@powerhousedao/reactor-api 6.2.3-dev.24 → 6.2.3-dev.25

package/dist/index.mjs

@@ -1,6 +1,7 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="29fbf62b-398f-53fa-ac67-5fcef3d5ac7d")}catch(e){}}();
-import { C as createAuthorizationService, D as MalformedStoredOperationError, E as ForbiddenError, S as AuthorizedDocumentHandle, T as AuthenticationRequiredError, _ as loadSubgraphs, a as piecesFromCdnList, b as createCanonicalDocumentIdResolver, c as buildGraphQlDriveDocument, d as isSubgraphClass, f as debounce, g as loadProcessors, h as loadDocumentModels, i as pieceListLocation, l as buildGraphqlOperation, o as piecesFromListModule, p as extractUpgradeManifests, r as PIECE_SOURCE_LIST, s as buildGraphQlDocument, u as buildGraphqlOperations, v as BaseSubgraph, w as AuthEvaluationUnsupportedError, x as AuthorizationPolicy, y as CanonicalDocumentIdResolutionError } from "./pieces-eqj2RKgd.mjs";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6828688f-9737-5852-b599-51439acc4894")}catch(e){}}();
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { C as createAuthorizationService, D as MalformedStoredOperationError, E as ForbiddenError, S as AuthorizedDocumentHandle, T as AuthenticationRequiredError, _ as loadSubgraphs, a as piecesFromCdnList, b as createCanonicalDocumentIdResolver, c as buildGraphQlDriveDocument, d as isSubgraphClass, f as debounce, g as loadProcessors, h as loadDocumentModels, i as pieceListLocation, l as buildGraphqlOperation, o as piecesFromListModule, p as extractUpgradeManifests, r as PIECE_SOURCE_LIST, s as buildGraphQlDocument, u as buildGraphqlOperations, v as BaseSubgraph, w as AuthEvaluationUnsupportedError, x as AuthorizationPolicy, y as CanonicalDocumentIdResolutionError } from "./pieces-BOwV3Ql9.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
@@ -47,18 +48,6 @@ import { AtomicNodeFs } from "@powerhousedao/pglite-fs";
 import knex from "knex";
 import ClientPgLite from "knex-pglite";
 import { KyselyKnexDialect, PGColdDialect } from "kysely-knex";
-//#region \0rolldown/runtime.js
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-//#endregion
 //#region src/graphql/analytics-subgraph.ts
 var AnalyticsSubgraph = class extends BaseSubgraph {
 	analyticsStore;
@@ -312,15 +301,15 @@ function createAuthFetchMiddleware(authService) {
 async function createGatewayAdapter(type, logger) {
 	switch (type) {
 		case "apollo": {
-			const { ApolloGatewayAdapter } = await import("./adapter-gateway-apollo-DowrX6E_.mjs");
+			const { ApolloGatewayAdapter } = await import("./adapter-gateway-apollo-D2DNlPY0.mjs");
 			return new ApolloGatewayAdapter(logger);
 		}
 		case "mercurius": {
-			const { MercuriusGatewayAdapter } = await import("./adapter-gateway-mercurius-CZVy88Za.mjs");
+			const { MercuriusGatewayAdapter } = await import("./adapter-gateway-mercurius-rbKlwF9m.mjs");
 			return new MercuriusGatewayAdapter(logger);
 		}
 		case "stitching": {
-			const { StitchingGatewayAdapter } = await import("./adapter-gateway-stitching-CaZjvRzx.mjs");
+			const { StitchingGatewayAdapter } = await import("./adapter-gateway-stitching-Dzv10u8D.mjs");
 			return new StitchingGatewayAdapter(logger);
 		}
 	}
@@ -328,11 +317,11 @@ async function createGatewayAdapter(type, logger) {
 async function createHttpAdapter(type) {
 	switch (type) {
 		case "express": {
-			const { createExpressHttpAdapter } = await import("./adapter-http-express-D4KBmDcQ.mjs");
+			const { createExpressHttpAdapter } = await import("./adapter-http-express-Drbaxszc.mjs");
 			return createExpressHttpAdapter();
 		}
 		case "fastify": {
-			const { createFastifyHttpAdapter } = await import("./adapter-http-fastify-U9j7HxQE.mjs");
+			const { createFastifyHttpAdapter } = await import("./adapter-http-fastify-DMPW_huG.mjs");
 			return createFastifyHttpAdapter();
 		}
 	}
@@ -360,7 +349,7 @@ const WS_AUTH_CLOSE_REASONS = [WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE
 */
 const SEGMENT = /^[a-z0-9][-a-z0-9._]*$/i;
 /** Segments that would read as path traversal rather than as a name. */
-const TRAVERSAL = new Set([".", ".."]);
+const TRAVERSAL = /* @__PURE__ */ new Set([".", ".."]);
 var InvalidNamespaceError = class extends Error {};
 /**
 * Turns a package name into the path segments it occupies.
@@ -846,27 +835,29 @@ var HttpScope = class {
 			headers: fetchHeaders(req),
 			signal: controller.signal
 		};
-		if (method !== "GET" && method !== "HEAD" && body !== "none") if (body === "stream") init = {
-			...init,
-			body: Readable.toWeb(req),
-			duplex: "half"
-		};
-		else {
-			try {
-				raw = await readBody(req, spec.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES$1);
-			} catch (error) {
-				if (error instanceof BodyTooLargeError) {
-					res.setHeader("connection", "close");
-					res.once("finish", () => req.destroy());
-					writeError(res, 413, "Payload too large");
-					return;
-				}
-				throw error;
-			}
-			if (raw.length) init = {
+		if (method !== "GET" && method !== "HEAD" && body !== "none") {
+			if (body === "stream") init = {
 				...init,
-				body: new Uint8Array(raw.buffer, raw.byteOffset, raw.byteLength)
+				body: Readable.toWeb(req),
+				duplex: "half"
 			};
+			else {
+				try {
+					raw = await readBody(req, spec.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES$1);
+				} catch (error) {
+					if (error instanceof BodyTooLargeError) {
+						res.setHeader("connection", "close");
+						res.once("finish", () => req.destroy());
+						writeError(res, 413, "Payload too large");
+						return;
+					}
+					throw error;
+				}
+				if (raw.length) init = {
+					...init,
+					body: new Uint8Array(raw.buffer, raw.byteOffset, raw.byteLength)
+				};
+			}
 		}
 		await writeResponse(res, await spec.handler(new Request(url, init), {
 			...ctx,
@@ -1043,7 +1034,7 @@ function verifyWebhook(options) {
 }
 /** Headers that would put a credential in a log or run journal. The configured signature
 * header joins them: it is an HMAC of the body under a live secret. */
-const REDACTED_HEADERS = new Set([
+const REDACTED_HEADERS = /* @__PURE__ */ new Set([
 	"authorization",
 	"proxy-authorization",
 	"cookie",
@@ -1316,6 +1307,7 @@ function newWebhookToken() {
 const NAMESPACE = "reactor_webhooks";
 /** Relational implementation, over the reactor's own database. */
 var RelationalWebhookStore = class {
+	relationalDb;
 	#db;
 	constructor(relationalDb) {
 		this.relationalDb = relationalDb;
@@ -1461,7 +1453,7 @@ const stripScalarDefinitions = (doc) => {
 * whole gateway. We dedupe these by name; field/operation/extension nodes are
 * left untouched.
 */
-const TYPE_DEFINITION_KINDS = new Set([
+const TYPE_DEFINITION_KINDS = /* @__PURE__ */ new Set([
 	Kind.OBJECT_TYPE_DEFINITION,
 	Kind.ENUM_TYPE_DEFINITION,
 	Kind.INPUT_OBJECT_TYPE_DEFINITION,
@@ -1563,7 +1555,7 @@ const getDocumentModelTypeDefs = (documentModels, typeDefs$1) => {
               stateJSON: JSONObject
           }\n`;
 	});
-	return dedupeTypeDefinitions(gql`
+	const schema = gql`
     scalar JSONObject
     scalar AttachmentRef
     # Codegen scalars not in the document-engineering set.
@@ -1639,7 +1631,8 @@ const getDocumentModelTypeDefs = (documentModels, typeDefs$1) => {
     }
 
     ${stripScalarDefinitions(typeDefs$1)}
-  `);
+  `;
+	return dedupeTypeDefinitions(schema);
 };
 /**
 * Extract type names from a GraphQL schema.
@@ -1735,9 +1728,7 @@ function generateStateInputTypes(stateSchema, excludeTypeNames) {
 		case Kind.OBJECT_TYPE_DEFINITION:
 			objectNames.add(def.name.value);
 			break;
-		case Kind.INPUT_OBJECT_TYPE_DEFINITION:
-			existingInputNames.add(def.name.value);
-			break;
+		case Kind.INPUT_OBJECT_TYPE_DEFINITION: existingInputNames.add(def.name.value);
 	}
 	const inputTypes = [];
 	for (const def of ast.definitions) {
@@ -1766,7 +1757,7 @@ function applyGraphQLTypePrefixes(schema, prefix, externalTypeNames = []) {
 	if (!schema || !schema.trim()) return schema;
 	let processedSchema = schema;
 	const localTypeNames = extractTypeNames(schema);
-	const allTypeNames = [...new Set([...localTypeNames, ...externalTypeNames])];
+	const allTypeNames = [.../* @__PURE__ */ new Set([...localTypeNames, ...externalTypeNames])];
 	if (allTypeNames.length === 0) return schema;
 	allTypeNames.forEach((typeName) => {
 		const typeRegex = new RegExp(`(?<![_A-Za-z0-9])(${typeName})(?![_A-Za-z0-9])|\\[(${typeName})\\]|\\[(${typeName})!\\]|\\[(${typeName})\\]!|\\[(${typeName})!\\]!`, "g");
@@ -1794,8 +1785,9 @@ function generateDocumentModelSchema(documentModel, options = {}) {
 	const localStateTypeNames = extractTypeNames(localStateSchema ?? "");
 	const stateTypeNames = [...globalStateTypeNames, ...localStateTypeNames];
 	const allOperationTypeNames = specification?.modules.flatMap((module) => module.operations.flatMap((op) => extractTypeNames(op.schema ?? ""))) ?? [];
-	const allTypeNames = [...new Set([...stateTypeNames, ...allOperationTypeNames])];
-	const prefixedStateInputTypes = applyGraphQLTypePrefixes(extractInputTypeDefinitions(globalStateSchema ?? "", new Set(allOperationTypeNames)), documentName, allTypeNames);
+	const allTypeNames = [.../* @__PURE__ */ new Set([...stateTypeNames, ...allOperationTypeNames])];
+	const operationInputTypeNames = new Set(allOperationTypeNames);
+	const prefixedStateInputTypes = applyGraphQLTypePrefixes(extractInputTypeDefinitions(globalStateSchema ?? "", operationInputTypeNames), documentName, allTypeNames);
 	const hasValidSchema = (schema) => !!(schema && /\b(input|type|enum|union|interface)\s+\w+/.test(schema));
 	const stateSchemaTypes = globalStateSchema ? applyGraphQLTypePrefixes(globalStateSchema.replaceAll("scalar DateTime", "").replaceAll(/input (.*?) {[\s\S]*?}/g, ""), documentName, allTypeNames) : "";
 	if (useNewApi) return generateNewApiSchema(documentName, specification, stateSchemaTypes, prefixedStateInputTypes, allTypeNames, hasValidSchema);
@@ -3020,8 +3012,8 @@ function fromInputMaybe(value) {
 function toReactorPropagationMode(gqlMode) {
 	if (gqlMode == null) return;
 	switch (gqlMode) {
-		case PropagationMode.Cascade: return PropagationMode$1.Cascade;
-		case PropagationMode.Orphan: return PropagationMode$1.None;
+		case "CASCADE": return PropagationMode$1.Cascade;
+		case "ORPHAN": return PropagationMode$1.None;
 	}
 }
 /**
@@ -3031,10 +3023,10 @@ function toReactorPropagationMode(gqlMode) {
 */
 function toGqlActionEvaluation(evaluation) {
 	return evaluation.decision === "allow" ? {
-		decision: AuthDecision.Allow,
+		decision: "ALLOW",
 		reason: null
 	} : {
-		decision: AuthDecision.Deny,
+		decision: "DENY",
 		reason: evaluation.reason
 	};
 }
@@ -3617,7 +3609,8 @@ async function createEmptyDocument(reactorClient, args, reactorDriveClient) {
 		if (parentIdentifier) {
 			const parent = await reactorClient.get(parentIdentifier);
 			if (isDriveContainerType(parent.header.documentType)) {
-				const document = withSignaturePolicy((await reactorClient.getDocumentModelModule(args.documentType)).utils.createDocument(), await reactorClient.getCreateSignaturePolicy());
+				const module = await reactorClient.getDocumentModelModule(args.documentType);
+				const document = withSignaturePolicy(module.utils.createDocument(), await reactorClient.getCreateSignaturePolicy());
 				if (name) document.header.name = name;
 				result = await pickDriveClient(reactorClient, parent.header.documentType, reactorDriveClient).addFile(parentIdentifier, document);
 			} else result = await reactorClient.createEmpty(args.documentType, { parentIdentifier });
@@ -4343,7 +4336,7 @@ const DRIVE_ID_HEADER = "drive-id";
 * in the ownership set yet); other create-shaped operations that may
 * synthesize a drive must be added here too.
 */
-const CACHE_BYPASS_OPERATIONS = new Set(["createDocument", "createEmptyDocument"]);
+const CACHE_BYPASS_OPERATIONS = /* @__PURE__ */ new Set(["createDocument", "createEmptyDocument"]);
 const driveIdMap = /* @__PURE__ */ new WeakMap();
 /** Internal — only `graphql-manager.ts` should call this. */
 function getRequestDriveId(request) {
@@ -4413,6 +4406,7 @@ function wrongShardResponse(driveId) {
 * 421 response.
 */
 var DriveOwnershipCache = class {
+	reactorClient;
 	drives = /* @__PURE__ */ new Set();
 	constructor(reactorClient) {
 		this.reactorClient = reactorClient;
@@ -4530,6 +4524,22 @@ function createWsAuthHandlers(opts) {
 	};
 }
 var GraphQLManager = class {
+	path;
+	httpServer;
+	wsServer;
+	reactorClient;
+	relationalDb;
+	analyticsStore;
+	syncManager;
+	logger;
+	httpAdapter;
+	gatewayAdapter;
+	authService;
+	documentPermissionService;
+	featureFlags;
+	port;
+	syncServingGate;
+	httpRoutes;
 	initialized = false;
 	coreSubgraphsMap = /* @__PURE__ */ new Map();
 	contextFields = {};
@@ -6003,6 +6013,13 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					throw error;
 				}
 			},
+			/**
+			* Gated on reading the document, the same gate every other read here
+			* carries: a verdict is derived from the document's policy, so a caller
+			* who may not read the document may not preflight against it either.
+			* That gate decides whether the query runs; the answer comes entirely
+			* from the reactor's decision model.
+			*/
 			evaluateActions: async (_parent, args, ctx) => {
 				this.logger.debug("evaluateActions(@args)", args);
 				try {
@@ -6378,10 +6395,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.3-dev.24";
+	return "6.2.3-dev.25";
 }
 function getGitHash() {
-	return "895cfda0dfc73ba08e40437ca258507d8b2c9377";
+	return "e44ced14916428517ebc9e26d9bfb53d1d86cbc0";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -6482,7 +6499,8 @@ var HttpPackageLoader = class {
 	async loadUpgradeManifests(packageSpec) {
 		const { name: packageName } = this.parsePackageSpec(packageSpec);
 		if (!this.isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
-		const manifests = extractUpgradeManifests(await import(`${this.registryUrl}-/cdn/${packageSpec}/node/document-models/index.mjs`));
+		const module = await import(`${this.registryUrl}-/cdn/${packageSpec}/node/document-models/index.mjs`);
+		const manifests = extractUpgradeManifests(module);
 		if (manifests.length > 0) this.logger.verbose(`Loaded ${manifests.length} upgrade manifests from ${packageName}`);
 		return manifests;
 	}
@@ -6673,10 +6691,11 @@ var ImportPackageLoader = class {
 			this.reportUnbuilt(identifier, root, listPath);
 			return [];
 		}
-		const pieces = piecesFromListModule(await import(
+		const module = await import(
 			/* @vite-ignore */
 			pathToFileURL(listPath).href
-), {
+);
+		const pieces = piecesFromListModule(module, {
 			root,
 			identifier,
 			logger: this.logger
@@ -6726,6 +6745,7 @@ function getUniqueUpgradeManifests(...upgradeManifests) {
 	return Array.from(uniqueManifests.values());
 }
 var PackageManager = class {
+	options;
 	logger = childLogger(["reactor-api", "package-manager"]);
 	loaders;
 	docModelsMap = /* @__PURE__ */ new Map();
@@ -7080,20 +7100,41 @@ async function createStartupAttachmentBackend({ db, env = process.env, s3Depende
 }
 //#endregion
 //#region src/services/attachment-access.service.ts
+/** The scope an attachment's bytes belong to: the document's own domain state. */
+const ATTACHMENT_SCOPE = "global";
+/** The branch an attachment reference is resolved against. */
+const ATTACHMENT_BRANCH = "main";
 const HASH_PATTERN = /^[a-f0-9]{64}$/;
 /**
 * Composes document authorization with the projected document/ref
 * relationship. Order is fixed: validate ref, resolve the canonical document
-* id, check `canRead`, then check the reference index. A denied document
+* id, decide the read, then check the reference index. A denied document
 * never reaches the reference reader, and the facade never touches
 * attachment metadata, storage backends, or presigners.
+*
+* The read is decided by the document's own policy when this composition has a
+* model to enforce it with, and by the host's permission tables when it does
+* not. That is not a preference between two equivalent answers: a host running
+* document policies keeps no rows in the permission tables, so asking them
+* about such a document returns whatever the host-wide policy says — under
+* `OPEN`, `true`, for everyone. Serving bytes on that answer hands the file to
+* anyone who learns its hash, which the document's own state may well have told
+* them. Both are kept because they are the two halves of one rule: an
+* attachment is readable by whoever may read the document that references it,
+* and each composition can only express that in its own terms.
 */
 var AttachmentAccessService = class {
-	constructor(resolveCanonicalId, authorization, references, projection) {
+	resolveCanonicalId;
+	authorization;
+	references;
+	projection;
+	scopeGate;
+	constructor(resolveCanonicalId, authorization, references, projection, scopeGate) {
 		this.resolveCanonicalId = resolveCanonicalId;
 		this.authorization = authorization;
 		this.references = references;
 		this.projection = projection;
+		this.scopeGate = scopeGate;
 	}
 	async canReadAttachment(request) {
 		if (this.projection.status !== "available") return { kind: "projection-unavailable" };
@@ -7105,7 +7146,7 @@ var AttachmentAccessService = class {
 		} catch {
 			return { kind: "denied" };
 		}
-		if (!await this.authorization.canRead(documentId, request.userAddress)) return { kind: "denied" };
+		if (!await this.canReadDocument(documentId, request)) return { kind: "denied" };
 		if (!await this.references.hasReference(documentId, ref)) return { kind: "denied" };
 		return {
 			kind: "allowed",
@@ -7113,6 +7154,21 @@ var AttachmentAccessService = class {
 			ref
 		};
 	}
+	/**
+	* Whether the caller may read the state the reference lives in.
+	*
+	* A failure here is rethrown rather than turned into a denial. A read side
+	* that is down must not read as a policy: a denial nobody can distinguish
+	* from a refusal is one nobody investigates, and the route answers 500 for a
+	* reason.
+	*/
+	async canReadDocument(documentId, request) {
+		if (!this.scopeGate) return this.authorization.canRead(documentId, request.userAddress);
+		return (await this.scopeGate.scopePredicateById(documentId, {
+			address: request.userAddress,
+			key: request.appKey
+		}, ATTACHMENT_BRANCH))(ATTACHMENT_SCOPE);
+	}
 };
 /**
 * Parses and canonicalizes a caller-supplied ref through the shared parser.
@@ -7596,6 +7652,7 @@ async function createRenownCredentialVerifier(config = {}) {
 * - Users can be granted permission to execute specific operations
 */
 var DocumentPermissionService = class {
+	db;
 	config;
 	constructor(db, config = { defaultProtection: false }) {
 		this.db = db;
@@ -8098,6 +8155,17 @@ function assertRequireAuthenticatedCallerAllowed(requireAuthenticatedCaller, res
 	if (!requireAuthenticatedCaller || resolvesCallerIdentity) return;
 	throw new Error("REQUIRE_AUTHENTICATED_CALLER is set but refused: it rejects every request without a resolved caller, and with neither AUTH_ENABLED nor RESOLVE_CALLER_IDENTITY the server never reads a bearer, so it would reject every caller, including authenticated ones. Enable identity resolution first (RESOLVE_CALLER_IDENTITY=true or AUTH_ENABLED=true).");
 }
+/**
+* Deciding an attachment read by the document's policy needs a policy model to
+* decide with, and that is what auth enforcement supplies. Without one there is
+* nothing to consult, so the setting would silently leave the permission tables
+* in charge — configuration that describes a protection the server is not
+* applying, which is worse than no configuration at all. Refuse instead.
+*/
+function assertAttachmentPolicyReadsAllowed(attachmentReadsFollowDocumentPolicy, hasDecisionModel) {
+	if (!attachmentReadsFollowDocumentPolicy || hasDecisionModel) return;
+	throw new Error("ATTACHMENT_READS_FOLLOW_DOCUMENT_POLICY is set but refused: deciding an attachment read by the referencing document's policy requires a policy model to evaluate, and this composition has none, so the host permission tables would keep deciding while the configuration says otherwise. Enable auth enforcement first (REACTOR_AUTH_ENFORCEMENT=true).");
+}
 function createReadinessGate() {
 	let ready = false;
 	return {
@@ -8288,6 +8356,7 @@ async function _setupCommonInfrastructure(options) {
 	let configuredResolveIdentity;
 	let configuredRequireAuth;
 	let configuredExemptPaths;
+	let configuredAttachmentPolicyReads;
 	let configuredRenown;
 	if (options.configFile) {
 		const config = getConfig(options.configFile);
@@ -8300,8 +8369,9 @@ async function _setupCommonInfrastructure(options) {
 		configuredResolveIdentity = options.auth.resolveIdentity;
 		configuredRequireAuth = options.auth.requireAuthenticatedCaller;
 		configuredExemptPaths = options.auth.requireAuthenticatedCallerExemptPaths;
+		configuredAttachmentPolicyReads = options.auth.attachmentReadsFollowDocumentPolicy;
 	}
-	const { AUTH_ENABLED, RESOLVE_CALLER_IDENTITY, REQUIRE_AUTHENTICATED_CALLER, REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION, CREDENTIAL_VERIFICATION_CACHE_TTL_MS } = process.env;
+	const { AUTH_ENABLED, RESOLVE_CALLER_IDENTITY, REQUIRE_AUTHENTICATED_CALLER, REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS, ATTACHMENT_READS_FOLLOW_DOCUMENT_POLICY, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION, CREDENTIAL_VERIFICATION_CACHE_TTL_MS } = process.env;
 	if (AUTH_ENABLED !== void 0) authEnabled = AUTH_ENABLED === "true";
 	/**
 	* Whether the auth middleware reads the bearer and populates `ctx.user`,
@@ -8344,6 +8414,18 @@ async function _setupCommonInfrastructure(options) {
 	*/
 	let requireAuthenticatedCallerExemptPaths = configuredExemptPaths ?? [];
 	if (REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS !== void 0) requireAuthenticatedCallerExemptPaths = REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS.split(",").map((path) => path.trim()).filter((path) => path.length > 0);
+	/**
+	* Whether an attachment read is decided by the referencing document's own
+	* policy rather than by the host's permission tables.
+	*
+	* Off by default, and a deployment's choice rather than something derived
+	* from the flags around it. Which model governs those bytes is configuration
+	* in the same sense the storage backend behind them is: a host that has said
+	* nothing keeps exactly the behaviour it has, and one that wants the change
+	* asks for it and can take it back without disturbing anything else.
+	*/
+	let attachmentReadsFollowDocumentPolicy = configuredAttachmentPolicyReads ?? false;
+	if (ATTACHMENT_READS_FOLLOW_DOCUMENT_POLICY !== void 0) attachmentReadsFollowDocumentPolicy = ATTACHMENT_READS_FOLLOW_DOCUMENT_POLICY === "true";
 	if (ADMINS !== void 0) admins = ADMINS.split(",").map((a) => a.toLowerCase());
 	let defaultProtection = false;
 	if (DEFAULT_PROTECTION !== void 0) defaultProtection = DEFAULT_PROTECTION.toLowerCase() === "true";
@@ -8420,7 +8502,7 @@ async function _setupCommonInfrastructure(options) {
 	await mkdir(attachmentStoragePath, { recursive: true });
 	const { db: attachmentDb, knex: attachmentKnex, pglite: attachmentPglite } = getDbClient(options.dbPath, options.pgliteFactory);
 	dbClosers.push(...makeDbClosers(attachmentKnex, attachmentPglite));
-	const ATTACHMENT_SWEEP_INTERVAL_MS = 3600 * 1e3;
+	const ATTACHMENT_SWEEP_INTERVAL_MS = 36e5;
 	const attachmentBackend = await createStartupAttachmentBackend({ db: attachmentDb });
 	const attachmentBuilder = new AttachmentBuilder(attachmentDb, attachmentStoragePath).withReservationSweepMs(ATTACHMENT_SWEEP_INTERVAL_MS);
 	if (attachmentBackend) attachmentBuilder.withBackend(attachmentBackend);
@@ -8465,13 +8547,14 @@ async function _setupCommonInfrastructure(options) {
 		attachmentReferenceIndex,
 		packages,
 		dbClosers,
-		readiness
+		readiness,
+		attachmentReadsFollowDocumentPolicy
 	};
 }
 /**
 * Private helper function containing common setup logic for API initialization
 */
-async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient, syncServingGate, httpRoutes) {
+async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient, syncServingGate, httpRoutes, attachmentReadsFollowDocumentPolicy = false) {
 	const hostModuleBase = {
 		...createReactorHostModuleBase({
 			client: reactorClient,
@@ -8513,7 +8596,8 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	const { httpServer, wsServer } = await startServer(httpAdapter, port, options.https, logger);
 	const authorizationService = createAuthorizationService(authorizationConfig, documentPermissionService, createGetParentIdsFn(reactorClient));
 	logger.info(`Authorization service initialized (policy: ${authorizationConfig.policy})`);
-	const attachmentAccess = new AttachmentAccessService(createCanonicalDocumentIdResolver(reactorClient), authorizationService, attachmentReferenceIndex.store, attachmentReferenceProjection);
+	assertAttachmentPolicyReadsAllowed(attachmentReadsFollowDocumentPolicy, syncServingGate !== void 0);
+	const attachmentAccess = new AttachmentAccessService(createCanonicalDocumentIdResolver(reactorClient), authorizationService, attachmentReferenceIndex.store, attachmentReferenceProjection, attachmentReadsFollowDocumentPolicy ? syncServingGate : void 0);
 	const coreSubgraphs = DefaultCoreSubgraphs.slice();
 	coreSubgraphs.push(ReactorSubgraph);
 	if (documentPermissionService) {
@@ -8599,7 +8683,7 @@ function buildApiDispose(args) {
 	};
 }
 async function initializeAndStartAPI(clientInitializer, options, processorApp) {
-	const { port, httpAdapter, httpRoutes, authFetchMiddleware, requireAuthFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, attachmentReferenceIndex, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
+	const { port, httpAdapter, httpRoutes, authFetchMiddleware, requireAuthFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, attachmentReferenceIndex, packages, dbClosers, readiness, attachmentReadsFollowDocumentPolicy } = await _setupCommonInfrastructure(options);
 	const { documentModels, upgradeManifests, processors, subgraphs } = await packages.init();
 	const { module: reactorClientModule, reactorDriveClient, attachmentReferenceProjection = {
 		status: "unavailable",
@@ -8616,7 +8700,7 @@ async function initializeAndStartAPI(clientInitializer, options, processorApp) {
 	const documentModelRegistry = reactorClientModule.reactorModule?.documentModelRegistry;
 	if (!documentModelRegistry) throw new Error("DocumentModelRegistry not available from InProcessReactorClientModule");
 	return {
-		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient, buildSyncServingGate(reactorClientModule.reactorModule, authorizationConfig, options.logger ?? defaultLogger), httpRoutes),
+		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient, buildSyncServingGate(reactorClientModule.reactorModule, authorizationConfig, options.logger ?? defaultLogger), httpRoutes, attachmentReadsFollowDocumentPolicy),
 		client: reactorClient,
 		syncManager,
 		documentModelRegistry,
@@ -8749,7 +8833,7 @@ var PackageManagementService = class {
 	}
 };
 //#endregion
-export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthDecision, AuthDecisionSchema, AuthEvaluationUnsupportedError, AuthService, AuthSubgraph, AuthenticationRequiredError, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CORE_PACKAGE_NAME, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, DocumentRelationshipFieldsFragmentDoc, EvaluateActionsDocument, FindDocumentsDocument, ForbiddenError, GetDocumentDocument, GetDocumentIncomingRelationshipEdgesDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipEdgesDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, HttpRouteService, ImportPackageLoader, InMemoryPackageStorage, InvalidNamespaceError, JobChangesDocument, MalformedStoredOperationError, MemoryWebhookStore, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PACKAGE_ROUTE_SEGMENT, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RelationalWebhookStore, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, UpdateRelationshipDocument, ViewFilterInputSchema, WEBHOOK_SEGMENT, WS_AUTH_CLOSE_REASONS, WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE_REASON_BEARER_REJECTED, WebhookService, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertHostMountPath, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, createWsAuthHandlers, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, namespacePath, namespaceSegments, newWebhookToken, parseDriveUrl, parseWebhookBody, redactHeaders, renderGraphqlPlayground, resolvePackageName, resolveRenownConfig, verifyWebhook };
+export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthDecision, AuthDecisionSchema, AuthEvaluationUnsupportedError, AuthService, AuthSubgraph, AuthenticationRequiredError, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CORE_PACKAGE_NAME, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, DocumentRelationshipFieldsFragmentDoc, EvaluateActionsDocument, FindDocumentsDocument, ForbiddenError, GetDocumentDocument, GetDocumentIncomingRelationshipEdgesDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipEdgesDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, HttpRouteService, ImportPackageLoader, InMemoryPackageStorage, InvalidNamespaceError, JobChangesDocument, MalformedStoredOperationError, MemoryWebhookStore, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PACKAGE_ROUTE_SEGMENT, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RelationalWebhookStore, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, UpdateRelationshipDocument, ViewFilterInputSchema, WEBHOOK_SEGMENT, WS_AUTH_CLOSE_REASONS, WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE_REASON_BEARER_REJECTED, WebhookService, assertAttachmentPolicyReadsAllowed, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertHostMountPath, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, createWsAuthHandlers, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, namespacePath, namespaceSegments, newWebhookToken, parseDriveUrl, parseWebhookBody, redactHeaders, renderGraphqlPlayground, resolvePackageName, resolveRenownConfig, verifyWebhook };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=29fbf62b-398f-53fa-ac67-5fcef3d5ac7d
+//# debugId=6828688f-9737-5852-b599-51439acc4894