@powerhousedao/reactor-api 6.2.2 → 6.2.3-dev.1

package/dist/index.d.mts

@@ -12,7 +12,7 @@ import { DocumentDriveDocument, DocumentDriveGlobalState } from "@powerhousedao/
 import { AttachmentBuildResult, AttachmentReferenceIndexBuildResult, IAttachmentReferenceReader, IAttachmentReferenceWriter } from "@powerhousedao/reactor-attachments";
 import { IAttachmentClient } from "@powerhousedao/reactor-attachments/client";
 import { WebSocketServer } from "ws";
-import { IRelationalDb as IRelationalDb$1, ProcessorApp, ProcessorFactory } from "@powerhousedao/shared/processors";
+import { AuthorizerResult, IHttpScope, IRelationalDb as IRelationalDb$1, IWebhookEndpoints, IWebhookScope, NodeRouteSpec, ProcessorApp, ProcessorFactory, RouteActor, RouteAuth, RouteAuthorizer, RouteBody, RouteContext, RouteHandler, RouteMethod, RouteOptions, RouteSpec, RouteTransport, RouteUser, RouteUser as RouteUser$1, ScopedRouteHandle, WebhookEndpointInfo, WebhookField, WebhookHashAlgorithm, WebhookPolicy, WebhookReply, WebhookRequest, WebhookScheme, WebhookSignatureEncoding, WebhookSpec, WebhookVerification } from "@powerhousedao/shared/processors";
 import { Generated, Kysely } from "kysely";
 import { PGlite } from "@electric-sql/pglite";
 import { Knex } from "knex";
@@ -287,6 +287,436 @@ interface IAuthorizationService {
   canMutate(documentId: CanonicalDocumentId, operationType: string, userAddress?: string): Promise<boolean>;
 }
 //#endregion
+//#region src/graphql/gateway/types.d.ts
+type TlsOptions = {
+  keyPath: string;
+  certPath: string;
+} | {
+  cert: Buffer | string;
+  key: Buffer | string;
+} | true;
+type GatewayContextFactory<TContext = unknown> = (request: Request) => Promise<TContext>;
+type WsContextFactory<TContext = unknown> = (connectionParams: Record<string, unknown>) => Promise<TContext>;
+type WsDisposer = {
+  dispose: () => void | Promise<void>;
+};
+type FetchHandler = (request: Request) => Promise<Response>;
+/**
+ * Handle to a route registered directly on the adapter. Packages hot-reload,
+ * so every registration is reversible; disposing a route that is already gone
+ * is a no-op.
+ *
+ * The handle *is* the capability to remove that one route: holding it is the
+ * only way to take the route back, and it cannot name any other. An opaque
+ * integer would let any holder remove any route by arithmetic, and a caller
+ * that disposed twice would eventually free somebody else's registration once
+ * ids were reused.
+ *
+ * Distinct from the `ScopedRouteHandle` a package's HTTP scope hands back,
+ * which also carries the public URL the route answers on — at this layer there
+ * is no namespace to build one from and no knowledge of the host's origin.
+ */
+interface AdapterRouteHandle {
+  dispose(): void;
+}
+/**
+ * A framework-agnostic description of a federated subgraph service.
+ * Used by IGatewayAdapter.createSupergraphHandler() to compose the supergraph SDL.
+ */
+type SubgraphDefinition = {
+  name: string;
+  typeDefs: DocumentNode;
+  url: string;
+};
+interface IGatewayAdapter<TContext = unknown> {
+  /** One-time startup. */
+  start(httpServer: http.Server): Promise<void>;
+  /**
+   * Returns a Fetch API handler for the given schema.
+   * Caller (IHttpAdapter) is responsible for mounting it at a path.
+   */
+  createHandler(schema: GraphQLSchema, contextFactory: GatewayContextFactory<TContext>): Promise<FetchHandler>;
+  /**
+   * Create a federation gateway handler that composes all subgraphs into a supergraph.
+   * getSubgraphs is called eagerly (during setup) and again on every updateSupergraph() call.
+   */
+  createSupergraphHandler(getSubgraphs: () => SubgraphDefinition[], httpServer: http.Server, contextFactory: GatewayContextFactory<TContext>): Promise<FetchHandler>;
+  /**
+   * Recompose the supergraph SDL from the current subgraph list and push the update
+   * to the running federation gateway. No-op if createSupergraphHandler() has not
+   * been called yet.
+   */
+  updateSupergraph(): Promise<void>;
+  /** Attach WebSocket subscriptions. Returns a disposer. */
+  attachWebSocket(wsServer: WebSocketServer, schema: GraphQLSchema, contextFactory: WsContextFactory<TContext>): WsDisposer;
+  stop(): Promise<void>;
+}
+/**
+ * Methods a node route may bind. OPTIONS is excluded: the framework's CORS
+ * plugin owns preflight, and a duplicate registration conflicts at startup.
+ */
+type HttpMethod = "DELETE" | "GET" | "HEAD" | "PATCH" | "POST" | "PUT";
+interface NodeRouteOptions {
+  /** Serve sub-paths too, not just an exact path match. */
+  prefix?: boolean;
+  /**
+   * Deliver the request body as the client sent it: unparsed and byte-exact.
+   * The handler reads `req` itself; the `body` argument stays undefined.
+   *
+   * Without this, the body has already been parsed by the time the handler
+   * runs, so a signature computed over the raw payload cannot be verified —
+   * re-encoding loses key order, whitespace and duplicate keys. This is the
+   * one capability a webhook endpoint cannot do without, and the reason a
+   * route needs to be dispatched ahead of the body parsers rather than behind
+   * them.
+   */
+  rawBody?: boolean;
+}
+interface IHttpAdapter {
+  /** Set up CORS and body-parser equivalent middleware. */
+  setupMiddleware(config: {
+    corsOptions?: CorsOptions;
+    bodyLimit?: string;
+  }): void;
+  /**
+   * Mount a Fetch API handler. Returns a handle whose `dispose()` removes it.
+   * - exact = false (default): exact path match.
+   * - exact = true: prefix match - handler also receives all sub-paths.
+   *
+   * Mounting a path that already holds a fetch mount of the same kind
+   * replaces the previous one (last write wins).
+   */
+  mount(path: string, handler: FetchHandler, options?: {
+    prefix?: boolean; /** @deprecated Misleading name: this always meant *prefix*, not exact. */
+    exact?: boolean;
+  }): AdapterRouteHandle;
+  /**
+   * Register a GET-only route that returns a Fetch Response (for health,
+   * explorer, etc.). Returns a handle whose `dispose()` removes it.
+   */
+  getRoute(path: string, handler: (request: Request) => Response | Promise<Response>): AdapterRouteHandle;
+  /**
+   * Start listening on the given port. Returns the underlying http.Server
+   * so callers can attach WebSocket servers.
+   */
+  listen(port: number, tls?: TlsOptions): Promise<http.Server>;
+  /**
+   * Mount a raw Connect/Express-compatible middleware function (e.g. Vite dev
+   * server middleware). The implementation is adapter-specific; for Express this
+   * is equivalent to `app.use(middleware)`.
+   */
+  mountRawMiddleware(middleware: unknown): void;
+  /**
+   * Register a method-specific route handler using Node.js core HTTP types.
+   * Use this when a Fetch API FetchHandler is not possible (e.g. streaming
+   * protocols that require direct access to IncomingMessage/ServerResponse).
+   *
+   * The req/res objects are `http.IncomingMessage`/`http.ServerResponse`
+   * (Express Request/Response are compatible subtypes). Returns a handle
+   * whose `dispose()` removes it.
+   */
+  mountNodeRoute(method: HttpMethod, path: string, handler: (req: http.IncomingMessage, res: http.ServerResponse, body?: unknown) => void | Promise<void>, options?: NodeRouteOptions): AdapterRouteHandle;
+  /**
+   * Register framework-specific Sentry error-capturing middleware after all routes
+   * are mounted. Each adapter calls the Sentry setup function appropriate for its
+   * framework (e.g. setupExpressErrorHandler, setupFastifyErrorHandler).
+   * No-op if Sentry is not relevant for the adapter.
+   */
+  setupSentryErrorHandler(sentry: object): void;
+  /** The raw framework handle (e.g. Express app). Cast as needed at call sites. */
+  readonly handle: unknown;
+}
+//#endregion
+//#region src/services/auth.service.d.ts
+type CredentialVerifier = (params: {
+  address: string;
+  chainId: number;
+  appId: string;
+}) => Promise<boolean>;
+interface AuthConfig {
+  /**
+   * Whether the authorization policy enforces anything: it selects `ADMIN_ONLY`
+   * over `OPEN`, and it is what `AuthContext.auth_enabled` reports to callers
+   * that gate on "is authentication being enforced" (the attachment routes do).
+   *
+   * It does NOT decide whether the bearer is read — see {@link resolveIdentity}.
+   */
+  enabled: boolean;
+  /**
+   * Whether the bearer is verified and `AuthContext.user` populated at all.
+   *
+   * Defaults to {@link enabled}, which is the behaviour every deployment had
+   * before this option existed. Setting it independently is what lets a server
+   * know who is calling while leaving the policy `OPEN` — resolving an identity
+   * and enforcing one are different concerns, and welding them together left
+   * consumers choosing between an unauthenticated caller and locking every
+   * non-admin out.
+   *
+   * It resolves an identity and enforces nothing: a request with no token is
+   * still admitted, with no user.
+   */
+  resolveIdentity?: boolean;
+  admins: string[];
+  skipCredentialVerification?: boolean;
+  credentialVerificationCacheTtlMs?: number;
+  verifyCredential?: CredentialVerifier;
+}
+/**
+ * The authenticated principal. The shape is declared once in
+ * `@powerhousedao/shared/processors` as `RouteUser`, so a route handler and a
+ * resolver agree on it without either package redeclaring it.
+ */
+type User = RouteUser$1;
+interface AuthContext {
+  user?: User;
+  admins: string[];
+  auth_enabled: boolean;
+}
+declare class AuthService {
+  private readonly config;
+  private readonly credentialCache;
+  constructor(config: AuthConfig);
+  /**
+   * Whether this service reads the bearer at all. Defaults to `enabled`, so a
+   * config written before `resolveIdentity` existed behaves exactly as it did.
+   */
+  private get resolvesIdentity();
+  /** The context an unresolved request gets: no user, and no admin list to match against. */
+  private anonymousContext;
+  authenticateRequest(request: globalThis.Request): Promise<AuthContext | globalThis.Response>;
+  /**
+   * Verify a Bearer token regardless of HTTP method. Use this from non-GraphQL
+   * middleware that must enforce authentication on every request.
+   */
+  verifyBearer(authorization: string | undefined): Promise<AuthContext | globalThis.Response>;
+  authenticateWebSocketConnection(connectionParams: Record<string, unknown>): Promise<User | null>;
+  /**
+   * Verify the auth bearer token
+   */
+  private verifyToken;
+  /**
+   * Extract user information from verification result.
+   *
+   * The issuer is required along with the credential subject. A credential that
+   * verified must carry one -- resolving it is how the signature was checked --
+   * so this rejects a shape that cannot have come from verification rather than
+   * admitting a keyless principal.
+   */
+  private extractUserFromVerification;
+  /**
+   * Verify that the credential still exists on the Renown API.
+   *
+   * Results are cached per (address, chainId, issuer) for a short TTL so the
+   * blocking external round-trip is not paid on every request. Concurrent
+   * checks for the same key share a single in-flight request, and entries
+   * that resolve to false are evicted immediately so failed or revoked
+   * credentials are re-checked on the next request.
+   */
+  private verifyCredentialExists;
+  /**
+   * Enforce the cache size cap before inserting a new entry: drop expired
+   * entries first, then evict oldest-inserted entries (insertion order
+   * matches expiry order since the TTL is constant) until under the cap, so
+   * a flood of distinct keys cannot grow the map without bound.
+   */
+  private pruneCredentialCache;
+  private fetchCredentialExists;
+}
+//#endregion
+//#region src/http/webhook-store.d.ts
+/**
+ * Where webhook tokens live. Core-owned and relational rather than per-host, so
+ * any host in a fleet can serve any endpoint: a provider's registered URL keeps
+ * working after a restart, a redeploy or a request landing on another replica.
+ */
+interface WebhookEndpointRow {
+  token: string;
+  /** The owning package's npm name. */
+  namespace: string;
+  /** The registration within that package. */
+  endpoint: string;
+  /** The caller's own key, e.g. a document id. Never appears in the URL. */
+  ownerKey: string;
+  createdAt: string;
+}
+interface IWebhookStore {
+  init(): Promise<void>;
+  /** Returns the existing token for this key, or mints one. */
+  ensure(namespace: string, endpoint: string, ownerKey: string): Promise<WebhookEndpointRow>;
+  find(token: string): Promise<WebhookEndpointRow | undefined>;
+  list(namespace: string, endpoint?: string): Promise<WebhookEndpointRow[]>;
+  revoke(namespace: string, endpoint: string, ownerKey: string): Promise<void>;
+  /** True when this delivery has been seen before, within the TTL. */
+  seen(token: string, key: string, ttlSeconds: number): Promise<boolean>;
+}
+/** Opaque and unguessable: the URL is a bearer capability held by a third party. */
+declare function newWebhookToken(): string;
+/** Relational implementation, over the reactor's own database. */
+declare class RelationalWebhookStore implements IWebhookStore {
+  #private;
+  private readonly relationalDb;
+  constructor(relationalDb: IRelationalDb$1);
+  init(): Promise<void>;
+  ensure(namespace: string, endpoint: string, ownerKey: string): Promise<WebhookEndpointRow>;
+  find(token: string): Promise<WebhookEndpointRow | undefined>;
+  list(namespace: string, endpoint?: string): Promise<WebhookEndpointRow[]>;
+  revoke(namespace: string, endpoint: string, ownerKey: string): Promise<void>;
+  seen(token: string, key: string, ttlSeconds: number): Promise<boolean>;
+}
+/** In-memory store, for hosts with no relational database and for tests. */
+declare class MemoryWebhookStore implements IWebhookStore {
+  #private;
+  init(): Promise<void>;
+  ensure(namespace: string, endpoint: string, ownerKey: string): Promise<WebhookEndpointRow>;
+  find(token: string): Promise<WebhookEndpointRow | undefined>;
+  list(namespace: string, endpoint?: string): Promise<WebhookEndpointRow[]>;
+  revoke(namespace: string, endpoint: string, ownerKey: string): Promise<void>;
+  seen(token: string, key: string, ttlSeconds: number): Promise<boolean>;
+}
+//#endregion
+//#region src/http/webhook-service.d.ts
+/** The flat, token-addressed path family. */
+declare const WEBHOOK_SEGMENT = "webhooks";
+interface WebhookServiceOptions {
+  store: IWebhookStore;
+  basePath?: string;
+  /** Public origin to advertise, e.g. https://switchboard.example. */
+  publicUrl?: string;
+}
+/** One host route for `/webhooks/:token`, dispatching by token. The flat path leaks
+ * neither package nor document; the namespace lives in the token record, which is also what stops one package's token reaching another's handler. */
+declare class WebhookService {
+  #private;
+  constructor({
+    store,
+    basePath,
+    publicUrl
+  }: WebhookServiceOptions);
+  /** The scope the endpoint family serves from, handed over once the route service exists;
+   * separate from the constructor only because that service takes this one as an option. */
+  attach(scope: IHttpScope): void;
+  init(): Promise<void>;
+  dispose(): void;
+  /** The facade a package's HTTP scope exposes as `scope.webhooks`. */
+  scopeFor(namespace: string): IWebhookScope;
+  /** Releases every registration a package made. */
+  disposeScope(namespace: string): void;
+  /** The URL to hand a provider. Absolute whenever the host knows its own origin: a
+   * relative path is useless to the third party that has to call it. */
+  urlFor(token: string): string;
+  /** Whether `urlFor` can produce something a provider could call. */
+  get hasPublicOrigin(): boolean;
+}
+//#endregion
+//#region src/http/route-service.d.ts
+/** The segment package routes live under, inside the host's base path. */
+declare const PACKAGE_ROUTE_SEGMENT = "api";
+/** The namespace core's own subgraphs and services register under. */
+declare const CORE_PACKAGE_NAME = "@powerhousedao/reactor-api";
+interface HttpRouteServiceOptions {
+  httpAdapter: IHttpAdapter;
+  /** Absent on a host with no webhook store; `scope.webhooks` then refuses. */
+  webhooks?: WebhookService;
+  /** The host's base path, i.e. config.basePath. */
+  basePath?: string;
+  /** Absent when auth is disabled host-wide; every route then sees an anonymous actor. */
+  authService?: AuthService;
+  /** The host's public origin; empty when unknowable, the only case where advertised URLs degrade to paths. */
+  publicUrl?: string;
+  /** Whether to believe the `X-Forwarded-*` headers that name the request's public origin.
+   * Off by default: they are client-written, so with no proxy in front a caller could choose the origin a route advertises. */
+  trustProxy?: boolean;
+}
+/** Owns the URL space packages serve from, handing each a scope bound to its own namespace. The prefix nests inside
+ * the host's base path (`<basePath>/api`), so core collisions are prevented by URL shape, not a reserved-name list. */
+declare class HttpRouteService {
+  #private;
+  constructor({
+    httpAdapter,
+    basePath,
+    authService,
+    webhooks,
+    publicUrl,
+    trustProxy
+  }: HttpRouteServiceOptions);
+  /** The absolute path packages are mounted under. */
+  get prefix(): string;
+  /** The scope for a package; idempotent per name, so a reload cannot accumulate namespaces. Throws when two packages
+   * resolve to one namespace — with verbatim names that means one package configured twice, a genuine ambiguity. */
+  scopeFor(packageKey: string): IHttpScope;
+  /** A scope at a host-named path; on the service, not `IHttpScope`, so a package can never name one. Namespacing is package
+   * policy: the host owns its URL space and third parties hold its URLs, so the path is verbatim and outside the package prefix. */
+  hostScope(name: string, mountPath: string): IHttpScope;
+  /** Like {@link scopeFor}, but never throws: a key resolving to no usable npm name gets a scope that refuses
+   * registrations, so one unroutable package cannot stop the host booting — it fails only if it serves a route. */
+  scopeForOrNull(packageKey: string): IHttpScope;
+  /** Releases a package's routes, e.g. when it is replaced or removed. */
+  disposeScope(packageKey: string): void;
+  disposeAll(): void;
+}
+//#endregion
+//#region src/http/namespace.d.ts
+declare class InvalidNamespaceError extends Error {}
+/**
+ * Turns a package name into the path segments it occupies.
+ * `@powerhousedao/workflow` → ["@powerhousedao", "workflow"]
+ * `document-model`          → ["document-model"]
+ */
+declare function namespaceSegments(packageName: string): string[];
+/**
+ * The path a package's routes hang off, relative to the package prefix.
+ * Scoped names occupy two segments — the addressing unpkg and jsdelivr use.
+ */
+declare function namespacePath(packageName: string): string;
+/**
+ * Resolves the npm name a package is routed under from the key the package
+ * manager holds it by. That key is the specifier as configured, which is not
+ * always a name:
+ * - `@scope/pkg` — already a name.
+ * - `@scope/pkg@1.3.9` — a registry spec; only the loader strips the tag.
+ * - `/Users/me/project` — the local project, which switchboard registers by
+ *   `process.cwd()`. Its real name lives in its package.json.
+ *
+ * Deriving a URL segment straight from the key would give a developer's home
+ * directory a route namespace, so the path form is resolved rather than slugged.
+ */
+declare function resolvePackageName(key: string, readPackageJsonName?: (dir: string) => string | undefined): string;
+/**
+ * A mount path the host named for one of its own route groups.
+ *
+ * The host owns the whole URL space — it holds the adapter — so unlike a
+ * package it may name an absolute path. That is the difference between hosting
+ * and being hosted, and it is why this lives on the service rather than on a
+ * scope: a package is only ever handed a scope, and a scope has no way to
+ * express a path outside itself.
+ *
+ * What the host still may not name is anything that is not one stable literal
+ * prefix. A traversal segment, or a pattern segment, would make the group's own
+ * routes unpredictable relative to each other. Returns the normalized path,
+ * with a leading and no trailing slash.
+ */
+declare function assertHostMountPath(path: string): string;
+//#endregion
+//#region src/http/webhook-verify.d.ts
+type VerifyResult = {
+  ok: true;
+} | {
+  ok: false;
+  reason: string;
+};
+/** Verifies a delivery against the configured scheme; `raw` must be the exact bytes
+ * received. The reason is for the log only: callers answer a fixed 401, so a probing sender learns nothing from the body. */
+declare function verifyWebhook(options: {
+  verification: WebhookVerification;
+  headers: Record<string, string>;
+  raw: Buffer;
+  now?: Date;
+}): VerifyResult;
+declare function redactHeaders(headers: Record<string, string>, extra?: string): Record<string, string>;
+/** JSON and form bodies become objects; anything else stays decoded text, so a verified
+ * XML or CSV payload is still reachable downstream. */
+declare function parseWebhookBody(raw: Buffer, contentType?: string): unknown;
+//#endregion
 //#region src/graphql/types.d.ts
 type SubgraphClass = typeof BaseSubgraph;
 type Context = {
@@ -321,6 +751,12 @@ type ISubgraph = {
 };
 type SubgraphArgs = {
   reactorClient: IReactorClient;
+  /**
+   * The subgraph's package's slice of the HTTP surface, for serving REST
+   * routes and webhooks alongside the GraphQL API. Already bound to the
+   * package's namespace: there is no way to mount outside it.
+   */
+  http: IHttpScope;
   relationalDb: IRelationalDb;
   analyticsStore: IAnalyticsStore;
   graphqlManager: GraphQLManager$1;
@@ -405,6 +841,8 @@ declare class BaseSubgraph implements ISubgraph$1 {
   resolvers: Record<string, any>;
   typeDefs: DocumentNode;
   reactorClient: IReactorClient;
+  /** This package's namespaced slice of the HTTP surface. */
+  readonly http: SubgraphArgs$1["http"];
   graphqlManager: GraphQLManager$1;
   relationalDb: IRelationalDb;
   syncManager: ISyncManager;
@@ -630,229 +1068,6 @@ declare class AuthSubgraph extends BaseSubgraph {
   onSetup(): Promise<void>;
 }
 //#endregion
-//#region src/services/auth.service.d.ts
-type CredentialVerifier = (params: {
-  address: string;
-  chainId: number;
-  appId: string;
-}) => Promise<boolean>;
-interface AuthConfig {
-  /**
-   * Whether the authorization policy enforces anything: it selects `ADMIN_ONLY`
-   * over `OPEN`, and it is what `AuthContext.auth_enabled` reports to callers
-   * that gate on "is authentication being enforced" (the attachment routes do).
-   *
-   * It does NOT decide whether the bearer is read — see {@link resolveIdentity}.
-   */
-  enabled: boolean;
-  /**
-   * Whether the bearer is verified and `AuthContext.user` populated at all.
-   *
-   * Defaults to {@link enabled}, which is the behaviour every deployment had
-   * before this option existed. Setting it independently is what lets a server
-   * know who is calling while leaving the policy `OPEN` — resolving an identity
-   * and enforcing one are different concerns, and welding them together left
-   * consumers choosing between an unauthenticated caller and locking every
-   * non-admin out.
-   *
-   * It resolves an identity and enforces nothing: a request with no token is
-   * still admitted, with no user.
-   */
-  resolveIdentity?: boolean;
-  admins: string[];
-  skipCredentialVerification?: boolean;
-  credentialVerificationCacheTtlMs?: number;
-  verifyCredential?: CredentialVerifier;
-}
-interface User {
-  address: string;
-  chainId: number;
-  networkId: string;
-  /**
-   * The did:key of the app instance that issued this request's token, taken
-   * from the verified credential's issuer.
-   *
-   * It is the same value a signer presents as its app key when it signs an
-   * action, which is what a document records as its creator. Carrying it here
-   * is what lets a request decide as the same principal the write path
-   * presents, rather than as an address with no key.
-   *
-   * Authenticated, not asserted: the token is verified by resolving this very
-   * DID, so a caller cannot name someone else's.
-   */
-  appKey: string;
-}
-interface AuthContext {
-  user?: User;
-  admins: string[];
-  auth_enabled: boolean;
-}
-declare class AuthService {
-  private readonly config;
-  private readonly credentialCache;
-  constructor(config: AuthConfig);
-  /**
-   * Whether this service reads the bearer at all. Defaults to `enabled`, so a
-   * config written before `resolveIdentity` existed behaves exactly as it did.
-   */
-  private get resolvesIdentity();
-  /** The context an unresolved request gets: no user, and no admin list to match against. */
-  private anonymousContext;
-  authenticateRequest(request: globalThis.Request): Promise<AuthContext | globalThis.Response>;
-  /**
-   * Verify a Bearer token regardless of HTTP method. Use this from non-GraphQL
-   * middleware that must enforce authentication on every request.
-   */
-  verifyBearer(authorization: string | undefined): Promise<AuthContext | globalThis.Response>;
-  authenticateWebSocketConnection(connectionParams: Record<string, unknown>): Promise<User | null>;
-  /**
-   * Verify the auth bearer token
-   */
-  private verifyToken;
-  /**
-   * Extract user information from verification result.
-   *
-   * The issuer is required along with the credential subject. A credential that
-   * verified must carry one -- resolving it is how the signature was checked --
-   * so this rejects a shape that cannot have come from verification rather than
-   * admitting a keyless principal.
-   */
-  private extractUserFromVerification;
-  /**
-   * Verify that the credential still exists on the Renown API.
-   *
-   * Results are cached per (address, chainId, issuer) for a short TTL so the
-   * blocking external round-trip is not paid on every request. Concurrent
-   * checks for the same key share a single in-flight request, and entries
-   * that resolve to false are evicted immediately so failed or revoked
-   * credentials are re-checked on the next request.
-   */
-  private verifyCredentialExists;
-  /**
-   * Enforce the cache size cap before inserting a new entry: drop expired
-   * entries first, then evict oldest-inserted entries (insertion order
-   * matches expiry order since the TTL is constant) until under the cap, so
-   * a flood of distinct keys cannot grow the map without bound.
-   */
-  private pruneCredentialCache;
-  private fetchCredentialExists;
-}
-//#endregion
-//#region src/graphql/gateway/types.d.ts
-type TlsOptions = {
-  keyPath: string;
-  certPath: string;
-} | {
-  cert: Buffer | string;
-  key: Buffer | string;
-} | true;
-type GatewayContextFactory<TContext = unknown> = (request: Request) => Promise<TContext>;
-type WsContextFactory<TContext = unknown> = (connectionParams: Record<string, unknown>) => Promise<TContext>;
-type WsDisposer = {
-  dispose: () => void | Promise<void>;
-};
-type FetchHandler = (request: Request) => Promise<Response>;
-/**
- * Opaque identifier for a registered route. Returned by `mount()`,
- * `getRoute()`, and `mountNodeRoute()`; pass it to `unmount()` to remove
- * the route.
- */
-type RouteHandle = number;
-/**
- * A framework-agnostic description of a federated subgraph service.
- * Used by IGatewayAdapter.createSupergraphHandler() to compose the supergraph SDL.
- */
-type SubgraphDefinition = {
-  name: string;
-  typeDefs: DocumentNode;
-  url: string;
-};
-interface IGatewayAdapter<TContext = unknown> {
-  /** One-time startup. */
-  start(httpServer: http.Server): Promise<void>;
-  /**
-   * Returns a Fetch API handler for the given schema.
-   * Caller (IHttpAdapter) is responsible for mounting it at a path.
-   */
-  createHandler(schema: GraphQLSchema, contextFactory: GatewayContextFactory<TContext>): Promise<FetchHandler>;
-  /**
-   * Create a federation gateway handler that composes all subgraphs into a supergraph.
-   * getSubgraphs is called eagerly (during setup) and again on every updateSupergraph() call.
-   */
-  createSupergraphHandler(getSubgraphs: () => SubgraphDefinition[], httpServer: http.Server, contextFactory: GatewayContextFactory<TContext>): Promise<FetchHandler>;
-  /**
-   * Recompose the supergraph SDL from the current subgraph list and push the update
-   * to the running federation gateway. No-op if createSupergraphHandler() has not
-   * been called yet.
-   */
-  updateSupergraph(): Promise<void>;
-  /** Attach WebSocket subscriptions. Returns a disposer. */
-  attachWebSocket(wsServer: WebSocketServer, schema: GraphQLSchema, contextFactory: WsContextFactory<TContext>): WsDisposer;
-  stop(): Promise<void>;
-}
-interface IHttpAdapter {
-  /** Set up CORS and body-parser equivalent middleware. */
-  setupMiddleware(config: {
-    corsOptions?: CorsOptions;
-    bodyLimit?: string;
-  }): void;
-  /**
-   * Mount a Fetch API handler. Returns a handle for {@link unmount}.
-   * - exact = false (default): exact path match.
-   * - exact = true: prefix match - handler also receives all sub-paths.
-   *
-   * Mounting a path that already holds a fetch mount of the same kind
-   * replaces the previous one (last write wins).
-   */
-  mount(path: string, handler: FetchHandler, options?: {
-    exact?: boolean;
-  }): RouteHandle;
-  /**
-   * Register a GET-only route that returns a Fetch Response (for health,
-   * explorer, etc.). Returns a handle for {@link unmount}.
-   */
-  getRoute(path: string, handler: (request: Request) => Response | Promise<Response>): RouteHandle;
-  /**
-   * Start listening on the given port. Returns the underlying http.Server
-   * so callers can attach WebSocket servers.
-   */
-  listen(port: number, tls?: TlsOptions): Promise<http.Server>;
-  /**
-   * Mount a raw Connect/Express-compatible middleware function (e.g. Vite dev
-   * server middleware). The implementation is adapter-specific; for Express this
-   * is equivalent to `app.use(middleware)`.
-   */
-  mountRawMiddleware(middleware: unknown): void;
-  /**
-   * Register a method-specific route handler using Node.js core HTTP types.
-   * Use this when a Fetch API FetchHandler is not possible (e.g. streaming
-   * protocols that require direct access to IncomingMessage/ServerResponse).
-   *
-   * The req/res objects are `http.IncomingMessage`/`http.ServerResponse`
-   * (Express Request/Response are compatible subtypes). Returns a handle
-   * for {@link unmount}.
-   */
-  mountNodeRoute(method: "DELETE" | "GET" | "HEAD" | "POST" | "PUT", path: string, handler: (req: http.IncomingMessage, res: http.ServerResponse, body?: unknown) => void | Promise<void>): RouteHandle;
-  /**
-   * Remove a route registered by `mount()`, `getRoute()`, or
-   * `mountNodeRoute()`, identified by the handle that call returned.
-   * No-op for unknown or already-removed handles.
-   *
-   * `mountRawMiddleware` is intentionally not removable: raw framework
-   * middleware (e.g. a Vite dev server) is not a single route.
-   */
-  unmount(handle: RouteHandle): void;
-  /**
-   * Register framework-specific Sentry error-capturing middleware after all routes
-   * are mounted. Each adapter calls the Sentry setup function appropriate for its
-   * framework (e.g. setupExpressErrorHandler, setupFastifyErrorHandler).
-   * No-op if Sentry is not relevant for the adapter.
-   */
-  setupSentryErrorHandler(sentry: object): void;
-  /** The raw framework handle (e.g. Express app). Cast as needed at call sites. */
-  readonly handle: unknown;
-}
-//#endregion
 //#region src/graphql/gateway/auth-middleware.d.ts
 type AuthFetchMiddleware = (handler: FetchHandler) => FetchHandler;
 /** Internal — only `graphql-manager.ts` should call this. */
@@ -914,6 +1129,7 @@ declare class GraphQLManager {
   private readonly featureFlags;
   private readonly port;
   private readonly syncServingGate?;
+  private readonly httpRoutes?;
   private initialized;
   private coreSubgraphsMap;
   private contextFields;
@@ -940,7 +1156,7 @@ declare class GraphQLManager {
    */
   readonly reactorDriveClient?: IDriveClient;
   private readonly authorizationService;
-  constructor(path: string, httpServer: http.Server, wsServer: WebSocketServer, reactorClient: IReactorClient, relationalDb: IRelationalDb, analyticsStore: IAnalyticsStore, syncManager: ISyncManager, logger: ILogger, httpAdapter: IHttpAdapter, gatewayAdapter: IGatewayAdapter<Context$1>, authService?: AuthService | undefined, documentPermissionService?: DocumentPermissionService | undefined, featureFlags?: GraphqlManagerFeatureFlags, port?: number, authorizationService?: IAuthorizationService, reactorDriveClient?: IDriveClient, syncServingGate?: SyncScopeGate | undefined);
+  constructor(path: string, httpServer: http.Server, wsServer: WebSocketServer, reactorClient: IReactorClient, relationalDb: IRelationalDb, analyticsStore: IAnalyticsStore, syncManager: ISyncManager, logger: ILogger, httpAdapter: IHttpAdapter, gatewayAdapter: IGatewayAdapter<Context$1>, authService?: AuthService | undefined, documentPermissionService?: DocumentPermissionService | undefined, featureFlags?: GraphqlManagerFeatureFlags, port?: number, authorizationService?: IAuthorizationService, reactorDriveClient?: IDriveClient, syncServingGate?: SyncScopeGate | undefined, httpRoutes?: HttpRouteService | undefined);
   init(coreSubgraphs: SubgraphClass$1[], authMiddleware?: AuthFetchMiddleware, requireAuthMiddleware?: RequireAuthFetchMiddleware): Promise<void>;
   /**
    * Regenerate document model subgraphs when models are dynamically loaded.
@@ -962,11 +1178,18 @@ declare class GraphQLManager {
    * {@link registerSubgraphInstance}.
    */
   getAuthorizationService(): IAuthorizationService;
+  /**
+   * The HTTP scope a package's subgraphs get. Falls back to a scope over a
+   * throwaway service when route hosting is not configured, so a subgraph can
+   * always rely on `args.http` existing.
+   */
+  scopeForPackage(packageName: string): IHttpScope;
   /**
    * Register a subgraph class. `packageName` labels the resulting instance
    * with its contributing package so the instance can be torn down when the
    * package is removed or drops the subgraph (see unregisterPackage and
-   * prunePackageSubgraphs).
+   * prunePackageSubgraphs), and decides the namespace its REST routes and
+   * webhooks live under.
    */
   registerSubgraph(subgraph: SubgraphClass$1, supergraph?: string, core?: boolean, packageName?: string): Promise<ISubgraph$1 | undefined>;
   /**
@@ -1110,7 +1333,8 @@ type ReadinessGate = {
   markReady: () => void;
 };
 type API = {
-  httpAdapter: IHttpAdapter;
+  httpAdapter: IHttpAdapter; /** Hands each package a namespaced slice of the HTTP surface. */
+  httpRoutes: HttpRouteService;
   graphqlManager: GraphQLManager$1;
   packages: IPackageManager;
   attachments: AttachmentBuildResult;
@@ -3405,5 +3629,5 @@ interface DocumentModelSchemaOptions {
  */
 declare function generateDocumentModelSchema(documentModel: DocumentModelGlobalState$1, options?: DocumentModelSchemaOptions): DocumentNode;
 //#endregion
-export { ADMIN_USERS, API, Action, ActionCandidateInput, ActionCandidateInputSchema, ActionContext, ActionContextInput, ActionContextInputSchema, ActionContextResolvers, ActionEvaluation, ActionEvaluationResolvers, ActionEvaluations, ActionEvaluationsResolvers, ActionInput, ActionInputSchema, ActionResolvers, AddRelationshipDocument, AddRelationshipMutation, AddRelationshipMutationVariables, AnalyticsSubgraph, AttachmentAccessRequest, AttachmentAccessResult, AttachmentAccessService, type AttachmentReferenceProjectionCapability, AuthConfig, AuthContext, AuthDecision, AuthDecisionSchema, AuthFetchMiddleware, AuthService, AuthSubgraph, type AuthorizationConfig, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, type CanonicalDocumentId, CanonicalDocumentIdResolutionError, CanonicalDocumentIdResolver, ChannelMeta, ChannelMetaInput, ChannelMetaInputSchema, ChannelMetaResolvers, ClientInitializerDependencies, ClientInitializerResult, Context, CreateDocumentDocument, CreateDocumentMutation, CreateDocumentMutationVariables, CreateEmptyDocumentDocument, CreateEmptyDocumentMutation, CreateEmptyDocumentMutationVariables, CredentialVerifier, DateTimeScalarConfig, DbClient, DeadLetterInfo, DeadLetterInfoResolvers, DeleteDocumentDocument, DeleteDocumentMutation, DeleteDocumentMutationVariables, DeleteDocumentsDocument, DeleteDocumentsMutation, DeleteDocumentsMutationVariables, DirectiveResolverFn, DocumentChangeContext, DocumentChangeContextResolvers, DocumentChangeEvent, DocumentChangeEventResolvers, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentChangesSubscription, DocumentChangesSubscriptionVariables, DocumentModelGlobalState, DocumentModelGlobalStateResolvers, DocumentModelResultPage, DocumentModelResultPageResolvers, DocumentModelSchemaOptions, DocumentOperationsFilterInput, DocumentOperationsFilterInputSchema, DocumentPermissionConfig, DocumentPermissionDatabase, DocumentPermissionEntry, DocumentPermissionLevel, DocumentPermissionService, DocumentPermissionTable, DocumentProtectionTable, DocumentWithChildren, DocumentWithChildrenResolvers, EvaluateActionsDocument, EvaluateActionsQuery, EvaluateActionsQueryVariables, Exact, ExplorerUrlState, FetchHandler, FindDocumentsDocument, FindDocumentsQuery, FindDocumentsQueryVariables, GatewayAdapterType, GatewayContextFactory, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentIncomingRelationshipsQuery, GetDocumentIncomingRelationshipsQueryVariables, GetDocumentModelsDocument, GetDocumentModelsQuery, GetDocumentModelsQueryVariables, GetDocumentOperationsDocument, GetDocumentOperationsQuery, GetDocumentOperationsQueryVariables, GetDocumentOutgoingRelationshipsDocument, GetDocumentOutgoingRelationshipsQuery, GetDocumentOutgoingRelationshipsQueryVariables, GetDocumentQuery, GetDocumentQueryVariables, GetDocumentWithOperationsDocument, GetDocumentWithOperationsQuery, GetDocumentWithOperationsQueryVariables, GetJobStatusDocument, GetJobStatusQuery, GetJobStatusQueryVariables, GetParentIdsFn, GqlDocument, GqlDriveDocument, GqlOperation, GqlOperationContext, GqlSigner, GqlSignerApp, GqlSignerUser, GraphQLManager, GraphqlManagerFeatureFlags, HttpAdapterSetup, HttpAdapterType, HttpDocumentModelLoader, HttpPackageLoader, HttpPackageLoaderLogger, HttpPackageLoaderOptions, IAttachmentAccessService, type IAuthorizationService, IGatewayAdapter, IHttpAdapter, type IPackageLoader, type IPackageLoaderOptions, IPackageStorage, IProcessorHostModule, IReactorProcessorHostModule, ISubgraph, ImportPackageLoader, InMemoryPackageStorage, Incremental, InputMaybe, InstallPackageResult, InstalledPackageInfo, IsTypeOfResolverFn, JobChangeEvent, JobChangeEventResolvers, JobChangesDocument, JobChangesSubscription, JobChangesSubscriptionVariables, JobInfo, JobInfoResolvers, JsonObjectScalarConfig, MakeEmpty, MakeMaybe, MakeOptional, Maybe, MoveRelationshipDocument, MoveRelationshipMutation, MoveRelationshipMutationVariables, MoveRelationshipResult, MoveRelationshipResultResolvers, MutateDocumentAsyncDocument, MutateDocumentAsyncMutation, MutateDocumentAsyncMutationVariables, MutateDocumentDocument, MutateDocumentMutation, MutateDocumentMutationVariables, Mutation, MutationAddRelationshipArgs, MutationCreateDocumentArgs, MutationCreateEmptyDocumentArgs, MutationDeleteDocumentArgs, MutationDeleteDocumentsArgs, MutationExecuteArgs, MutationExecuteAsyncArgs, MutationMoveRelationshipArgs, MutationMutateDocumentArgs, MutationMutateDocumentAsyncArgs, MutationPushSyncEnvelopesArgs, MutationRemoveRelationshipArgs, MutationRenameDocumentArgs, MutationResolvers, MutationSetPreferredEditorArgs, MutationTouchChannelArgs, NextResolverFn, OperationContext, OperationContextInput, OperationContextInputSchema, OperationContextResolvers, OperationInput, OperationInputSchema, OperationUserPermissionEntry, OperationUserPermissionTable, OperationWithContext, OperationWithContextInput, OperationWithContextInputSchema, OperationWithContextResolvers, OperationsFilterInput, OperationsFilterInputSchema, PGLITE_UTC_PARSERS, PackageManagementService, PackageManagementServiceOptions, PackageManager, PackagesSubgraph, type PackagesSubgraphArgs, PagingInput, PagingInputSchema, type ParsedDriveUrl, PgliteFactory, PhDocument, PhDocumentFieldsFragment, PhDocumentFieldsFragmentDoc, PhDocumentOperationsArgs, PhDocumentResolvers, PhDocumentResultPage, PhDocumentResultPageResolvers, PollSyncEnvelopesDocument, PollSyncEnvelopesQuery, PollSyncEnvelopesQueryVariables, PollSyncEnvelopesResult, PollSyncEnvelopesResultResolvers, Processor, ProcessorDriveFactory, ProcessorFactoryBuilder, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, PushSyncEnvelopesMutation, PushSyncEnvelopesMutationVariables, Query, QueryDocumentArgs, QueryDocumentIncomingRelationshipsArgs, QueryDocumentModelsArgs, QueryDocumentOperationsArgs, QueryDocumentOutgoingRelationshipsArgs, QueryEvaluateActionsArgs, QueryFindDocumentsArgs, QueryJobStatusArgs, QueryPollSyncEnvelopesArgs, QueryResolvers, ReactorModule, ReactorOperation, ReactorOperationResolvers, ReactorOperationResultPage, ReactorOperationResultPageResolvers, ReactorSigner, ReactorSignerApp, ReactorSignerAppInput, ReactorSignerAppInputSchema, ReactorSignerAppResolvers, ReactorSignerInput, ReactorSignerInputSchema, ReactorSignerResolvers, ReactorSignerUser, ReactorSignerUserInput, ReactorSignerUserInputSchema, ReactorSignerUserResolvers, ReactorSubgraph, ReadinessGate, RemoteCursor, RemoteCursorInput, RemoteCursorInputSchema, RemoteCursorResolvers, RemoteFilterInput, RemoteFilterInputSchema, RemoveRelationshipDocument, RemoveRelationshipMutation, RemoveRelationshipMutationVariables, RenameDocumentDocument, RenameDocumentMutation, RenameDocumentMutationVariables, RenownConfig, RenownCredentialVerifierConfig, RenownSource, Requester, RequireFields, ResolvedRenownConfig, Resolver, ResolverFn, ResolverTypeWrapper, ResolverWithResolve, Resolvers, ResolversObject, ResolversParentTypes, ResolversTypes, Revision, RevisionResolvers, RouteHandle, Scalars, Sdk, SearchFilterInput, SearchFilterInputSchema, SetPreferredEditorDocument, SetPreferredEditorMutation, SetPreferredEditorMutationVariables, SubgraphArgs, SubgraphClass, SubgraphDefinition, Subscription, SubscriptionDocumentChangesArgs, SubscriptionJobChangesArgs, SubscriptionObject, SubscriptionResolveFn, SubscriptionResolver, SubscriptionResolverObject, SubscriptionResolvers, SubscriptionSubscribeFn, SubscriptionSubscriberObject, SyncEnvelope, SyncEnvelopeInput, SyncEnvelopeInputSchema, SyncEnvelopeResolvers, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TlsOptions, TouchChannelDocument, TouchChannelInput, TouchChannelInputSchema, TouchChannelMutation, TouchChannelMutationVariables, TouchChannelResult, TouchChannelResultResolvers, TypeResolveFn, User, ViewFilterInput, ViewFilterInputSchema, WithIndex, WsContextFactory, WsDisposer, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground, resolveRenownConfig };
+export { ADMIN_USERS, API, Action, ActionCandidateInput, ActionCandidateInputSchema, ActionContext, ActionContextInput, ActionContextInputSchema, ActionContextResolvers, ActionEvaluation, ActionEvaluationResolvers, ActionEvaluations, ActionEvaluationsResolvers, ActionInput, ActionInputSchema, ActionResolvers, AdapterRouteHandle, AddRelationshipDocument, AddRelationshipMutation, AddRelationshipMutationVariables, AnalyticsSubgraph, AttachmentAccessRequest, AttachmentAccessResult, AttachmentAccessService, type AttachmentReferenceProjectionCapability, AuthConfig, AuthContext, AuthDecision, AuthDecisionSchema, AuthFetchMiddleware, AuthService, AuthSubgraph, type AuthorizationConfig, AuthorizationPolicy, AuthorizedDocumentHandle, type AuthorizerResult, BaseSubgraph, CORE_PACKAGE_NAME, type CanonicalDocumentId, CanonicalDocumentIdResolutionError, CanonicalDocumentIdResolver, ChannelMeta, ChannelMetaInput, ChannelMetaInputSchema, ChannelMetaResolvers, ClientInitializerDependencies, ClientInitializerResult, Context, CreateDocumentDocument, CreateDocumentMutation, CreateDocumentMutationVariables, CreateEmptyDocumentDocument, CreateEmptyDocumentMutation, CreateEmptyDocumentMutationVariables, CredentialVerifier, DateTimeScalarConfig, DbClient, DeadLetterInfo, DeadLetterInfoResolvers, DeleteDocumentDocument, DeleteDocumentMutation, DeleteDocumentMutationVariables, DeleteDocumentsDocument, DeleteDocumentsMutation, DeleteDocumentsMutationVariables, DirectiveResolverFn, DocumentChangeContext, DocumentChangeContextResolvers, DocumentChangeEvent, DocumentChangeEventResolvers, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentChangesSubscription, DocumentChangesSubscriptionVariables, DocumentModelGlobalState, DocumentModelGlobalStateResolvers, DocumentModelResultPage, DocumentModelResultPageResolvers, DocumentModelSchemaOptions, DocumentOperationsFilterInput, DocumentOperationsFilterInputSchema, DocumentPermissionConfig, DocumentPermissionDatabase, DocumentPermissionEntry, DocumentPermissionLevel, DocumentPermissionService, DocumentPermissionTable, DocumentProtectionTable, DocumentWithChildren, DocumentWithChildrenResolvers, EvaluateActionsDocument, EvaluateActionsQuery, EvaluateActionsQueryVariables, Exact, ExplorerUrlState, FetchHandler, FindDocumentsDocument, FindDocumentsQuery, FindDocumentsQueryVariables, GatewayAdapterType, GatewayContextFactory, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentIncomingRelationshipsQuery, GetDocumentIncomingRelationshipsQueryVariables, GetDocumentModelsDocument, GetDocumentModelsQuery, GetDocumentModelsQueryVariables, GetDocumentOperationsDocument, GetDocumentOperationsQuery, GetDocumentOperationsQueryVariables, GetDocumentOutgoingRelationshipsDocument, GetDocumentOutgoingRelationshipsQuery, GetDocumentOutgoingRelationshipsQueryVariables, GetDocumentQuery, GetDocumentQueryVariables, GetDocumentWithOperationsDocument, GetDocumentWithOperationsQuery, GetDocumentWithOperationsQueryVariables, GetJobStatusDocument, GetJobStatusQuery, GetJobStatusQueryVariables, GetParentIdsFn, GqlDocument, GqlDriveDocument, GqlOperation, GqlOperationContext, GqlSigner, GqlSignerApp, GqlSignerUser, GraphQLManager, GraphqlManagerFeatureFlags, HttpAdapterSetup, HttpAdapterType, HttpDocumentModelLoader, HttpMethod, HttpPackageLoader, HttpPackageLoaderLogger, HttpPackageLoaderOptions, HttpRouteService, type HttpRouteServiceOptions, IAttachmentAccessService, type IAuthorizationService, IGatewayAdapter, IHttpAdapter, type IHttpScope, type IPackageLoader, type IPackageLoaderOptions, IPackageStorage, IProcessorHostModule, IReactorProcessorHostModule, ISubgraph, type IWebhookEndpoints, type IWebhookScope, type IWebhookStore, ImportPackageLoader, InMemoryPackageStorage, Incremental, InputMaybe, InstallPackageResult, InstalledPackageInfo, InvalidNamespaceError, IsTypeOfResolverFn, JobChangeEvent, JobChangeEventResolvers, JobChangesDocument, JobChangesSubscription, JobChangesSubscriptionVariables, JobInfo, JobInfoResolvers, JsonObjectScalarConfig, MakeEmpty, MakeMaybe, MakeOptional, Maybe, MemoryWebhookStore, MoveRelationshipDocument, MoveRelationshipMutation, MoveRelationshipMutationVariables, MoveRelationshipResult, MoveRelationshipResultResolvers, MutateDocumentAsyncDocument, MutateDocumentAsyncMutation, MutateDocumentAsyncMutationVariables, MutateDocumentDocument, MutateDocumentMutation, MutateDocumentMutationVariables, Mutation, MutationAddRelationshipArgs, MutationCreateDocumentArgs, MutationCreateEmptyDocumentArgs, MutationDeleteDocumentArgs, MutationDeleteDocumentsArgs, MutationExecuteArgs, MutationExecuteAsyncArgs, MutationMoveRelationshipArgs, MutationMutateDocumentArgs, MutationMutateDocumentAsyncArgs, MutationPushSyncEnvelopesArgs, MutationRemoveRelationshipArgs, MutationRenameDocumentArgs, MutationResolvers, MutationSetPreferredEditorArgs, MutationTouchChannelArgs, NextResolverFn, NodeRouteOptions, type NodeRouteSpec, OperationContext, OperationContextInput, OperationContextInputSchema, OperationContextResolvers, OperationInput, OperationInputSchema, OperationUserPermissionEntry, OperationUserPermissionTable, OperationWithContext, OperationWithContextInput, OperationWithContextInputSchema, OperationWithContextResolvers, OperationsFilterInput, OperationsFilterInputSchema, PACKAGE_ROUTE_SEGMENT, PGLITE_UTC_PARSERS, PackageManagementService, PackageManagementServiceOptions, PackageManager, PackagesSubgraph, type PackagesSubgraphArgs, PagingInput, PagingInputSchema, type ParsedDriveUrl, PgliteFactory, PhDocument, PhDocumentFieldsFragment, PhDocumentFieldsFragmentDoc, PhDocumentOperationsArgs, PhDocumentResolvers, PhDocumentResultPage, PhDocumentResultPageResolvers, PollSyncEnvelopesDocument, PollSyncEnvelopesQuery, PollSyncEnvelopesQueryVariables, PollSyncEnvelopesResult, PollSyncEnvelopesResultResolvers, Processor, ProcessorDriveFactory, ProcessorFactoryBuilder, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, PushSyncEnvelopesMutation, PushSyncEnvelopesMutationVariables, Query, QueryDocumentArgs, QueryDocumentIncomingRelationshipsArgs, QueryDocumentModelsArgs, QueryDocumentOperationsArgs, QueryDocumentOutgoingRelationshipsArgs, QueryEvaluateActionsArgs, QueryFindDocumentsArgs, QueryJobStatusArgs, QueryPollSyncEnvelopesArgs, QueryResolvers, ReactorModule, ReactorOperation, ReactorOperationResolvers, ReactorOperationResultPage, ReactorOperationResultPageResolvers, ReactorSigner, ReactorSignerApp, ReactorSignerAppInput, ReactorSignerAppInputSchema, ReactorSignerAppResolvers, ReactorSignerInput, ReactorSignerInputSchema, ReactorSignerResolvers, ReactorSignerUser, ReactorSignerUserInput, ReactorSignerUserInputSchema, ReactorSignerUserResolvers, ReactorSubgraph, ReadinessGate, RelationalWebhookStore, RemoteCursor, RemoteCursorInput, RemoteCursorInputSchema, RemoteCursorResolvers, RemoteFilterInput, RemoteFilterInputSchema, RemoveRelationshipDocument, RemoveRelationshipMutation, RemoveRelationshipMutationVariables, RenameDocumentDocument, RenameDocumentMutation, RenameDocumentMutationVariables, RenownConfig, RenownCredentialVerifierConfig, RenownSource, Requester, RequireFields, ResolvedRenownConfig, Resolver, ResolverFn, ResolverTypeWrapper, ResolverWithResolve, Resolvers, ResolversObject, ResolversParentTypes, ResolversTypes, Revision, RevisionResolvers, type RouteActor, type RouteAuth, type RouteAuthorizer, type RouteBody, type RouteContext, type RouteHandler, type RouteMethod, type RouteOptions, type RouteSpec, type RouteTransport, type RouteUser, Scalars, type ScopedRouteHandle, Sdk, SearchFilterInput, SearchFilterInputSchema, SetPreferredEditorDocument, SetPreferredEditorMutation, SetPreferredEditorMutationVariables, SubgraphArgs, SubgraphClass, SubgraphDefinition, Subscription, SubscriptionDocumentChangesArgs, SubscriptionJobChangesArgs, SubscriptionObject, SubscriptionResolveFn, SubscriptionResolver, SubscriptionResolverObject, SubscriptionResolvers, SubscriptionSubscribeFn, SubscriptionSubscriberObject, SyncEnvelope, SyncEnvelopeInput, SyncEnvelopeInputSchema, SyncEnvelopeResolvers, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TlsOptions, TouchChannelDocument, TouchChannelInput, TouchChannelInputSchema, TouchChannelMutation, TouchChannelMutationVariables, TouchChannelResult, TouchChannelResultResolvers, TypeResolveFn, User, ViewFilterInput, ViewFilterInputSchema, WEBHOOK_SEGMENT, type WebhookEndpointInfo, type WebhookEndpointRow, type WebhookField, type WebhookHashAlgorithm, type WebhookPolicy, type WebhookReply, type WebhookRequest, type WebhookScheme, WebhookService, type WebhookSignatureEncoding, type WebhookSpec, type WebhookVerification, WithIndex, WsContextFactory, WsDisposer, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertHostMountPath, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, namespacePath, namespaceSegments, newWebhookToken, parseDriveUrl, parseWebhookBody, redactHeaders, renderGraphqlPlayground, resolvePackageName, resolveRenownConfig, verifyWebhook };
 //# sourceMappingURL=index.d.mts.map