subgraphPath, fetchHandler);
+				this.subgraphHandlerCache.set(subgraphPath, {
+					handler: fetchHandler,
+					subgraph
+				});
+				this.#setInternalSubgraphHandler(subgraph, subgraphPath, rawHandler);
+				this.subgraphRouteHandles.set(subgraphPath, this.httpAdapter.mount(subgraphPath, fetchHandler));
 				if (subgraph.hasSubscriptions) {
 					try {
 						if (this.subgraphWsDisposers.get(subgraphPath)) this.logger.warn("Overwriting existing WebSocket disposer for subgraph at path @path", subgraphPath);
@@ -3171,7 +3709,7 @@ var GraphQLManager = class {
 		}));
 	}
 	async #createSupergraphGateway() {
-		const superGraphPath = path.join(this.path, "graphql");
+		const superGraphPath = path.posix.join(this.path, "graphql");
 		const rawHandler = await this.gatewayAdapter.createSupergraphHandler(() => this.#getSubgraphDefinitions(), this.httpServer, this.#makeContextFactory());
 		const fetchHandler = this.#composeFetchMiddleware(rawHandler);
 		this.httpAdapter.mount(superGraphPath, fetchHandler);
@@ -3190,7 +3728,13 @@ var GraphQLManager = class {
 	#setupSupergraphSSE(superGraphPath) {
 		const allSubgraphs = this.#getAllSubgraphs();
 		const modules = Array.from(allSubgraphs.values()).filter((subgraph) => subgraph.hasSubscriptions).map((subgraph) => this.#buildSubgraphSchemaModule(subgraph));
-		if (modules.length === 0) return;
+		if (modules.length === 0) {
+			if (this.sseRouteHandle !== void 0) {
+				this.httpAdapter.unmount(this.sseRouteHandle);
+				this.sseRouteHandle = void 0;
+			}
+			return;
+		}
 		try {
 			const mergedSchema = createMergedSchema(modules);
 			this.#setupSSEHandler(mergedSchema, superGraphPath);
@@ -3214,16 +3758,20 @@ var GraphQLManager = class {
 			contextFactory: this.#makeContextFactory()
 		});
 		const handler = this.#composeFetchMiddleware(rawHandler);
-		this.httpAdapter.mount(ssePath, handler, { exact: true });
+		if (this.sseRouteHandle !== void 0) this.httpAdapter.unmount(this.sseRouteHandle);
+		this.sseRouteHandle = this.httpAdapter.mount(ssePath, handler, { exact: true });
 	}
 	/**
 	* Compose the request-level fetch middleware chain. Auth runs first
 	* (so we don't validate shard before knowing the request is even
-	* authorized), drive-ownership validation runs after.
+	* authorized); the require-authenticated-caller middleware runs next,
+	* before shard validation, so an anonymous caller is rejected with a
+	* 401 rather than a 421; drive-ownership validation runs last.
 	*/
 	#composeFetchMiddleware(rawHandler) {
 		let handler = rawHandler;
 		if (this.#driveMiddleware) handler = this.#driveMiddleware(handler);
+		if (this.#requireAuthMiddleware) handler = this.#requireAuthMiddleware(handler);
 		if (this.#authMiddleware) handler = this.#authMiddleware(handler);
 		return handler;
 	}
@@ -3329,6 +3877,31 @@ var PackagesSubgraph = class extends BaseSubgraph {
 //#endregion
 //#region src/graphql/playground.ts
 /**
+* Decodes an `explorerURLState` URL parameter. Returns `null` for anything
+* that is not a valid lz-compressed payload with a non-empty `document`.
+*/
+function decodeExplorerUrlState(encoded) {
+	try {
+		const decompressed = lzString.decompressFromEncodedURIComponent(encoded);
+		if (!decompressed) return null;
+		const payload = JSON.parse(decompressed);
+		if (typeof payload.document !== "string" || payload.document.length === 0) return null;
+		const variables = typeof payload.variables === "string" ? payload.variables : void 0;
+		let headers;
+		if (typeof payload.headers === "string") {
+			const parsed = JSON.parse(payload.headers);
+			if (parsed && typeof parsed === "object") headers = parsed;
+		}
+		return {
+			query: payload.document,
+			variables,
+			headers
+		};
+	} catch {
+		return null;
+	}
+}
+/**
 * Pinned CDN versions for GraphiQL playground dependencies.
 * Using pinned versions avoids unpkg.com redirect issues that can
 * trigger CORS errors in the browser.
@@ -3339,7 +3912,29 @@ const CDN_VERSIONS = {
 	graphiql: "3.8.3",
 	pluginExplorer: "4.0.0"
 };
-function renderGraphqlPlayground(url, query, headers = {}) {
+/**
+* Escape a string for embedding as a single-quoted JS string literal inside
+* an HTML `<script>` block. The payload reaches the browser through an
+* attacker-controllable URL parameter, so the embedding must survive two
+* parsers: HTML (a `<\/script>` inside the string would end the script
+* element and start a new, attacker-authored one) and JS (backticks,
+* `${...}` and quotes in the content would otherwise break out of the
+* literal). Backslash, quote, CR and LF escapes keep the literal valid;
+* every `<` becomes `\u003c`, which no HTML parser reads as a tag opener.
+* The escapes resolve when the script parses, so the in-memory value is
+* byte-identical to the input.
+*/
+function jsStringEscape(value) {
+	return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/\r/g, "\\r").replace(/\n/g, "\\n").replace(/</g, "\\u003c");
+}
+/**
+* JSON is already a valid JS object/string literal; the only HTML-hostile
+* byte left is `<` (e.g. `<\/script>` inside a string value).
+*/
+function jsJsonEscape(json) {
+	return json.replace(/</g, "\\u003c");
+}
+function renderGraphqlPlayground(url, query, headers = {}, variables) {
 	return `<!doctype html>
     <html lang="en">
       <head>
@@ -3379,16 +3974,21 @@ function renderGraphqlPlayground(url, query, headers = {}) {
         <div id="graphiql">Loading...</div>
         <script>
             var fetcher = GraphiQL.createFetcher({
-                url: '${url}',
-                headers: ${JSON.stringify(headers)}
+                url: '${jsStringEscape(url)}',
+                headers: ${jsJsonEscape(JSON.stringify(headers))}
             });
-            var defaultQuery = ${query ? `\`${query}\`` : void 0};
+            var defaultQuery = ${query ? `'${jsStringEscape(query)}'` : "undefined"};
+            var defaultVariables = ${variables ? `'${jsStringEscape(variables)}'` : "undefined"};
 
-            if (defaultQuery) {
-                var sessionQuery = localStorage.getItem("graphiql:query");
-                if (sessionQuery) {
-                    localStorage.setItem("graphiql:query", defaultQuery);
-                }
+            // GraphiQL only applies defaultQuery/variables when the editor has
+            // no persisted value. Overwrite any stale persisted state so a
+            // returning user still gets the document-scoped query/variables
+            // instead of their last session's.
+            if (defaultQuery && localStorage.getItem("graphiql:query")) {
+                localStorage.setItem("graphiql:query", defaultQuery);
+            }
+            if (defaultVariables && localStorage.getItem("graphiql:variables")) {
+                localStorage.setItem("graphiql:variables", defaultVariables);
             }
 
             var explorerPlugin = GraphiQLPluginExplorer.explorerPlugin();
@@ -3398,7 +3998,8 @@ function renderGraphqlPlayground(url, query, headers = {}) {
                 fetcher: fetcher,
                 defaultEditorToolsVisibility: true,
                 plugins: [explorerPlugin],
-                defaultQuery
+                defaultQuery: defaultQuery,
+                variables: defaultVariables
                 });
             }
 
@@ -3536,6 +4137,17 @@ const DocumentChangeEventDTO = z.object({
 	documents: z.array(PHDocumentDTO),
 	context: DocumentChangeContextDTO.nullable().optional()
 }).strip();
+const ActionEvaluationDTO = z.object({
+	decision: z.enum(["ALLOW", "DENY"]),
+	reason: z.string().nullable().optional()
+}).strip();
+const ActionEvaluationsDTO = z.object({
+	evaluations: z.array(ActionEvaluationDTO),
+	allAllowed: z.boolean(),
+	anyAllowed: z.boolean(),
+	allDenied: z.boolean(),
+	anyDenied: z.boolean()
+}).strip();
 const JobChangeEventDTO = z.object({
 	jobId: z.string(),
 	status: z.string(),
@@ -3569,6 +4181,9 @@ const operationValidators = {
 	GetJobStatus: (data) => {
 		if (data.jobStatus) JobInfoDTO.parse(data.jobStatus);
 	},
+	EvaluateActions: (data) => {
+		if (data.evaluateActions) ActionEvaluationsDTO.parse(data.evaluateActions);
+	},
 	CreateDocument: (data) => {
 		if (data.createDocument) PHDocumentDTO.parse(data.createDocument);
 	},
@@ -3631,7 +4246,7 @@ function createReactorGraphQLClient(url, fetchImpl = fetch, headers) {
 }
 //#endregion
 //#region src/graphql/reactor/schema.graphql
-var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n  result: JSONObject!\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n  result: JSONObject!\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n# Input types for sync operations\ninput ActionContextInput {\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  # Poll for sync envelopes from a channel\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
+var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  \"\"\"\n  How the origin classified the failure. A peer needs this to mirror the origin's\n  quarantine decision; without it a held auth operation would freeze the document\n  on the peer side while the origin kept syncing.\n  \"\"\"\n  errorType: String\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Null until then, which\n  is the state every job is in when it is handed back from a submission.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n  result: JSONObject!\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n\"\"\"\nOne operation an authorization preflight predicts a verdict for.\n\n`input` is what a conditional grant reads, so a candidate standing for a\nfilled-in form carries that form's input. Omitting it predicts the verdict an\nempty input earns, not the verdict the filled-in form will get.\n\"\"\"\ninput ActionCandidateInput {\n  scope: String!\n  type: String!\n  input: JSONObject\n}\n\nenum AuthDecision {\n  ALLOW\n  DENY\n}\n\n\"\"\"\nOne candidate's predicted verdict. `reason` carries the refusal a DENY is\nrecorded with, and is null on an ALLOW.\n\"\"\"\ntype ActionEvaluation {\n  decision: AuthDecision!\n  reason: String\n}\n\n\"\"\"\nThe predicted verdicts for a set of candidates, in the order they were given,\nwith the aggregates a caller branches on.\n\nThe aggregates are redundant -- a verdict is binary -- and all four are returned\nso a caller reads the one its question is phrased in rather than negating\nanother. Over no candidates every aggregate is false: nothing is allowed and\nnothing is denied.\n\"\"\"\ntype ActionEvaluations {\n  evaluations: [ActionEvaluation!]!\n  allAllowed: Boolean!\n  anyAllowed: Boolean!\n  allDenied: Boolean!\n  anyDenied: Boolean!\n}\n\n# Input types for sync operations\n\"\"\"\nAn action's context, as a caller submits it.\n\nDeclares every field `ActionContext` carries, because an input object rejects a\nfield it does not declare: an action stamped with the head it applies to - which\nis what a signing client sends - is refused outright if these are missing, and\nthat refusal is a whole-request one, not a per-field one.\n\n`prevOpHash` and `prevOpIndex` are the scope head the action was composed\nagainst. They are recorded rather than enforced; a signature is verified from\nthe params carried in its own tuple, which do not include them.\n\"\"\"\ninput ActionContextInput {\n  \"\"\"The index of the last operation in the scope the action applies to.\"\"\"\n  prevOpIndex: Int\n\n  \"\"\"The hash of the state the action applies to.\"\"\"\n  prevOpHash: String\n\n  \"\"\"Covers replay of an operation that would otherwise be a no-op.\"\"\"\n  nonce: String\n\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  \"\"\"\n  Predicts whether the calling subject would be admitted to execute each of a\n  set of candidate operations, without submitting any of them. A UI asks this to\n  disable a control rather than offer an action that fails on submit.\n\n  The answer is a prediction, not a promise:\n\n  - Real admission compiles an append condition over everything it read and the\n    store enforces it at write time. A preflight reads no future, so a policy\n    change landing between this answer and the submit changes the verdict. The\n    submit path stays the only authority.\n  - The verdict is evaluated at the stream heads, so it is correct for a\n    candidate about to be submitted. A backdated submission is out of contract;\n    the reactor decides that one by position.\n  - A candidate whose verdict depends on its input has to carry that input, since\n    a conditional grant reads it.\n\n  The subject is the authenticated caller and cannot be named in the request:\n  answering for an arbitrary subject would disclose what a policy grants\n  somebody else. It carries both the caller's address and the did:key of the app\n  instance whose token authenticated the request, so a policy naming either\n  matches the same principal the write path presents.\n\n  Requires the reactor's authEnforcement feature flag. Without it the reactor\n  holds no decision model, so this fails with extensions.code\n  AUTH_EVALUATION_UNSUPPORTED rather than guessing.\n  \"\"\"\n  evaluateActions(\n    documentIdentifier: String!\n    branch: String\n    candidates: [ActionCandidateInput!]!\n  ): ActionEvaluations!\n\n  \"\"\"\n  Polls for sync envelopes from a channel.\n\n  An operation stored before the API required an action id cannot be\n  represented by this schema, and rather than serving a partial response beside\n  a bare non-null violation, this fails with extensions.code\n  MALFORMED_STORED_OPERATION naming the operation. That code means the failure\n  is worth polling through: the document holding the operation needs repairing,\n  but the channel serves every other document, and a peer that stopped polling\n  would stop receiving those too.\n  \"\"\"\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  \"\"\"\n  Applies actions to a document and waits for the result.\n\n  Each action is coerced against `ActionInput`, so one missing a field the wire\n  declares is refused before any work starts. The id in particular: it is hashed\n  into the operation id and replay dedupes by it, so an action without one is\n  stored under an operation id shared by every id-less operation on the same\n  document, scope and branch.\n\n  Named for `IReactorClient.execute`, which this is the wire form of. `branch`\n  defaults to `main`.\n  \"\"\"\n  execute(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): PHDocument!\n\n  \"\"\"\n  Submits actions to a document and returns the job that will apply them.\n\n  Coerced exactly as `execute` is, so a malformed action is refused here rather\n  than surfacing later as a failed job. Returns the job rather than only its id,\n  so a caller has the status and the creation time it would otherwise have to\n  ask for; `result` is null until the job produces one.\n  \"\"\"\n  executeAsync(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): JobInfo!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n    @deprecated(\n      reason: \"Use execute. Actions here are untyped, so a malformed one is refused by a hand-written check rather than by the schema, and `view.scopes` is accepted but ignored.\"\n    )\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n    @deprecated(\n      reason: \"Use executeAsync, which is typed and returns the job rather than only its id.\"\n    )\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
 //#endregion
 //#region src/graphql/reactor/pubsub.ts
 const pubSub = new PubSub();
@@ -3769,6 +4384,46 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			if (!await this.canReadDocument(documentId, ctx)) forbidden.add(documentId);
 		}
 	}
+	/**
+	* Enforces which subject a sync channel answers to, adopting an unclaimed one.
+	*
+	* A channel is a private queue: it names a collection, and it accumulates
+	* exactly the operations one subject is owed, so serving it to a second
+	* subject would hand over that subject's cursor as well as its contents. An
+	* unbound channel -- created anonymously, or created before binding existed --
+	* is claimed by the first authenticated subject to use it, and answers to that
+	* address alone thereafter. Adoption is safe precisely because serving
+	* withholds rather than consumes: before it was claimed the channel served
+	* only what an anonymous subject may read, and everything withheld is still
+	* queued for the adopter.
+	*
+	* The refusal is the shape a read denial takes, so a puller treats it as a
+	* signal to authenticate again rather than as a transport failure.
+	*
+	* Nothing is enforced or adopted without a serving gate. Below
+	* `authEnforcement` there is no policy being enforced for the channel to
+	* belong to, and refusing a poll there would break sync for no gain.
+	*/
+	async #bindOrRefuseChannel(channelId, ctx) {
+		if (!this.syncServingGate) return;
+		let remote;
+		try {
+			remote = this.syncManager.getById(channelId);
+		} catch {
+			return;
+		}
+		const bound = remote.meta.options.boundAddress;
+		const address = ctx.user?.address;
+		if (bound === void 0) {
+			if (address !== void 0) await this.syncManager.bindRemote(channelId, address);
+			return;
+		}
+		if (bound !== address) throw new ForbiddenError("to poll this sync channel");
+	}
+	/** The address a channel created by this request belongs to, if any. */
+	#creatorBinding(ctx) {
+		return this.syncServingGate ? ctx.user?.address : void 0;
+	}
 	typeDefs = gql(schema_default);
 	resolvers = {
 		PHDocument: { operations: async (parent, args, ctx) => {
@@ -3787,7 +4442,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 				return await documentOperations(this.reactorClient, {
 					filter,
 					paging: args.paging
-				});
+				}, this.viewSubject(ctx));
 			} catch (error) {
 				this.logger.error("Error in PHDocument.operations: @Error", error);
 				throw error;
@@ -3810,7 +4465,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await document(this.reactorClient, {
 						...args,
 						identifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in document: @Error", error);
 					throw error;
@@ -3823,7 +4478,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await documentOutgoingRelationships(this.reactorClient, {
 						...args,
 						sourceIdentifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in documentOutgoingRelationships: @Error", error);
 					throw error;
@@ -3836,7 +4491,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					const result = await documentIncomingRelationships(this.reactorClient, {
 						...args,
 						targetIdentifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
@@ -3857,7 +4512,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					const result = await findDocuments(this.reactorClient, {
 						...args,
 						search: args.search ?? {}
-					});
+					}, this.viewSubject(ctx));
 					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
@@ -3891,12 +4546,25 @@ var ReactorSubgraph = class extends BaseSubgraph {
 							...args.filter,
 							documentId: handle.fetchIdentifier
 						}
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in documentOperations: @Error", error);
 					throw error;
 				}
 			},
+			evaluateActions: async (_parent, args, ctx) => {
+				this.logger.debug("evaluateActions(@args)", args);
+				try {
+					const handle = await this.assertCanRead(args.documentIdentifier, ctx);
+					return await evaluateActions(this.reactorClient, {
+						...args,
+						documentIdentifier: handle.fetchIdentifier
+					}, this.viewSubject(ctx));
+				} catch (error) {
+					this.logger.error("Error in evaluateActions: @Error", error);
+					throw error;
+				}
+			},
 			pollSyncEnvelopes: async (_parent, args, ctx) => {
 				this.logger.debug("pollSyncEnvelopes(@args)", args);
 				try {
@@ -3909,12 +4577,14 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					const driveId = remote.meta.collectionId.driveId;
 					const isAdmin = this.authorizationService.isSupremeAdmin(ctx.user?.address);
 					if (!isAdmin) await this.assertCanReadCanonical(driveId, ctx);
+					await this.#bindOrRefuseChannel(args.channelId, ctx);
 					const forbiddenIds = /* @__PURE__ */ new Set();
 					if (!isAdmin) {
 						if (await this.authorizationService.canRead(driveId, void 0)) await this.#collectForbiddenDocuments(remote.channel.outbox.items, forbiddenIds, ctx);
 						await this.#collectForbiddenDocuments(remote.channel.deadLetter.items, forbiddenIds, ctx);
 					}
-					const { envelopes, ackOrdinal, deadLetters, hasMore } = pollSyncEnvelopes(this.syncManager, args, forbiddenIds);
+					const heldOpIds = this.syncServingGate ? await collectHeldSyncOperations([...remote.channel.outbox.items, ...remote.channel.deadLetter.items], this.syncServingGate, this.viewSubject(ctx)) : /* @__PURE__ */ new Set();
+					const { envelopes, ackOrdinal, deadLetters, hasMore } = pollSyncEnvelopes(this.syncManager, args, forbiddenIds, heldOpIds);
 					return {
 						envelopes,
 						ackOrdinal,
@@ -3960,6 +4630,32 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					throw error;
 				}
 			},
+			execute: async (_parent, args, ctx) => {
+				this.logger.debug("execute(@args)", args);
+				try {
+					const handle = await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
+					return await execute(this.reactorClient, {
+						...args,
+						documentIdentifier: handle.fetchIdentifier
+					});
+				} catch (error) {
+					this.logger.error("Error in execute(@args): @Error", args, error);
+					throw error;
+				}
+			},
+			executeAsync: async (_parent, args, ctx) => {
+				this.logger.debug("executeAsync(@args)", args);
+				try {
+					const handle = await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
+					return await executeAsync(this.reactorClient, {
+						...args,
+						documentIdentifier: handle.fetchIdentifier
+					});
+				} catch (error) {
+					this.logger.error("Error in executeAsync(@args): @Error", args, error);
+					throw error;
+				}
+			},
 			mutateDocument: async (_parent, args, ctx) => {
 				this.logger.debug("mutateDocument(@args)", args);
 				try {
@@ -4093,7 +4789,8 @@ var ReactorSubgraph = class extends BaseSubgraph {
 						const driveId = DriveCollectionId.fromKey(args.input.collectionId).driveId;
 						await this.assertCanReadCanonical(driveId, ctx);
 					}
-					return await touchChannel(this.syncManager, args);
+					await this.#bindOrRefuseChannel(args.input.id, ctx);
+					return await touchChannel(this.syncManager, args, this.#creatorBinding(ctx));
 				} catch (error) {
 					this.logger.error("Error in touchChannel(@args): @Error", args, error);
 					throw error;
@@ -4205,10 +4902,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.2-dev.9";
+	return "6.2.2";
 }
 function getGitHash() {
-	return "ec23e4c4dd92ea6fa8ae283471c757e68e92b552";
+	return "f1edb55f5581a52badb784d25c78666b266f9caf";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -4306,6 +5003,13 @@ var HttpPackageLoader = class {
 		this.logger.verbose(`Loaded ${models.length} document models from ${packageName}`);
 		return models;
 	}
+	async loadUpgradeManifests(packageSpec) {
+		const { name: packageName } = this.parsePackageSpec(packageSpec);
+		if (!this.isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
+		const manifests = extractUpgradeManifests(await import(`${this.registryUrl}-/cdn/${packageSpec}/node/document-models/index.mjs`));
+		if (manifests.length > 0) this.logger.verbose(`Loaded ${manifests.length} upgrade manifests from ${packageName}`);
+		return manifests;
+	}
 	async loadSubgraphs(packageSpec) {
 		const { name: packageName } = this.parsePackageSpec(packageSpec);
 		if (!this.isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
@@ -4431,7 +5135,7 @@ var ImportPackageLoader = class {
 		this.logger.verbose(`Loading document models from package: ${identifier}`);
 		const pkgModule = await loadDocumentModels(identifier);
 		if (pkgModule) {
-			const models = Object.values(pkgModule);
+			const models = Object.values(pkgModule).filter((m) => m !== null && typeof m === "object" && "documentModel" in m);
 			this.logger.verbose(`  ➜  Loaded ${models.length} Document Models from: ${identifier}`);
 			return models;
 		} else {
@@ -4439,6 +5143,13 @@ var ImportPackageLoader = class {
 			return [];
 		}
 	}
+	async loadUpgradeManifests(identifier) {
+		const pkgModule = await loadDocumentModels(identifier);
+		if (!pkgModule) return [];
+		const manifests = extractUpgradeManifests(pkgModule);
+		if (manifests.length > 0) this.logger.verbose(`  ➜  Loaded ${manifests.length} Upgrade Manifests from: ${identifier}`);
+		return manifests;
+	}
 	async loadSubgraphs(identifier) {
 		this.logger.verbose(`Loading subgraphs from package: ${identifier}`);
 		const pkgModule = await loadSubgraphs(identifier);
@@ -4487,13 +5198,19 @@ function isExpectedLoaderMiss(error, pkg) {
 }
 function getUniqueDocumentModels(...documentModels) {
 	const uniqueModels = /* @__PURE__ */ new Map();
-	for (const models of documentModels) for (const model of models) uniqueModels.set(model.documentModel.global.id, model);
+	for (const models of documentModels) for (const model of models) uniqueModels.set(`${model.documentModel.global.id}@${model.version ?? 1}`, model);
 	return Array.from(uniqueModels.values());
 }
+function getUniqueUpgradeManifests(...upgradeManifests) {
+	const uniqueManifests = /* @__PURE__ */ new Map();
+	for (const manifests of upgradeManifests) for (const manifest of manifests) uniqueManifests.set(manifest.documentType, manifest);
+	return Array.from(uniqueManifests.values());
+}
 var PackageManager = class {
 	logger = childLogger(["reactor-api", "package-manager"]);
 	loaders;
 	docModelsMap = /* @__PURE__ */ new Map();
+	upgradeManifestsMap = /* @__PURE__ */ new Map();
 	subgraphsMap = /* @__PURE__ */ new Map();
 	processorMap = /* @__PURE__ */ new Map();
 	configWatcher;
@@ -4511,8 +5228,10 @@ var PackageManager = class {
 	async loadPackages(packages) {
 		this.logger.info("Loading packages: @packages", packages.join(", "));
 		const documentModelsMap = await this.loadDocumentModels(packages);
+		const upgradeManifestsMap = await this.loadUpgradeManifests(packages);
 		const subgraphsMap = await this.loadSubgraphs(packages);
 		const processorsMap = await this.loadProcessors(packages);
+		this.upgradeManifestsMap = upgradeManifestsMap;
 		this.updatePackagesMap(documentModelsMap);
 		this.updateSubgraphsMap(subgraphsMap);
 		this.updateProcessorsMap(processorsMap);
@@ -4523,6 +5242,7 @@ var PackageManager = class {
 		}
 		return {
 			documentModels: getUniqueDocumentModels(...Array.from(documentModelsMap.values())),
+			upgradeManifests: this.getUniqueUpgradeManifests(),
 			subgraphs: subgraphsMap,
 			processors: processorsMap
 		};
@@ -4533,6 +5253,7 @@ var PackageManager = class {
 		documentModelModuleMap.set("document-drive", [driveDocumentModelModule]);
 		documentModelModuleMap.set("document-model", [documentModelDocumentModelModule]);
 		documentModelModuleMap.set("reactor-drive", [reactorDriveDocumentModelModule]);
+		documentModelModuleMap.set("reactor-group", [ReactorGroupV1]);
 		for (const pkg of packages) {
 			const allDocumentModels = [];
 			const failures = [];
@@ -4555,6 +5276,26 @@ var PackageManager = class {
 		}
 		return documentModelModuleMap;
 	}
+	/** Upgrade manifests currently loaded across all packages, one per type. */
+	getUniqueUpgradeManifests() {
+		return getUniqueUpgradeManifests(...Array.from(this.upgradeManifestsMap.values()));
+	}
+	async loadUpgradeManifests(packages) {
+		const manifestsMap = /* @__PURE__ */ new Map();
+		for (const pkg of packages) for (const loader of this.loaders) {
+			if (!loader.loadUpgradeManifests) continue;
+			try {
+				const manifests = await loader.loadUpgradeManifests(pkg);
+				if (manifests.length > 0) {
+					manifestsMap.set(pkg, manifests);
+					break;
+				}
+			} catch (error) {
+				this.logger.debug(`[${loader.name}] Failed to load upgrade manifests from package @pkg: @error`, pkg, error);
+			}
+		}
+		return manifestsMap;
+	}
 	async loadSubgraphs(packages) {
 		this.logger.debug(`Loading subgraphs from packages: ${packages.join(", ")}`);
 		const subgraphsMap = /* @__PURE__ */ new Map();
@@ -4601,7 +5342,6 @@ var PackageManager = class {
 			this.maybeWarnAllLoadersFailed("processors", pkg, succeeded, failures);
 			processorsMap.set(pkg, allProcessors);
 		}
-		this.updateProcessorsMap(processorsMap);
 		return processorsMap;
 	}
 	maybeWarnAllLoadersFailed(kind, pkg, succeeded, failures) {
@@ -4616,23 +5356,58 @@ var PackageManager = class {
 	async updateDocumentModelsForPackage(pkg) {
 		this.logger.debug(`Updating document models for package: ${pkg}`);
 		const documentModels = await this.loadDocumentModels([pkg]);
+		const upgradeManifests = await this.loadUpgradeManifests([pkg]);
+		const upgradeManifestsMap = new Map(this.upgradeManifestsMap);
+		const pkgManifests = upgradeManifests.get(pkg) ?? [];
+		if (pkgManifests.length === 0) upgradeManifestsMap.delete(pkg);
+		else upgradeManifestsMap.set(pkg, pkgManifests);
+		this.upgradeManifestsMap = upgradeManifestsMap;
 		const documentModelsMap = new Map(this.docModelsMap);
-		documentModelsMap.set(pkg, documentModels.get(pkg) ?? []);
+		const pkgModels = documentModels.get(pkg) ?? [];
+		if (pkgModels.length === 0) documentModelsMap.delete(pkg);
+		else documentModelsMap.set(pkg, pkgModels);
 		this.updatePackagesMap(documentModelsMap);
 	}
+	async updateSubgraphsForPackage(pkg) {
+		this.logger.debug(`Updating subgraphs for package: ${pkg}`);
+		const subgraphs = await this.loadSubgraphs([pkg]);
+		const subgraphsMap = new Map(this.subgraphsMap);
+		const pkgSubgraphs = subgraphs.get(pkg) ?? [];
+		if (pkgSubgraphs.length === 0) subgraphsMap.delete(pkg);
+		else subgraphsMap.set(pkg, pkgSubgraphs);
+		this.updateSubgraphsMap(subgraphsMap);
+	}
+	async updateProcessorsForPackage(pkg) {
+		this.logger.debug(`Updating processors for package: ${pkg}`);
+		const processors = await this.loadProcessors([pkg]);
+		const processorsMap = new Map(this.processorMap);
+		const pkgProcessors = processors.get(pkg) ?? [];
+		if (pkgProcessors.length === 0) processorsMap.delete(pkg);
+		else processorsMap.set(pkg, pkgProcessors);
+		this.updateProcessorsMap(processorsMap);
+	}
+	/** Debounced per key so repeated subscribePackages calls reuse one timer. */
+	getDebouncedUpdateCallback(key, update) {
+		if (!this.debouncedUpdateCallbacks.has(key)) {
+			const debouncedFn = debounce(update, 1e3);
+			this.debouncedUpdateCallbacks.set(key, () => {
+				debouncedFn().catch((error) => {
+					this.logger.error("Failed to update package: @error", error);
+				});
+			});
+		}
+		return this.debouncedUpdateCallbacks.get(key);
+	}
 	subscribePackages(packages) {
 		const unsubs = [];
 		for (const pkg of packages) {
-			if (!this.debouncedUpdateCallbacks.has(pkg)) {
-				const debouncedFn = debounce(() => this.updateDocumentModelsForPackage(pkg), 1e3);
-				this.debouncedUpdateCallbacks.set(pkg, () => {
-					debouncedFn();
-				});
-			}
-			const debouncedCallback = this.debouncedUpdateCallbacks.get(pkg);
-			for (const loader of this.loaders) if (loader.onDocumentModelsChange) {
-				const unsub = loader.onDocumentModelsChange(pkg, debouncedCallback);
-				unsubs.push(unsub);
+			const onDocumentModels = this.getDebouncedUpdateCallback(`${pkg}:document-models`, () => this.updateDocumentModelsForPackage(pkg));
+			const onSubgraphs = this.getDebouncedUpdateCallback(`${pkg}:subgraphs`, () => this.updateSubgraphsForPackage(pkg));
+			const onProcessors = this.getDebouncedUpdateCallback(`${pkg}:processors`, () => this.updateProcessorsForPackage(pkg));
+			for (const loader of this.loaders) {
+				if (loader.onDocumentModelsChange) unsubs.push(loader.onDocumentModelsChange(pkg, onDocumentModels));
+				if (loader.onSubgraphsChange) unsubs.push(loader.onSubgraphsChange(pkg, onSubgraphs));
+				if (loader.onProcessorsChange) unsubs.push(loader.onProcessorsChange(pkg, onProcessors));
 			}
 		}
 		return () => {
@@ -4680,6 +5455,28 @@ var PackageManager = class {
 		this.processorMap = processorsMap;
 		this.eventEmitter.emit("processorsChange", processorsMap);
 	}
+	/**
+	* Remove `pkg` from all package maps and emit the change events, tearing
+	* down everything the package registered (subgraphs, processors, document
+	* models). For an uninstalled package no loader can serve it again, so
+	* nothing can re-add it.
+	*/
+	removePackage(pkg) {
+		this.logger.info(`Removing package: ${pkg}`);
+		const dropKey = (map) => {
+			if (!map.has(pkg)) return map;
+			const next = new Map(map);
+			next.delete(pkg);
+			return next;
+		};
+		this.docModelsMap = dropKey(this.docModelsMap);
+		this.upgradeManifestsMap = dropKey(this.upgradeManifestsMap);
+		this.subgraphsMap = dropKey(this.subgraphsMap);
+		this.processorMap = dropKey(this.processorMap);
+		this.updatePackagesMap(this.docModelsMap);
+		this.updateSubgraphsMap(this.subgraphsMap);
+		this.updateProcessorsMap(this.processorMap);
+	}
 	onDocumentModelsChange(handler) {
 		this.eventEmitter.on("documentModelsChange", handler);
 	}
@@ -4695,6 +5492,104 @@ var PackageManager = class {
 const config = { basePath: process.env.BASE_PATH || "/" };
 const DefaultCoreSubgraphs = [AnalyticsSubgraph, SystemSubgraph];
 //#endregion
+//#region src/attachment-backend.ts
+/** Filesystem is the default; explicit S3 is readiness-gated without fallback. */
+async function createStartupAttachmentBackend({ db, env = process.env, s3Dependencies }) {
+	const storage = parseAttachmentStorageConfig(env);
+	if (storage.kind === "filesystem") return void 0;
+	const backend = createS3AttachmentBackend(db.withSchema("attachments"), storage.s3, s3Dependencies);
+	if (!(await backend.health()).ready) throw new Error("S3 attachment backend readiness check failed");
+	return backend;
+}
+//#endregion
+//#region src/services/attachment-access.service.ts
+const HASH_PATTERN = /^[a-f0-9]{64}$/;
+/**
+* Composes document authorization with the projected document/ref
+* relationship. Order is fixed: validate ref, resolve the canonical document
+* id, check `canRead`, then check the reference index. A denied document
+* never reaches the reference reader, and the facade never touches
+* attachment metadata, storage backends, or presigners.
+*/
+var AttachmentAccessService = class {
+	constructor(resolveCanonicalId, authorization, references, projection) {
+		this.resolveCanonicalId = resolveCanonicalId;
+		this.authorization = authorization;
+		this.references = references;
+		this.projection = projection;
+	}
+	async canReadAttachment(request) {
+		if (this.projection.status !== "available") return { kind: "projection-unavailable" };
+		const ref = normalizeAttachmentRef(request.attachmentRef);
+		if (ref === null) return { kind: "denied" };
+		let documentId;
+		try {
+			documentId = await this.resolveCanonicalId(request.documentId);
+		} catch {
+			return { kind: "denied" };
+		}
+		if (!await this.authorization.canRead(documentId, request.userAddress)) return { kind: "denied" };
+		if (!await this.references.hasReference(documentId, ref)) return { kind: "denied" };
+		return {
+			kind: "allowed",
+			documentId,
+			ref
+		};
+	}
+};
+/**
+* Parses and canonicalizes a caller-supplied ref through the shared parser.
+* Returns null for anything that is not a v1 ref over a 64-char SHA-256 hex
+* hash; hex case is normalized so index lookups use the canonical form.
+*/
+function normalizeAttachmentRef(value) {
+	let hash;
+	let version;
+	try {
+		const parsed = parseRef(value);
+		hash = parsed.hash.toLowerCase();
+		version = parsed.version;
+	} catch {
+		return null;
+	}
+	if (version !== 1 || !HASH_PATTERN.test(hash)) return null;
+	return createRef(hash, version);
+}
+//#endregion
+//#region src/graphql/gateway/require-auth-middleware.ts
+/**
+* Returns a fetch middleware that rejects anonymous callers with a 401.
+*
+* This is the enforcement half of the resolve-and-don't-enforce split set up
+* by `RESOLVE_CALLER_IDENTITY`: the auth middleware must run before this
+* one — it verifies the bearer (an invalid token is still a 401 from
+* there) and records the resolved caller on the request. This middleware
+* then refuses the request when no caller was resolved, so under `OPEN`
+* (or `AUTH_ENABLED` with identity resolution) the whole generic surface —
+* document CRUD, sync, every custom subgraph — is reachable only by
+* authenticated callers, without locking out non-admins the way
+* `ADMIN_ONLY` does.
+*
+* It composes in one place in the fetch chain, so it covers every mounted
+* subgraph, the supergraph, and the SSE handler alike.
+*
+* OPTIONS is let through: a CORS preflight never carries a bearer, and
+* `AuthService.authenticateRequest` already answers it with an anonymous
+* context — refusing it would break every cross-origin client with a 401.
+*
+* Fails closed: a request that reaches this middleware without a resolved
+* context has no caller, and is rejected. The server never composes this
+* middleware without the auth middleware in the chain (see
+* `assertRequireAuthenticatedCallerAllowed` in `server.ts`).
+*/
+function createRequireAuthFetchMiddleware() {
+	return (next) => async (request) => {
+		if (request.method === "OPTIONS") return next(request);
+		if (getAuthContext(request)?.user === void 0) return new globalThis.Response(JSON.stringify({ error: "Authentication required" }), { status: 401 });
+		return next(request);
+	};
+}
+//#endregion
 //#region src/migrations/001_create_document_permissions.ts
 var _001_create_document_permissions_exports = /* @__PURE__ */ __exportAll({
 	down: () => down$2,
@@ -4915,17 +5810,27 @@ var AuthService = class {
 	constructor(config) {
 		this.config = config;
 	}
-	async authenticateRequest(request) {
-		if (!this.config.enabled) return {
+	/**
+	* Whether this service reads the bearer at all. Defaults to `enabled`, so a
+	* config written before `resolveIdentity` existed behaves exactly as it did.
+	*/
+	get resolvesIdentity() {
+		return this.config.resolveIdentity ?? this.config.enabled;
+	}
+	/** The context an unresolved request gets: no user, and no admin list to match against. */
+	anonymousContext() {
+		return {
 			user: void 0,
 			admins: [],
-			auth_enabled: false
+			auth_enabled: this.config.enabled
 		};
-		const method = request.method;
-		if (method === "OPTIONS" || method === "GET") return {
+	}
+	async authenticateRequest(request) {
+		if (!this.resolvesIdentity) return this.anonymousContext();
+		if (request.method === "OPTIONS") return {
 			user: void 0,
 			admins: this.config.admins,
-			auth_enabled: true
+			auth_enabled: this.config.enabled
 		};
 		return this.verifyBearer(request.headers.get("authorization") ?? void 0);
 	}
@@ -4934,16 +5839,12 @@ var AuthService = class {
 	* middleware that must enforce authentication on every request.
 	*/
 	async verifyBearer(authorization) {
-		if (!this.config.enabled) return {
-			user: void 0,
-			admins: [],
-			auth_enabled: false
-		};
+		if (!this.resolvesIdentity) return this.anonymousContext();
 		const token = authorization?.split(" ")[1];
 		if (!token) return {
 			user: void 0,
 			admins: this.config.admins,
-			auth_enabled: true
+			auth_enabled: this.config.enabled
 		};
 		try {
 			const verified = await this.verifyToken(token);
@@ -4956,16 +5857,19 @@ var AuthService = class {
 			return {
 				user,
 				admins: this.config.admins,
-				auth_enabled: true
+				auth_enabled: this.config.enabled
 			};
 		} catch {
 			return new Response(JSON.stringify({ error: "Authentication failed" }), { status: 401 });
 		}
 	}
 	async authenticateWebSocketConnection(connectionParams) {
-		if (!this.config.enabled) return null;
+		if (!this.resolvesIdentity) return null;
 		const authHeader = connectionParams.authorization;
-		if (!authHeader) throw new Error("Missing authorization in connection parameters");
+		if (!authHeader) {
+			if (!this.config.enabled) return null;
+			throw new Error("Missing authorization in connection parameters");
+		}
 		const token = authHeader.split(" ")[1];
 		if (!token) throw new Error("Invalid authorization format");
 		const verified = await this.verifyToken(token);
@@ -4984,16 +5888,23 @@ var AuthService = class {
 		return await verifyAuthBearerToken(token);
 	}
 	/**
-	* Extract user information from verification result
+	* Extract user information from verification result.
+	*
+	* The issuer is required along with the credential subject. A credential that
+	* verified must carry one -- resolving it is how the signature was checked --
+	* so this rejects a shape that cannot have come from verification rather than
+	* admitting a keyless principal.
 	*/
 	extractUserFromVerification(verified) {
 		try {
 			const { address, chainId, networkId } = verified.verifiableCredential.credentialSubject;
-			if (!address || !chainId || !networkId) return null;
+			const appKey = verified.issuer;
+			if (!address || !chainId || !networkId || !appKey) return null;
 			return {
 				address,
 				chainId,
-				networkId
+				networkId,
+				appKey
 			};
 		} catch {
 			return null;
@@ -5042,14 +5953,33 @@ var AuthService = class {
 		}
 	}
 	async fetchCredentialExists(address, chainId, appId) {
-		return await fetchDelegationCredential({
+		if (!this.config.verifyCredential) throw new Error("AuthService: credential verification is enabled but no verifyCredential was provided");
+		return this.config.verifyCredential({
 			address,
 			chainId,
-			appDid: appId
-		}) !== void 0;
+			appId
+		});
 	}
 };
 //#endregion
+//#region src/services/renown-credential-verifier.ts
+async function createRenownCredentialVerifier(config = {}) {
+	const switchboardUrl = await resolveSwitchboardEndpoint({
+		switchboardUrl: config.switchboardUrl,
+		baseUrl: config.renownUrl
+	});
+	return async ({ address, chainId, appId }) => {
+		return await fetchDelegationCredential({
+			address,
+			chainId,
+			appDid: appId,
+			switchboardUrl,
+			baseUrl: switchboardUrl ? void 0 : config.renownUrl,
+			discover: false
+		}) !== void 0;
+	};
+}
+//#endregion
 //#region src/services/document-permission.service.ts
 /**
 * Service for managing document-level permissions.
@@ -5365,7 +6295,35 @@ function createMcpRequestAuthorizer(authService, authorizationService) {
 	};
 }
 //#endregion
+//#region src/services/renown-config.ts
+/** Reading credentials from this reactor's own read model needs a host-supplied
+* verifier: core has no idea which subgraph serves that read model. */
+function assertCredentialVerifierForSource(source, hasVerifier) {
+	if (source !== "self" || hasVerifier) return;
+	throw new Error("Renown credential verification is set to \"self\" (auth.renown.source or RENOWN_SOURCE) but no verifyCredential was provided. A host that reads its own read model must pass one — see apps/switchboard, which builds it from @renown/sdk createLocalCredentialVerifier — or set RENOWN_SOURCE=remote to verify against a Renown instance.");
+}
+function envOverride(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
+}
+/** Resolve `auth.renown`; RENOWN_SOURCE / RENOWN_URL / SWITCHBOARD_URL win
+* over the config file, which wins over the SDK defaults. */
+function resolveRenownConfig(configured, env, logger) {
+	return {
+		source: resolveRenownSource(envOverride(env.RENOWN_SOURCE) ?? configured?.source, logger),
+		url: envOverride(env.RENOWN_URL) ?? configured?.url,
+		switchboardUrl: envOverride(env.SWITCHBOARD_URL) ?? configured?.switchboardUrl
+	};
+}
+function resolveRenownSource(value, logger) {
+	if (value === void 0 || value === null) return "remote";
+	if (value === "self" || value === "remote") return value;
+	logger.warn(`Ignoring invalid renown source "${value}" (expected "self" or "remote") — using "remote"`);
+	return "remote";
+}
+//#endregion
 //#region src/utils/db.ts
+const PGLITE_UTC_PARSERS = { 1114: (value) => /* @__PURE__ */ new Date(`${value.replace(" ", "T")}Z`) };
 function isPG(connectionString) {
 	if (connectionString.startsWith("postgresql://") || connectionString.startsWith("postgres://")) return true;
 	return false;
@@ -5396,7 +6354,10 @@ function getDbClient(connectionString = void 0, pgliteFactory) {
 	if (cached) return cached;
 	const isPg = connectionString && isPG(connectionString);
 	const client = isPg ? "pg" : ClientPgLite;
-	const pgliteInstance = isPg ? void 0 : pgliteFactory ? pgliteFactory(connectionString) : connectionString ? new PGlite({ fs: new AtomicNodeFs(connectionString) }) : new PGlite();
+	const pgliteInstance = isPg ? void 0 : pgliteFactory ? pgliteFactory(connectionString) : connectionString ? new PGlite({
+		fs: new AtomicNodeFs(connectionString),
+		parsers: PGLITE_UTC_PARSERS
+	}) : new PGlite({ parsers: PGLITE_UTC_PARSERS });
 	const connection = isPg ? { connectionString } : { pglite: pgliteInstance };
 	if (connectionString && !isPg) {
 		const dirPath = path.resolve(connectionString, "..");
@@ -5502,12 +6463,23 @@ function assertAuthRequiredForDocumentPermissions(authEnabled, documentPermissio
 * opt-in: it removes the only binding between a token's claimed address and its
 * signing key. Fail-closed — unset NODE_ENV counts as production.
 */
-function assertSkipCredentialVerificationAllowed(authEnabled, skipCredentialVerification, env) {
-	if (!authEnabled || !skipCredentialVerification) return;
+function assertSkipCredentialVerificationAllowed(resolvesCallerIdentity, skipCredentialVerification, env) {
+	if (!resolvesCallerIdentity || !skipCredentialVerification) return;
 	const inAutomatedTest = env.VITEST === "true" || env.NODE_ENV === "test";
 	const acknowledged = env.ALLOW_INSECURE_SKIP_CREDENTIAL_VERIFICATION === "true";
 	if (!inAutomatedTest && !acknowledged) throw new Error("SKIP_CREDENTIAL_VERIFICATION is set but refused: it disables the live Renown credential check — the only check binding a token's claimed address to the key that signed it — so honoring it allows identity spoofing, including of admins. It is never safe in production. For local or sandbox use, also set ALLOW_INSECURE_SKIP_CREDENTIAL_VERIFICATION=true to acknowledge the risk; automated test runs (VITEST=true or NODE_ENV=test) are exempt.");
 }
+/**
+* Requiring an authenticated caller requires identity resolution to exist at
+* all: with neither AUTH_ENABLED nor RESOLVE_CALLER_IDENTITY the middleware
+* never reads a bearer, no `user` is ever resolved, and the
+* require-authenticated-caller middleware would reject every caller —
+* authenticated ones included. Refuse to boot rather than run broken.
+*/
+function assertRequireAuthenticatedCallerAllowed(requireAuthenticatedCaller, resolvesCallerIdentity) {
+	if (!requireAuthenticatedCaller || resolvesCallerIdentity) return;
+	throw new Error("REQUIRE_AUTHENTICATED_CALLER is set but refused: it rejects every request without a resolved caller, and with neither AUTH_ENABLED nor RESOLVE_CALLER_IDENTITY the server never reads a bearer, so it would reject every caller, including authenticated ones. Enable identity resolution first (RESOLVE_CALLER_IDENTITY=true or AUTH_ENABLED=true).");
+}
 function createReadinessGate() {
 	let ready = false;
 	return {
@@ -5517,6 +6489,15 @@ function createReadinessGate() {
 		}
 	};
 }
+/**
+* The GraphiQL explorer page's mount prefix. `path.posix.join` normalizes the
+* join with `basePath` — a naive template literal would produce `//explorer`
+* for the default `/` basePath, which express compiles into a route that only
+* matches `//explorer`, leaving `GET /explorer` a 404.
+*/
+function getExplorerPrefix(basePath) {
+	return path.posix.join(basePath, "explorer");
+}
 function resolveAttachmentStoragePath(options) {
 	if (options.attachmentStoragePath) return options.attachmentStoragePath;
 	if (options.dbPath && !options.dbPath.startsWith("postgres")) return path.resolve(options.dbPath, "..", "attachments");
@@ -5553,12 +6534,33 @@ function makeDbClosers(knexInstance, pglite) {
 	return closers;
 }
 /**
+* The gate sync serving evaluates a document's own policy through, or undefined
+* when there is none to evaluate.
+*
+* It is built here rather than taken off the reactor client because it is not
+* the same gate reads use: it carries the host's closes-by-default setting,
+* which withholds the domain scopes of a document nobody has policied yet. That
+* answer belongs to serving alone -- replay must keep reading an uninitialized
+* document in full -- so the two gates are deliberately separate objects over
+* the same model.
+*
+* Undefined below `authEnforcement`, where the registered model ignores the auth
+* scope: gating through it would serve every domain scope of a policied document
+* to anyone, which is worse than not gating at all.
+*/
+function buildSyncServingGate(reactorModule, authorizationConfig, logger) {
+	if (!reactorModule) return;
+	const model = readDecisionModel(reactorModule.featureFlags, reactorModule.documentModelRegistry);
+	if (!model) return;
+	return new SyncScopeGate(new ModelReadGate(model, reactorModule.documentView, reactorModule.featureFlags.authGroups, reactorModule.operationIndex, logger, { withholdUninitialized: authorizationConfig.defaultProtection }), reactorModule.documentView, logger);
+}
+/**
 * Sets up the subgraph manager and registers subgraphs
 */
-async function setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient) {
-	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter("apollo", logger), authService, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient);
-	await graphqlManager.init(subgraphs.core, authFetchMiddleware);
-	for (const [, collection] of subgraphs.extended.entries()) for (const subgraph of collection) await graphqlManager.registerSubgraph(subgraph, "graphql");
+async function setupGraphQLManager(httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate) {
+	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter("apollo", logger), authService, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient, syncServingGate);
+	await graphqlManager.init(subgraphs.core, authFetchMiddleware, requireAuthFetchMiddleware);
+	for (const [packageName, collection] of subgraphs.extended.entries()) for (const subgraph of collection) await graphqlManager.registerSubgraph(subgraph, "graphql", false, packageName);
 	await graphqlManager.updateRouter();
 	return graphqlManager;
 }
@@ -5568,26 +6570,45 @@ async function setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer,
 function setupEventListeners(pkgManager, graphqlManager, reactorProcessorManager, module, documentModelRegistry) {
 	pkgManager.onDocumentModelsChange((packagedModels) => {
 		if (documentModelRegistry) {
-			const newModules = Object.values(packagedModels).flat();
-			const registeredModules = documentModelRegistry.getAllModules();
-			const registeredTypes = new Set(registeredModules.map((m) => m.documentModel.global.id));
-			const modulesToRegister = newModules.filter((mod) => !registeredTypes.has(mod.documentModel.global.id));
-			if (modulesToRegister.length > 0) {
-				const results = documentModelRegistry.registerModules(...modulesToRegister);
-				for (const result of results) if (result.status === "success") defaultLogger.info(`Registered new document model: ${result.item.documentModel.global.id}`);
+			const newModules = getUniqueDocumentModels(Object.values(packagedModels).flat());
+			const incomingTypes = new Set(newModules.map((m) => m.documentModel.global.id));
+			if (incomingTypes.size > 0) {
+				documentModelRegistry.unregisterModules(...incomingTypes);
+				const results = documentModelRegistry.registerModules(...newModules);
+				for (const result of results) if (result.status === "success") defaultLogger.info(`Registered document model: ${result.item.documentModel.global.id} v${result.item.version ?? 1}`);
 				else defaultLogger.error(`Failed to register document model: ${result.error.message}`);
 			}
+			const manifests = pkgManager.getUniqueUpgradeManifests();
+			if (manifests.length > 0) {
+				documentModelRegistry.unregisterUpgradeManifests(...manifests.map((m) => m.documentType));
+				const manifestResults = documentModelRegistry.registerUpgradeManifests(...manifests);
+				for (const result of manifestResults) if (result.status === "error") defaultLogger.error(`Failed to register upgrade manifest: ${result.error.message}`);
+			}
 		}
 		graphqlManager.regenerateDocumentModelSubgraphs();
 	});
+	let knownSubgraphPackages = /* @__PURE__ */ new Set();
 	pkgManager.onSubgraphsChange((packagedSubgraphs) => {
 		(async () => {
-			for (const [, subgraphs] of packagedSubgraphs) for (const subgraph of subgraphs) await graphqlManager.registerSubgraph(subgraph, "graphql");
+			for (const [packageName, subgraphs] of packagedSubgraphs) {
+				const incomingNames = /* @__PURE__ */ new Set();
+				for (const subgraph of subgraphs) {
+					const instance = await graphqlManager.registerSubgraph(subgraph, "graphql", false, packageName);
+					if (!instance) continue;
+					incomingNames.add(instance.name);
+				}
+				await graphqlManager.prunePackageSubgraphs(packageName, incomingNames);
+			}
+			for (const packageName of knownSubgraphPackages) if (!packagedSubgraphs.has(packageName)) await graphqlManager.unregisterPackage(packageName);
+			knownSubgraphPackages = new Set(packagedSubgraphs.keys());
 			await graphqlManager.updateRouter();
 		})();
 	});
+	let knownProcessorPackages = /* @__PURE__ */ new Set();
 	pkgManager.onProcessorsChange((processors) => {
 		(async () => {
+			for (const packageName of knownProcessorPackages) if (!processors.has(packageName)) await reactorProcessorManager.unregisterFactory(packageName);
+			knownProcessorPackages = new Set(processors.keys());
 			for (const [packageName, fns] of processors) {
 				await reactorProcessorManager.unregisterFactory(packageName);
 				const validBuilders = fns.map((fn) => fn(module)).filter((factory) => typeof factory === "function");
@@ -5633,16 +6654,51 @@ async function _setupCommonInfrastructure(options) {
 	const logger = options.logger ?? defaultLogger;
 	let admins = [];
 	let authEnabled = false;
+	let configuredResolveIdentity;
+	let configuredRequireAuth;
+	let configuredRenown;
 	if (options.configFile) {
 		const config = getConfig(options.configFile);
 		admins = config.auth?.admins.map((a) => a.toLowerCase()) ?? [];
 		authEnabled = config.auth?.enabled ?? false;
+		configuredRenown = config.auth?.renown;
 	} else if (options.auth) {
 		admins = options.auth.admins.map((a) => a.toLowerCase());
 		authEnabled = options.auth.enabled;
+		configuredResolveIdentity = options.auth.resolveIdentity;
+		configuredRequireAuth = options.auth.requireAuthenticatedCaller;
 	}
-	const { AUTH_ENABLED, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION, CREDENTIAL_VERIFICATION_CACHE_TTL_MS } = process.env;
+	const { AUTH_ENABLED, RESOLVE_CALLER_IDENTITY, REQUIRE_AUTHENTICATED_CALLER, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION, CREDENTIAL_VERIFICATION_CACHE_TTL_MS } = process.env;
 	if (AUTH_ENABLED !== void 0) authEnabled = AUTH_ENABLED === "true";
+	/**
+	* Whether the auth middleware reads the bearer and populates `ctx.user`,
+	* independently of the authorization policy.
+	*
+	* Defaults to `authEnabled`, so a deployment that never sets it behaves
+	* exactly as it did: auth on means the token is read AND the policy is
+	* `ADMIN_ONLY`; auth off means neither. Setting it explicitly is what
+	* separates the two — a server can then know who is calling while the policy
+	* stays `OPEN`, which is the combination custom subgraphs need and the one
+	* `AUTH_ENABLED` alone cannot express.
+	*/
+	let resolveCallerIdentity = configuredResolveIdentity ?? authEnabled;
+	if (RESOLVE_CALLER_IDENTITY !== void 0) resolveCallerIdentity = RESOLVE_CALLER_IDENTITY === "true";
+	/**
+	* Whether the require-authenticated-caller middleware is active: anonymous
+	* callers are rejected with a 401 before any subgraph sees the request.
+	*
+	* Off by default, so nothing changes for existing deployments. This is the
+	* enforcement half of the `RESOLVE_CALLER_IDENTITY` split: that one lets a
+	* server know who is calling while the policy stays `OPEN`, and this one
+	* closes the hole it leaves open — under `OPEN`, an anonymous caller
+	* reaches the whole generic surface (document CRUD, sync, every custom
+	* subgraph), because `OpenAuthorizationService` answers `true` to
+	* everything. `ADMIN_ONLY` is the only alternative today, and it locks
+	* out every non-admin; this expresses "authenticated callers allowed,
+	* anonymous not".
+	*/
+	let requireAuthenticatedCaller = configuredRequireAuth ?? false;
+	if (REQUIRE_AUTHENTICATED_CALLER !== void 0) requireAuthenticatedCaller = REQUIRE_AUTHENTICATED_CALLER === "true";
 	if (ADMINS !== void 0) admins = ADMINS.split(",").map((a) => a.toLowerCase());
 	let defaultProtection = false;
 	if (DEFAULT_PROTECTION !== void 0) defaultProtection = DEFAULT_PROTECTION.toLowerCase() === "true";
@@ -5656,30 +6712,46 @@ async function _setupCommonInfrastructure(options) {
 	}
 	const documentPermissionsRequested = options.documentPermissionService !== void 0 || DOCUMENT_PERMISSIONS_ENABLED === "true";
 	assertAuthRequiredForDocumentPermissions(authEnabled, documentPermissionsRequested);
-	assertSkipCredentialVerificationAllowed(authEnabled, skipCredentialVerification, process.env);
+	assertSkipCredentialVerificationAllowed(resolveCallerIdentity, skipCredentialVerification, process.env);
+	assertRequireAuthenticatedCallerAllowed(requireAuthenticatedCaller, resolveCallerIdentity);
 	if (authEnabled && skipCredentialVerification) logger.warn("SECURITY: SKIP_CREDENTIAL_VERIFICATION is enabled — Renown credential verification is disabled and a bearer token's claimed address is NOT cryptographically bound to its signing key. Identity is unverifiable; use only in development or test.");
 	httpAdapter.getRoute("/health", () => new Response("OK", { status: 200 }));
 	const readiness = createReadinessGate();
 	httpAdapter.getRoute("/ready", () => readiness.isReady() ? new Response("OK", { status: 200 }) : new Response("starting", { status: 503 }));
-	const explorerPrefix = `${config.basePath}/explorer`;
+	const explorerPrefix = getExplorerPrefix(config.basePath);
 	httpAdapter.getRoute(`${explorerPrefix}/:endpoint?`, (request) => {
 		const url = new URL(request.url);
 		const suffix = url.pathname.slice(explorerPrefix.length).replace(/^\//, "");
 		const endpoint = suffix ? `/${suffix}` : "/graphql";
-		const query = url.searchParams.get("query") ?? void 0;
-		return new Response(renderGraphqlPlayground(endpoint, query), { headers: { "Content-Type": "text/html" } });
+		const explorerState = decodeExplorerUrlState(url.searchParams.get("explorerURLState") ?? "");
+		const query = explorerState?.query ?? url.searchParams.get("query") ?? void 0;
+		return new Response(renderGraphqlPlayground(endpoint, query, explorerState?.headers ?? {}, explorerState?.variables), { headers: { "Content-Type": "text/html" } });
 	});
 	let authFetchMiddleware;
+	let requireAuthFetchMiddleware;
 	let authService;
-	if (authEnabled) {
-		logger.info("Setting up Auth middleware");
+	if (resolveCallerIdentity || authEnabled) {
+		logger.info("Setting up Auth middleware (policy enforcement: @enabled, caller identity: @resolve)", authEnabled, resolveCallerIdentity);
+		const renown = options.renown ?? resolveRenownConfig(configuredRenown, process.env, logger);
+		assertCredentialVerifierForSource(renown.source, options.verifyCredential !== void 0);
+		if (options.verifyCredential) logger.info("Renown credentials will be verified by the host's verifier");
+		else logger.info("Renown credentials will be verified against @url", renown.switchboardUrl ?? renown.url ?? "the default Renown instance");
 		authService = new AuthService({
 			enabled: authEnabled,
+			resolveIdentity: resolveCallerIdentity,
 			admins,
 			skipCredentialVerification,
-			credentialVerificationCacheTtlMs
+			credentialVerificationCacheTtlMs,
+			verifyCredential: options.verifyCredential ?? await createRenownCredentialVerifier({
+				renownUrl: renown.url,
+				switchboardUrl: renown.switchboardUrl
+			})
 		});
 		authFetchMiddleware = createAuthFetchMiddleware(authService);
+		if (requireAuthenticatedCaller) {
+			requireAuthFetchMiddleware = createRequireAuthFetchMiddleware();
+			logger.info("Require-authenticated-caller middleware enabled: anonymous callers are rejected with a 401 before any subgraph");
+		}
 	}
 	const dbClosers = [];
 	const { relationalDb, analyticsStore, closers: analyticsClosers } = await initializeDatabaseAndAnalytics(options.dbPath, options.pgliteFactory);
@@ -5703,7 +6775,12 @@ async function _setupCommonInfrastructure(options) {
 	await mkdir(attachmentStoragePath, { recursive: true });
 	const { db: attachmentDb, knex: attachmentKnex, pglite: attachmentPglite } = getDbClient(options.dbPath, options.pgliteFactory);
 	dbClosers.push(...makeDbClosers(attachmentKnex, attachmentPglite));
-	const attachments = await new AttachmentBuilder(attachmentDb, attachmentStoragePath).withReservationSweepMs(3600 * 1e3).build();
+	const ATTACHMENT_SWEEP_INTERVAL_MS = 3600 * 1e3;
+	const attachmentBackend = await createStartupAttachmentBackend({ db: attachmentDb });
+	const attachmentBuilder = new AttachmentBuilder(attachmentDb, attachmentStoragePath).withReservationSweepMs(ATTACHMENT_SWEEP_INTERVAL_MS);
+	if (attachmentBackend) attachmentBuilder.withBackend(attachmentBackend);
+	const attachments = await attachmentBuilder.build();
+	const attachmentReferenceIndex = await new AttachmentReferenceIndexBuilder(attachmentDb).build();
 	dbClosers.push(() => {
 		attachments.destroy();
 		return Promise.resolve();
@@ -5717,12 +6794,14 @@ async function _setupCommonInfrastructure(options) {
 		port,
 		httpAdapter,
 		authFetchMiddleware,
+		requireAuthFetchMiddleware,
 		authService,
 		relationalDb,
 		analyticsStore,
 		documentPermissionService,
 		authorizationConfig,
 		attachments,
+		attachmentReferenceIndex,
 		packages,
 		dbClosers,
 		readiness
@@ -5731,26 +6810,17 @@ async function _setupCommonInfrastructure(options) {
 /**
 * Private helper function containing common setup logic for API initialization
 */
-async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient) {
+async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient, syncServingGate) {
 	const hostModule = {
-		relationalDb,
-		analyticsStore,
-		processorApp,
-		config: options.processorConfig,
-		client: reactorClient,
-		attachments: createAttachmentClient(attachments.service),
-		dispatch: { async execute(docId, branch, actions, signal) {
-			const jobInfo = await reactorClient.executeAsync(docId, branch, actions, signal);
-			return {
-				id: jobInfo.id,
-				status: jobInfo.status
-			};
-		} },
-		getReadModel(name) {
-			const model = readModels.find((m) => m.name === name);
-			if (!model) throw new Error(`Read model "${name}" not found`);
-			return model;
-		}
+		...createReactorHostModuleBase({
+			client: reactorClient,
+			readModels,
+			relationalDb,
+			analyticsStore,
+			processorApp,
+			config: options.processorConfig
+		}),
+		attachments: createAttachmentClient(attachments.service)
 	};
 	const mcpServerEnabled = options.mcp ?? true;
 	const logger = options.logger ?? defaultLogger;
@@ -5778,16 +6848,17 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	const { httpServer, wsServer } = await startServer(httpAdapter, port, options.https, logger);
 	const authorizationService = createAuthorizationService(authorizationConfig, documentPermissionService, createGetParentIdsFn(reactorClient));
 	logger.info(`Authorization service initialized (policy: ${authorizationConfig.policy})`);
+	const attachmentAccess = new AttachmentAccessService(createCanonicalDocumentIdResolver(reactorClient), authorizationService, attachmentReferenceIndex.store, attachmentReferenceProjection);
 	const coreSubgraphs = DefaultCoreSubgraphs.slice();
 	coreSubgraphs.push(ReactorSubgraph);
 	if (documentPermissionService) {
 		coreSubgraphs.push(AuthSubgraph);
 		logger.info("Auth subgraph registered (document permissions enabled)");
 	}
-	const graphqlManager = await setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, {
+	const graphqlManager = await setupGraphQLManager(httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, {
 		extended: subgraphs,
 		core: coreSubgraphs
-	}, logger.child(["graphql-manager"]), authorizationService, authService, documentPermissionService, options.enableDocumentModelSubgraphs, port, reactorDriveClient);
+	}, logger.child(["graphql-manager"]), authorizationService, authService, documentPermissionService, options.enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate);
 	setupEventListeners(packages, graphqlManager, reactorProcessorManager, hostModule, documentModelRegistry);
 	if (mcpServerEnabled) {
 		await setupMcpServer({
@@ -5802,6 +6873,8 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 		graphqlManager,
 		packages,
 		attachments,
+		attachmentReferenceIndex,
+		attachmentAccess,
 		authService,
 		dispose: buildApiDispose({
 			graphqlManager,
@@ -5850,9 +6923,15 @@ function buildApiDispose(args) {
 	};
 }
 async function initializeAndStartAPI(clientInitializer, options, processorApp) {
-	const { port, httpAdapter, authFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
-	const { documentModels, processors, subgraphs } = await packages.init();
-	const { module: reactorClientModule, reactorDriveClient } = await clientInitializer(documentModels);
+	const { port, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, attachmentReferenceIndex, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
+	const { documentModels, upgradeManifests, processors, subgraphs } = await packages.init();
+	const { module: reactorClientModule, reactorDriveClient, attachmentReferenceProjection = {
+		status: "unavailable",
+		reason: "initializer-did-not-report"
+	} } = await clientInitializer(documentModels, {
+		attachmentReferenceWriter: attachmentReferenceIndex.store,
+		upgradeManifests
+	});
 	const reactorClient = reactorClientModule.client;
 	const syncManager = reactorClientModule.reactorModule?.syncModule?.syncManager;
 	if (!syncManager) throw new Error("SyncManager not available from InProcessReactorClientModule");
@@ -5861,11 +6940,13 @@ async function initializeAndStartAPI(clientInitializer, options, processorApp) {
 	const documentModelRegistry = reactorClientModule.reactorModule?.documentModelRegistry;
 	if (!documentModelRegistry) throw new Error("DocumentModelRegistry not available from InProcessReactorClientModule");
 	return {
-		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient),
+		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient, buildSyncServingGate(reactorClientModule.reactorModule, authorizationConfig, options.logger ?? defaultLogger)),
 		client: reactorClient,
 		syncManager,
 		documentModelRegistry,
-		readiness
+		readiness,
+		attachmentReferenceProjection,
+		packageManager: packages
 	};
 }
 //#endregion
@@ -5896,6 +6977,7 @@ var PackageManagementService = class {
 	defaultRegistryUrl;
 	httpLoader;
 	documentModelRegistry;
+	packageManager;
 	logger = childLogger(["reactor-api", "package-management-service"]);
 	onModelsChanged;
 	loadedModulesCache = /* @__PURE__ */ new Map();
@@ -5904,6 +6986,7 @@ var PackageManagementService = class {
 		this.defaultRegistryUrl = options.defaultRegistryUrl;
 		this.httpLoader = options.httpLoader;
 		this.documentModelRegistry = options.documentModelRegistry;
+		this.packageManager = options.packageManager;
 	}
 	setOnModelsChanged(callback) {
 		this.onModelsChanged = callback;
@@ -5946,6 +7029,7 @@ var PackageManagementService = class {
 		this.loadedModulesCache.delete(name);
 		if (this.httpLoader) this.httpLoader.documentModelLoader.removeFromCache(name);
 		if (this.documentModelRegistry) this.documentModelRegistry.unregisterModules(...existing.documentTypes);
+		if (this.packageManager) this.packageManager.removePackage(name);
 		this.triggerModelsChanged();
 		this.logger.info("Uninstalled package @name", name);
 		return true;
@@ -5969,7 +7053,7 @@ var PackageManagementService = class {
 	}
 };
 //#endregion
-export { ADMIN_USERS, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, assertAuthRequiredForDocumentPermissions, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
+export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthDecision, AuthDecisionSchema, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, EvaluateActionsDocument, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground, resolveRenownConfig };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=e58cea2c-2319-52a8-90cd-3e99d94ba98f
+//# debugId=f43e08dc-7398-57dd-8824-db5d97ccc6ca