@powerhousedao/reactor-api 6.2.3-dev.23 → 6.2.3-dev.24

package/dist/index.mjs

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ab52a900-0b3c-526b-8f88-77c4b827d650")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="29fbf62b-398f-53fa-ac67-5fcef3d5ac7d")}catch(e){}}();
 import { C as createAuthorizationService, D as MalformedStoredOperationError, E as ForbiddenError, S as AuthorizedDocumentHandle, T as AuthenticationRequiredError, _ as loadSubgraphs, a as piecesFromCdnList, b as createCanonicalDocumentIdResolver, c as buildGraphQlDriveDocument, d as isSubgraphClass, f as debounce, g as loadProcessors, h as loadDocumentModels, i as pieceListLocation, l as buildGraphqlOperation, o as piecesFromListModule, p as extractUpgradeManifests, r as PIECE_SOURCE_LIST, s as buildGraphQlDocument, u as buildGraphqlOperations, v as BaseSubgraph, w as AuthEvaluationUnsupportedError, x as AuthorizationPolicy, y as CanonicalDocumentIdResolutionError } from "./pieces-eqj2RKgd.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
@@ -19,7 +19,7 @@ import { buildSubgraphSchema } from "@apollo/subgraph";
 import { typeDefs } from "@powerhousedao/document-engineering/graphql";
 import { camelCase, kebabCase, pascalCase } from "change-case";
 import { GraphQLJSON, GraphQLJSONObject } from "graphql-type-json";
-import { deserializeSignature, serializeSignature, setName } from "@powerhousedao/shared/document-model";
+import { deserializeSignature, serializeSignature, setName, withSignaturePolicy } from "@powerhousedao/shared/document-model";
 import * as z$1 from "zod";
 import { z } from "zod";
 import { createHandler } from "graphql-sse/lib/use/fetch";
@@ -3617,7 +3617,7 @@ async function createEmptyDocument(reactorClient, args, reactorDriveClient) {
 		if (parentIdentifier) {
 			const parent = await reactorClient.get(parentIdentifier);
 			if (isDriveContainerType(parent.header.documentType)) {
-				const document = (await reactorClient.getDocumentModelModule(args.documentType)).utils.createDocument();
+				const document = withSignaturePolicy((await reactorClient.getDocumentModelModule(args.documentType)).utils.createDocument(), await reactorClient.getCreateSignaturePolicy());
 				if (name) document.header.name = name;
 				result = await pickDriveClient(reactorClient, parent.header.documentType, reactorDriveClient).addFile(parentIdentifier, document);
 			} else result = await reactorClient.createEmpty(args.documentType, { parentIdentifier });
@@ -3642,7 +3642,7 @@ async function createDocumentWithInitialState(reactorClient, args, reactorDriveC
 	} catch (error) {
 		throw new GraphQLError(`Document model not found for type ${args.documentType}: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
-	const document = module.utils.createDocument();
+	const document = withSignaturePolicy(module.utils.createDocument(), await reactorClient.getCreateSignaturePolicy());
 	const allowedScopes = new Set(Object.keys(module.documentModel.global.specifications.at(-1)?.state ?? {}));
 	const state = document.state;
 	for (const [scope, scopeState] of Object.entries(args.initialState)) if (allowedScopes.has(scope) && scope in state) state[scope] = {
@@ -4544,8 +4544,8 @@ var GraphQLManager = class {
 	subgraphHandlerCache = /* @__PURE__ */ new Map();
 	/** subgraphPath → the http adapter handle of its mounted route. */
 	subgraphRouteHandles = /* @__PURE__ */ new Map();
-	/** Handle of the currently mounted supergraph SSE route, if any. */
-	sseRouteHandle;
+	/** Mounted SSE routes, keyed by path: the supergraph's and each subgraph's. */
+	sseRouteHandles = /* @__PURE__ */ new Map();
 	/**
 	* Package name → the subgraph instances registered from it, keyed by
 	* subgraph name. Tracks the package association so that removed packages
@@ -4743,6 +4743,7 @@ var GraphQLManager = class {
 				routeHandle.dispose();
 				this.subgraphRouteHandles.delete(subgraphPath);
 			}
+			this.#disposeSSERoute(subgraphPath);
 			const wsDisposer = this.subgraphWsDisposers.get(subgraphPath);
 			if (wsDisposer) {
 				this.subgraphWsDisposers.delete(subgraphPath);
@@ -5082,10 +5083,7 @@ var GraphQLManager = class {
 		const allSubgraphs = this.#getAllSubgraphs();
 		const modules = Array.from(allSubgraphs.values()).filter((subgraph) => subgraph.hasSubscriptions).map((subgraph) => this.#buildSubgraphSchemaModule(subgraph));
 		if (modules.length === 0) {
-			if (this.sseRouteHandle !== void 0) {
-				this.sseRouteHandle.dispose();
-				this.sseRouteHandle = void 0;
-			}
+			this.#disposeSSERoute(superGraphPath);
 			return;
 		}
 		try {
@@ -5111,8 +5109,16 @@ var GraphQLManager = class {
 			contextFactory: this.#makeContextFactory()
 		});
 		const handler = this.#composeFetchMiddleware(rawHandler);
-		if (this.sseRouteHandle !== void 0) this.sseRouteHandle.dispose();
-		this.sseRouteHandle = this.httpAdapter.mount(ssePath, handler, { exact: true });
+		this.#disposeSSERoute(basePath);
+		this.sseRouteHandles.set(ssePath, this.httpAdapter.mount(ssePath, handler, { exact: true }));
+	}
+	#disposeSSERoute(basePath) {
+		const ssePath = basePath + "/stream";
+		const handle = this.sseRouteHandles.get(ssePath);
+		if (handle !== void 0) {
+			handle.dispose();
+			this.sseRouteHandles.delete(ssePath);
+		}
 	}
 	/**
 	* Compose the request-level fetch middleware chain. Auth runs first
@@ -5623,7 +5629,7 @@ function createReactorGraphQLClient(url, fetchImpl = fetch, headers) {
 }
 //#endregion
 //#region src/graphql/reactor/schema.graphql
-var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\n# A directed edge between two documents, with the metadata recorded against it.\ntype DocumentRelationship {\n  sourceId: String!\n  targetId: String!\n  relationshipType: String!\n  metadata: JSONObject\n  createdAt: DateTime!\n  updatedAt: DateTime!\n}\n\ntype DocumentRelationshipResultPage {\n  items: [DocumentRelationship!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  \"\"\"\n  How the origin classified the failure. A peer needs this to mirror the origin's\n  quarantine decision; without it a held auth operation would freeze the document\n  on the peer side while the origin kept syncing.\n  \"\"\"\n  errorType: String\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Null until then, which\n  is the state every job is in when it is handed back from a submission.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Nullable for the same\n  reason as `JobInfo.result`: a job that has not written yet has produced\n  nothing, and an empty object would claim otherwise.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n\"\"\"\nOne operation an authorization preflight predicts a verdict for.\n\n`input` is what a conditional grant reads, so a candidate standing for a\nfilled-in form carries that form's input. Omitting it predicts the verdict an\nempty input earns, not the verdict the filled-in form will get.\n\"\"\"\ninput ActionCandidateInput {\n  scope: String!\n  type: String!\n  input: JSONObject\n}\n\nenum AuthDecision {\n  ALLOW\n  DENY\n}\n\n\"\"\"\nOne candidate's predicted verdict. `reason` carries the refusal a DENY is\nrecorded with, and is null on an ALLOW.\n\"\"\"\ntype ActionEvaluation {\n  decision: AuthDecision!\n  reason: String\n}\n\n\"\"\"\nThe predicted verdicts for a set of candidates, in the order they were given,\nwith the aggregates a caller branches on.\n\nThe aggregates are redundant -- a verdict is binary -- and all four are returned\nso a caller reads the one its question is phrased in rather than negating\nanother. Over no candidates every aggregate is false: nothing is allowed and\nnothing is denied.\n\"\"\"\ntype ActionEvaluations {\n  evaluations: [ActionEvaluation!]!\n  allAllowed: Boolean!\n  anyAllowed: Boolean!\n  allDenied: Boolean!\n  anyDenied: Boolean!\n}\n\n# Input types for sync operations\n\"\"\"\nAn action's context, as a caller submits it.\n\nDeclares every field `ActionContext` carries, because an input object rejects a\nfield it does not declare: an action stamped with the head it applies to - which\nis what a signing client sends - is refused outright if these are missing, and\nthat refusal is a whole-request one, not a per-field one.\n\n`prevOpHash` and `prevOpIndex` are the scope head the action was composed\nagainst. They are recorded rather than enforced; a signature is verified from\nthe params carried in its own tuple, which do not include them.\n\"\"\"\ninput ActionContextInput {\n  \"\"\"The index of the last operation in the scope the action applies to.\"\"\"\n  prevOpIndex: Int\n\n  \"\"\"The hash of the state the action applies to.\"\"\"\n  prevOpHash: String\n\n  \"\"\"Covers replay of an operation that would otherwise be a no-op.\"\"\"\n  nonce: String\n\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get the outgoing relationship edges of a source document. Unlike\n  # documentOutgoingRelationships, which returns the documents at the far end,\n  # this returns the edges themselves, carrying their metadata and timestamps.\n  # Omit relationshipType to return edges of every type.\n  documentOutgoingRelationshipEdges(\n    sourceIdentifier: String!\n    relationshipType: String\n    view: ViewFilterInput\n    paging: PagingInput\n  ): DocumentRelationshipResultPage!\n\n  # Get the incoming relationship edges of a target document. Unlike\n  # documentIncomingRelationships, which returns the documents at the far end,\n  # this returns the edges themselves, carrying their metadata and timestamps.\n  # Omit relationshipType to return edges of every type.\n  documentIncomingRelationshipEdges(\n    targetIdentifier: String!\n    relationshipType: String\n    view: ViewFilterInput\n    paging: PagingInput\n  ): DocumentRelationshipResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  \"\"\"\n  Predicts whether the calling subject would be admitted to execute each of a\n  set of candidate operations, without submitting any of them. A UI asks this to\n  disable a control rather than offer an action that fails on submit.\n\n  The answer is a prediction, not a promise:\n\n  - Real admission compiles an append condition over everything it read and the\n    store enforces it at write time. A preflight reads no future, so a policy\n    change landing between this answer and the submit changes the verdict. The\n    submit path stays the only authority.\n  - The verdict is evaluated at the stream heads, so it is correct for a\n    candidate about to be submitted. A backdated submission is out of contract;\n    the reactor decides that one by position.\n  - A candidate whose verdict depends on its input has to carry that input, since\n    a conditional grant reads it.\n\n  The subject is the authenticated caller and cannot be named in the request:\n  answering for an arbitrary subject would disclose what a policy grants\n  somebody else. It carries both the caller's address and the did:key of the app\n  instance whose token authenticated the request, so a policy naming either\n  matches the same principal the write path presents.\n\n  Requires the reactor's authEnforcement feature flag. Without it the reactor\n  holds no decision model, so this fails with extensions.code\n  AUTH_EVALUATION_UNSUPPORTED rather than guessing.\n  \"\"\"\n  evaluateActions(\n    documentIdentifier: String!\n    branch: String\n    candidates: [ActionCandidateInput!]!\n  ): ActionEvaluations!\n\n  \"\"\"\n  Polls for sync envelopes from a channel.\n\n  An operation stored before the API required an action id cannot be\n  represented by this schema, and rather than serving a partial response beside\n  a bare non-null violation, this fails with extensions.code\n  MALFORMED_STORED_OPERATION naming the operation. That code means the failure\n  is worth polling through: the document holding the operation needs repairing,\n  but the channel serves every other document, and a peer that stopped polling\n  would stop receiving those too.\n  \"\"\"\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  \"\"\"\n  Applies actions to a document and waits for the result.\n\n  Each action is coerced against `ActionInput`, so one missing a field the wire\n  declares is refused before any work starts. The id in particular: it is hashed\n  into the operation id and replay dedupes by it, so an action without one is\n  stored under an operation id shared by every id-less operation on the same\n  document, scope and branch.\n\n  Named for `IReactorClient.execute`, which this is the wire form of. `branch`\n  defaults to `main`.\n  \"\"\"\n  execute(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): PHDocument!\n\n  \"\"\"\n  Submits actions to a document and returns the job that will apply them.\n\n  Coerced exactly as `execute` is, so a malformed action is refused here rather\n  than surfacing later as a failed job. Returns the job rather than only its id,\n  so a caller has the status and the creation time it would otherwise have to\n  ask for; `result` is null until the job produces one.\n  \"\"\"\n  executeAsync(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): JobInfo!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n    @deprecated(\n      reason: \"Use execute. Actions here are untyped, so a malformed one is refused by a hand-written check rather than by the schema, and `view.scopes` is accepted but ignored.\"\n    )\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n    @deprecated(\n      reason: \"Use executeAsync, which is typed and returns the job rather than only its id.\"\n    )\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents. Adding one that already exists is\n  # a no-op, metadata included -- use updateRelationship to change an edge.\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    metadata: JSONObject\n    branch: String\n  ): PHDocument!\n\n  # Replace the metadata of an existing relationship, preserving its createdAt.\n  # Omitting metadata, or passing null, clears it.\n  updateRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    metadata: JSONObject\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
+var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\n# A directed edge between two documents, with the metadata recorded against it.\ntype DocumentRelationship {\n  sourceId: String!\n  targetId: String!\n  relationshipType: String!\n  metadata: JSONObject\n  createdAt: DateTime!\n  updatedAt: DateTime!\n}\n\ntype DocumentRelationshipResultPage {\n  items: [DocumentRelationship!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  \"\"\"\n  How the origin classified the failure. A peer needs this to mirror the origin's\n  quarantine decision; without it a held auth operation would freeze the document\n  on the peer side while the origin kept syncing.\n  \"\"\"\n  errorType: String\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Null until then, which\n  is the state every job is in when it is handed back from a submission.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Nullable for the same\n  reason as `JobInfo.result`: a job that has not written yet has produced\n  nothing, and an empty object would claim otherwise.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n\"\"\"\nOne operation an authorization preflight predicts a verdict for.\n\n`input` is what a conditional grant reads, so a candidate standing for a\nfilled-in form carries that form's input. Omitting it predicts the verdict an\nempty input earns, not the verdict the filled-in form will get.\n\"\"\"\ninput ActionCandidateInput {\n  scope: String!\n  type: String!\n  input: JSONObject\n}\n\nenum AuthDecision {\n  ALLOW\n  DENY\n}\n\n\"\"\"\nOne candidate's predicted verdict. `reason` carries the refusal a DENY is\nrecorded with, and is null on an ALLOW.\n\"\"\"\ntype ActionEvaluation {\n  decision: AuthDecision!\n  reason: String\n}\n\n\"\"\"\nThe predicted verdicts for a set of candidates, in the order they were given,\nwith the aggregates a caller branches on.\n\nThe aggregates are redundant -- a verdict is binary -- and all four are returned\nso a caller reads the one its question is phrased in rather than negating\nanother. Over no candidates every aggregate is false: nothing is allowed and\nnothing is denied.\n\"\"\"\ntype ActionEvaluations {\n  evaluations: [ActionEvaluation!]!\n  allAllowed: Boolean!\n  anyAllowed: Boolean!\n  allDenied: Boolean!\n  anyDenied: Boolean!\n}\n\n# Input types for sync operations\n\"\"\"\nAn action's context, as a caller submits it.\n\nDeclares every field `ActionContext` carries, because an input object rejects a\nfield it does not declare: an action stamped with the head it applies to - which\nis what a signing client sends - is refused outright if these are missing, and\nthat refusal is a whole-request one, not a per-field one.\n\n`prevOpHash` and `prevOpIndex` are the scope head the action was composed\nagainst. They are recorded rather than enforced; a signature is verified from\nthe params carried in its own tuple, which do not include them.\n\"\"\"\ninput ActionContextInput {\n  \"\"\"\n  The index of the last operation in the scope the action applies to.\n  \"\"\"\n  prevOpIndex: Int\n\n  \"\"\"\n  The hash of the state the action applies to.\n  \"\"\"\n  prevOpHash: String\n\n  \"\"\"\n  Covers replay of an operation that would otherwise be a no-op.\n  \"\"\"\n  nonce: String\n\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get the outgoing relationship edges of a source document. Unlike\n  # documentOutgoingRelationships, which returns the documents at the far end,\n  # this returns the edges themselves, carrying their metadata and timestamps.\n  # Omit relationshipType to return edges of every type.\n  documentOutgoingRelationshipEdges(\n    sourceIdentifier: String!\n    relationshipType: String\n    view: ViewFilterInput\n    paging: PagingInput\n  ): DocumentRelationshipResultPage!\n\n  # Get the incoming relationship edges of a target document. Unlike\n  # documentIncomingRelationships, which returns the documents at the far end,\n  # this returns the edges themselves, carrying their metadata and timestamps.\n  # Omit relationshipType to return edges of every type.\n  documentIncomingRelationshipEdges(\n    targetIdentifier: String!\n    relationshipType: String\n    view: ViewFilterInput\n    paging: PagingInput\n  ): DocumentRelationshipResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  \"\"\"\n  Predicts whether the calling subject would be admitted to execute each of a\n  set of candidate operations, without submitting any of them. A UI asks this to\n  disable a control rather than offer an action that fails on submit.\n\n  The answer is a prediction, not a promise:\n\n  - Real admission compiles an append condition over everything it read and the\n    store enforces it at write time. A preflight reads no future, so a policy\n    change landing between this answer and the submit changes the verdict. The\n    submit path stays the only authority.\n  - The verdict is evaluated at the stream heads, so it is correct for a\n    candidate about to be submitted. A backdated submission is out of contract;\n    the reactor decides that one by position.\n  - A candidate whose verdict depends on its input has to carry that input, since\n    a conditional grant reads it.\n\n  The subject is the authenticated caller and cannot be named in the request:\n  answering for an arbitrary subject would disclose what a policy grants\n  somebody else. It carries both the caller's address and the did:key of the app\n  instance whose token authenticated the request, so a policy naming either\n  matches the same principal the write path presents.\n\n  Requires the reactor's authEnforcement feature flag. Without it the reactor\n  holds no decision model, so this fails with extensions.code\n  AUTH_EVALUATION_UNSUPPORTED rather than guessing.\n  \"\"\"\n  evaluateActions(\n    documentIdentifier: String!\n    branch: String\n    candidates: [ActionCandidateInput!]!\n  ): ActionEvaluations!\n\n  \"\"\"\n  Polls for sync envelopes from a channel.\n\n  An operation stored before the API required an action id cannot be\n  represented by this schema, and rather than serving a partial response beside\n  a bare non-null violation, this fails with extensions.code\n  MALFORMED_STORED_OPERATION naming the operation. That code means the failure\n  is worth polling through: the document holding the operation needs repairing,\n  but the channel serves every other document, and a peer that stopped polling\n  would stop receiving those too.\n  \"\"\"\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  \"\"\"\n  Applies actions to a document and waits for the result.\n\n  Each action is coerced against `ActionInput`, so one missing a field the wire\n  declares is refused before any work starts. The id in particular: it is hashed\n  into the operation id and replay dedupes by it, so an action without one is\n  stored under an operation id shared by every id-less operation on the same\n  document, scope and branch.\n\n  Named for `IReactorClient.execute`, which this is the wire form of. `branch`\n  defaults to `main`.\n  \"\"\"\n  execute(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): PHDocument!\n\n  \"\"\"\n  Submits actions to a document and returns the job that will apply them.\n\n  Coerced exactly as `execute` is, so a malformed action is refused here rather\n  than surfacing later as a failed job. Returns the job rather than only its id,\n  so a caller has the status and the creation time it would otherwise have to\n  ask for; `result` is null until the job produces one.\n  \"\"\"\n  executeAsync(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): JobInfo!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n    @deprecated(\n      reason: \"Use execute. Actions here are untyped, so a malformed one is refused by a hand-written check rather than by the schema, and `view.scopes` is accepted but ignored.\"\n    )\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n    @deprecated(\n      reason: \"Use executeAsync, which is typed and returns the job rather than only its id.\"\n    )\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents. Adding one that already exists is\n  # a no-op, metadata included -- use updateRelationship to change an edge.\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    metadata: JSONObject\n    branch: String\n  ): PHDocument!\n\n  # Replace the metadata of an existing relationship, preserving its createdAt.\n  # Omitting metadata, or passing null, clears it.\n  updateRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    metadata: JSONObject\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
 //#endregion
 //#region src/graphql/reactor/pubsub.ts
 const pubSub = new PubSub();
@@ -6372,10 +6378,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.3-dev.23";
+	return "6.2.3-dev.24";
 }
 function getGitHash() {
-	return "7b5cf362aaa580a9e468dd0e3d98e0dca9630e91";
+	return "895cfda0dfc73ba08e40437ca258507d8b2c9377";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -7152,14 +7158,42 @@ function normalizeAttachmentRef(value) {
 * context has no caller, and is rejected. The server never composes this
 * middleware without the auth middleware in the chain (see
 * `assertRequireAuthenticatedCallerAllowed` in `server.ts`).
+*
+* `exemptPaths` names the mounted paths that stay reachable anonymously — a
+* deployment whose product has a flow that runs before sign-in, such as
+* previewing an invitation from its code, needs somewhere to serve it from.
+* Each entry is a hole in the floor, so the match is deliberately the
+* narrowest one that works: the request's pathname, compared in full. A
+* prefix rule would exempt `/graphql/public-admin` along with
+* `/graphql/public`, and an exempt surface nobody can enumerate by reading
+* the configuration is not one anybody audits.
 */
-function createRequireAuthFetchMiddleware() {
+function createRequireAuthFetchMiddleware(exemptPaths = []) {
+	const exempt = new Set(exemptPaths.map(normalizeExemptPath));
 	return (next) => async (request) => {
 		if (request.method === "OPTIONS") return next(request);
+		if (exempt.size > 0 && exempt.has(normalizeExemptPath(new URL(request.url).pathname))) return next(request);
 		if (getAuthContext(request)?.user === void 0) return new globalThis.Response(JSON.stringify({ error: "Authentication required" }), { status: 401 });
 		return next(request);
 	};
 }
+/**
+* The form both sides of the comparison are reduced to: surrounding whitespace
+* gone, and one trailing slash gone, so `/graphql/public/` and
+* `/graphql/public` are the same path. A client that appends a slash is not
+* asking for a different route, and a configuration that carries one is not
+* asking for a different rule.
+*
+* Deliberately NOT normalized: case, percent-encoding, and a missing leading
+* slash. The first two would let two spellings of one path diverge from how
+* the router itself matches; the third is a configuration error, and
+* `assertRequireAuthenticatedCallerAllowed` refuses to boot on it rather than
+* leaving an exemption that silently never applies.
+*/
+function normalizeExemptPath(path) {
+	const trimmed = path.trim();
+	return trimmed.length > 1 && trimmed.endsWith("/") ? trimmed.slice(0, -1) : trimmed;
+}
 //#endregion
 //#region src/migrations/001_create_document_permissions.ts
 var _001_create_document_permissions_exports = /* @__PURE__ */ __exportAll({
@@ -8045,7 +8079,22 @@ function assertSkipCredentialVerificationAllowed(resolvesCallerIdentity, skipCre
 * require-authenticated-caller middleware would reject every caller —
 * authenticated ones included. Refuse to boot rather than run broken.
 */
-function assertRequireAuthenticatedCallerAllowed(requireAuthenticatedCaller, resolvesCallerIdentity) {
+function assertRequireAuthenticatedCallerAllowed(requireAuthenticatedCaller, resolvesCallerIdentity, exemptPaths = []) {
+	/**
+	* An exemption is only ever a hole in this floor, so configuring one while
+	* the floor is off is not a harmless no-op: it reads, to anyone auditing the
+	* configuration, as a surface that was deliberately opened — and therefore
+	* as a floor that exists. Refuse rather than let the two drift.
+	*/
+	if (!requireAuthenticatedCaller && exemptPaths.length > 0) throw new Error("REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS is set but refused: REQUIRE_AUTHENTICATED_CALLER is off, so nothing is being exempted from anything and the configuration claims a protection the server is not applying. Enable the floor, or drop the exemptions.");
+	/**
+	* A path that cannot match anything is worse than no path: the operator
+	* believes the flow is reachable, and finds out when the first user cannot
+	* claim an invitation. `URL.pathname` is always absolute, so an entry that
+	* does not start with `/` never matches, whatever the router does.
+	*/
+	const relative = exemptPaths.filter((path) => !path.trim().startsWith("/"));
+	if (relative.length > 0) throw new Error(`REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS contains ${relative.map((path) => `"${path}"`).join(", ")}, which cannot match: an exempt path is compared against the request's pathname and must start with '/' (for example '/graphql/public').`);
 	if (!requireAuthenticatedCaller || resolvesCallerIdentity) return;
 	throw new Error("REQUIRE_AUTHENTICATED_CALLER is set but refused: it rejects every request without a resolved caller, and with neither AUTH_ENABLED nor RESOLVE_CALLER_IDENTITY the server never reads a bearer, so it would reject every caller, including authenticated ones. Enable identity resolution first (RESOLVE_CALLER_IDENTITY=true or AUTH_ENABLED=true).");
 }
@@ -8238,6 +8287,7 @@ async function _setupCommonInfrastructure(options) {
 	let authEnabled = false;
 	let configuredResolveIdentity;
 	let configuredRequireAuth;
+	let configuredExemptPaths;
 	let configuredRenown;
 	if (options.configFile) {
 		const config = getConfig(options.configFile);
@@ -8249,8 +8299,9 @@ async function _setupCommonInfrastructure(options) {
 		authEnabled = options.auth.enabled;
 		configuredResolveIdentity = options.auth.resolveIdentity;
 		configuredRequireAuth = options.auth.requireAuthenticatedCaller;
+		configuredExemptPaths = options.auth.requireAuthenticatedCallerExemptPaths;
 	}
-	const { AUTH_ENABLED, RESOLVE_CALLER_IDENTITY, REQUIRE_AUTHENTICATED_CALLER, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION, CREDENTIAL_VERIFICATION_CACHE_TTL_MS } = process.env;
+	const { AUTH_ENABLED, RESOLVE_CALLER_IDENTITY, REQUIRE_AUTHENTICATED_CALLER, REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION, CREDENTIAL_VERIFICATION_CACHE_TTL_MS } = process.env;
 	if (AUTH_ENABLED !== void 0) authEnabled = AUTH_ENABLED === "true";
 	/**
 	* Whether the auth middleware reads the bearer and populates `ctx.user`,
@@ -8281,6 +8332,18 @@ async function _setupCommonInfrastructure(options) {
 	*/
 	let requireAuthenticatedCaller = configuredRequireAuth ?? false;
 	if (REQUIRE_AUTHENTICATED_CALLER !== void 0) requireAuthenticatedCaller = REQUIRE_AUTHENTICATED_CALLER === "true";
+	/**
+	* The paths the floor above does not apply to. Comma-separated, like
+	* `ADMINS`, because a deployment configures this the same way it configures
+	* everything else: one variable, one line, however many values it has.
+	*
+	* Empty entries are dropped rather than refused, so a trailing comma or a
+	* value split across lines in a manifest is not a boot failure; a value that
+	* cannot ever match is refused, in
+	* {@link assertRequireAuthenticatedCallerAllowed}.
+	*/
+	let requireAuthenticatedCallerExemptPaths = configuredExemptPaths ?? [];
+	if (REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS !== void 0) requireAuthenticatedCallerExemptPaths = REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS.split(",").map((path) => path.trim()).filter((path) => path.length > 0);
 	if (ADMINS !== void 0) admins = ADMINS.split(",").map((a) => a.toLowerCase());
 	let defaultProtection = false;
 	if (DEFAULT_PROTECTION !== void 0) defaultProtection = DEFAULT_PROTECTION.toLowerCase() === "true";
@@ -8295,7 +8358,7 @@ async function _setupCommonInfrastructure(options) {
 	const documentPermissionsRequested = options.documentPermissionService !== void 0 || DOCUMENT_PERMISSIONS_ENABLED === "true";
 	assertAuthRequiredForDocumentPermissions(authEnabled, documentPermissionsRequested);
 	assertSkipCredentialVerificationAllowed(resolveCallerIdentity, skipCredentialVerification, process.env);
-	assertRequireAuthenticatedCallerAllowed(requireAuthenticatedCaller, resolveCallerIdentity);
+	assertRequireAuthenticatedCallerAllowed(requireAuthenticatedCaller, resolveCallerIdentity, requireAuthenticatedCallerExemptPaths);
 	if (authEnabled && skipCredentialVerification) logger.warn("SECURITY: SKIP_CREDENTIAL_VERIFICATION is enabled — Renown credential verification is disabled and a bearer token's claimed address is NOT cryptographically bound to its signing key. Identity is unverifiable; use only in development or test.");
 	httpAdapter.getRoute("/health", () => new Response("OK", { status: 200 }));
 	const readiness = createReadinessGate();
@@ -8331,8 +8394,8 @@ async function _setupCommonInfrastructure(options) {
 		});
 		authFetchMiddleware = createAuthFetchMiddleware(authService);
 		if (requireAuthenticatedCaller) {
-			requireAuthFetchMiddleware = createRequireAuthFetchMiddleware();
-			logger.info("Require-authenticated-caller middleware enabled: anonymous callers are rejected with a 401 before any subgraph");
+			requireAuthFetchMiddleware = createRequireAuthFetchMiddleware(requireAuthenticatedCallerExemptPaths);
+			logger.info(requireAuthenticatedCallerExemptPaths.length > 0 ? `Require-authenticated-caller middleware enabled: anonymous callers are rejected with a 401 before any subgraph, except on ${requireAuthenticatedCallerExemptPaths.join(", ")}` : "Require-authenticated-caller middleware enabled: anonymous callers are rejected with a 401 before any subgraph");
 		} else logger.warn("Anonymous callers are admitted on every transport, including WebSocket subscriptions: REQUIRE_AUTHENTICATED_CALLER is not set. The authorization policy gates the reactor's own documents, but a package-provided subgraph authorizes nothing on its own. Set REQUIRE_AUTHENTICATED_CALLER=true to refuse anonymous callers before any subgraph sees them.");
 	}
 	const dbClosers = [];
@@ -8487,6 +8550,7 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 		attachmentReferenceIndex,
 		attachmentAccess,
 		authService,
+		requireAuthenticatedCaller: requireAuthFetchMiddleware !== void 0,
 		authorizationService,
 		relationalDb,
 		dispose
@@ -8688,4 +8752,4 @@ var PackageManagementService = class {
 export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthDecision, AuthDecisionSchema, AuthEvaluationUnsupportedError, AuthService, AuthSubgraph, AuthenticationRequiredError, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CORE_PACKAGE_NAME, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, DocumentRelationshipFieldsFragmentDoc, EvaluateActionsDocument, FindDocumentsDocument, ForbiddenError, GetDocumentDocument, GetDocumentIncomingRelationshipEdgesDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipEdgesDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, HttpRouteService, ImportPackageLoader, InMemoryPackageStorage, InvalidNamespaceError, JobChangesDocument, MalformedStoredOperationError, MemoryWebhookStore, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PACKAGE_ROUTE_SEGMENT, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RelationalWebhookStore, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, UpdateRelationshipDocument, ViewFilterInputSchema, WEBHOOK_SEGMENT, WS_AUTH_CLOSE_REASONS, WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE_REASON_BEARER_REJECTED, WebhookService, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertHostMountPath, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, createWsAuthHandlers, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, namespacePath, namespaceSegments, newWebhookToken, parseDriveUrl, parseWebhookBody, redactHeaders, renderGraphqlPlayground, resolvePackageName, resolveRenownConfig, verifyWebhook };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=ab52a900-0b3c-526b-8f88-77c4b827d650
+//# debugId=29fbf62b-398f-53fa-ac67-5fcef3d5ac7d