@powerhousedao/reactor-api 6.2.3-dev.2 → 6.2.3-dev.21

package/dist/index.mjs

@@ -1,19 +1,20 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="46ad8545-02e9-5fb8-b003-7b9b93f82f75")}catch(e){}}();
-import { _ as createAuthorizationService, a as isSubgraphClass, b as MalformedStoredOperationError, d as loadSubgraphs, f as BaseSubgraph, g as AuthorizedDocumentHandle, h as AuthorizationPolicy, i as buildGraphqlOperations, l as loadDocumentModels, m as createCanonicalDocumentIdResolver, n as buildGraphQlDriveDocument, o as debounce, p as CanonicalDocumentIdResolutionError, r as buildGraphqlOperation, s as extractUpgradeManifests, t as buildGraphQlDocument, u as loadProcessors, v as AuthEvaluationUnsupportedError, y as ForbiddenError } from "./utils-XWVecaNn.mjs";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cdb25466-37b1-55fd-be52-a82be4286288")}catch(e){}}();
+import { C as createAuthorizationService, D as MalformedStoredOperationError, E as ForbiddenError, S as AuthorizedDocumentHandle, T as AuthenticationRequiredError, _ as loadSubgraphs, a as piecesFromCdnList, b as createCanonicalDocumentIdResolver, c as buildGraphQlDriveDocument, d as isSubgraphClass, f as debounce, g as loadProcessors, h as loadDocumentModels, i as pieceListLocation, l as buildGraphqlOperation, o as piecesFromListModule, p as extractUpgradeManifests, r as PIECE_SOURCE_LIST, s as buildGraphQlDocument, u as buildGraphqlOperations, v as BaseSubgraph, w as AuthEvaluationUnsupportedError, x as AuthorizationPolicy, y as CanonicalDocumentIdResolutionError } from "./pieces-eqj2RKgd.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
 import { GraphQLError, Kind, parse, print } from "graphql";
 import { AuthEnforcementDisabledError, DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, ModelReadGate, PropagationMode as PropagationMode$1, SyncScopeGate, consolidateSyncOperations, createReactorHostModuleBase, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl, readDecisionModel, syncOperationErrorType } from "@powerhousedao/reactor";
 import { ConsoleLogger, childLogger, documentModelDocumentModelModule } from "document-model";
-import path, { join } from "node:path";
+import path, { isAbsolute, join } from "node:path";
 import { match } from "path-to-regexp";
 import posix from "node:path/posix";
 import { Readable } from "node:stream";
-import fs, { readFileSync, watchFile } from "node:fs";
+import fs, { existsSync, readFileSync, watchFile } from "node:fs";
 import { pipeline } from "node:stream/promises";
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { pathToFileURL } from "node:url";
 import { buildSubgraphSchema } from "@apollo/subgraph";
 import { typeDefs } from "@powerhousedao/document-engineering/graphql";
 import { camelCase, kebabCase, pascalCase } from "change-case";
@@ -311,28 +312,40 @@ function createAuthFetchMiddleware(authService) {
 async function createGatewayAdapter(type, logger) {
 	switch (type) {
 		case "apollo": {
-			const { ApolloGatewayAdapter } = await import("./adapter-gateway-apollo-DdamNLPT.mjs");
+			const { ApolloGatewayAdapter } = await import("./adapter-gateway-apollo-DowrX6E_.mjs");
 			return new ApolloGatewayAdapter(logger);
 		}
 		case "mercurius": {
-			const { MercuriusGatewayAdapter } = await import("./adapter-gateway-mercurius-CLmTtNJC.mjs");
+			const { MercuriusGatewayAdapter } = await import("./adapter-gateway-mercurius-CZVy88Za.mjs");
 			return new MercuriusGatewayAdapter(logger);
 		}
+		case "stitching": {
+			const { StitchingGatewayAdapter } = await import("./adapter-gateway-stitching-CaZjvRzx.mjs");
+			return new StitchingGatewayAdapter(logger);
+		}
 	}
 }
 async function createHttpAdapter(type) {
 	switch (type) {
 		case "express": {
-			const { createExpressHttpAdapter } = await import("./adapter-http-express-54gdI9bu.mjs");
+			const { createExpressHttpAdapter } = await import("./adapter-http-express-B39rPhqH.mjs");
 			return createExpressHttpAdapter();
 		}
 		case "fastify": {
-			const { createFastifyHttpAdapter } = await import("./adapter-http-fastify-DmccBVOe.mjs");
+			const { createFastifyHttpAdapter } = await import("./adapter-http-fastify-BwXO6rqE.mjs");
 			return createFastifyHttpAdapter();
 		}
 	}
 }
 //#endregion
+//#region src/graphql/gateway/types.ts
+/** No authenticated caller resolved, and REQUIRE_AUTHENTICATED_CALLER wants one. */
+const WS_CLOSE_REASON_AUTHENTICATION_REQUIRED = "authentication-required";
+/** A bearer was sent and could not be verified. */
+const WS_CLOSE_REASON_BEARER_REJECTED = "bearer-rejected";
+/** Every reason a refusal closes with, for a client matching on the set. */
+const WS_AUTH_CLOSE_REASONS = [WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE_REASON_BEARER_REJECTED];
+//#endregion
 //#region src/http/namespace.ts
 /**
 * A package's namespace is its npm name, used verbatim as one or two path
@@ -2218,6 +2231,16 @@ const PhDocumentFieldsFragmentDoc = gql`
     lastModifiedAtUtcIso
   }
 `;
+const DocumentRelationshipFieldsFragmentDoc = gql`
+  fragment DocumentRelationshipFields on DocumentRelationship {
+    sourceId
+    targetId
+    relationshipType
+    metadata
+    createdAt
+    updatedAt
+  }
+`;
 const GetDocumentModelsDocument = gql`
   query GetDocumentModels($namespace: String, $paging: PagingInput) {
     documentModels(namespace: $namespace, paging: $paging) {
@@ -2346,6 +2369,54 @@ const GetDocumentIncomingRelationshipsDocument = gql`
   }
   ${PhDocumentFieldsFragmentDoc}
 `;
+const GetDocumentOutgoingRelationshipEdgesDocument = gql`
+  query GetDocumentOutgoingRelationshipEdges(
+    $sourceIdentifier: String!
+    $relationshipType: String
+    $view: ViewFilterInput
+    $paging: PagingInput
+  ) {
+    documentOutgoingRelationshipEdges(
+      sourceIdentifier: $sourceIdentifier
+      relationshipType: $relationshipType
+      view: $view
+      paging: $paging
+    ) {
+      items {
+        ...DocumentRelationshipFields
+      }
+      totalCount
+      hasNextPage
+      hasPreviousPage
+      cursor
+    }
+  }
+  ${DocumentRelationshipFieldsFragmentDoc}
+`;
+const GetDocumentIncomingRelationshipEdgesDocument = gql`
+  query GetDocumentIncomingRelationshipEdges(
+    $targetIdentifier: String!
+    $relationshipType: String
+    $view: ViewFilterInput
+    $paging: PagingInput
+  ) {
+    documentIncomingRelationshipEdges(
+      targetIdentifier: $targetIdentifier
+      relationshipType: $relationshipType
+      view: $view
+      paging: $paging
+    ) {
+      items {
+        ...DocumentRelationshipFields
+      }
+      totalCount
+      hasNextPage
+      hasPreviousPage
+      cursor
+    }
+  }
+  ${DocumentRelationshipFieldsFragmentDoc}
+`;
 const FindDocumentsDocument = gql`
   query FindDocuments(
     $search: SearchFilterInput
@@ -2536,12 +2607,34 @@ const AddRelationshipDocument = gql`
     $sourceIdentifier: String!
     $targetIdentifier: String!
     $relationshipType: String!
+    $metadata: JSONObject
     $branch: String
   ) {
     addRelationship(
       sourceIdentifier: $sourceIdentifier
       targetIdentifier: $targetIdentifier
       relationshipType: $relationshipType
+      metadata: $metadata
+      branch: $branch
+    ) {
+      ...PHDocumentFields
+    }
+  }
+  ${PhDocumentFieldsFragmentDoc}
+`;
+const UpdateRelationshipDocument = gql`
+  mutation UpdateRelationship(
+    $sourceIdentifier: String!
+    $targetIdentifier: String!
+    $relationshipType: String!
+    $metadata: JSONObject
+    $branch: String
+  ) {
+    updateRelationship(
+      sourceIdentifier: $sourceIdentifier
+      targetIdentifier: $targetIdentifier
+      relationshipType: $relationshipType
+      metadata: $metadata
       branch: $branch
     ) {
       ...PHDocumentFields
@@ -2735,6 +2828,12 @@ function getSdk(requester) {
 		GetDocumentIncomingRelationships(variables, options) {
 			return requester(GetDocumentIncomingRelationshipsDocument, variables, options);
 		},
+		GetDocumentOutgoingRelationshipEdges(variables, options) {
+			return requester(GetDocumentOutgoingRelationshipEdgesDocument, variables, options);
+		},
+		GetDocumentIncomingRelationshipEdges(variables, options) {
+			return requester(GetDocumentIncomingRelationshipEdgesDocument, variables, options);
+		},
 		FindDocuments(variables, options) {
 			return requester(FindDocumentsDocument, variables, options);
 		},
@@ -2768,6 +2867,9 @@ function getSdk(requester) {
 		AddRelationship(variables, options) {
 			return requester(AddRelationshipDocument, variables, options);
 		},
+		UpdateRelationship(variables, options) {
+			return requester(UpdateRelationshipDocument, variables, options);
+		},
 		RemoveRelationship(variables, options) {
 			return requester(RemoveRelationshipDocument, variables, options);
 		},
@@ -2846,6 +2948,32 @@ function toPhDocumentResultPage(result) {
 	};
 }
 /**
+* Converts a relationship edge from the indexer to GraphQL format.
+*/
+function toGqlDocumentRelationship(relationship) {
+	return {
+		sourceId: relationship.sourceId,
+		targetId: relationship.targetId,
+		relationshipType: relationship.relationshipType,
+		metadata: relationship.metadata ?? null,
+		createdAt: relationship.createdAt,
+		updatedAt: relationship.updatedAt
+	};
+}
+/**
+* Converts a PagedResults of relationship edges to GraphQL
+* DocumentRelationshipResultPage format
+*/
+function toDocumentRelationshipResultPage(result) {
+	return {
+		cursor: result.nextCursor ?? null,
+		hasNextPage: !!result.nextCursor,
+		hasPreviousPage: !!result.options.cursor,
+		items: result.results.map(toGqlDocumentRelationship),
+		totalCount: result.totalCount ?? result.results.length
+	};
+}
+/**
 * Converts a PHDocument from ReactorClient to GraphQL PhDocument format
 */
 function toGqlPhDocument(doc) {
@@ -3291,6 +3419,54 @@ async function documentIncomingRelationships(reactorClient, args, subject) {
 		throw new GraphQLError(`Failed to convert incoming relationships to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
+async function documentOutgoingRelationshipEdges(reactorClient, args, subject) {
+	const view = toRelationshipViewFilter(args.view, subject);
+	const paging = toRelationshipPagingOptions(args.paging);
+	let result;
+	try {
+		result = await reactorClient.getOutgoingRelationshipEdges(args.sourceIdentifier, fromInputMaybe(args.relationshipType), view, paging);
+	} catch (error) {
+		throw new GraphQLError(`Failed to fetch outgoing relationship edges: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+	try {
+		return toDocumentRelationshipResultPage(result);
+	} catch (error) {
+		throw new GraphQLError(`Failed to convert outgoing relationship edges to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+}
+async function documentIncomingRelationshipEdges(reactorClient, args, subject) {
+	const view = toRelationshipViewFilter(args.view, subject);
+	const paging = toRelationshipPagingOptions(args.paging);
+	let result;
+	try {
+		result = await reactorClient.getIncomingRelationshipEdges(args.targetIdentifier, fromInputMaybe(args.relationshipType), view, paging);
+	} catch (error) {
+		throw new GraphQLError(`Failed to fetch incoming relationship edges: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+	try {
+		return toDocumentRelationshipResultPage(result);
+	} catch (error) {
+		throw new GraphQLError(`Failed to convert incoming relationship edges to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+}
+function toRelationshipViewFilter(input, subject) {
+	if (!input) return subject ? { subject } : void 0;
+	return {
+		subject,
+		branch: fromInputMaybe(input.branch),
+		scopes: toMutableArray(fromInputMaybe(input.scopes))
+	};
+}
+function toRelationshipPagingOptions(input) {
+	if (!input) return;
+	const cursor = fromInputMaybe(input.cursor);
+	const limit = fromInputMaybe(input.limit);
+	if (!cursor && !limit) return;
+	return {
+		cursor: cursor || "",
+		limit: limit || 10
+	};
+}
 async function findDocuments(reactorClient, args, subject) {
 	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
@@ -3622,9 +3798,10 @@ async function setPreferredEditor(reactorClient, args, signal) {
 }
 async function addRelationship(reactorClient, args) {
 	const branch = fromInputMaybe(args.branch);
+	const metadata = fromInputMaybe(args.metadata);
 	let result;
 	try {
-		result = await reactorClient.addRelationship(args.sourceIdentifier, args.targetIdentifier, args.relationshipType, branch);
+		result = await reactorClient.addRelationship(args.sourceIdentifier, args.targetIdentifier, args.relationshipType, metadata, branch);
 	} catch (error) {
 		throw new GraphQLError(`Failed to add relationship: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -3634,6 +3811,21 @@ async function addRelationship(reactorClient, args) {
 		throw new GraphQLError(`Failed to convert document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
+async function updateRelationship(reactorClient, args) {
+	const branch = fromInputMaybe(args.branch);
+	const metadata = fromInputMaybe(args.metadata) ?? null;
+	let result;
+	try {
+		result = await reactorClient.updateRelationship(args.sourceIdentifier, args.targetIdentifier, args.relationshipType, metadata, branch);
+	} catch (error) {
+		throw new GraphQLError(`Failed to update relationship: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+	try {
+		return toGqlPhDocument(result);
+	} catch (error) {
+		throw new GraphQLError(`Failed to convert document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+}
 async function removeRelationship(reactorClient, args) {
 	const branch = fromInputMaybe(args.branch);
 	let result;
@@ -3774,14 +3966,16 @@ async function collectHeldSyncOperations(syncOps, gate, subject, signal) {
 *   client ordinal the switchboard has successfully applied, so the client
 *   can trim its own outbox)
 */
-function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new Set(), heldOpIds = /* @__PURE__ */ new Set()) {
+function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new Set(), heldOpIds = /* @__PURE__ */ new Set(), gatedOpIds) {
+	const isHeld = (syncOp) => heldOpIds.has(syncOp.id) || gatedOpIds !== void 0 && !gatedOpIds.has(syncOp.id);
 	let remote;
 	try {
 		remote = syncManager.getById(args.channelId);
 	} catch (error) {
 		throw new GraphQLError(`Channel not found: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
-	const deadLetters = remote.channel.deadLetter.items.filter((syncOp) => !forbiddenIds.has(syncOp.documentId) && !heldOpIds.has(syncOp.id)).map((syncOp) => ({
+	remote.channel.notePoll();
+	const deadLetters = remote.channel.deadLetter.items.filter((syncOp) => !forbiddenIds.has(syncOp.documentId) && !isHeld(syncOp)).map((syncOp) => ({
 		documentId: syncOp.documentId,
 		error: syncOp.error?.message ?? "Unknown error",
 		errorType: syncOperationErrorType(syncOp.error),
@@ -3830,7 +4024,7 @@ function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new
 			hasMore = true;
 			break;
 		}
-		if (heldOpIds.has(syncOp.id)) continue;
+		if (isHeld(syncOp)) continue;
 		syncOp.deliveredCount ??= 0;
 		syncOp.emittedCount ??= 0;
 		while (syncOp.deliveredCount < syncOp.emittedCount && syncOp.operations[syncOp.deliveredCount].context.ordinal <= args.outboxLatest) syncOp.deliveredCount += 1;
@@ -3905,6 +4099,7 @@ function pushSyncEnvelopes(syncManager, args) {
 			throw new GraphQLError(`Channel not found: ${error instanceof Error ? error.message : "Unknown error"}`);
 		}
 		if (!envelope.operations || envelope.operations.length === 0) continue;
+		remote.channel.notePoll();
 		const syncOps = envelopesToSyncOperations(envelope, remote.meta.name);
 		if (!remoteSyncOps.has(remote)) remoteSyncOps.set(remote, []);
 		remoteSyncOps.get(remote).push(...syncOps);
@@ -4308,6 +4503,32 @@ const DefaultFeatureFlags = { enableDocumentModelSubgraphs: true };
 * regenerateDocumentModelSubgraphs).
 */
 const DOCUMENT_MODEL_SUBGRAPH_SOURCE = "document-models";
+function refuseConnection(connection, reason) {
+	const { socket } = connection;
+	socket?.close?.(4403, reason);
+	return false;
+}
+function createWsAuthHandlers(opts) {
+	const resolved = /* @__PURE__ */ new WeakMap();
+	return {
+		onConnect: async (connectionParams, connection) => {
+			let user = null;
+			if (opts.authService) try {
+				user = await opts.authService.authenticateWebSocketConnection(connectionParams);
+			} catch (error) {
+				opts.logger.warn("Refusing WebSocket connection: @error", error instanceof Error ? error.message : error);
+				return refuseConnection(connection, WS_CLOSE_REASON_BEARER_REJECTED);
+			}
+			if (user === null && opts.requireAuthenticatedCaller()) {
+				opts.logger.warn("Refusing anonymous WebSocket connection: an authenticated caller is required");
+				return refuseConnection(connection, WS_CLOSE_REASON_AUTHENTICATION_REQUIRED);
+			}
+			resolved.set(connection, user ?? void 0);
+			return true;
+		},
+		context: (connectionParams, connection) => Promise.resolve(opts.buildContext(connectionParams, resolved.get(connection)))
+	};
+}
 var GraphQLManager = class {
 	initialized = false;
 	coreSubgraphsMap = /* @__PURE__ */ new Map();
@@ -4380,13 +4601,17 @@ var GraphQLManager = class {
 		this.httpAdapter.setupMiddleware({ bodyLimit: "50mb" });
 		const driveRoutePath = path.posix.join(this.path, "d/:drive");
 		const driveMatcher = match(driveRoutePath);
-		this.httpAdapter.mount(driveRoutePath, async (request) => {
+		const driveInfoHandler = async (request) => {
 			const url = new URL(request.url);
 			const matched = driveMatcher(url.pathname);
 			const driveIdOrSlug = matched ? matched.params.drive : void 0;
 			if (!driveIdOrSlug) return Response.json({ error: "Drive ID or slug is required" }, { status: 400 });
 			try {
 				const driveDoc = await this.reactorClient.get(driveIdOrSlug);
+				if (!await this.authorizationService.canRead(driveDoc.header.id, getAuthContext(request)?.user?.address)) {
+					this.logger.debug(`Drive read refused: ${driveIdOrSlug}`);
+					return Response.json({ error: "Drive not found" }, { status: 404 });
+				}
 				const graphqlEndpoint = `${(request.headers.get("x-forwarded-proto")?.split(",")[0].trim() ?? url.protocol.replace(":", "")) + ":"}//${request.headers.get("x-forwarded-host")?.split(",")[0].trim() ?? request.headers.get("host") ?? ""}${(request.headers.get("x-forwarded-prefix")?.split(",")[0].trim().replace(/\/$/, "") ?? "") + (this.path === "/" ? "" : this.path)}/graphql/r`;
 				return Response.json({
 					id: driveDoc.header.id,
@@ -4400,7 +4625,8 @@ var GraphQLManager = class {
 				this.logger.debug(`Drive not found: ${driveIdOrSlug}`, error);
 				return Response.json({ error: "Drive not found" }, { status: 404 });
 			}
-		});
+		};
+		this.httpAdapter.mount(driveRoutePath, this.#authMiddleware ? this.#authMiddleware(driveInfoHandler) : driveInfoHandler);
 		this.logger.info(`Registered REST endpoint: GET ${driveRoutePath}`);
 		await this.#setupCoreSubgraphs("graphql", coreSubgraphs);
 		if (this.featureFlags.enableDocumentModelSubgraphs) await this.#setupDocumentModelSubgraphs("graphql", models);
@@ -4691,17 +4917,6 @@ var GraphQLManager = class {
 			...fields
 		};
 	}
-	async #createWebSocketContext(connectionParams) {
-		let user = null;
-		if (this.authService) user = await this.authService.authenticateWebSocketConnection(connectionParams);
-		const context = {
-			headers: connectionParams,
-			db: this.relationalDb,
-			...this.getAdditionalContextFields()
-		};
-		if (user) context.user = user;
-		return context;
-	}
 	#makeContextFactory() {
 		return (request) => {
 			const authCtx = getAuthContext(request);
@@ -4720,7 +4935,20 @@ var GraphQLManager = class {
 		};
 	}
 	#makeWsContextFactory() {
-		return (connectionParams) => this.#createWebSocketContext(connectionParams);
+		return createWsAuthHandlers({
+			authService: this.authService,
+			requireAuthenticatedCaller: () => this.#requireAuthMiddleware !== void 0,
+			logger: this.logger,
+			buildContext: (connectionParams, user) => {
+				const context = {
+					headers: connectionParams,
+					db: this.relationalDb,
+					...this.getAdditionalContextFields()
+				};
+				if (user) context.user = user;
+				return context;
+			}
+		});
 	}
 	setSupergraph(supergraph, subgraphs) {
 		const accepted = [];
@@ -4823,11 +5051,15 @@ var GraphQLManager = class {
 	#getSubgraphDefinitions() {
 		const subgraphs = this.#getAllSubgraphs();
 		const herokuOrLocal = process.env.HEROKU_APP_DEFAULT_DOMAIN_NAME ? `https://${process.env.HEROKU_APP_DEFAULT_DOMAIN_NAME}` : `http://localhost:${this.port}`;
-		return Array.from(subgraphs.entries()).map(([subgraphPath, subgraph]) => ({
-			name: subgraphPath.replace("/", ":"),
-			typeDefs: this.#buildSubgraphSchemaModule(subgraph).typeDefs,
-			url: `${herokuOrLocal}${subgraphPath}`
-		}));
+		return Array.from(subgraphs.entries()).map(([subgraphPath, subgraph]) => {
+			const module = this.#buildSubgraphSchemaModule(subgraph);
+			return {
+				name: subgraphPath.replace("/", ":"),
+				typeDefs: module.typeDefs,
+				resolvers: module.resolvers,
+				url: `${herokuOrLocal}${subgraphPath}`
+			};
+		});
 	}
 	async #createSupergraphGateway() {
 		const superGraphPath = path.posix.join(this.path, "graphql");
@@ -5190,6 +5422,21 @@ const PHDocumentResultPageDTO = z.object({
 	hasPreviousPage: z.boolean(),
 	cursor: z.string().nullable().optional()
 }).strip();
+const DocumentRelationshipDTO = z.object({
+	sourceId: z.string(),
+	targetId: z.string(),
+	relationshipType: z.string(),
+	metadata: JSONObjectDTO.nullable().optional(),
+	createdAt: DateTimeDTO,
+	updatedAt: DateTimeDTO
+}).strip();
+const DocumentRelationshipResultPageDTO = z.object({
+	items: z.array(DocumentRelationshipDTO),
+	totalCount: z.number().int(),
+	hasNextPage: z.boolean(),
+	hasPreviousPage: z.boolean(),
+	cursor: z.string().nullable().optional()
+}).strip();
 const DocumentWithChildrenDTO = z.object({
 	document: PHDocumentDTO,
 	childIds: z.array(z.string())
@@ -5293,6 +5540,12 @@ const operationValidators = {
 	GetDocumentIncomingRelationships: (data) => {
 		if (data.documentIncomingRelationships) PHDocumentResultPageDTO.parse(data.documentIncomingRelationships);
 	},
+	GetDocumentOutgoingRelationshipEdges: (data) => {
+		if (data.documentOutgoingRelationshipEdges) DocumentRelationshipResultPageDTO.parse(data.documentOutgoingRelationshipEdges);
+	},
+	GetDocumentIncomingRelationshipEdges: (data) => {
+		if (data.documentIncomingRelationshipEdges) DocumentRelationshipResultPageDTO.parse(data.documentIncomingRelationshipEdges);
+	},
 	FindDocuments: (data) => {
 		if (data.findDocuments) PHDocumentResultPageDTO.parse(data.findDocuments);
 	},
@@ -5326,6 +5579,9 @@ const operationValidators = {
 	AddRelationship: (data) => {
 		if (data.addRelationship) PHDocumentDTO.parse(data.addRelationship);
 	},
+	UpdateRelationship: (data) => {
+		if (data.updateRelationship) PHDocumentDTO.parse(data.updateRelationship);
+	},
 	RemoveRelationship: (data) => {
 		if (data.removeRelationship) PHDocumentDTO.parse(data.removeRelationship);
 	},
@@ -5367,7 +5623,7 @@ function createReactorGraphQLClient(url, fetchImpl = fetch, headers) {
 }
 //#endregion
 //#region src/graphql/reactor/schema.graphql
-var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  \"\"\"\n  How the origin classified the failure. A peer needs this to mirror the origin's\n  quarantine decision; without it a held auth operation would freeze the document\n  on the peer side while the origin kept syncing.\n  \"\"\"\n  errorType: String\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Null until then, which\n  is the state every job is in when it is handed back from a submission.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n  result: JSONObject!\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n\"\"\"\nOne operation an authorization preflight predicts a verdict for.\n\n`input` is what a conditional grant reads, so a candidate standing for a\nfilled-in form carries that form's input. Omitting it predicts the verdict an\nempty input earns, not the verdict the filled-in form will get.\n\"\"\"\ninput ActionCandidateInput {\n  scope: String!\n  type: String!\n  input: JSONObject\n}\n\nenum AuthDecision {\n  ALLOW\n  DENY\n}\n\n\"\"\"\nOne candidate's predicted verdict. `reason` carries the refusal a DENY is\nrecorded with, and is null on an ALLOW.\n\"\"\"\ntype ActionEvaluation {\n  decision: AuthDecision!\n  reason: String\n}\n\n\"\"\"\nThe predicted verdicts for a set of candidates, in the order they were given,\nwith the aggregates a caller branches on.\n\nThe aggregates are redundant -- a verdict is binary -- and all four are returned\nso a caller reads the one its question is phrased in rather than negating\nanother. Over no candidates every aggregate is false: nothing is allowed and\nnothing is denied.\n\"\"\"\ntype ActionEvaluations {\n  evaluations: [ActionEvaluation!]!\n  allAllowed: Boolean!\n  anyAllowed: Boolean!\n  allDenied: Boolean!\n  anyDenied: Boolean!\n}\n\n# Input types for sync operations\n\"\"\"\nAn action's context, as a caller submits it.\n\nDeclares every field `ActionContext` carries, because an input object rejects a\nfield it does not declare: an action stamped with the head it applies to - which\nis what a signing client sends - is refused outright if these are missing, and\nthat refusal is a whole-request one, not a per-field one.\n\n`prevOpHash` and `prevOpIndex` are the scope head the action was composed\nagainst. They are recorded rather than enforced; a signature is verified from\nthe params carried in its own tuple, which do not include them.\n\"\"\"\ninput ActionContextInput {\n  \"\"\"The index of the last operation in the scope the action applies to.\"\"\"\n  prevOpIndex: Int\n\n  \"\"\"The hash of the state the action applies to.\"\"\"\n  prevOpHash: String\n\n  \"\"\"Covers replay of an operation that would otherwise be a no-op.\"\"\"\n  nonce: String\n\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  \"\"\"\n  Predicts whether the calling subject would be admitted to execute each of a\n  set of candidate operations, without submitting any of them. A UI asks this to\n  disable a control rather than offer an action that fails on submit.\n\n  The answer is a prediction, not a promise:\n\n  - Real admission compiles an append condition over everything it read and the\n    store enforces it at write time. A preflight reads no future, so a policy\n    change landing between this answer and the submit changes the verdict. The\n    submit path stays the only authority.\n  - The verdict is evaluated at the stream heads, so it is correct for a\n    candidate about to be submitted. A backdated submission is out of contract;\n    the reactor decides that one by position.\n  - A candidate whose verdict depends on its input has to carry that input, since\n    a conditional grant reads it.\n\n  The subject is the authenticated caller and cannot be named in the request:\n  answering for an arbitrary subject would disclose what a policy grants\n  somebody else. It carries both the caller's address and the did:key of the app\n  instance whose token authenticated the request, so a policy naming either\n  matches the same principal the write path presents.\n\n  Requires the reactor's authEnforcement feature flag. Without it the reactor\n  holds no decision model, so this fails with extensions.code\n  AUTH_EVALUATION_UNSUPPORTED rather than guessing.\n  \"\"\"\n  evaluateActions(\n    documentIdentifier: String!\n    branch: String\n    candidates: [ActionCandidateInput!]!\n  ): ActionEvaluations!\n\n  \"\"\"\n  Polls for sync envelopes from a channel.\n\n  An operation stored before the API required an action id cannot be\n  represented by this schema, and rather than serving a partial response beside\n  a bare non-null violation, this fails with extensions.code\n  MALFORMED_STORED_OPERATION naming the operation. That code means the failure\n  is worth polling through: the document holding the operation needs repairing,\n  but the channel serves every other document, and a peer that stopped polling\n  would stop receiving those too.\n  \"\"\"\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  \"\"\"\n  Applies actions to a document and waits for the result.\n\n  Each action is coerced against `ActionInput`, so one missing a field the wire\n  declares is refused before any work starts. The id in particular: it is hashed\n  into the operation id and replay dedupes by it, so an action without one is\n  stored under an operation id shared by every id-less operation on the same\n  document, scope and branch.\n\n  Named for `IReactorClient.execute`, which this is the wire form of. `branch`\n  defaults to `main`.\n  \"\"\"\n  execute(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): PHDocument!\n\n  \"\"\"\n  Submits actions to a document and returns the job that will apply them.\n\n  Coerced exactly as `execute` is, so a malformed action is refused here rather\n  than surfacing later as a failed job. Returns the job rather than only its id,\n  so a caller has the status and the creation time it would otherwise have to\n  ask for; `result` is null until the job produces one.\n  \"\"\"\n  executeAsync(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): JobInfo!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n    @deprecated(\n      reason: \"Use execute. Actions here are untyped, so a malformed one is refused by a hand-written check rather than by the schema, and `view.scopes` is accepted but ignored.\"\n    )\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n    @deprecated(\n      reason: \"Use executeAsync, which is typed and returns the job rather than only its id.\"\n    )\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
+var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\n# A directed edge between two documents, with the metadata recorded against it.\ntype DocumentRelationship {\n  sourceId: String!\n  targetId: String!\n  relationshipType: String!\n  metadata: JSONObject\n  createdAt: DateTime!\n  updatedAt: DateTime!\n}\n\ntype DocumentRelationshipResultPage {\n  items: [DocumentRelationship!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  \"\"\"\n  How the origin classified the failure. A peer needs this to mirror the origin's\n  quarantine decision; without it a held auth operation would freeze the document\n  on the peer side while the origin kept syncing.\n  \"\"\"\n  errorType: String\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Null until then, which\n  is the state every job is in when it is handed back from a submission.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Nullable for the same\n  reason as `JobInfo.result`: a job that has not written yet has produced\n  nothing, and an empty object would claim otherwise.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n\"\"\"\nOne operation an authorization preflight predicts a verdict for.\n\n`input` is what a conditional grant reads, so a candidate standing for a\nfilled-in form carries that form's input. Omitting it predicts the verdict an\nempty input earns, not the verdict the filled-in form will get.\n\"\"\"\ninput ActionCandidateInput {\n  scope: String!\n  type: String!\n  input: JSONObject\n}\n\nenum AuthDecision {\n  ALLOW\n  DENY\n}\n\n\"\"\"\nOne candidate's predicted verdict. `reason` carries the refusal a DENY is\nrecorded with, and is null on an ALLOW.\n\"\"\"\ntype ActionEvaluation {\n  decision: AuthDecision!\n  reason: String\n}\n\n\"\"\"\nThe predicted verdicts for a set of candidates, in the order they were given,\nwith the aggregates a caller branches on.\n\nThe aggregates are redundant -- a verdict is binary -- and all four are returned\nso a caller reads the one its question is phrased in rather than negating\nanother. Over no candidates every aggregate is false: nothing is allowed and\nnothing is denied.\n\"\"\"\ntype ActionEvaluations {\n  evaluations: [ActionEvaluation!]!\n  allAllowed: Boolean!\n  anyAllowed: Boolean!\n  allDenied: Boolean!\n  anyDenied: Boolean!\n}\n\n# Input types for sync operations\n\"\"\"\nAn action's context, as a caller submits it.\n\nDeclares every field `ActionContext` carries, because an input object rejects a\nfield it does not declare: an action stamped with the head it applies to - which\nis what a signing client sends - is refused outright if these are missing, and\nthat refusal is a whole-request one, not a per-field one.\n\n`prevOpHash` and `prevOpIndex` are the scope head the action was composed\nagainst. They are recorded rather than enforced; a signature is verified from\nthe params carried in its own tuple, which do not include them.\n\"\"\"\ninput ActionContextInput {\n  \"\"\"The index of the last operation in the scope the action applies to.\"\"\"\n  prevOpIndex: Int\n\n  \"\"\"The hash of the state the action applies to.\"\"\"\n  prevOpHash: String\n\n  \"\"\"Covers replay of an operation that would otherwise be a no-op.\"\"\"\n  nonce: String\n\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get the outgoing relationship edges of a source document. Unlike\n  # documentOutgoingRelationships, which returns the documents at the far end,\n  # this returns the edges themselves, carrying their metadata and timestamps.\n  # Omit relationshipType to return edges of every type.\n  documentOutgoingRelationshipEdges(\n    sourceIdentifier: String!\n    relationshipType: String\n    view: ViewFilterInput\n    paging: PagingInput\n  ): DocumentRelationshipResultPage!\n\n  # Get the incoming relationship edges of a target document. Unlike\n  # documentIncomingRelationships, which returns the documents at the far end,\n  # this returns the edges themselves, carrying their metadata and timestamps.\n  # Omit relationshipType to return edges of every type.\n  documentIncomingRelationshipEdges(\n    targetIdentifier: String!\n    relationshipType: String\n    view: ViewFilterInput\n    paging: PagingInput\n  ): DocumentRelationshipResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  \"\"\"\n  Predicts whether the calling subject would be admitted to execute each of a\n  set of candidate operations, without submitting any of them. A UI asks this to\n  disable a control rather than offer an action that fails on submit.\n\n  The answer is a prediction, not a promise:\n\n  - Real admission compiles an append condition over everything it read and the\n    store enforces it at write time. A preflight reads no future, so a policy\n    change landing between this answer and the submit changes the verdict. The\n    submit path stays the only authority.\n  - The verdict is evaluated at the stream heads, so it is correct for a\n    candidate about to be submitted. A backdated submission is out of contract;\n    the reactor decides that one by position.\n  - A candidate whose verdict depends on its input has to carry that input, since\n    a conditional grant reads it.\n\n  The subject is the authenticated caller and cannot be named in the request:\n  answering for an arbitrary subject would disclose what a policy grants\n  somebody else. It carries both the caller's address and the did:key of the app\n  instance whose token authenticated the request, so a policy naming either\n  matches the same principal the write path presents.\n\n  Requires the reactor's authEnforcement feature flag. Without it the reactor\n  holds no decision model, so this fails with extensions.code\n  AUTH_EVALUATION_UNSUPPORTED rather than guessing.\n  \"\"\"\n  evaluateActions(\n    documentIdentifier: String!\n    branch: String\n    candidates: [ActionCandidateInput!]!\n  ): ActionEvaluations!\n\n  \"\"\"\n  Polls for sync envelopes from a channel.\n\n  An operation stored before the API required an action id cannot be\n  represented by this schema, and rather than serving a partial response beside\n  a bare non-null violation, this fails with extensions.code\n  MALFORMED_STORED_OPERATION naming the operation. That code means the failure\n  is worth polling through: the document holding the operation needs repairing,\n  but the channel serves every other document, and a peer that stopped polling\n  would stop receiving those too.\n  \"\"\"\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  \"\"\"\n  Applies actions to a document and waits for the result.\n\n  Each action is coerced against `ActionInput`, so one missing a field the wire\n  declares is refused before any work starts. The id in particular: it is hashed\n  into the operation id and replay dedupes by it, so an action without one is\n  stored under an operation id shared by every id-less operation on the same\n  document, scope and branch.\n\n  Named for `IReactorClient.execute`, which this is the wire form of. `branch`\n  defaults to `main`.\n  \"\"\"\n  execute(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): PHDocument!\n\n  \"\"\"\n  Submits actions to a document and returns the job that will apply them.\n\n  Coerced exactly as `execute` is, so a malformed action is refused here rather\n  than surfacing later as a failed job. Returns the job rather than only its id,\n  so a caller has the status and the creation time it would otherwise have to\n  ask for; `result` is null until the job produces one.\n  \"\"\"\n  executeAsync(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): JobInfo!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n    @deprecated(\n      reason: \"Use execute. Actions here are untyped, so a malformed one is refused by a hand-written check rather than by the schema, and `view.scopes` is accepted but ignored.\"\n    )\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n    @deprecated(\n      reason: \"Use executeAsync, which is typed and returns the job rather than only its id.\"\n    )\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents. Adding one that already exists is\n  # a no-op, metadata included -- use updateRelationship to change an edge.\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    metadata: JSONObject\n    branch: String\n  ): PHDocument!\n\n  # Replace the metadata of an existing relationship, preserving its createdAt.\n  # Omitting metadata, or passing null, clears it.\n  updateRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    metadata: JSONObject\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
 //#endregion
 //#region src/graphql/reactor/pubsub.ts
 const pubSub = new PubSub();
@@ -5414,7 +5670,7 @@ function ensureJobSubscription(reactorClient, jobId) {
 					createdAt: jobInfo.createdAtUtcIso,
 					completedAt: jobInfo.completedAtUtcIso ?? null,
 					error: jobInfo.error?.message ?? null,
-					result: jobInfo.result ?? {}
+					result: jobInfo.result ?? null
 				},
 				jobId,
 				documentId: jobInfo.documentId
@@ -5492,6 +5748,48 @@ var ReactorSubgraph = class extends BaseSubgraph {
 		}
 	}
 	/**
+	* Drops the relationship edges whose far-end document the caller cannot read.
+	*
+	* An edge names two documents, so returning it discloses the far end's id. The
+	* document-shaped relationship queries already withhold far-end documents the
+	* caller cannot read; the edge-shaped queries have to withhold the same ones,
+	* or they become a way to enumerate around that check. Supreme admins read
+	* everything, so the per-edge check is skipped for them.
+	*
+	* The counts describe what is served; the cursor describes where to resume in
+	* the underlying unfiltered stream, so it is left as it came. A filtered page
+	* is therefore often shorter than the requested limit, and that is the stream
+	* continuing rather than a sign it ended.
+	*/
+	async filterRelationshipEdges(page, farEnd, ctx) {
+		if (this.authorizationService.isSupremeAdmin(ctx.user?.address)) return page;
+		const decisions = /* @__PURE__ */ new Map();
+		const items = [];
+		for (const edge of page.items) {
+			const documentId = edge[farEnd];
+			let canRead = decisions.get(documentId);
+			if (canRead === void 0) {
+				canRead = await this.canReadDocument(documentId, ctx);
+				decisions.set(documentId, canRead);
+			}
+			if (canRead) items.push(edge);
+		}
+		return this.servedPage(page, items);
+	}
+	/**
+	* Restates a page's totalCount over the items that survived a read filter, so
+	* that the difference between the two cannot be read off as a count of what
+	* the caller was not allowed to see.
+	*/
+	servedPage(page, items) {
+		const withheld = page.items.length - items.length;
+		return {
+			...page,
+			items,
+			totalCount: Math.max(0, page.totalCount - withheld)
+		};
+	}
+	/**
 	* Adds to `forbidden` the canonical document ids in `syncOps` that the caller
 	* cannot read, checking each distinct id once. Sync operation document ids are
 	* canonical (never slugs), so no resolution is needed.
@@ -5519,14 +5817,18 @@ var ReactorSubgraph = class extends BaseSubgraph {
 	* queued for the adopter.
 	*
 	* The refusal is the shape a read denial takes, so a puller treats it as a
-	* signal to authenticate again rather than as a transport failure.
+	* signal to authenticate again rather than as a transport failure. Pushes are
+	* refused the same way -- a push interacts with the same private queue, and
+	* reports the liveness that keeps it from being reclaimed -- but they never
+	* adopt, since the push path has no drive check to clear the claimant.
 	*
 	* Nothing is enforced or adopted without a serving gate. Below
 	* `authEnforcement` there is no policy being enforced for the channel to
 	* belong to, and refusing a poll there would break sync for no gain.
 	*/
-	async #bindOrRefuseChannel(channelId, ctx) {
+	async #bindOrRefuseChannel(channelId, ctx, options = {}) {
 		if (!this.syncServingGate) return;
+		const { adopt = true, action = "poll" } = options;
 		let remote;
 		try {
 			remote = this.syncManager.getById(channelId);
@@ -5536,10 +5838,10 @@ var ReactorSubgraph = class extends BaseSubgraph {
 		const bound = remote.meta.options.boundAddress;
 		const address = ctx.user?.address;
 		if (bound === void 0) {
-			if (address !== void 0) await this.syncManager.bindRemote(channelId, address);
+			if (adopt && address !== void 0) await this.syncManager.bindRemote(channelId, address);
 			return;
 		}
-		if (bound !== address) throw new ForbiddenError("to poll this sync channel");
+		if (bound !== address) throw new ForbiddenError(`to ${action} this sync channel`);
 	}
 	/** The address a channel created by this request belongs to, if any. */
 	#creatorBinding(ctx) {
@@ -5616,10 +5918,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
-						return {
-							...result,
-							items: filteredItems
-						};
+						return this.servedPage(result, filteredItems);
 					}
 					return result;
 				} catch (error) {
@@ -5627,6 +5926,34 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					throw error;
 				}
 			},
+			documentOutgoingRelationshipEdges: async (_parent, args, ctx) => {
+				this.logger.debug("documentOutgoingRelationshipEdges(@args)", args);
+				try {
+					const handle = await this.assertCanRead(args.sourceIdentifier, ctx);
+					const result = await documentOutgoingRelationshipEdges(this.reactorClient, {
+						...args,
+						sourceIdentifier: handle.fetchIdentifier
+					}, this.viewSubject(ctx));
+					return await this.filterRelationshipEdges(result, "targetId", ctx);
+				} catch (error) {
+					this.logger.error("Error in documentOutgoingRelationshipEdges: @Error", error);
+					throw error;
+				}
+			},
+			documentIncomingRelationshipEdges: async (_parent, args, ctx) => {
+				this.logger.debug("documentIncomingRelationshipEdges(@args)", args);
+				try {
+					const handle = await this.assertCanRead(args.targetIdentifier, ctx);
+					const result = await documentIncomingRelationshipEdges(this.reactorClient, {
+						...args,
+						targetIdentifier: handle.fetchIdentifier
+					}, this.viewSubject(ctx));
+					return await this.filterRelationshipEdges(result, "sourceId", ctx);
+				} catch (error) {
+					this.logger.error("Error in documentIncomingRelationshipEdges: @Error", error);
+					throw error;
+				}
+			},
 			findDocuments: async (_parent, args, ctx) => {
 				this.logger.debug("findDocuments(@args)", args);
 				try {
@@ -5637,10 +5964,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
-						return {
-							...result,
-							items: filteredItems
-						};
+						return this.servedPage(result, filteredItems);
 					}
 					return result;
 				} catch (error) {
@@ -5704,8 +6028,10 @@ var ReactorSubgraph = class extends BaseSubgraph {
 						if (await this.authorizationService.canRead(driveId, void 0)) await this.#collectForbiddenDocuments(remote.channel.outbox.items, forbiddenIds, ctx);
 						await this.#collectForbiddenDocuments(remote.channel.deadLetter.items, forbiddenIds, ctx);
 					}
-					const heldOpIds = this.syncServingGate ? await collectHeldSyncOperations([...remote.channel.outbox.items, ...remote.channel.deadLetter.items], this.syncServingGate, this.viewSubject(ctx)) : /* @__PURE__ */ new Set();
-					const { envelopes, ackOrdinal, deadLetters, hasMore } = pollSyncEnvelopes(this.syncManager, args, forbiddenIds, heldOpIds);
+					const gate = this.syncServingGate;
+					const gated = gate ? [...remote.channel.outbox.items, ...remote.channel.deadLetter.items] : void 0;
+					const heldOpIds = gate && gated ? await collectHeldSyncOperations(gated, gate, this.viewSubject(ctx)) : /* @__PURE__ */ new Set();
+					const { envelopes, ackOrdinal, deadLetters, hasMore } = pollSyncEnvelopes(this.syncManager, args, forbiddenIds, heldOpIds, gated && new Set(gated.map((syncOp) => syncOp.id)));
 					return {
 						envelopes,
 						ackOrdinal,
@@ -5842,6 +6168,19 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					throw error;
 				}
 			},
+			updateRelationship: async (_parent, args, ctx) => {
+				this.logger.debug("updateRelationship(@args)", args);
+				try {
+					const handle = await this.assertCanWrite(args.sourceIdentifier, ctx);
+					return await updateRelationship(this.reactorClient, {
+						...args,
+						sourceIdentifier: handle.fetchIdentifier
+					});
+				} catch (error) {
+					this.logger.error("Error in updateRelationship(@args): @Error", args, error);
+					throw error;
+				}
+			},
 			removeRelationship: async (_parent, args, ctx) => {
 				this.logger.debug("removeRelationship(@args)", args);
 				try {
@@ -5920,6 +6259,16 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			pushSyncEnvelopes: async (_parent, args, ctx) => {
 				this.logger.debug("pushSyncEnvelopes(@args)", args);
 				try {
+					const boundChannelIds = /* @__PURE__ */ new Set();
+					for (const envelope of args.envelopes) {
+						const channelId = envelope.channelMeta.id;
+						if (boundChannelIds.has(channelId)) continue;
+						boundChannelIds.add(channelId);
+						await this.#bindOrRefuseChannel(channelId, ctx, {
+							adopt: false,
+							action: "push to"
+						});
+					}
 					const checkedOperations = /* @__PURE__ */ new Map();
 					for (const envelope of args.envelopes) for (const op of envelope.operations ?? []) {
 						const documentId = op.context.documentId;
@@ -6023,10 +6372,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.3-dev.2";
+	return "6.2.3-dev.21";
 }
 function getGitHash() {
-	return "3540858558b669f520d0b49c63963572355aae2c";
+	return "ae4d9b1ad416d695a1bc03fc68b017606b38f7e7";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -6153,6 +6502,22 @@ var HttpPackageLoader = class {
 		this.logger.verbose(`No processor factory found in ${packageName}`);
 		return null;
 	}
+	async loadPieces(packageSpec) {
+		const { name: packageName } = this.parsePackageSpec(packageSpec);
+		if (!this.isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
+		const base = `${this.registryUrl}-/cdn/${packageSpec}/node/pieces/`;
+		this.logger.verbose(`Importing pieces from: ${base}index.mjs`);
+		let module;
+		try {
+			module = await import(`${base}index.mjs`);
+		} catch (error) {
+			this.logger.verbose(`No pieces found for: ${packageName}`, error);
+			return [];
+		}
+		const pieces = piecesFromCdnList(module, base, packageName, this.logger);
+		this.logger.verbose(`Loaded ${pieces.length} pieces from ${packageName}`);
+		return pieces;
+	}
 	/**
 	* Load document models from multiple packages.
 	* Continues loading even if some packages fail.
@@ -6252,6 +6617,7 @@ var HttpDocumentModelLoader = class {
 var ImportPackageLoader = class {
 	logger = childLogger(["reactor-api", "import-loader"]);
 	name = "ImportPackageLoader";
+	reportedUnbuilt = /* @__PURE__ */ new Set();
 	async loadDocumentModels(identifier) {
 		this.logger.verbose(`Loading document models from package: ${identifier}`);
 		const pkgModule = await loadDocumentModels(identifier);
@@ -6294,6 +6660,30 @@ var ImportPackageLoader = class {
 		this.logger.verbose(`  ➜  No Processor Factory found: ${identifier}`);
 		return null;
 	}
+	async loadPieces(identifier) {
+		this.logger.verbose(`Loading pieces from package: ${identifier}`);
+		const { root, listPath } = pieceListLocation(identifier);
+		if (!existsSync(listPath)) {
+			this.reportUnbuilt(identifier, root, listPath);
+			return [];
+		}
+		const pieces = piecesFromListModule(await import(
+			/* @vite-ignore */
+			pathToFileURL(listPath).href
+), {
+			root,
+			identifier,
+			logger: this.logger
+		});
+		this.logger.verbose(`  ➜  Loaded ${pieces.length} Pieces from: ${identifier}`);
+		return pieces;
+	}
+	reportUnbuilt(identifier, root, listPath) {
+		if (!isAbsolute(identifier) || this.reportedUnbuilt.has(identifier)) return;
+		if (!existsSync(join(root, PIECE_SOURCE_LIST))) return;
+		this.reportedUnbuilt.add(identifier);
+		this.logger.warn("@pkg declares pieces but @list was never built; run `ph build`", identifier, listPath);
+	}
 };
 //#endregion
 //#region src/packages/package-manager.ts
@@ -6309,10 +6699,12 @@ var ImportPackageLoader = class {
 * either bare (`'pkg'`) or as a subpath (`'pkg/subgraphs'`), since loaders
 * import sub-entries like `${pkg}/subgraphs` / `${pkg}/document-models`.
 */
-function isExpectedLoaderMiss(error, pkg) {
+function isExpectedLoaderMiss(error, pkg, subPath) {
 	if (!(error instanceof Error)) return false;
 	const code = error.code;
 	if (code === "ERR_UNSUPPORTED_DIR_IMPORT") return true;
+	if (code === "ERR_PACKAGE_PATH_NOT_EXPORTED" && subPath !== void 0 && error.message.includes(`'./${subPath}'`)) return true;
+	if (subPath !== void 0 && new RegExp(`^Failed to fetch \\S*/${subPath}/index\\.mjs: 404$`).test(error.message)) return true;
 	if (error.message.startsWith("Invalid package name:")) return true;
 	if (code === "ERR_MODULE_NOT_FOUND") return error.message.includes(`'${pkg}'`) || error.message.includes(`"${pkg}"`) || error.message.includes(`'${pkg}/`) || error.message.includes(`"${pkg}/`);
 	return false;
@@ -6334,6 +6726,7 @@ var PackageManager = class {
 	upgradeManifestsMap = /* @__PURE__ */ new Map();
 	subgraphsMap = /* @__PURE__ */ new Map();
 	processorMap = /* @__PURE__ */ new Map();
+	piecesMap = /* @__PURE__ */ new Map();
 	configWatcher;
 	debouncedUpdateCallbacks = /* @__PURE__ */ new Map();
 	eventEmitter = new EventEmitter();
@@ -6352,10 +6745,12 @@ var PackageManager = class {
 		const upgradeManifestsMap = await this.loadUpgradeManifests(packages);
 		const subgraphsMap = await this.loadSubgraphs(packages);
 		const processorsMap = await this.loadProcessors(packages);
+		const piecesMap = await this.loadPieces(packages);
 		this.upgradeManifestsMap = upgradeManifestsMap;
 		this.updatePackagesMap(documentModelsMap);
 		this.updateSubgraphsMap(subgraphsMap);
 		this.updateProcessorsMap(processorsMap);
+		this.updatePiecesMap(piecesMap);
 		try {
 			this.subscribePackages(packages);
 		} catch (error) {
@@ -6365,7 +6760,8 @@ var PackageManager = class {
 			documentModels: getUniqueDocumentModels(...Array.from(documentModelsMap.values())),
 			upgradeManifests: this.getUniqueUpgradeManifests(),
 			subgraphs: subgraphsMap,
-			processors: processorsMap
+			processors: processorsMap,
+			pieces: piecesMap
 		};
 	}
 	async loadDocumentModels(packages) {
@@ -6465,9 +6861,34 @@ var PackageManager = class {
 		}
 		return processorsMap;
 	}
+	async loadPieces(packages) {
+		this.logger.debug(`Loading pieces from packages: ${packages.join(", ")}`);
+		const piecesMap = /* @__PURE__ */ new Map();
+		for (const pkg of packages) {
+			const allPieces = [];
+			const failures = [];
+			let succeeded = false;
+			for (const loader of this.loaders) try {
+				allPieces.push(...await loader.loadPieces(pkg));
+				succeeded = true;
+				break;
+			} catch (error) {
+				failures.push({
+					loader: loader.name,
+					error
+				});
+				this.logger.debug(`[${loader.name}] Failed to load pieces from package ${pkg}`, error);
+			}
+			this.maybeWarnAllLoadersFailed("pieces", pkg, succeeded, failures);
+			if (allPieces.length > 0) this.logger.info("Loaded @count piece(s) from package @pkg: @pieces", allPieces.length, pkg, allPieces.map((piece) => piece.name).join(", "));
+			piecesMap.set(pkg, allPieces);
+		}
+		return piecesMap;
+	}
 	maybeWarnAllLoadersFailed(kind, pkg, succeeded, failures) {
 		if (succeeded || failures.length === 0) return;
-		const realFailures = failures.filter(({ error }) => !isExpectedLoaderMiss(error, pkg));
+		const subPath = kind === "document models" ? "document-models" : kind;
+		const realFailures = failures.filter(({ error }) => !isExpectedLoaderMiss(error, pkg, subPath));
 		if (realFailures.length === 0) return;
 		const details = realFailures.map(({ loader, error }) => {
 			return `  [${loader}] ${error instanceof Error ? error.message : String(error)}`;
@@ -6507,6 +6928,15 @@ var PackageManager = class {
 		else processorsMap.set(pkg, pkgProcessors);
 		this.updateProcessorsMap(processorsMap);
 	}
+	async updatePiecesForPackage(pkg) {
+		this.logger.debug(`Updating pieces for package: ${pkg}`);
+		const pieces = await this.loadPieces([pkg]);
+		const piecesMap = new Map(this.piecesMap);
+		const pkgPieces = pieces.get(pkg) ?? [];
+		if (pkgPieces.length === 0) piecesMap.delete(pkg);
+		else piecesMap.set(pkg, pkgPieces);
+		this.updatePiecesMap(piecesMap);
+	}
 	/** Debounced per key so repeated subscribePackages calls reuse one timer. */
 	getDebouncedUpdateCallback(key, update) {
 		if (!this.debouncedUpdateCallbacks.has(key)) {
@@ -6525,10 +6955,12 @@ var PackageManager = class {
 			const onDocumentModels = this.getDebouncedUpdateCallback(`${pkg}:document-models`, () => this.updateDocumentModelsForPackage(pkg));
 			const onSubgraphs = this.getDebouncedUpdateCallback(`${pkg}:subgraphs`, () => this.updateSubgraphsForPackage(pkg));
 			const onProcessors = this.getDebouncedUpdateCallback(`${pkg}:processors`, () => this.updateProcessorsForPackage(pkg));
+			const onPieces = this.getDebouncedUpdateCallback(`${pkg}:pieces`, () => this.updatePiecesForPackage(pkg));
 			for (const loader of this.loaders) {
 				if (loader.onDocumentModelsChange) unsubs.push(loader.onDocumentModelsChange(pkg, onDocumentModels));
 				if (loader.onSubgraphsChange) unsubs.push(loader.onSubgraphsChange(pkg, onSubgraphs));
 				if (loader.onProcessorsChange) unsubs.push(loader.onProcessorsChange(pkg, onProcessors));
+				if (loader.onPiecesChange) unsubs.push(loader.onPiecesChange(pkg, onPieces));
 			}
 		}
 		return () => {
@@ -6576,6 +7008,19 @@ var PackageManager = class {
 		this.processorMap = processorsMap;
 		this.eventEmitter.emit("processorsChange", processorsMap);
 	}
+	updatePiecesMap(piecesMap) {
+		const oldPackages = Array.from(this.piecesMap.keys());
+		const newPackages = Array.from(piecesMap.keys());
+		oldPackages.filter((pkg) => !newPackages.includes(pkg)).forEach((pkg) => {
+			this.logger.info("Removed pieces from: @pkg", pkg);
+		});
+		this.piecesMap = piecesMap;
+		this.eventEmitter.emit("piecesChange", piecesMap);
+	}
+	/** The pieces every loaded package ships, keyed by the package. */
+	getPieces() {
+		return new Map(this.piecesMap);
+	}
 	/**
 	* Remove `pkg` from all package maps and emit the change events, tearing
 	* down everything the package registered (subgraphs, processors, document
@@ -6594,9 +7039,11 @@ var PackageManager = class {
 		this.upgradeManifestsMap = dropKey(this.upgradeManifestsMap);
 		this.subgraphsMap = dropKey(this.subgraphsMap);
 		this.processorMap = dropKey(this.processorMap);
+		this.piecesMap = dropKey(this.piecesMap);
 		this.updatePackagesMap(this.docModelsMap);
 		this.updateSubgraphsMap(this.subgraphsMap);
 		this.updateProcessorsMap(this.processorMap);
+		this.updatePiecesMap(this.piecesMap);
 	}
 	onDocumentModelsChange(handler) {
 		this.eventEmitter.on("documentModelsChange", handler);
@@ -6607,6 +7054,9 @@ var PackageManager = class {
 	onProcessorsChange(handler) {
 		this.eventEmitter.on("processorsChange", handler);
 	}
+	onPiecesChange(handler) {
+		this.eventEmitter.on("piecesChange", handler);
+	}
 };
 //#endregion
 //#region src/config.ts
@@ -6984,13 +7434,11 @@ var AuthService = class {
 			return new Response(JSON.stringify({ error: "Authentication failed" }), { status: 401 });
 		}
 	}
+	/** Throws only for a bearer that is present and unusable, as HTTP 401s it. */
 	async authenticateWebSocketConnection(connectionParams) {
 		if (!this.resolvesIdentity) return null;
 		const authHeader = connectionParams.authorization;
-		if (!authHeader) {
-			if (!this.config.enabled) return null;
-			throw new Error("Missing authorization in connection parameters");
-		}
+		if (!authHeader) return null;
 		const token = authHeader.split(" ")[1];
 		if (!token) throw new Error("Invalid authorization format");
 		const verified = await this.verifyToken(token);
@@ -7676,10 +8124,23 @@ function buildSyncServingGate(reactorModule, authorizationConfig, logger) {
 	return new SyncScopeGate(new ModelReadGate(model, reactorModule.documentView, reactorModule.featureFlags.authGroups, reactorModule.operationIndex, logger, { withholdUninitialized: authorizationConfig.defaultProtection }), reactorModule.documentView, logger);
 }
 /**
+* Resolves the gateway adapter type from the `GATEWAY_ADAPTER` env var.
+* Defaults to "apollo" (the federation gateway, production behavior).
+* "stitching" selects the in-process graphql-tools merge gateway (#1565
+* prototype); "mercurius" the Fastify federation gateway.
+*/
+function resolveGatewayAdapterType(logger) {
+	const configured = process.env.GATEWAY_ADAPTER;
+	if (configured === void 0) return "apollo";
+	if (configured === "apollo" || configured === "mercurius" || configured === "stitching") return configured;
+	logger.warn(`Unknown GATEWAY_ADAPTER="${configured}"; falling back to "apollo"`);
+	return "apollo";
+}
+/**
 * Sets up the subgraph manager and registers subgraphs
 */
 async function setupGraphQLManager(httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate, httpRoutes) {
-	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter("apollo", logger), authService, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient, syncServingGate, httpRoutes);
+	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter(resolveGatewayAdapterType(logger), logger), authService, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient, syncServingGate, httpRoutes);
 	await graphqlManager.init(subgraphs.core, authFetchMiddleware, requireAuthFetchMiddleware);
 	for (const [packageName, collection] of subgraphs.extended.entries()) for (const subgraph of collection) await graphqlManager.registerSubgraph(subgraph, "graphql", false, packageName);
 	await graphqlManager.updateRouter();
@@ -7872,7 +8333,7 @@ async function _setupCommonInfrastructure(options) {
 		if (requireAuthenticatedCaller) {
 			requireAuthFetchMiddleware = createRequireAuthFetchMiddleware();
 			logger.info("Require-authenticated-caller middleware enabled: anonymous callers are rejected with a 401 before any subgraph");
-		}
+		} else logger.warn("Anonymous callers are admitted on every transport, including WebSocket subscriptions: REQUIRE_AUTHENTICATED_CALLER is not set. The authorization policy gates the reactor's own documents, but a package-provided subgraph authorizes nothing on its own. Set REQUIRE_AUTHENTICATED_CALLER=true to refuse anonymous callers before any subgraph sees them.");
 	}
 	const dbClosers = [];
 	const { relationalDb, analyticsStore, closers: analyticsClosers } = await initializeDatabaseAndAnalytics(options.dbPath, options.pgliteFactory);
@@ -8026,6 +8487,8 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 		attachmentReferenceIndex,
 		attachmentAccess,
 		authService,
+		authorizationService,
+		relationalDb,
 		dispose
 	};
 }
@@ -8222,7 +8685,7 @@ var PackageManagementService = class {
 	}
 };
 //#endregion
-export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthDecision, AuthDecisionSchema, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CORE_PACKAGE_NAME, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, EvaluateActionsDocument, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, HttpRouteService, ImportPackageLoader, InMemoryPackageStorage, InvalidNamespaceError, JobChangesDocument, MemoryWebhookStore, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PACKAGE_ROUTE_SEGMENT, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RelationalWebhookStore, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, WEBHOOK_SEGMENT, WebhookService, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertHostMountPath, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, namespacePath, namespaceSegments, newWebhookToken, parseDriveUrl, parseWebhookBody, redactHeaders, renderGraphqlPlayground, resolvePackageName, resolveRenownConfig, verifyWebhook };
+export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthDecision, AuthDecisionSchema, AuthEvaluationUnsupportedError, AuthService, AuthSubgraph, AuthenticationRequiredError, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CORE_PACKAGE_NAME, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, DocumentRelationshipFieldsFragmentDoc, EvaluateActionsDocument, FindDocumentsDocument, ForbiddenError, GetDocumentDocument, GetDocumentIncomingRelationshipEdgesDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipEdgesDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, HttpRouteService, ImportPackageLoader, InMemoryPackageStorage, InvalidNamespaceError, JobChangesDocument, MalformedStoredOperationError, MemoryWebhookStore, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PACKAGE_ROUTE_SEGMENT, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RelationalWebhookStore, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, UpdateRelationshipDocument, ViewFilterInputSchema, WEBHOOK_SEGMENT, WS_AUTH_CLOSE_REASONS, WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE_REASON_BEARER_REJECTED, WebhookService, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertHostMountPath, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, createWsAuthHandlers, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, namespacePath, namespaceSegments, newWebhookToken, parseDriveUrl, parseWebhookBody, redactHeaders, renderGraphqlPlayground, resolvePackageName, resolveRenownConfig, verifyWebhook };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=46ad8545-02e9-5fb8-b003-7b9b93f82f75
+//# debugId=cdb25466-37b1-55fd-be52-a82be4286288