@powerhousedao/reactor-api 6.2.2 → 6.2.3-dev.1

package/dist/index.mjs

@@ -1,14 +1,19 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f43e08dc-7398-57dd-8824-db5d97ccc6ca")}catch(e){}}();
-import { _ as createAuthorizationService, a as isSubgraphClass, b as MalformedStoredOperationError, d as loadSubgraphs, f as BaseSubgraph, g as AuthorizedDocumentHandle, h as AuthorizationPolicy, i as buildGraphqlOperations, l as loadDocumentModels, m as createCanonicalDocumentIdResolver, n as buildGraphQlDriveDocument, o as debounce, p as CanonicalDocumentIdResolutionError, r as buildGraphqlOperation, s as extractUpgradeManifests, t as buildGraphQlDocument, u as loadProcessors, v as AuthEvaluationUnsupportedError, y as ForbiddenError } from "./utils-lHoPB-ft.mjs";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="46ad8545-02e9-5fb8-b003-7b9b93f82f75")}catch(e){}}();
+import { _ as createAuthorizationService, a as isSubgraphClass, b as MalformedStoredOperationError, d as loadSubgraphs, f as BaseSubgraph, g as AuthorizedDocumentHandle, h as AuthorizationPolicy, i as buildGraphqlOperations, l as loadDocumentModels, m as createCanonicalDocumentIdResolver, n as buildGraphQlDriveDocument, o as debounce, p as CanonicalDocumentIdResolutionError, r as buildGraphqlOperation, s as extractUpgradeManifests, t as buildGraphQlDocument, u as loadProcessors, v as AuthEvaluationUnsupportedError, y as ForbiddenError } from "./utils-XWVecaNn.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
 import { GraphQLError, Kind, parse, print } from "graphql";
 import { AuthEnforcementDisabledError, DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, ModelReadGate, PropagationMode as PropagationMode$1, SyncScopeGate, consolidateSyncOperations, createReactorHostModuleBase, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl, readDecisionModel, syncOperationErrorType } from "@powerhousedao/reactor";
 import { ConsoleLogger, childLogger, documentModelDocumentModelModule } from "document-model";
-import path from "node:path";
+import path, { join } from "node:path";
 import { match } from "path-to-regexp";
+import posix from "node:path/posix";
+import { Readable } from "node:stream";
+import fs, { readFileSync, watchFile } from "node:fs";
+import { pipeline } from "node:stream/promises";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { buildSubgraphSchema } from "@apollo/subgraph";
 import { typeDefs } from "@powerhousedao/document-engineering/graphql";
 import { camelCase, kebabCase, pascalCase } from "change-case";
@@ -26,7 +31,6 @@ import { reactorDriveDocumentModelModule } from "@powerhousedao/reactor-drive";
 import { ReactorGroupV1 } from "@powerhousedao/reactor-group";
 import { driveDocumentModelModule } from "@powerhousedao/shared/document-drive";
 import EventEmitter from "node:events";
-import fs, { watchFile } from "node:fs";
 import { PostgresAnalyticsStore } from "@powerhousedao/analytics-engine-pg";
 import { AttachmentBuilder, AttachmentReferenceIndexBuilder, createRef, createS3AttachmentBackend, parseAttachmentStorageConfig, parseRef } from "@powerhousedao/reactor-attachments";
 import { createAttachmentClient } from "@powerhousedao/reactor-attachments/client";
@@ -319,16 +323,1101 @@ async function createGatewayAdapter(type, logger) {
 async function createHttpAdapter(type) {
 	switch (type) {
 		case "express": {
-			const { createExpressHttpAdapter } = await import("./adapter-http-express-CgVPgEMm.mjs");
+			const { createExpressHttpAdapter } = await import("./adapter-http-express-54gdI9bu.mjs");
 			return createExpressHttpAdapter();
 		}
 		case "fastify": {
-			const { createFastifyHttpAdapter } = await import("./adapter-http-fastify-D98iRljY.mjs");
+			const { createFastifyHttpAdapter } = await import("./adapter-http-fastify-DmccBVOe.mjs");
 			return createFastifyHttpAdapter();
 		}
 	}
 }
 //#endregion
+//#region src/http/namespace.ts
+/**
+* A package's namespace is its npm name, used verbatim as one or two path
+* segments. Nothing is slugged: dropping the scope, folding `.`/`_` to `-` or
+* lower-casing would all map distinct package names onto one namespace, and a
+* lossy mapping means two packages can silently claim the same URL space.
+* Verbatim is injective, so there is no collision left to detect.
+*/
+/**
+* npm's package-name grammar, per segment. Deliberately the same shape the HTTP
+* package loader validates with, so a name that can be installed can be routed.
+*/
+const SEGMENT = /^[a-z0-9][-a-z0-9._]*$/i;
+/** Segments that would read as path traversal rather than as a name. */
+const TRAVERSAL = new Set([".", ".."]);
+var InvalidNamespaceError = class extends Error {};
+/**
+* Turns a package name into the path segments it occupies.
+* `@powerhousedao/workflow` → ["@powerhousedao", "workflow"]
+* `document-model`          → ["document-model"]
+*/
+function namespaceSegments(packageName) {
+	if (!packageName) throw new InvalidNamespaceError("Package name is empty");
+	const scoped = packageName.startsWith("@");
+	const parts = (scoped ? packageName.slice(1) : packageName).split("/");
+	if (parts.length !== (scoped ? 2 : 1)) throw new InvalidNamespaceError(`"${packageName}" is not a package name: expected ${scoped ? "@scope/name" : "name"}`);
+	for (const part of parts) if (TRAVERSAL.has(part) || !SEGMENT.test(part)) throw new InvalidNamespaceError(`"${packageName}" contains a segment that is not a valid npm name part: "${part}"`);
+	return scoped ? [`@${parts[0]}`, parts[1]] : parts;
+}
+/**
+* The path a package's routes hang off, relative to the package prefix.
+* Scoped names occupy two segments — the addressing unpkg and jsdelivr use.
+*/
+function namespacePath(packageName) {
+	return namespaceSegments(packageName).join("/");
+}
+/**
+* The same path with the leading `@` percent-encoded. Both routers match the
+* raw pathname, so a client that percent-encodes each segment would otherwise
+* 404. Registering both spellings avoids decoding the pathname before matching,
+* which would turn `%2f` into `/` and let a crafted URL cross segment
+* boundaries. `%40` cannot introduce a boundary, which is what makes this safe.
+*/
+function encodedNamespacePath(packageName) {
+	const path = namespacePath(packageName);
+	return path.startsWith("@") ? `%40${path.slice(1)}` : void 0;
+}
+/**
+* A route path a package supplied. Must be relative and must not climb out of
+* the scope.
+*/
+function assertRelativeRoutePath(path) {
+	if (path.startsWith("/")) throw new InvalidNamespaceError(`Route path "${path}" must be relative to the scope, not absolute`);
+	if (/^[a-z][a-z0-9+.-]*:/i.test(path)) throw new InvalidNamespaceError(`Route path "${path}" must be a path, not a URL`);
+	if (path.split("/").some((segment) => TRAVERSAL.has(segment))) throw new InvalidNamespaceError(`Route path "${path}" must not contain "." or ".." segments`);
+	return path.replace(/^\/+|\/+$/g, "");
+}
+/**
+* Resolves the npm name a package is routed under from the key the package
+* manager holds it by. That key is the specifier as configured, which is not
+* always a name:
+* - `@scope/pkg` — already a name.
+* - `@scope/pkg@1.3.9` — a registry spec; only the loader strips the tag.
+* - `/Users/me/project` — the local project, which switchboard registers by
+*   `process.cwd()`. Its real name lives in its package.json.
+*
+* Deriving a URL segment straight from the key would give a developer's home
+* directory a route namespace, so the path form is resolved rather than slugged.
+*/
+function resolvePackageName(key, readPackageJsonName = defaultReadName) {
+	const withoutVersion = stripVersionSpec(key);
+	if (isPackageName(withoutVersion)) return withoutVersion;
+	if (key.startsWith("/") || key.startsWith(".")) {
+		const name = readPackageJsonName(key);
+		if (name && isPackageName(name)) return name;
+		throw new InvalidNamespaceError(`Package at "${key}" has no usable name in its package.json, so it cannot host routes`);
+	}
+	throw new InvalidNamespaceError(`"${key}" is not a package name and not a path, so it cannot host routes`);
+}
+function isPackageName(value) {
+	try {
+		namespaceSegments(value);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** `@scope/pkg@1.3.9` → `@scope/pkg`; `pkg@1.0.0` → `pkg`. */
+function stripVersionSpec(key) {
+	const at = key.lastIndexOf("@");
+	if (at <= 0) return key;
+	return key.slice(0, at);
+}
+function defaultReadName(dir) {
+	try {
+		const raw = readFileSync(join(dir, "package.json"), "utf8");
+		const parsed = JSON.parse(raw);
+		return typeof parsed.name === "string" ? parsed.name : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* A mount path the host named for one of its own route groups.
+*
+* The host owns the whole URL space — it holds the adapter — so unlike a
+* package it may name an absolute path. That is the difference between hosting
+* and being hosted, and it is why this lives on the service rather than on a
+* scope: a package is only ever handed a scope, and a scope has no way to
+* express a path outside itself.
+*
+* What the host still may not name is anything that is not one stable literal
+* prefix. A traversal segment, or a pattern segment, would make the group's own
+* routes unpredictable relative to each other. Returns the normalized path,
+* with a leading and no trailing slash.
+*/
+function assertHostMountPath(path) {
+	if (!path.startsWith("/")) throw new InvalidNamespaceError(`Host mount path "${path}" must be absolute, e.g. "/webhooks"`);
+	const segments = path.split("/").filter((segment) => segment.length > 0);
+	if (segments.length === 0) throw new InvalidNamespaceError(`Host mount path "${path}" is the whole URL space, which is the adapter rather than a scope of it`);
+	for (const segment of segments) {
+		if (TRAVERSAL.has(segment)) throw new InvalidNamespaceError(`Host mount path "${path}" must not contain "." or ".." segments`);
+		if (segment.startsWith(":") || segment.includes("*")) throw new InvalidNamespaceError(`Host mount path "${path}" must be a literal prefix, not a pattern: "${segment}"`);
+	}
+	return `/${segments.join("/")}`;
+}
+//#endregion
+//#region src/http/node-response.ts
+/** Converts Node incoming headers to Fetch Headers. */
+function fetchHeaders(req) {
+	const headers = new Headers();
+	for (const [key, value] of Object.entries(req.headers)) {
+		if (value === void 0) continue;
+		headers.set(key, Array.isArray(value) ? value.join(", ") : value);
+	}
+	return headers;
+}
+/**
+* Where the request reached the host. `trustProxy` says whether the
+* `x-forwarded-*` headers may be believed: they are client-written, so with no
+* proxy in front a caller could pick the origin a route advertises. The `host`
+* header is always read, being the request's own target.
+*/
+function resolveTransport(req, trustProxy = false) {
+	const header = (name) => {
+		const value = req.headers[name];
+		return (Array.isArray(value) ? value[0] : value)?.split(",")[0]?.trim() || void 0;
+	};
+	const forwarded = (name) => trustProxy ? header(name) : void 0;
+	const encrypted = req.socket.encrypted === true;
+	const proto = forwarded("x-forwarded-proto") ?? (encrypted ? "https" : "http");
+	const host = forwarded("x-forwarded-host") ?? header("host") ?? "localhost";
+	const prefix = forwarded("x-forwarded-prefix") ?? "";
+	return {
+		proto,
+		host,
+		prefix,
+		baseUrl: `${proto}://${host}${prefix}`
+	};
+}
+var BodyTooLargeError = class extends Error {};
+/**
+* Buffers the request body, refusing anything past `maxBytes`.
+*
+* Written with events rather than `for await`, because an async iterator
+* destroys the stream when the loop exits early — which tears down the socket
+* before a 413 can be written to it. The stream is left paused instead, so the
+* caller can answer and then close the connection deliberately.
+*/
+function readBody(req, maxBytes) {
+	return new Promise((resolve, reject) => {
+		const chunks = [];
+		let size = 0;
+		let settled = false;
+		const settle = (error) => {
+			if (settled) return;
+			settled = true;
+			req.off("data", onData);
+			req.off("end", onEnd);
+			req.off("error", onError);
+			req.pause();
+			if (error) reject(error);
+			else resolve(Buffer.concat(chunks));
+		};
+		const onData = (chunk) => {
+			size += chunk.length;
+			if (size > maxBytes) {
+				settle(new BodyTooLargeError(`Body exceeds ${maxBytes} bytes`));
+				return;
+			}
+			chunks.push(chunk);
+		};
+		const onEnd = () => settle();
+		const onError = (error) => settle(error);
+		req.on("data", onData);
+		req.once("end", onEnd);
+		req.once("error", onError);
+	});
+}
+/**
+* Copies a Fetch Response onto a Node response, streaming the body. A HEAD
+* response carries headers only, however the handler filled the body.
+*/
+async function writeResponse(res, response, method) {
+	if (res.writableEnded || res.headersSent) return;
+	res.statusCode = response.status;
+	response.headers.forEach((value, key) => {
+		res.setHeader(key, value);
+	});
+	if (!response.body || method.toUpperCase() === "HEAD") {
+		res.end();
+		return;
+	}
+	const source = Readable.fromWeb(response.body);
+	res.on("close", () => source.destroy());
+	await pipeline(source, res);
+}
+/** Answers with a JSON error, unless the response is already underway. */
+function writeError(res, status, message) {
+	if (res.writableEnded || res.headersSent) {
+		res.destroy();
+		return;
+	}
+	const body = JSON.stringify({ error: message });
+	res.statusCode = status;
+	res.setHeader("content-type", "application/json");
+	res.setHeader("content-length", Buffer.byteLength(body));
+	res.end(body);
+}
+//#endregion
+//#region src/http/route-service.ts
+const logger$2 = childLogger(["reactor-api", "http-routes"]);
+/** The segment package routes live under, inside the host's base path. */
+const PACKAGE_ROUTE_SEGMENT = "api";
+/** The namespace core's own subgraphs and services register under. */
+const CORE_PACKAGE_NAME = "@powerhousedao/reactor-api";
+/** Generous enough for any request a route should be buffering at all. */
+const DEFAULT_MAX_BODY_BYTES$1 = 1048576;
+const ANONYMOUS = {
+	user: void 0,
+	authEnabled: false
+};
+/** Owns the URL space packages serve from, handing each a scope bound to its own namespace. The prefix nests inside
+* the host's base path (`<basePath>/api`), so core collisions are prevented by URL shape, not a reserved-name list. */
+var HttpRouteService = class {
+	#adapter;
+	#authService;
+	#prefix;
+	#publicUrl;
+	#trustProxy;
+	#scopes = /* @__PURE__ */ new Map();
+	#webhooks;
+	constructor({ httpAdapter, basePath = "/", authService, webhooks, publicUrl = "", trustProxy = false }) {
+		this.#adapter = httpAdapter;
+		this.#authService = authService;
+		this.#webhooks = webhooks;
+		this.#publicUrl = publicUrl.replace(/\/+$/, "");
+		this.#trustProxy = trustProxy;
+		this.#prefix = posix.join("/", basePath, "api");
+	}
+	/** The absolute path packages are mounted under. */
+	get prefix() {
+		return this.#prefix;
+	}
+	/** The scope for a package; idempotent per name, so a reload cannot accumulate namespaces. Throws when two packages
+	* resolve to one namespace — with verbatim names that means one package configured twice, a genuine ambiguity. */
+	scopeFor(packageKey) {
+		const packageName = resolvePackageName(packageKey);
+		const namespace = namespacePath(packageName);
+		const encoded = encodedNamespacePath(packageName);
+		return this.#scope({
+			owner: packageName,
+			base: posix.join(this.#prefix, namespace),
+			encodedBase: encoded ? posix.join(this.#prefix, encoded) : void 0,
+			claim: `the route namespace "${namespace}"`,
+			webhooks: this.#webhooks?.scopeFor(packageName),
+			onDispose: () => this.#webhooks?.disposeScope(packageName)
+		});
+	}
+	/** A scope at a host-named path; on the service, not `IHttpScope`, so a package can never name one. Namespacing is package
+	* policy: the host owns its URL space and third parties hold its URLs, so the path is verbatim and outside the package prefix. */
+	hostScope(name, mountPath) {
+		const base = assertHostMountPath(mountPath);
+		if (base === this.#prefix || base.startsWith(`${this.#prefix}/`)) throw new InvalidNamespaceError(`Host scope "${name}" cannot mount at "${base}": that is the package route prefix, which packages own`);
+		return this.#scope({
+			owner: name,
+			base,
+			encodedBase: void 0,
+			claim: `the mount path "${base}"`,
+			webhooks: void 0,
+			onDispose: () => void 0
+		});
+	}
+	/** Idempotent per base path, so a package reload cannot accumulate namespaces. Two owners wanting one path is an error —
+	* with verbatim names that needs one package configured twice at different versions, a genuine ambiguity, not a clash. */
+	#scope(options) {
+		const { owner, base } = options;
+		const existing = this.#scopes.get(base);
+		if (existing) {
+			if (existing.owner !== owner) throw new Error(`"${owner}" wants ${options.claim}, which "${existing.owner}" already holds`);
+			return existing;
+		}
+		const scope = new HttpScope({
+			owner,
+			base,
+			encodedBase: options.encodedBase,
+			publicUrl: this.#publicUrl,
+			trustProxy: this.#trustProxy,
+			adapter: this.#adapter,
+			authService: this.#authService,
+			webhooks: options.webhooks,
+			onDispose: () => {
+				this.#scopes.delete(base);
+				options.onDispose();
+			}
+		});
+		this.#scopes.set(base, scope);
+		return scope;
+	}
+	/** Like {@link scopeFor}, but never throws: a key resolving to no usable npm name gets a scope that refuses
+	* registrations, so one unroutable package cannot stop the host booting — it fails only if it serves a route. */
+	scopeForOrNull(packageKey) {
+		try {
+			return this.scopeFor(packageKey);
+		} catch (error) {
+			if (!(error instanceof InvalidNamespaceError)) throw error;
+			logger$2.warn("Package \"@package\" cannot host HTTP routes: @reason", packageKey, error.message);
+			return new UnroutableScope(packageKey, error.message);
+		}
+	}
+	/** Releases a package's routes, e.g. when it is replaced or removed. */
+	disposeScope(packageKey) {
+		try {
+			const namespace = namespacePath(resolvePackageName(packageKey));
+			this.#scopes.get(posix.join(this.#prefix, namespace))?.dispose();
+		} catch (error) {
+			if (!(error instanceof InvalidNamespaceError)) throw error;
+		}
+	}
+	disposeAll() {
+		for (const scope of [...this.#scopes.values()]) scope.dispose();
+	}
+};
+var HttpScope = class {
+	owner;
+	#base;
+	#publicUrl;
+	#trustProxy;
+	#encodedBase;
+	#adapter;
+	#authService;
+	#onDispose;
+	#registrations = /* @__PURE__ */ new Map();
+	#webhooks;
+	constructor(options) {
+		this.owner = options.owner;
+		this.#base = options.base;
+		this.#publicUrl = options.publicUrl;
+		this.#trustProxy = options.trustProxy;
+		this.#encodedBase = options.encodedBase;
+		this.#adapter = options.adapter;
+		this.#authService = options.authService;
+		this.#onDispose = options.onDispose;
+		this.#webhooks = options.webhooks ?? unavailableWebhooks(options.owner);
+	}
+	get baseUrl() {
+		return `${this.#publicUrl}${this.#base}`;
+	}
+	get webhooks() {
+		return this.#webhooks;
+	}
+	get(path, a, b) {
+		return this.#shorthand("GET", path, a, b);
+	}
+	post(path, a, b) {
+		return this.#shorthand("POST", path, a, b);
+	}
+	put(path, a, b) {
+		return this.#shorthand("PUT", path, a, b);
+	}
+	patch(path, a, b) {
+		return this.#shorthand("PATCH", path, a, b);
+	}
+	delete(path, a, b) {
+		return this.#shorthand("DELETE", path, a, b);
+	}
+	head(path, a, b) {
+		return this.#shorthand("HEAD", path, a, b);
+	}
+	#shorthand(method, path, a, b) {
+		const options = typeof a === "function" ? {} : a;
+		const handler = typeof a === "function" ? a : b;
+		if (!handler) throw new Error(`Route ${method} ${path} was registered with no handler`);
+		return this.route({
+			...options,
+			method,
+			path,
+			handler
+		});
+	}
+	route(spec) {
+		const body = spec.body ?? "parsed";
+		return this.#register(spec, (req, res, ctx) => this.#serve(spec, body, req, res, ctx));
+	}
+	nodeRoute(spec) {
+		return this.#register(spec, (req, res, ctx) => spec.handler(req, res, ctx));
+	}
+	dispose() {
+		for (const registration of this.#registrations.values()) for (const handle of registration.handles) handle.dispose();
+		this.#registrations.clear();
+		this.#onDispose();
+	}
+	/** Mounts one route under this scope's namespace, in both the verbatim and the
+	* percent-encoded spelling of a scoped name. */
+	#register(spec, run) {
+		const relative = assertRelativeRoutePath(spec.path);
+		const methods = Array.isArray(spec.method) ? spec.method : [spec.method];
+		const routePath = relative ? posix.join(this.#base, relative) : this.#base;
+		const key = `${methods.join(",")} ${routePath}`;
+		if (this.#registrations.has(key)) throw new Error(`Route ${key} is already registered by "${this.owner}"`);
+		const handles = [];
+		const paths = [routePath];
+		if (this.#encodedBase) paths.push(relative ? posix.join(this.#encodedBase, relative) : this.#encodedBase);
+		for (const path of paths) for (const method of methods) handles.push(this.#adapter.mountNodeRoute(method, path, (req, res) => {
+			this.#guard(spec, req, res, run);
+		}, {
+			rawBody: true,
+			prefix: spec.prefix
+		}));
+		this.#registrations.set(key, {
+			path: routePath,
+			handles
+		});
+		logger$2.debug("Registered @route for @package", key, this.owner);
+		return {
+			url: `${this.#publicUrl}${routePath}`,
+			dispose: () => {
+				const registration = this.#registrations.get(key);
+				if (!registration) return;
+				for (const handle of registration.handles) handle.dispose();
+				this.#registrations.delete(key);
+			}
+		};
+	}
+	/** Authenticate, then run. */
+	async #guard(spec, req, res, run) {
+		try {
+			const actor = await this.#authenticate(spec.auth ?? "renown", req, res);
+			if (actor === REJECTED) return;
+			await run(req, res, {
+				params: routeParams(req),
+				user: actor?.user,
+				authEnabled: actor?.authEnabled ?? false,
+				transport: resolveTransport(req, this.#trustProxy)
+			});
+		} catch (error) {
+			logger$2.error("Route handler failed for @package", this.owner, error);
+			writeError(res, 500, "Internal server error");
+		}
+	}
+	/** Resolves the caller, answering the request itself when the route refuses it;
+	* returns REJECTED in that case so the caller stops. */
+	async #authenticate(auth, req, res) {
+		if (auth === "public") return void 0;
+		if (typeof auth === "function") {
+			const result = await auth(req);
+			if (!result.authorized) {
+				if ("response" in result) await writeResponse(res, result.response, req.method ?? "GET");
+				else writeError(res, result.status, result.message);
+				return REJECTED;
+			}
+			return;
+		}
+		if (!this.#authService) return ANONYMOUS;
+		const result = await this.#authService.verifyBearer(req.headers.authorization);
+		if (result instanceof Response) {
+			await writeResponse(res, result, req.method ?? "GET");
+			return REJECTED;
+		}
+		if (result.auth_enabled && !result.user && auth === "renown") {
+			writeError(res, 401, "Authentication required");
+			return REJECTED;
+		}
+		return {
+			user: result.user,
+			authEnabled: result.auth_enabled
+		};
+	}
+	/** Builds the Fetch Request from the raw stream and runs the handler. */
+	async #serve(spec, body, req, res, ctx) {
+		const method = req.method ?? "GET";
+		const url = `${ctx.transport.baseUrl}${req.url ?? "/"}`;
+		const controller = new AbortController();
+		req.once("close", () => controller.abort());
+		let raw;
+		let init = {
+			method,
+			headers: fetchHeaders(req),
+			signal: controller.signal
+		};
+		if (method !== "GET" && method !== "HEAD" && body !== "none") if (body === "stream") init = {
+			...init,
+			body: Readable.toWeb(req),
+			duplex: "half"
+		};
+		else {
+			try {
+				raw = await readBody(req, spec.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES$1);
+			} catch (error) {
+				if (error instanceof BodyTooLargeError) {
+					res.setHeader("connection", "close");
+					res.once("finish", () => req.destroy());
+					writeError(res, 413, "Payload too large");
+					return;
+				}
+				throw error;
+			}
+			if (raw.length) init = {
+				...init,
+				body: new Uint8Array(raw.buffer, raw.byteOffset, raw.byteLength)
+			};
+		}
+		await writeResponse(res, await spec.handler(new Request(url, init), {
+			...ctx,
+			rawBody: body === "raw" ? raw ?? Buffer.alloc(0) : void 0,
+			signal: controller.signal
+		}), method);
+	}
+};
+const REJECTED = Symbol("rejected");
+function routeParams(req) {
+	const params = req.params;
+	if (!params || typeof params !== "object") return {};
+	const out = {};
+	for (const [key, value] of Object.entries(params)) if (typeof value === "string") out[key] = value;
+	else if (Array.isArray(value)) out[key] = value.join("/");
+	return out;
+}
+/** Stands in for a package that cannot be routed — its key resolves to no npm name. Registering a route throws with
+* the reason; nothing else does, so the package still loads and its non-HTTP behaviour is unaffected. */
+var UnroutableScope = class {
+	owner;
+	baseUrl = "";
+	#reason;
+	constructor(packageKey, reason) {
+		this.owner = packageKey;
+		this.#reason = reason;
+	}
+	#refuse() {
+		throw new Error(`Package "${this.owner}" cannot host HTTP routes: ${this.#reason}`);
+	}
+	get() {
+		this.#refuse();
+	}
+	post() {
+		this.#refuse();
+	}
+	put() {
+		this.#refuse();
+	}
+	patch() {
+		this.#refuse();
+	}
+	delete() {
+		this.#refuse();
+	}
+	head() {
+		this.#refuse();
+	}
+	route() {
+		this.#refuse();
+	}
+	nodeRoute() {
+		this.#refuse();
+	}
+	get webhooks() {
+		return unavailableWebhooks(this.owner);
+	}
+	dispose() {}
+};
+/** Stands in when the host has no webhook store configured. */
+function unavailableWebhooks(packageName) {
+	return {
+		hasPublicOrigin: false,
+		register: () => Promise.reject(/* @__PURE__ */ new Error(`Webhooks are not available on this host, so "${packageName}" cannot register one`))
+	};
+}
+/** Header each scheme reads when the caller does not name one: the name the format is
+* most often carried in, not a property of it, so `WebhookVerification.header` overrides any of them. */
+const DEFAULT_SCHEME_HEADER = {
+	none: "",
+	token: "x-webhook-token",
+	hmac: "x-signature",
+	"hmac-prefixed": "x-hub-signature-256",
+	"hmac-timestamped": "stripe-signature"
+};
+const OK = { ok: true };
+/** Constant-time over equal-length inputs; a length mismatch is already a rejection, so
+* the early return leaks nothing a caller could not measure. */
+function secureEquals(a, b) {
+	const left = Buffer.from(a, "utf8");
+	const right = Buffer.from(b, "utf8");
+	if (left.length !== right.length) return false;
+	return timingSafeEqual(left, right);
+}
+function hmacDigest(secret, payload, verification) {
+	return createHmac(verification.algorithm ?? "sha256", secret).update(payload).digest(verification.encoding ?? "hex");
+}
+/** Hex folds case, so an uppercased digest still verifies. Base64 must not: two distinct
+* digests can differ only in case, so folding there would accept a signature that is not the one computed. */
+function digestEquals(presented, expected, verification) {
+	const candidate = presented.trim();
+	if ((verification.encoding ?? "hex") === "base64") return secureEquals(candidate, expected);
+	return secureEquals(candidate.toLowerCase(), expected.toLowerCase());
+}
+/** The label `hmac-prefixed` expects before the digest. */
+function signaturePrefix(verification) {
+	return verification.prefix ?? `${verification.algorithm ?? "sha256"}=`;
+}
+/** `t=<unix>,v1=<hex>[,v1=<hex>…]`. Several `v1` values appear while a secret is being
+* rotated, and any one of them matching is a pass. */
+function parseTimestampedHeader(value) {
+	const signatures = [];
+	let timestamp;
+	for (const part of value.split(",")) {
+		const separator = part.indexOf("=");
+		if (separator < 0) continue;
+		const key = part.slice(0, separator).trim();
+		const item = part.slice(separator + 1).trim();
+		if (key === "t") timestamp = Number(item);
+		else if (key === "v1") signatures.push(item);
+	}
+	return {
+		timestamp,
+		signatures
+	};
+}
+function schemeHeader(verification) {
+	return (verification.header ?? DEFAULT_SCHEME_HEADER[verification.scheme]).toLowerCase();
+}
+/** Verifies a delivery against the configured scheme; `raw` must be the exact bytes
+* received. The reason is for the log only: callers answer a fixed 401, so a probing sender learns nothing from the body. */
+function verifyWebhook(options) {
+	const { verification, headers, raw } = options;
+	if (verification.scheme === "none") return OK;
+	if (!verification.secret) return {
+		ok: false,
+		reason: "signing secret missing"
+	};
+	const header = schemeHeader(verification);
+	const presented = headers[header];
+	if (!presented) return {
+		ok: false,
+		reason: `header "${header}" absent`
+	};
+	const secret = verification.secret;
+	const tolerance = verification.toleranceSeconds ?? 300;
+	switch (verification.scheme) {
+		case "token": return secureEquals(presented, secret) ? OK : {
+			ok: false,
+			reason: "token mismatch"
+		};
+		case "hmac": return digestEquals(presented, hmacDigest(secret, raw, verification), verification) ? OK : {
+			ok: false,
+			reason: "hmac mismatch"
+		};
+		case "hmac-prefixed": return digestEquals(presented, `${signaturePrefix(verification)}${hmacDigest(secret, raw, verification)}`, verification) ? OK : {
+			ok: false,
+			reason: "hmac mismatch"
+		};
+		case "hmac-timestamped": {
+			const { timestamp, signatures } = parseTimestampedHeader(presented);
+			if (timestamp === void 0 || !Number.isFinite(timestamp)) return {
+				ok: false,
+				reason: "no timestamp in the signature header"
+			};
+			if (signatures.length === 0) return {
+				ok: false,
+				reason: "no v1 signature in the header"
+			};
+			const nowMs = (options.now ?? /* @__PURE__ */ new Date()).getTime();
+			if (Math.abs(nowMs / 1e3 - timestamp) > tolerance) return {
+				ok: false,
+				reason: "timestamp outside the replay window"
+			};
+			const expected = hmacDigest(secret, Buffer.concat([Buffer.from(`${timestamp}.`, "utf8"), raw]), verification);
+			let matched = false;
+			for (const signature of signatures) if (digestEquals(signature, expected, verification)) matched = true;
+			return matched ? OK : {
+				ok: false,
+				reason: "hmac mismatch"
+			};
+		}
+	}
+}
+/** Headers that would put a credential in a log or run journal. The configured signature
+* header joins them: it is an HMAC of the body under a live secret. */
+const REDACTED_HEADERS = new Set([
+	"authorization",
+	"proxy-authorization",
+	"cookie",
+	"set-cookie",
+	"x-api-key",
+	"x-webhook-token",
+	"x-signature",
+	"x-hub-signature",
+	"x-hub-signature-256",
+	"stripe-signature"
+]);
+const REDACTED = "[redacted]";
+function redactHeaders(headers, extra) {
+	const redacted = {};
+	for (const [name, value] of Object.entries(headers)) {
+		const key = name.toLowerCase();
+		redacted[key] = REDACTED_HEADERS.has(key) || extra && key === extra.toLowerCase() ? REDACTED : value;
+	}
+	return redacted;
+}
+/** JSON and form bodies become objects; anything else stays decoded text, so a verified
+* XML or CSV payload is still reachable downstream. */
+function parseWebhookBody(raw, contentType) {
+	if (raw.length === 0) return void 0;
+	const type = (contentType ?? "").split(";")[0].trim().toLowerCase();
+	const text = raw.toString("utf8");
+	if (type === "application/json" || type.endsWith("+json")) try {
+		return JSON.parse(text);
+	} catch {
+		return text;
+	}
+	if (type === "application/x-www-form-urlencoded") return Object.fromEntries(new URLSearchParams(text));
+	return text;
+}
+//#endregion
+//#region src/http/webhook-service.ts
+const logger$1 = childLogger(["reactor-api", "webhooks"]);
+/** The flat, token-addressed path family. */
+const WEBHOOK_SEGMENT = "webhooks";
+const DEFAULT_MAX_BODY_BYTES = 1048576;
+const DEFAULT_DEDUPE_TTL_SECONDS = 300;
+/** One host route for `/webhooks/:token`, dispatching by token. The flat path leaks
+* neither package nor document; the namespace lives in the token record, which is also what stops one package's token reaching another's handler. */
+var WebhookService = class {
+	#store;
+	#path;
+	#publicUrl;
+	#scope;
+	#registrations = /* @__PURE__ */ new Map();
+	#routes = [];
+	constructor({ store, basePath = "/", publicUrl }) {
+		this.#store = store;
+		this.#path = posix.join("/", basePath, WEBHOOK_SEGMENT);
+		this.#publicUrl = publicUrl?.replace(/\/+$/, "");
+	}
+	/** The scope the endpoint family serves from, handed over once the route service exists;
+	* separate from the constructor only because that service takes this one as an option. */
+	attach(scope) {
+		this.#scope = scope;
+	}
+	async init() {
+		await this.#store.init();
+		if (this.#routes.length) return;
+		if (!this.#scope) throw new Error("The webhook service has no HTTP scope; the host must call attach() before a package registers");
+		this.#routes = [this.#scope.nodeRoute({
+			method: [
+				"DELETE",
+				"GET",
+				"HEAD",
+				"PATCH",
+				"POST",
+				"PUT"
+			],
+			path: ":token",
+			auth: "public",
+			handler: (req, res, ctx) => void this.#deliver(req, res, ctx.params)
+		})];
+	}
+	dispose() {
+		for (const handle of this.#routes) handle.dispose();
+		this.#routes = [];
+		this.#registrations.clear();
+	}
+	/** The facade a package's HTTP scope exposes as `scope.webhooks`. */
+	scopeFor(namespace) {
+		return {
+			hasPublicOrigin: this.hasPublicOrigin,
+			register: async (spec) => {
+				await this.init();
+				const key = `${namespace}|${spec.name}`;
+				this.#registrations.set(key, {
+					namespace,
+					spec
+				});
+				return {
+					endpointFor: async (ownerKey) => {
+						const row = await this.#store.ensure(namespace, spec.name, ownerKey);
+						return {
+							token: row.token,
+							url: this.urlFor(row.token),
+							createdAt: row.createdAt
+						};
+					},
+					revoke: (ownerKey) => this.#store.revoke(namespace, spec.name, ownerKey),
+					list: async () => (await this.#store.list(namespace, spec.name)).map((row) => ({
+						key: row.ownerKey,
+						token: row.token,
+						url: this.urlFor(row.token),
+						createdAt: row.createdAt
+					}))
+				};
+			}
+		};
+	}
+	/** Releases every registration a package made. */
+	disposeScope(namespace) {
+		for (const [key, registration] of this.#registrations) if (registration.namespace === namespace) this.#registrations.delete(key);
+	}
+	/** The URL to hand a provider. Absolute whenever the host knows its own origin: a
+	* relative path is useless to the third party that has to call it. */
+	urlFor(token) {
+		const path = posix.join(this.#path, token);
+		return this.#publicUrl ? `${this.#publicUrl}${path}` : path;
+	}
+	/** Whether `urlFor` can produce something a provider could call. */
+	get hasPublicOrigin() {
+		return this.#publicUrl !== void 0;
+	}
+	async #deliver(req, res, params) {
+		const token = params.token;
+		if (!token) {
+			writeError(res, 404, "Unknown endpoint");
+			return;
+		}
+		try {
+			const row = await this.#store.find(token);
+			if (!row) {
+				writeError(res, 404, "Unknown endpoint");
+				return;
+			}
+			const registrationKey = `${row.namespace}|${row.endpoint}`;
+			const registration = this.#registrations.get(registrationKey);
+			if (!registration) {
+				writeError(res, 503, "Endpoint temporarily unavailable");
+				return;
+			}
+			const { spec } = registration;
+			const method = (req.method ?? "POST").toUpperCase();
+			const perEndpoint = spec.policyFor ? await spec.policyFor(row.ownerKey) : {};
+			if (!perEndpoint) {
+				writeError(res, 404, "Unknown endpoint");
+				return;
+			}
+			const policy = {
+				...spec.defaults,
+				...perEndpoint
+			};
+			if (policy.methods && !policy.methods.includes(method)) {
+				writeError(res, 405, "Method not allowed");
+				return;
+			}
+			let raw;
+			try {
+				raw = await readBody(req, policy.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES);
+			} catch (error) {
+				if (error instanceof BodyTooLargeError) {
+					res.setHeader("connection", "close");
+					res.once("finish", () => req.destroy());
+					writeError(res, 413, "Payload too large");
+					return;
+				}
+				throw error;
+			}
+			const verification = policy.verify;
+			if (verification) {
+				const result = verifyWebhook({
+					verification,
+					headers: headerRecord(req),
+					raw
+				});
+				if (!result.ok) {
+					logger$1.warn("Rejected webhook delivery for @package/@endpoint: @reason", row.namespace, row.endpoint, result.reason);
+					writeError(res, 401, "Signature verification failed");
+					return;
+				}
+			}
+			const url = new URL(req.url ?? "/", "http://localhost");
+			const queryParams = Object.fromEntries(url.searchParams);
+			const signatureHeader = verification ? schemeHeader(verification) : void 0;
+			const headers = headerRecord(req);
+			const body = parseWebhookBody(raw, headers["content-type"]);
+			const challenge = challengeValue(policy.challengeField, queryParams, headers, body);
+			if (challenge !== void 0) {
+				res.statusCode = 200;
+				res.setHeader("content-type", "text/plain");
+				res.end(challenge);
+				return;
+			}
+			if (policy.dedupe) {
+				const key = dedupeKey(policy.dedupe.field, queryParams, headers, body);
+				if (key !== void 0 && await this.#store.seen(token, key, policy.dedupe.ttlSeconds ?? DEFAULT_DEDUPE_TTL_SECONDS)) {
+					res.statusCode = 200;
+					res.end();
+					return;
+				}
+			}
+			const reply = await spec.onRequest({
+				key: row.ownerKey,
+				method,
+				path: url.pathname,
+				queryParams,
+				headers: redactHeaders(headers, signatureHeader),
+				raw,
+				body
+			});
+			res.statusCode = reply.status;
+			if (reply.body !== void 0 && method !== "HEAD") {
+				res.setHeader("content-type", reply.contentType ?? "text/plain");
+				res.end(reply.body);
+			} else res.end();
+		} catch (error) {
+			logger$1.error("Webhook delivery failed for @method", req.method, error);
+			writeError(res, 500, "Internal server error");
+		}
+	}
+};
+function headerRecord(req) {
+	const headers = {};
+	for (const [name, value] of Object.entries(req.headers)) {
+		if (value === void 0) continue;
+		headers[name.toLowerCase()] = Array.isArray(value) ? value.join(", ") : value;
+	}
+	return headers;
+}
+function scalar(value) {
+	if (typeof value === "string" && value !== "") return value;
+	if (typeof value === "number") return String(value);
+}
+/** Walks a dot-separated path into the parsed body. */
+function bodyPath(path, body) {
+	let current = body;
+	for (const segment of path.split(".")) {
+		if (!current || typeof current !== "object") return void 0;
+		current = current[segment];
+	}
+	return scalar(current);
+}
+/** Resolves where a provider put a value. A bare string means query first, then a
+* top-level body field; `{ header }` and `{ body }` reach what that cannot — GitHub's delivery id is a header, Stripe's event id is nested. */
+function fieldValue(field, queryParams, headers, body) {
+	if (typeof field === "object") return "header" in field ? scalar(headers[field.header.toLowerCase()]) : bodyPath(field.body, body);
+	const fromQuery = scalar(queryParams[field]);
+	if (fromQuery !== void 0) return fromQuery;
+	return body && typeof body === "object" ? scalar(body[field]) : void 0;
+}
+function challengeValue(field, queryParams, headers, body) {
+	return field === void 0 ? void 0 : fieldValue(field, queryParams, headers, body);
+}
+function dedupeKey(field, queryParams, headers, body) {
+	return fieldValue(field, queryParams, headers, body);
+}
+//#endregion
+//#region src/http/webhook-store.ts
+const TOKEN_BYTES = 16;
+const TOKEN_PATTERN = /^[0-9a-f]{32}$/;
+/** Opaque and unguessable: the URL is a bearer capability held by a third party. */
+function newWebhookToken() {
+	return randomBytes(TOKEN_BYTES).toString("hex");
+}
+const NAMESPACE = "reactor_webhooks";
+/** Relational implementation, over the reactor's own database. */
+var RelationalWebhookStore = class {
+	#db;
+	constructor(relationalDb) {
+		this.relationalDb = relationalDb;
+	}
+	async init() {
+		if (this.#db) return;
+		const db = await this.relationalDb.createNamespace(NAMESPACE);
+		await db.schema.createTable("webhook_endpoints").ifNotExists().addColumn("token", "text", (col) => col.primaryKey()).addColumn("namespace", "text", (col) => col.notNull()).addColumn("endpoint", "text", (col) => col.notNull()).addColumn("owner_key", "text", (col) => col.notNull()).addColumn("created_at", "text", (col) => col.notNull()).execute();
+		await db.schema.createIndex("webhook_endpoints_owner").ifNotExists().on("webhook_endpoints").columns([
+			"namespace",
+			"endpoint",
+			"owner_key"
+		]).unique().execute();
+		await db.schema.createTable("webhook_deliveries").ifNotExists().addColumn("token", "text", (col) => col.notNull()).addColumn("dedupe_key", "text", (col) => col.notNull()).addColumn("seen_at", "text", (col) => col.notNull()).addColumn("claim_id", "text", (col) => col.notNull()).execute();
+		await db.schema.createIndex("webhook_deliveries_key").ifNotExists().on("webhook_deliveries").columns(["token", "dedupe_key"]).unique().execute();
+		await db.schema.createIndex("webhook_deliveries_seen_at").ifNotExists().on("webhook_deliveries").columns(["seen_at"]).execute();
+		this.#db = db;
+	}
+	get #handle() {
+		if (!this.#db) throw new Error("Webhook store used before init()");
+		return this.#db;
+	}
+	async ensure(namespace, endpoint, ownerKey) {
+		const existing = await this.#handle.selectFrom("webhook_endpoints").selectAll().where("namespace", "=", namespace).where("endpoint", "=", endpoint).where("owner_key", "=", ownerKey).executeTakeFirst();
+		if (existing) return toRow(existing);
+		const row = {
+			token: newWebhookToken(),
+			namespace,
+			endpoint,
+			owner_key: ownerKey,
+			created_at: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.#handle.insertInto("webhook_endpoints").values(row).onConflict((oc) => oc.columns([
+			"namespace",
+			"endpoint",
+			"owner_key"
+		]).doNothing()).execute();
+		const settled = await this.#handle.selectFrom("webhook_endpoints").selectAll().where("namespace", "=", namespace).where("endpoint", "=", endpoint).where("owner_key", "=", ownerKey).executeTakeFirst();
+		return settled ? toRow(settled) : toRow(row);
+	}
+	async find(token) {
+		if (!TOKEN_PATTERN.test(token)) return void 0;
+		const found = await this.#handle.selectFrom("webhook_endpoints").selectAll().where("token", "=", token).executeTakeFirst();
+		return found ? toRow(found) : void 0;
+	}
+	async list(namespace, endpoint) {
+		let query = this.#handle.selectFrom("webhook_endpoints").selectAll().where("namespace", "=", namespace);
+		if (endpoint) query = query.where("endpoint", "=", endpoint);
+		return (await query.execute()).map(toRow);
+	}
+	async revoke(namespace, endpoint, ownerKey) {
+		await this.#handle.deleteFrom("webhook_endpoints").where("namespace", "=", namespace).where("endpoint", "=", endpoint).where("owner_key", "=", ownerKey).execute();
+	}
+	async seen(token, key, ttlSeconds) {
+		const now = Date.now();
+		const cutoff = (/* @__PURE__ */ new Date(now - ttlSeconds * 1e3)).toISOString();
+		await this.#handle.deleteFrom("webhook_deliveries").where("seen_at", "<", cutoff).execute();
+		const claimId = randomBytes(16).toString("hex");
+		await this.#handle.insertInto("webhook_deliveries").values({
+			token,
+			dedupe_key: key,
+			seen_at: new Date(now).toISOString(),
+			claim_id: claimId
+		}).onConflict((oc) => oc.columns(["token", "dedupe_key"]).doNothing()).execute();
+		return (await this.#handle.selectFrom("webhook_deliveries").select("claim_id").where("token", "=", token).where("dedupe_key", "=", key).executeTakeFirst())?.claim_id !== claimId;
+	}
+};
+function toRow(row) {
+	return {
+		token: row.token,
+		namespace: row.namespace,
+		endpoint: row.endpoint,
+		ownerKey: row.owner_key,
+		createdAt: row.created_at
+	};
+}
+/** In-memory store, for hosts with no relational database and for tests. */
+var MemoryWebhookStore = class {
+	#byToken = /* @__PURE__ */ new Map();
+	#deliveries = /* @__PURE__ */ new Map();
+	init() {
+		return Promise.resolve();
+	}
+	ensure(namespace, endpoint, ownerKey) {
+		for (const row of this.#byToken.values()) if (row.namespace === namespace && row.endpoint === endpoint && row.ownerKey === ownerKey) return Promise.resolve(row);
+		const row = {
+			token: newWebhookToken(),
+			namespace,
+			endpoint,
+			ownerKey,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		this.#byToken.set(row.token, row);
+		return Promise.resolve(row);
+	}
+	find(token) {
+		return Promise.resolve(this.#byToken.get(token));
+	}
+	list(namespace, endpoint) {
+		return Promise.resolve([...this.#byToken.values()].filter((row) => row.namespace === namespace && (endpoint === void 0 || row.endpoint === endpoint)));
+	}
+	revoke(namespace, endpoint, ownerKey) {
+		for (const [token, row] of this.#byToken) if (row.namespace === namespace && row.endpoint === endpoint && row.ownerKey === ownerKey) this.#byToken.delete(token);
+		return Promise.resolve();
+	}
+	seen(token, key, ttlSeconds) {
+		const now = Date.now();
+		for (const [k, at] of this.#deliveries) if (at < now - ttlSeconds * 1e3) this.#deliveries.delete(k);
+		const composite = `${token}|${key}`;
+		if (this.#deliveries.has(composite)) return Promise.resolve(true);
+		this.#deliveries.set(composite, now);
+		return Promise.resolve(false);
+	}
+};
+//#endregion
 //#region src/utils/create-schema.ts
 const logger = childLogger(["reactor-api", "create-schema"]);
 /**
@@ -3252,7 +4341,9 @@ var GraphQLManager = class {
 	*/
 	reactorDriveClient;
 	authorizationService;
-	constructor(path, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, logger, httpAdapter, gatewayAdapter, authService, documentPermissionService, featureFlags = DefaultFeatureFlags, port = 4001, authorizationService, reactorDriveClient, syncServingGate) {
+	/** Route service in use: the injected one, or one built on first need. */
+	#fallbackRoutes;
+	constructor(path, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, logger, httpAdapter, gatewayAdapter, authService, documentPermissionService, featureFlags = DefaultFeatureFlags, port = 4001, authorizationService, reactorDriveClient, syncServingGate, httpRoutes) {
 		this.path = path;
 		this.httpServer = httpServer;
 		this.wsServer = wsServer;
@@ -3268,6 +4359,7 @@ var GraphQLManager = class {
 		this.featureFlags = featureFlags;
 		this.port = port;
 		this.syncServingGate = syncServingGate;
+		this.httpRoutes = httpRoutes;
 		if (!authorizationService) throw new Error("GraphQLManager requires an authorizationService");
 		this.authorizationService = authorizationService;
 		this.reactorDriveClient = reactorDriveClient;
@@ -3349,6 +4441,7 @@ var GraphQLManager = class {
 			if (!hasOperationSchemas(documentModel)) continue;
 			try {
 				const subgraphInstance = new DocumentModelSubgraph(documentModel, {
+					http: this.scopeForPackage(CORE_PACKAGE_NAME),
 					relationalDb: this.relationalDb,
 					analyticsStore: this.analyticsStore,
 					reactorClient: this.reactorClient,
@@ -3421,7 +4514,7 @@ var GraphQLManager = class {
 			this.subgraphHandlerCache.delete(subgraphPath);
 			const routeHandle = this.subgraphRouteHandles.get(subgraphPath);
 			if (routeHandle !== void 0) {
-				this.httpAdapter.unmount(routeHandle);
+				routeHandle.dispose();
 				this.subgraphRouteHandles.delete(subgraphPath);
 			}
 			const wsDisposer = this.subgraphWsDisposers.get(subgraphPath);
@@ -3463,13 +4556,28 @@ var GraphQLManager = class {
 		return this.authorizationService;
 	}
 	/**
+	* The HTTP scope a package's subgraphs get. Falls back to a scope over a
+	* throwaway service when route hosting is not configured, so a subgraph can
+	* always rely on `args.http` existing.
+	*/
+	scopeForPackage(packageName) {
+		this.#fallbackRoutes ??= this.httpRoutes ?? new HttpRouteService({
+			httpAdapter: this.httpAdapter,
+			basePath: this.path,
+			authService: this.authService
+		});
+		return this.#fallbackRoutes.scopeForOrNull(packageName);
+	}
+	/**
 	* Register a subgraph class. `packageName` labels the resulting instance
 	* with its contributing package so the instance can be torn down when the
 	* package is removed or drops the subgraph (see unregisterPackage and
-	* prunePackageSubgraphs).
+	* prunePackageSubgraphs), and decides the namespace its REST routes and
+	* webhooks live under.
 	*/
 	async registerSubgraph(subgraph, supergraph = "", core = false, packageName) {
 		const subgraphInstance = new subgraph({
+			http: this.scopeForPackage(packageName ?? "@powerhousedao/reactor-api"),
 			relationalDb: this.relationalDb,
 			analyticsStore: this.analyticsStore,
 			reactorClient: this.reactorClient,
@@ -3490,12 +4598,25 @@ var GraphQLManager = class {
 	* package has no registered subgraphs.
 	*/
 	async unregisterPackage(packageName) {
+		this.#disposeHttpScope(packageName);
 		const byName = this.packageSubgraphs.get(packageName);
 		if (!byName || byName.size === 0) return;
 		for (const instance of Array.from(byName.values())) await this.#removeSubgraphInstance(instance);
 		await this.updateRouter();
 	}
 	/**
+	* Releases the package's HTTP scope: every route it mounted, and its webhook
+	* registrations. Idempotent, and silent for a package that never had one.
+	*/
+	#disposeHttpScope(packageName) {
+		const routes = this.#fallbackRoutes ?? this.httpRoutes;
+		try {
+			routes?.disposeScope(packageName);
+		} catch (error) {
+			this.logger.warn(`Failed to release HTTP routes for "${packageName}": @error`, error);
+		}
+	}
+	/**
 	* Remove this package's registered subgraphs whose names are not in
 	* `keepNames` — the package is still loaded but dropped some of its
 	* subgraphs. Refreshes the router if anything was removed.
@@ -3730,7 +4851,7 @@ var GraphQLManager = class {
 		const modules = Array.from(allSubgraphs.values()).filter((subgraph) => subgraph.hasSubscriptions).map((subgraph) => this.#buildSubgraphSchemaModule(subgraph));
 		if (modules.length === 0) {
 			if (this.sseRouteHandle !== void 0) {
-				this.httpAdapter.unmount(this.sseRouteHandle);
+				this.sseRouteHandle.dispose();
 				this.sseRouteHandle = void 0;
 			}
 			return;
@@ -3758,7 +4879,7 @@ var GraphQLManager = class {
 			contextFactory: this.#makeContextFactory()
 		});
 		const handler = this.#composeFetchMiddleware(rawHandler);
-		if (this.sseRouteHandle !== void 0) this.httpAdapter.unmount(this.sseRouteHandle);
+		if (this.sseRouteHandle !== void 0) this.sseRouteHandle.dispose();
 		this.sseRouteHandle = this.httpAdapter.mount(ssePath, handler, { exact: true });
 	}
 	/**
@@ -4902,10 +6023,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.2";
+	return "6.2.3-dev.1";
 }
 function getGitHash() {
-	return "f1edb55f5581a52badb784d25c78666b266f9caf";
+	return "4f706b751c94b165e31129acf22704dbb96b56c2";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -6557,8 +7678,8 @@ function buildSyncServingGate(reactorModule, authorizationConfig, logger) {
 /**
 * Sets up the subgraph manager and registers subgraphs
 */
-async function setupGraphQLManager(httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate) {
-	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter("apollo", logger), authService, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient, syncServingGate);
+async function setupGraphQLManager(httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate, httpRoutes) {
+	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter("apollo", logger), authService, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient, syncServingGate, httpRoutes);
 	await graphqlManager.init(subgraphs.core, authFetchMiddleware, requireAuthFetchMiddleware);
 	for (const [packageName, collection] of subgraphs.extended.entries()) for (const subgraph of collection) await graphqlManager.registerSubgraph(subgraph, "graphql", false, packageName);
 	await graphqlManager.updateRouter();
@@ -6567,7 +7688,7 @@ async function setupGraphQLManager(httpAdapter, authFetchMiddleware, requireAuth
 /**
 * Sets up event listeners for package manager changes
 */
-function setupEventListeners(pkgManager, graphqlManager, reactorProcessorManager, module, documentModelRegistry) {
+function setupEventListeners(pkgManager, graphqlManager, reactorProcessorManager, moduleFor, documentModelRegistry) {
 	pkgManager.onDocumentModelsChange((packagedModels) => {
 		if (documentModelRegistry) {
 			const newModules = getUniqueDocumentModels(Object.values(packagedModels).flat());
@@ -6611,7 +7732,7 @@ function setupEventListeners(pkgManager, graphqlManager, reactorProcessorManager
 			knownProcessorPackages = new Set(processors.keys());
 			for (const [packageName, fns] of processors) {
 				await reactorProcessorManager.unregisterFactory(packageName);
-				const validBuilders = fns.map((fn) => fn(module)).filter((factory) => typeof factory === "function");
+				const validBuilders = fns.map((fn) => fn(moduleFor(packageName))).filter((factory) => typeof factory === "function");
 				if (!validBuilders.length) continue;
 				await reactorProcessorManager.registerFactory(packageName, async (driveHeader) => (await Promise.all(validBuilders.map(async (driveFactory) => {
 					try {
@@ -6790,9 +7911,25 @@ async function _setupCommonInfrastructure(options) {
 		configFile: options.configFile,
 		packages: options.packages ?? []
 	});
+	const publicUrl = resolvePublicOrigin(port);
+	const webhooks = new WebhookService({
+		store: new RelationalWebhookStore(relationalDb),
+		basePath: config.basePath,
+		publicUrl
+	});
+	const httpRoutes = new HttpRouteService({
+		httpAdapter,
+		basePath: config.basePath,
+		authService,
+		webhooks,
+		publicUrl,
+		trustProxy: true
+	});
+	webhooks.attach(httpRoutes.hostScope(CORE_PACKAGE_NAME, path.posix.join("/", config.basePath ?? "/", WEBHOOK_SEGMENT)));
 	return {
 		port,
 		httpAdapter,
+		httpRoutes,
 		authFetchMiddleware,
 		requireAuthFetchMiddleware,
 		authService,
@@ -6810,8 +7947,8 @@ async function _setupCommonInfrastructure(options) {
 /**
 * Private helper function containing common setup logic for API initialization
 */
-async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient, syncServingGate) {
-	const hostModule = {
+async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient, syncServingGate, httpRoutes) {
+	const hostModuleBase = {
 		...createReactorHostModuleBase({
 			client: reactorClient,
 			readModels,
@@ -6822,6 +7959,10 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 		}),
 		attachments: createAttachmentClient(attachments.service)
 	};
+	const moduleFor = (packageName) => ({
+		...hostModuleBase,
+		http: httpRoutes?.scopeForOrNull(packageName)
+	});
 	const mcpServerEnabled = options.mcp ?? true;
 	const logger = options.logger ?? defaultLogger;
 	const configuredProcessorEntries = Object.entries(options.processors ?? {});
@@ -6829,7 +7970,7 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	for (const [packageName, fns] of processorEntries) {
 		const validFactories = (await Promise.allSettled(fns.map(async (fn) => {
 			try {
-				return fn(hostModule);
+				return fn(moduleFor(packageName));
 			} catch (e) {
 				logger.error(`Error initializing processor factory for package ${packageName}:`, e);
 				return null;
@@ -6858,8 +7999,8 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	const graphqlManager = await setupGraphQLManager(httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, {
 		extended: subgraphs,
 		core: coreSubgraphs
-	}, logger.child(["graphql-manager"]), authorizationService, authService, documentPermissionService, options.enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate);
-	setupEventListeners(packages, graphqlManager, reactorProcessorManager, hostModule, documentModelRegistry);
+	}, logger.child(["graphql-manager"]), authorizationService, authService, documentPermissionService, options.enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate, httpRoutes);
+	setupEventListeners(packages, graphqlManager, reactorProcessorManager, moduleFor, documentModelRegistry);
 	if (mcpServerEnabled) {
 		await setupMcpServer({
 			client: reactorClient,
@@ -6868,21 +8009,24 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 		}, httpAdapter);
 		logger.info(`MCP server available at http://localhost:${port}/mcp`);
 	}
+	const dispose = buildApiDispose({
+		graphqlManager,
+		httpRoutes,
+		httpServer,
+		wsServer,
+		dbClosers,
+		logger
+	});
 	return {
 		httpAdapter,
+		httpRoutes: httpRoutes ?? new HttpRouteService({ httpAdapter }),
 		graphqlManager,
 		packages,
 		attachments,
 		attachmentReferenceIndex,
 		attachmentAccess,
 		authService,
-		dispose: buildApiDispose({
-			graphqlManager,
-			httpServer,
-			wsServer,
-			dbClosers,
-			logger
-		})
+		dispose
 	};
 }
 /**
@@ -6893,11 +8037,16 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 * since this runs on the way to process exit.
 */
 function buildApiDispose(args) {
-	const { graphqlManager, httpServer, wsServer, dbClosers, logger } = args;
+	const { graphqlManager, httpRoutes, httpServer, wsServer, dbClosers, logger } = args;
 	let disposed = false;
 	return async () => {
 		if (disposed) return;
 		disposed = true;
+		try {
+			httpRoutes?.disposeAll();
+		} catch (error) {
+			logger.error("API dispose: releasing HTTP routes failed: @error", error);
+		}
 		try {
 			await graphqlManager.shutdown();
 		} catch (error) {
@@ -6923,7 +8072,7 @@ function buildApiDispose(args) {
 	};
 }
 async function initializeAndStartAPI(clientInitializer, options, processorApp) {
-	const { port, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, attachmentReferenceIndex, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
+	const { port, httpAdapter, httpRoutes, authFetchMiddleware, requireAuthFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, attachmentReferenceIndex, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
 	const { documentModels, upgradeManifests, processors, subgraphs } = await packages.init();
 	const { module: reactorClientModule, reactorDriveClient, attachmentReferenceProjection = {
 		status: "unavailable",
@@ -6940,7 +8089,7 @@ async function initializeAndStartAPI(clientInitializer, options, processorApp) {
 	const documentModelRegistry = reactorClientModule.reactorModule?.documentModelRegistry;
 	if (!documentModelRegistry) throw new Error("DocumentModelRegistry not available from InProcessReactorClientModule");
 	return {
-		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient, buildSyncServingGate(reactorClientModule.reactorModule, authorizationConfig, options.logger ?? defaultLogger)),
+		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient, buildSyncServingGate(reactorClientModule.reactorModule, authorizationConfig, options.logger ?? defaultLogger), httpRoutes),
 		client: reactorClient,
 		syncManager,
 		documentModelRegistry,
@@ -6949,6 +8098,26 @@ async function initializeAndStartAPI(clientInitializer, options, processorApp) {
 		packageManager: packages
 	};
 }
+/**
+* The origin to advertise in a webhook URL.
+*
+* A provider is a third party: it has to be given something it can resolve, so
+* a relative path is not an option. The platform variables come first, then a
+* bare deploy domain, and finally the local origin — which is right for `ph
+* dev` behind a tunnel and, at worst, obviously wrong rather than silently
+* unusable.
+*/
+function resolvePublicOrigin(port) {
+	const explicit = process.env.PUBLIC_URL ?? process.env.RENDER_EXTERNAL_URL;
+	if (explicit) return withScheme(explicit);
+	const domain = process.env.HEROKU_APP_DEFAULT_DOMAIN_NAME;
+	if (domain) return withScheme(domain);
+	return `http://localhost:${port}`;
+}
+function withScheme(origin) {
+	const trimmed = origin.replace(/\/+$/, "");
+	return /^https?:\/\//.test(trimmed) ? trimmed : `https://${trimmed}`;
+}
 //#endregion
 //#region src/services/package-storage.ts
 var InMemoryPackageStorage = class {
@@ -7053,7 +8222,7 @@ var PackageManagementService = class {
 	}
 };
 //#endregion
-export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthDecision, AuthDecisionSchema, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, EvaluateActionsDocument, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground, resolveRenownConfig };
+export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthDecision, AuthDecisionSchema, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CORE_PACKAGE_NAME, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, EvaluateActionsDocument, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, HttpRouteService, ImportPackageLoader, InMemoryPackageStorage, InvalidNamespaceError, JobChangesDocument, MemoryWebhookStore, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PACKAGE_ROUTE_SEGMENT, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RelationalWebhookStore, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, WEBHOOK_SEGMENT, WebhookService, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertHostMountPath, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, namespacePath, namespaceSegments, newWebhookToken, parseDriveUrl, parseWebhookBody, redactHeaders, renderGraphqlPlayground, resolvePackageName, resolveRenownConfig, verifyWebhook };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=f43e08dc-7398-57dd-8824-db5d97ccc6ca
+//# debugId=46ad8545-02e9-5fb8-b003-7b9b93f82f75