@powerhousedao/reactor-api 6.2.3-dev.2 → 6.2.3-dev.4

package/dist/index.mjs

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="46ad8545-02e9-5fb8-b003-7b9b93f82f75")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a15aa3df-1a6d-517d-93c4-3e8a84cefd09")}catch(e){}}();
 import { _ as createAuthorizationService, a as isSubgraphClass, b as MalformedStoredOperationError, d as loadSubgraphs, f as BaseSubgraph, g as AuthorizedDocumentHandle, h as AuthorizationPolicy, i as buildGraphqlOperations, l as loadDocumentModels, m as createCanonicalDocumentIdResolver, n as buildGraphQlDriveDocument, o as debounce, p as CanonicalDocumentIdResolutionError, r as buildGraphqlOperation, s as extractUpgradeManifests, t as buildGraphQlDocument, u as loadProcessors, v as AuthEvaluationUnsupportedError, y as ForbiddenError } from "./utils-XWVecaNn.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
@@ -311,28 +311,40 @@ function createAuthFetchMiddleware(authService) {
 async function createGatewayAdapter(type, logger) {
 	switch (type) {
 		case "apollo": {
-			const { ApolloGatewayAdapter } = await import("./adapter-gateway-apollo-DdamNLPT.mjs");
+			const { ApolloGatewayAdapter } = await import("./adapter-gateway-apollo-DowrX6E_.mjs");
 			return new ApolloGatewayAdapter(logger);
 		}
 		case "mercurius": {
-			const { MercuriusGatewayAdapter } = await import("./adapter-gateway-mercurius-CLmTtNJC.mjs");
+			const { MercuriusGatewayAdapter } = await import("./adapter-gateway-mercurius-CZVy88Za.mjs");
 			return new MercuriusGatewayAdapter(logger);
 		}
+		case "stitching": {
+			const { StitchingGatewayAdapter } = await import("./adapter-gateway-stitching-CaZjvRzx.mjs");
+			return new StitchingGatewayAdapter(logger);
+		}
 	}
 }
 async function createHttpAdapter(type) {
 	switch (type) {
 		case "express": {
-			const { createExpressHttpAdapter } = await import("./adapter-http-express-54gdI9bu.mjs");
+			const { createExpressHttpAdapter } = await import("./adapter-http-express-B39rPhqH.mjs");
 			return createExpressHttpAdapter();
 		}
 		case "fastify": {
-			const { createFastifyHttpAdapter } = await import("./adapter-http-fastify-DmccBVOe.mjs");
+			const { createFastifyHttpAdapter } = await import("./adapter-http-fastify-BwXO6rqE.mjs");
 			return createFastifyHttpAdapter();
 		}
 	}
 }
 //#endregion
+//#region src/graphql/gateway/types.ts
+/** No authenticated caller resolved, and REQUIRE_AUTHENTICATED_CALLER wants one. */
+const WS_CLOSE_REASON_AUTHENTICATION_REQUIRED = "authentication-required";
+/** A bearer was sent and could not be verified. */
+const WS_CLOSE_REASON_BEARER_REJECTED = "bearer-rejected";
+/** Every reason a refusal closes with, for a client matching on the set. */
+const WS_AUTH_CLOSE_REASONS = [WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE_REASON_BEARER_REJECTED];
+//#endregion
 //#region src/http/namespace.ts
 /**
 * A package's namespace is its npm name, used verbatim as one or two path
@@ -3781,6 +3793,7 @@ function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new
 	} catch (error) {
 		throw new GraphQLError(`Channel not found: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	remote.channel.notePoll();
 	const deadLetters = remote.channel.deadLetter.items.filter((syncOp) => !forbiddenIds.has(syncOp.documentId) && !heldOpIds.has(syncOp.id)).map((syncOp) => ({
 		documentId: syncOp.documentId,
 		error: syncOp.error?.message ?? "Unknown error",
@@ -3905,6 +3918,7 @@ function pushSyncEnvelopes(syncManager, args) {
 			throw new GraphQLError(`Channel not found: ${error instanceof Error ? error.message : "Unknown error"}`);
 		}
 		if (!envelope.operations || envelope.operations.length === 0) continue;
+		remote.channel.notePoll();
 		const syncOps = envelopesToSyncOperations(envelope, remote.meta.name);
 		if (!remoteSyncOps.has(remote)) remoteSyncOps.set(remote, []);
 		remoteSyncOps.get(remote).push(...syncOps);
@@ -4308,6 +4322,32 @@ const DefaultFeatureFlags = { enableDocumentModelSubgraphs: true };
 * regenerateDocumentModelSubgraphs).
 */
 const DOCUMENT_MODEL_SUBGRAPH_SOURCE = "document-models";
+function refuseConnection(connection, reason) {
+	const { socket } = connection;
+	socket?.close?.(4403, reason);
+	return false;
+}
+function createWsAuthHandlers(opts) {
+	const resolved = /* @__PURE__ */ new WeakMap();
+	return {
+		onConnect: async (connectionParams, connection) => {
+			let user = null;
+			if (opts.authService) try {
+				user = await opts.authService.authenticateWebSocketConnection(connectionParams);
+			} catch (error) {
+				opts.logger.warn("Refusing WebSocket connection: @error", error instanceof Error ? error.message : error);
+				return refuseConnection(connection, WS_CLOSE_REASON_BEARER_REJECTED);
+			}
+			if (user === null && opts.requireAuthenticatedCaller()) {
+				opts.logger.warn("Refusing anonymous WebSocket connection: an authenticated caller is required");
+				return refuseConnection(connection, WS_CLOSE_REASON_AUTHENTICATION_REQUIRED);
+			}
+			resolved.set(connection, user ?? void 0);
+			return true;
+		},
+		context: (connectionParams, connection) => Promise.resolve(opts.buildContext(connectionParams, resolved.get(connection)))
+	};
+}
 var GraphQLManager = class {
 	initialized = false;
 	coreSubgraphsMap = /* @__PURE__ */ new Map();
@@ -4380,13 +4420,17 @@ var GraphQLManager = class {
 		this.httpAdapter.setupMiddleware({ bodyLimit: "50mb" });
 		const driveRoutePath = path.posix.join(this.path, "d/:drive");
 		const driveMatcher = match(driveRoutePath);
-		this.httpAdapter.mount(driveRoutePath, async (request) => {
+		const driveInfoHandler = async (request) => {
 			const url = new URL(request.url);
 			const matched = driveMatcher(url.pathname);
 			const driveIdOrSlug = matched ? matched.params.drive : void 0;
 			if (!driveIdOrSlug) return Response.json({ error: "Drive ID or slug is required" }, { status: 400 });
 			try {
 				const driveDoc = await this.reactorClient.get(driveIdOrSlug);
+				if (!await this.authorizationService.canRead(driveDoc.header.id, getAuthContext(request)?.user?.address)) {
+					this.logger.debug(`Drive read refused: ${driveIdOrSlug}`);
+					return Response.json({ error: "Drive not found" }, { status: 404 });
+				}
 				const graphqlEndpoint = `${(request.headers.get("x-forwarded-proto")?.split(",")[0].trim() ?? url.protocol.replace(":", "")) + ":"}//${request.headers.get("x-forwarded-host")?.split(",")[0].trim() ?? request.headers.get("host") ?? ""}${(request.headers.get("x-forwarded-prefix")?.split(",")[0].trim().replace(/\/$/, "") ?? "") + (this.path === "/" ? "" : this.path)}/graphql/r`;
 				return Response.json({
 					id: driveDoc.header.id,
@@ -4400,7 +4444,8 @@ var GraphQLManager = class {
 				this.logger.debug(`Drive not found: ${driveIdOrSlug}`, error);
 				return Response.json({ error: "Drive not found" }, { status: 404 });
 			}
-		});
+		};
+		this.httpAdapter.mount(driveRoutePath, this.#authMiddleware ? this.#authMiddleware(driveInfoHandler) : driveInfoHandler);
 		this.logger.info(`Registered REST endpoint: GET ${driveRoutePath}`);
 		await this.#setupCoreSubgraphs("graphql", coreSubgraphs);
 		if (this.featureFlags.enableDocumentModelSubgraphs) await this.#setupDocumentModelSubgraphs("graphql", models);
@@ -4691,17 +4736,6 @@ var GraphQLManager = class {
 			...fields
 		};
 	}
-	async #createWebSocketContext(connectionParams) {
-		let user = null;
-		if (this.authService) user = await this.authService.authenticateWebSocketConnection(connectionParams);
-		const context = {
-			headers: connectionParams,
-			db: this.relationalDb,
-			...this.getAdditionalContextFields()
-		};
-		if (user) context.user = user;
-		return context;
-	}
 	#makeContextFactory() {
 		return (request) => {
 			const authCtx = getAuthContext(request);
@@ -4720,7 +4754,20 @@ var GraphQLManager = class {
 		};
 	}
 	#makeWsContextFactory() {
-		return (connectionParams) => this.#createWebSocketContext(connectionParams);
+		return createWsAuthHandlers({
+			authService: this.authService,
+			requireAuthenticatedCaller: () => this.#requireAuthMiddleware !== void 0,
+			logger: this.logger,
+			buildContext: (connectionParams, user) => {
+				const context = {
+					headers: connectionParams,
+					db: this.relationalDb,
+					...this.getAdditionalContextFields()
+				};
+				if (user) context.user = user;
+				return context;
+			}
+		});
 	}
 	setSupergraph(supergraph, subgraphs) {
 		const accepted = [];
@@ -4823,11 +4870,15 @@ var GraphQLManager = class {
 	#getSubgraphDefinitions() {
 		const subgraphs = this.#getAllSubgraphs();
 		const herokuOrLocal = process.env.HEROKU_APP_DEFAULT_DOMAIN_NAME ? `https://${process.env.HEROKU_APP_DEFAULT_DOMAIN_NAME}` : `http://localhost:${this.port}`;
-		return Array.from(subgraphs.entries()).map(([subgraphPath, subgraph]) => ({
-			name: subgraphPath.replace("/", ":"),
-			typeDefs: this.#buildSubgraphSchemaModule(subgraph).typeDefs,
-			url: `${herokuOrLocal}${subgraphPath}`
-		}));
+		return Array.from(subgraphs.entries()).map(([subgraphPath, subgraph]) => {
+			const module = this.#buildSubgraphSchemaModule(subgraph);
+			return {
+				name: subgraphPath.replace("/", ":"),
+				typeDefs: module.typeDefs,
+				resolvers: module.resolvers,
+				url: `${herokuOrLocal}${subgraphPath}`
+			};
+		});
 	}
 	async #createSupergraphGateway() {
 		const superGraphPath = path.posix.join(this.path, "graphql");
@@ -5519,14 +5570,18 @@ var ReactorSubgraph = class extends BaseSubgraph {
 	* queued for the adopter.
 	*
 	* The refusal is the shape a read denial takes, so a puller treats it as a
-	* signal to authenticate again rather than as a transport failure.
+	* signal to authenticate again rather than as a transport failure. Pushes are
+	* refused the same way -- a push interacts with the same private queue, and
+	* reports the liveness that keeps it from being reclaimed -- but they never
+	* adopt, since the push path has no drive check to clear the claimant.
 	*
 	* Nothing is enforced or adopted without a serving gate. Below
 	* `authEnforcement` there is no policy being enforced for the channel to
 	* belong to, and refusing a poll there would break sync for no gain.
 	*/
-	async #bindOrRefuseChannel(channelId, ctx) {
+	async #bindOrRefuseChannel(channelId, ctx, options = {}) {
 		if (!this.syncServingGate) return;
+		const { adopt = true, action = "poll" } = options;
 		let remote;
 		try {
 			remote = this.syncManager.getById(channelId);
@@ -5536,10 +5591,10 @@ var ReactorSubgraph = class extends BaseSubgraph {
 		const bound = remote.meta.options.boundAddress;
 		const address = ctx.user?.address;
 		if (bound === void 0) {
-			if (address !== void 0) await this.syncManager.bindRemote(channelId, address);
+			if (adopt && address !== void 0) await this.syncManager.bindRemote(channelId, address);
 			return;
 		}
-		if (bound !== address) throw new ForbiddenError("to poll this sync channel");
+		if (bound !== address) throw new ForbiddenError(`to ${action} this sync channel`);
 	}
 	/** The address a channel created by this request belongs to, if any. */
 	#creatorBinding(ctx) {
@@ -5920,6 +5975,16 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			pushSyncEnvelopes: async (_parent, args, ctx) => {
 				this.logger.debug("pushSyncEnvelopes(@args)", args);
 				try {
+					const boundChannelIds = /* @__PURE__ */ new Set();
+					for (const envelope of args.envelopes) {
+						const channelId = envelope.channelMeta.id;
+						if (boundChannelIds.has(channelId)) continue;
+						boundChannelIds.add(channelId);
+						await this.#bindOrRefuseChannel(channelId, ctx, {
+							adopt: false,
+							action: "push to"
+						});
+					}
 					const checkedOperations = /* @__PURE__ */ new Map();
 					for (const envelope of args.envelopes) for (const op of envelope.operations ?? []) {
 						const documentId = op.context.documentId;
@@ -6023,10 +6088,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.3-dev.2";
+	return "6.2.3-dev.4";
 }
 function getGitHash() {
-	return "3540858558b669f520d0b49c63963572355aae2c";
+	return "e30f072e1e13237f4a9ce0f7c5ca18700cab7845";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -6984,13 +7049,11 @@ var AuthService = class {
 			return new Response(JSON.stringify({ error: "Authentication failed" }), { status: 401 });
 		}
 	}
+	/** Throws only for a bearer that is present and unusable, as HTTP 401s it. */
 	async authenticateWebSocketConnection(connectionParams) {
 		if (!this.resolvesIdentity) return null;
 		const authHeader = connectionParams.authorization;
-		if (!authHeader) {
-			if (!this.config.enabled) return null;
-			throw new Error("Missing authorization in connection parameters");
-		}
+		if (!authHeader) return null;
 		const token = authHeader.split(" ")[1];
 		if (!token) throw new Error("Invalid authorization format");
 		const verified = await this.verifyToken(token);
@@ -7676,10 +7739,23 @@ function buildSyncServingGate(reactorModule, authorizationConfig, logger) {
 	return new SyncScopeGate(new ModelReadGate(model, reactorModule.documentView, reactorModule.featureFlags.authGroups, reactorModule.operationIndex, logger, { withholdUninitialized: authorizationConfig.defaultProtection }), reactorModule.documentView, logger);
 }
 /**
+* Resolves the gateway adapter type from the `GATEWAY_ADAPTER` env var.
+* Defaults to "apollo" (the federation gateway, production behavior).
+* "stitching" selects the in-process graphql-tools merge gateway (#1565
+* prototype); "mercurius" the Fastify federation gateway.
+*/
+function resolveGatewayAdapterType(logger) {
+	const configured = process.env.GATEWAY_ADAPTER;
+	if (configured === void 0) return "apollo";
+	if (configured === "apollo" || configured === "mercurius" || configured === "stitching") return configured;
+	logger.warn(`Unknown GATEWAY_ADAPTER="${configured}"; falling back to "apollo"`);
+	return "apollo";
+}
+/**
 * Sets up the subgraph manager and registers subgraphs
 */
 async function setupGraphQLManager(httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate, httpRoutes) {
-	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter("apollo", logger), authService, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient, syncServingGate, httpRoutes);
+	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter(resolveGatewayAdapterType(logger), logger), authService, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient, syncServingGate, httpRoutes);
 	await graphqlManager.init(subgraphs.core, authFetchMiddleware, requireAuthFetchMiddleware);
 	for (const [packageName, collection] of subgraphs.extended.entries()) for (const subgraph of collection) await graphqlManager.registerSubgraph(subgraph, "graphql", false, packageName);
 	await graphqlManager.updateRouter();
@@ -7872,7 +7948,7 @@ async function _setupCommonInfrastructure(options) {
 		if (requireAuthenticatedCaller) {
 			requireAuthFetchMiddleware = createRequireAuthFetchMiddleware();
 			logger.info("Require-authenticated-caller middleware enabled: anonymous callers are rejected with a 401 before any subgraph");
-		}
+		} else logger.warn("Anonymous callers are admitted on every transport, including WebSocket subscriptions: REQUIRE_AUTHENTICATED_CALLER is not set. The authorization policy gates the reactor's own documents, but a package-provided subgraph authorizes nothing on its own. Set REQUIRE_AUTHENTICATED_CALLER=true to refuse anonymous callers before any subgraph sees them.");
 	}
 	const dbClosers = [];
 	const { relationalDb, analyticsStore, closers: analyticsClosers } = await initializeDatabaseAndAnalytics(options.dbPath, options.pgliteFactory);
@@ -8222,7 +8298,7 @@ var PackageManagementService = class {
 	}
 };
 //#endregion
-export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthDecision, AuthDecisionSchema, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CORE_PACKAGE_NAME, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, EvaluateActionsDocument, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, HttpRouteService, ImportPackageLoader, InMemoryPackageStorage, InvalidNamespaceError, JobChangesDocument, MemoryWebhookStore, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PACKAGE_ROUTE_SEGMENT, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RelationalWebhookStore, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, WEBHOOK_SEGMENT, WebhookService, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertHostMountPath, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, namespacePath, namespaceSegments, newWebhookToken, parseDriveUrl, parseWebhookBody, redactHeaders, renderGraphqlPlayground, resolvePackageName, resolveRenownConfig, verifyWebhook };
+export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthDecision, AuthDecisionSchema, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CORE_PACKAGE_NAME, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, EvaluateActionsDocument, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, HttpRouteService, ImportPackageLoader, InMemoryPackageStorage, InvalidNamespaceError, JobChangesDocument, MemoryWebhookStore, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PACKAGE_ROUTE_SEGMENT, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RelationalWebhookStore, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, WEBHOOK_SEGMENT, WS_AUTH_CLOSE_REASONS, WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE_REASON_BEARER_REJECTED, WebhookService, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertHostMountPath, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, createWsAuthHandlers, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, namespacePath, namespaceSegments, newWebhookToken, parseDriveUrl, parseWebhookBody, redactHeaders, renderGraphqlPlayground, resolvePackageName, resolveRenownConfig, verifyWebhook };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=46ad8545-02e9-5fb8-b003-7b9b93f82f75
+//# debugId=a15aa3df-1a6d-517d-93c4-3e8a84cefd09