@powerhousedao/reactor-api 6.2.3-dev.24 → 6.2.3-dev.26

package/dist/index.mjs

@@ -1,11 +1,12 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="29fbf62b-398f-53fa-ac67-5fcef3d5ac7d")}catch(e){}}();
-import { C as createAuthorizationService, D as MalformedStoredOperationError, E as ForbiddenError, S as AuthorizedDocumentHandle, T as AuthenticationRequiredError, _ as loadSubgraphs, a as piecesFromCdnList, b as createCanonicalDocumentIdResolver, c as buildGraphQlDriveDocument, d as isSubgraphClass, f as debounce, g as loadProcessors, h as loadDocumentModels, i as pieceListLocation, l as buildGraphqlOperation, o as piecesFromListModule, p as extractUpgradeManifests, r as PIECE_SOURCE_LIST, s as buildGraphQlDocument, u as buildGraphqlOperations, v as BaseSubgraph, w as AuthEvaluationUnsupportedError, x as AuthorizationPolicy, y as CanonicalDocumentIdResolutionError } from "./pieces-eqj2RKgd.mjs";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8ab62893-8127-51eb-9d6f-a5900b1823de")}catch(e){}}();
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { C as AuthorizedDocumentHandle, D as ForbiddenError, E as AuthenticationRequiredError, O as MalformedStoredOperationError, S as AuthorizationPolicy, T as AuthEvaluationUnsupportedError, _ as loadSubgraphs, a as piecesFromCdnList, b as CanonicalDocumentIdResolutionError, c as buildGraphQlDriveDocument, d as isSubgraphClass, f as debounce, g as loadProcessors, h as loadDocumentModels, i as pieceListLocation, l as buildGraphqlOperation, o as piecesFromListModule, p as extractUpgradeManifests, r as PIECE_SOURCE_LIST, s as buildGraphQlDocument, u as buildGraphqlOperations, v as BaseSubgraph, w as createAuthorizationService, x as createCanonicalDocumentIdResolver, y as callerSubject } from "./pieces-DMQotfIR.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
 import { GraphQLError, Kind, parse, print } from "graphql";
-import { AuthEnforcementDisabledError, DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, ModelReadGate, PropagationMode as PropagationMode$1, SyncScopeGate, consolidateSyncOperations, createReactorHostModuleBase, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl, readDecisionModel, syncOperationErrorType } from "@powerhousedao/reactor";
+import { AuthEnforcementDisabledError, BareReadGate, DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, JobStatus, ModelReadGate, PropagationMode as PropagationMode$1, SyncScopeGate, consolidateSyncOperations, createReactorHostModuleBase, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl, readDecisionModel, syncOperationErrorType } from "@powerhousedao/reactor";
 import { ConsoleLogger, childLogger, documentModelDocumentModelModule } from "document-model";
 import path, { isAbsolute, join } from "node:path";
 import { match } from "path-to-regexp";
@@ -47,19 +48,8 @@ import { AtomicNodeFs } from "@powerhousedao/pglite-fs";
 import knex from "knex";
 import ClientPgLite from "knex-pglite";
 import { KyselyKnexDialect, PGColdDialect } from "kysely-knex";
-//#region \0rolldown/runtime.js
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-//#endregion
 //#region src/graphql/analytics-subgraph.ts
+const analyticsResolvers = AnalyticsResolvers;
 var AnalyticsSubgraph = class extends BaseSubgraph {
 	analyticsStore;
 	analyticsModel;
@@ -67,13 +57,33 @@ var AnalyticsSubgraph = class extends BaseSubgraph {
 	typeDefs = gql`
     ${typedefs}
   `;
-	resolvers = AnalyticsResolvers;
+	/**
+	* Every analytics field hangs off `Query.analytics`, so gating it gates them
+	* all. Series are aggregates a processor built from many documents and carry
+	* no document to decide on, so only a caller with policy-wide read (anyone
+	* under OPEN, an admin otherwise) may read them.
+	*/
+	resolvers = {
+		...analyticsResolvers,
+		Query: {
+			...analyticsResolvers.Query,
+			analytics: (parent, args, ctx) => {
+				this.#assertCanReadAnalytics(ctx);
+				return analyticsResolvers.Query.analytics(parent, args, ctx);
+			}
+		}
+	};
 	constructor(args) {
 		super(args);
 		this.analyticsStore = args.analyticsStore;
 		this.analyticsModel = new AnalyticsModel(new AnalyticsQueryEngine(this.analyticsStore));
 		args.graphqlManager.setAdditionalContextFields({ dataSources: { db: { Analytics: this.analyticsModel } } });
 	}
+	#assertCanReadAnalytics(ctx) {
+		if (this.authorizationService.isSupremeAdmin(ctx.user?.address)) return;
+		if (ctx.user?.address) throw new ForbiddenError("to read analytics");
+		throw new AuthenticationRequiredError("to read analytics");
+	}
 };
 //#endregion
 //#region src/graphql/auth/schema.graphql
@@ -312,15 +322,15 @@ function createAuthFetchMiddleware(authService) {
 async function createGatewayAdapter(type, logger) {
 	switch (type) {
 		case "apollo": {
-			const { ApolloGatewayAdapter } = await import("./adapter-gateway-apollo-DowrX6E_.mjs");
+			const { ApolloGatewayAdapter } = await import("./adapter-gateway-apollo-D2DNlPY0.mjs");
 			return new ApolloGatewayAdapter(logger);
 		}
 		case "mercurius": {
-			const { MercuriusGatewayAdapter } = await import("./adapter-gateway-mercurius-CZVy88Za.mjs");
+			const { MercuriusGatewayAdapter } = await import("./adapter-gateway-mercurius-rbKlwF9m.mjs");
 			return new MercuriusGatewayAdapter(logger);
 		}
 		case "stitching": {
-			const { StitchingGatewayAdapter } = await import("./adapter-gateway-stitching-CaZjvRzx.mjs");
+			const { StitchingGatewayAdapter } = await import("./adapter-gateway-stitching-Dzv10u8D.mjs");
 			return new StitchingGatewayAdapter(logger);
 		}
 	}
@@ -328,11 +338,11 @@ async function createGatewayAdapter(type, logger) {
 async function createHttpAdapter(type) {
 	switch (type) {
 		case "express": {
-			const { createExpressHttpAdapter } = await import("./adapter-http-express-D4KBmDcQ.mjs");
+			const { createExpressHttpAdapter } = await import("./adapter-http-express-CWqziB1p.mjs");
 			return createExpressHttpAdapter();
 		}
 		case "fastify": {
-			const { createFastifyHttpAdapter } = await import("./adapter-http-fastify-U9j7HxQE.mjs");
+			const { createFastifyHttpAdapter } = await import("./adapter-http-fastify-CYZQ6FFv.mjs");
 			return createFastifyHttpAdapter();
 		}
 	}
@@ -360,7 +370,7 @@ const WS_AUTH_CLOSE_REASONS = [WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE
 */
 const SEGMENT = /^[a-z0-9][-a-z0-9._]*$/i;
 /** Segments that would read as path traversal rather than as a name. */
-const TRAVERSAL = new Set([".", ".."]);
+const TRAVERSAL = /* @__PURE__ */ new Set([".", ".."]);
 var InvalidNamespaceError = class extends Error {};
 /**
 * Turns a package name into the path segments it occupies.
@@ -846,27 +856,29 @@ var HttpScope = class {
 			headers: fetchHeaders(req),
 			signal: controller.signal
 		};
-		if (method !== "GET" && method !== "HEAD" && body !== "none") if (body === "stream") init = {
-			...init,
-			body: Readable.toWeb(req),
-			duplex: "half"
-		};
-		else {
-			try {
-				raw = await readBody(req, spec.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES$1);
-			} catch (error) {
-				if (error instanceof BodyTooLargeError) {
-					res.setHeader("connection", "close");
-					res.once("finish", () => req.destroy());
-					writeError(res, 413, "Payload too large");
-					return;
-				}
-				throw error;
-			}
-			if (raw.length) init = {
+		if (method !== "GET" && method !== "HEAD" && body !== "none") {
+			if (body === "stream") init = {
 				...init,
-				body: new Uint8Array(raw.buffer, raw.byteOffset, raw.byteLength)
+				body: Readable.toWeb(req),
+				duplex: "half"
 			};
+			else {
+				try {
+					raw = await readBody(req, spec.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES$1);
+				} catch (error) {
+					if (error instanceof BodyTooLargeError) {
+						res.setHeader("connection", "close");
+						res.once("finish", () => req.destroy());
+						writeError(res, 413, "Payload too large");
+						return;
+					}
+					throw error;
+				}
+				if (raw.length) init = {
+					...init,
+					body: new Uint8Array(raw.buffer, raw.byteOffset, raw.byteLength)
+				};
+			}
 		}
 		await writeResponse(res, await spec.handler(new Request(url, init), {
 			...ctx,
@@ -1043,7 +1055,7 @@ function verifyWebhook(options) {
 }
 /** Headers that would put a credential in a log or run journal. The configured signature
 * header joins them: it is an HMAC of the body under a live secret. */
-const REDACTED_HEADERS = new Set([
+const REDACTED_HEADERS = /* @__PURE__ */ new Set([
 	"authorization",
 	"proxy-authorization",
 	"cookie",
@@ -1316,6 +1328,7 @@ function newWebhookToken() {
 const NAMESPACE = "reactor_webhooks";
 /** Relational implementation, over the reactor's own database. */
 var RelationalWebhookStore = class {
+	relationalDb;
 	#db;
 	constructor(relationalDb) {
 		this.relationalDb = relationalDb;
@@ -1461,7 +1474,7 @@ const stripScalarDefinitions = (doc) => {
 * whole gateway. We dedupe these by name; field/operation/extension nodes are
 * left untouched.
 */
-const TYPE_DEFINITION_KINDS = new Set([
+const TYPE_DEFINITION_KINDS = /* @__PURE__ */ new Set([
 	Kind.OBJECT_TYPE_DEFINITION,
 	Kind.ENUM_TYPE_DEFINITION,
 	Kind.INPUT_OBJECT_TYPE_DEFINITION,
@@ -1563,7 +1576,7 @@ const getDocumentModelTypeDefs = (documentModels, typeDefs$1) => {
               stateJSON: JSONObject
           }\n`;
 	});
-	return dedupeTypeDefinitions(gql`
+	const schema = gql`
     scalar JSONObject
     scalar AttachmentRef
     # Codegen scalars not in the document-engineering set.
@@ -1639,7 +1652,8 @@ const getDocumentModelTypeDefs = (documentModels, typeDefs$1) => {
     }
 
     ${stripScalarDefinitions(typeDefs$1)}
-  `);
+  `;
+	return dedupeTypeDefinitions(schema);
 };
 /**
 * Extract type names from a GraphQL schema.
@@ -1735,9 +1749,7 @@ function generateStateInputTypes(stateSchema, excludeTypeNames) {
 		case Kind.OBJECT_TYPE_DEFINITION:
 			objectNames.add(def.name.value);
 			break;
-		case Kind.INPUT_OBJECT_TYPE_DEFINITION:
-			existingInputNames.add(def.name.value);
-			break;
+		case Kind.INPUT_OBJECT_TYPE_DEFINITION: existingInputNames.add(def.name.value);
 	}
 	const inputTypes = [];
 	for (const def of ast.definitions) {
@@ -1766,7 +1778,7 @@ function applyGraphQLTypePrefixes(schema, prefix, externalTypeNames = []) {
 	if (!schema || !schema.trim()) return schema;
 	let processedSchema = schema;
 	const localTypeNames = extractTypeNames(schema);
-	const allTypeNames = [...new Set([...localTypeNames, ...externalTypeNames])];
+	const allTypeNames = [.../* @__PURE__ */ new Set([...localTypeNames, ...externalTypeNames])];
 	if (allTypeNames.length === 0) return schema;
 	allTypeNames.forEach((typeName) => {
 		const typeRegex = new RegExp(`(?<![_A-Za-z0-9])(${typeName})(?![_A-Za-z0-9])|\\[(${typeName})\\]|\\[(${typeName})!\\]|\\[(${typeName})\\]!|\\[(${typeName})!\\]!`, "g");
@@ -1794,8 +1806,9 @@ function generateDocumentModelSchema(documentModel, options = {}) {
 	const localStateTypeNames = extractTypeNames(localStateSchema ?? "");
 	const stateTypeNames = [...globalStateTypeNames, ...localStateTypeNames];
 	const allOperationTypeNames = specification?.modules.flatMap((module) => module.operations.flatMap((op) => extractTypeNames(op.schema ?? ""))) ?? [];
-	const allTypeNames = [...new Set([...stateTypeNames, ...allOperationTypeNames])];
-	const prefixedStateInputTypes = applyGraphQLTypePrefixes(extractInputTypeDefinitions(globalStateSchema ?? "", new Set(allOperationTypeNames)), documentName, allTypeNames);
+	const allTypeNames = [.../* @__PURE__ */ new Set([...stateTypeNames, ...allOperationTypeNames])];
+	const operationInputTypeNames = new Set(allOperationTypeNames);
+	const prefixedStateInputTypes = applyGraphQLTypePrefixes(extractInputTypeDefinitions(globalStateSchema ?? "", operationInputTypeNames), documentName, allTypeNames);
 	const hasValidSchema = (schema) => !!(schema && /\b(input|type|enum|union|interface)\s+\w+/.test(schema));
 	const stateSchemaTypes = globalStateSchema ? applyGraphQLTypePrefixes(globalStateSchema.replaceAll("scalar DateTime", "").replaceAll(/input (.*?) {[\s\S]*?}/g, ""), documentName, allTypeNames) : "";
 	if (useNewApi) return generateNewApiSchema(documentName, specification, stateSchemaTypes, prefixedStateInputTypes, allTypeNames, hasValidSchema);
@@ -1925,7 +1938,6 @@ function generateNewApiSchema(documentName, specification, _stateSchemaTypes, pr
     """
     type ${documentName}_DocumentResultPage {
       items: [${documentName}MutationResult!]!
-      totalCount: Int!
       hasNextPage: Boolean!
       hasPreviousPage: Boolean!
       cursor: String
@@ -2251,7 +2263,6 @@ const GetDocumentModelsDocument = gql`
         version
         specification
       }
-      totalCount
       hasNextPage
       hasPreviousPage
       cursor
@@ -2310,7 +2321,6 @@ const GetDocumentWithOperationsDocument = gql`
               }
             }
           }
-          totalCount
           hasNextPage
           hasPreviousPage
           cursor
@@ -2337,7 +2347,6 @@ const GetDocumentOutgoingRelationshipsDocument = gql`
       items {
         ...PHDocumentFields
       }
-      totalCount
       hasNextPage
       hasPreviousPage
       cursor
@@ -2361,7 +2370,6 @@ const GetDocumentIncomingRelationshipsDocument = gql`
       items {
         ...PHDocumentFields
       }
-      totalCount
       hasNextPage
       hasPreviousPage
       cursor
@@ -2385,7 +2393,6 @@ const GetDocumentOutgoingRelationshipEdgesDocument = gql`
       items {
         ...DocumentRelationshipFields
       }
-      totalCount
       hasNextPage
       hasPreviousPage
       cursor
@@ -2409,7 +2416,6 @@ const GetDocumentIncomingRelationshipEdgesDocument = gql`
       items {
         ...DocumentRelationshipFields
       }
-      totalCount
       hasNextPage
       hasPreviousPage
       cursor
@@ -2427,7 +2433,6 @@ const FindDocumentsDocument = gql`
       items {
         ...PHDocumentFields
       }
-      totalCount
       hasNextPage
       hasPreviousPage
       cursor
@@ -2471,7 +2476,6 @@ const GetDocumentOperationsDocument = gql`
           }
         }
       }
-      totalCount
       hasNextPage
       hasPreviousPage
       cursor
@@ -2910,8 +2914,7 @@ function toDocumentModelResultPage(result) {
 		cursor: result.nextCursor ?? null,
 		hasNextPage: !!result.nextCursor,
 		hasPreviousPage: !!result.options.cursor,
-		items: models.map(toGqlDocumentModelState),
-		totalCount: result.results.length
+		items: models.map(toGqlDocumentModelState)
 	};
 }
 /**
@@ -2943,8 +2946,7 @@ function toPhDocumentResultPage(result) {
 		cursor: result.nextCursor ?? null,
 		hasNextPage: !!result.nextCursor,
 		hasPreviousPage: !!result.options.cursor,
-		items: result.results.map(toGqlPhDocument),
-		totalCount: result.totalCount ?? result.results.length
+		items: result.results.map(toGqlPhDocument)
 	};
 }
 /**
@@ -2969,8 +2971,7 @@ function toDocumentRelationshipResultPage(result) {
 		cursor: result.nextCursor ?? null,
 		hasNextPage: !!result.nextCursor,
 		hasPreviousPage: !!result.options.cursor,
-		items: result.results.map(toGqlDocumentRelationship),
-		totalCount: result.totalCount ?? result.results.length
+		items: result.results.map(toGqlDocumentRelationship)
 	};
 }
 /**
@@ -3020,8 +3021,8 @@ function fromInputMaybe(value) {
 function toReactorPropagationMode(gqlMode) {
 	if (gqlMode == null) return;
 	switch (gqlMode) {
-		case PropagationMode.Cascade: return PropagationMode$1.Cascade;
-		case PropagationMode.Orphan: return PropagationMode$1.None;
+		case "CASCADE": return PropagationMode$1.Cascade;
+		case "ORPHAN": return PropagationMode$1.None;
 	}
 }
 /**
@@ -3031,10 +3032,10 @@ function toReactorPropagationMode(gqlMode) {
 */
 function toGqlActionEvaluation(evaluation) {
 	return evaluation.decision === "allow" ? {
-		decision: AuthDecision.Allow,
+		decision: "ALLOW",
 		reason: null
 	} : {
-		decision: AuthDecision.Deny,
+		decision: "DENY",
 		reason: evaluation.reason
 	};
 }
@@ -3239,8 +3240,7 @@ function toOperationResultPage(result) {
 		cursor: result.nextCursor ?? null,
 		hasNextPage: !!result.nextCursor,
 		hasPreviousPage: !!result.options.cursor && result.options.cursor !== "0",
-		items: result.results.map(serializeOperationForGraphQL),
-		totalCount: result.results.length
+		items: result.results.map(serializeOperationForGraphQL)
 	};
 }
 function toGqlDocumentChangeEvent(event) {
@@ -3312,6 +3312,21 @@ function pickDriveClient(reactorClient, driveContainerType, reactorDriveClient)
 	}
 	return reactorClient.drives;
 }
+/**
+* A mutation's document re-read as the caller, since the client reads it back
+* as its signer. A caller who may write but not read gets it stripped.
+*/
+async function readAsCaller(reactorClient, document, subject, branch) {
+	if (!subject) return document;
+	try {
+		return await reactorClient.get(document.header.id, {
+			subject,
+			branch
+		});
+	} catch (error) {
+		throw new GraphQLError(`Failed to read the document back: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+}
 async function documentModels(reactorClient, args) {
 	const namespace = fromInputMaybe(args.namespace);
 	let paging;
@@ -3499,13 +3514,42 @@ async function findDocuments(reactorClient, args, subject) {
 		throw new GraphQLError(`Failed to convert documents to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function jobStatus(reactorClient, args) {
+/**
+* The answer for a job the caller may not see, shaped as the reactor answers
+* an unknown one so that the two cannot be told apart.
+*/
+function unknownJob(jobId) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	return {
+		id: jobId,
+		documentId: "",
+		status: JobStatus.FAILED,
+		createdAtUtcIso: now,
+		completedAtUtcIso: now,
+		error: {
+			name: "Error",
+			message: "Job not found",
+			stack: ""
+		},
+		consistencyToken: {
+			version: 1,
+			createdAtUtcIso: now,
+			coordinates: []
+		},
+		meta: {
+			batchId: jobId,
+			batchJobIds: [jobId]
+		}
+	};
+}
+async function jobStatus(reactorClient, args, serves) {
 	let result;
 	try {
 		result = await reactorClient.getJobStatus(args.jobId);
 	} catch (error) {
 		throw new GraphQLError(`Failed to fetch job status: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	if (!await serves(result.documentId)) result = unknownJob(args.jobId);
 	try {
 		return toGqlJobInfo(result);
 	} catch (error) {
@@ -3588,7 +3632,7 @@ async function evaluateActions(reactorClient, args, subject) {
 		anyDenied: result.anyDenied
 	};
 }
-async function createDocument(reactorClient, args, reactorDriveClient) {
+async function createDocument(reactorClient, args, reactorDriveClient, subject) {
 	if (!args.document || typeof args.document !== "object") throw new GraphQLError("Invalid document: must be an object");
 	const document = args.document;
 	if (!document.header || typeof document.header !== "object") throw new GraphQLError("Invalid document: missing or invalid header");
@@ -3596,28 +3640,30 @@ async function createDocument(reactorClient, args, reactorDriveClient) {
 	let result;
 	try {
 		if (parentIdentifier) {
-			const parent = await reactorClient.get(parentIdentifier);
+			const parent = await reactorClient.get(parentIdentifier, subject && { subject });
 			if (isDriveContainerType(parent.header.documentType)) result = await pickDriveClient(reactorClient, parent.header.documentType, reactorDriveClient).addFile(parentIdentifier, document);
 			else result = await reactorClient.create(document, parentIdentifier);
 		} else result = await reactorClient.create(document);
 	} catch (error) {
 		throw new GraphQLError(`Failed to create document: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	result = await readAsCaller(reactorClient, result, subject);
 	try {
 		return toGqlPhDocument(result);
 	} catch (error) {
 		throw new GraphQLError(`Failed to convert created document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function createEmptyDocument(reactorClient, args, reactorDriveClient) {
+async function createEmptyDocument(reactorClient, args, reactorDriveClient, subject) {
 	const parentIdentifier = fromInputMaybe(args.parentIdentifier);
 	const name = fromInputMaybe(args.name);
 	let result;
 	try {
 		if (parentIdentifier) {
-			const parent = await reactorClient.get(parentIdentifier);
+			const parent = await reactorClient.get(parentIdentifier, subject && { subject });
 			if (isDriveContainerType(parent.header.documentType)) {
-				const document = withSignaturePolicy((await reactorClient.getDocumentModelModule(args.documentType)).utils.createDocument(), await reactorClient.getCreateSignaturePolicy());
+				const module = await reactorClient.getDocumentModelModule(args.documentType);
+				const document = withSignaturePolicy(module.utils.createDocument(), await reactorClient.getCreateSignaturePolicy());
 				if (name) document.header.name = name;
 				result = await pickDriveClient(reactorClient, parent.header.documentType, reactorDriveClient).addFile(parentIdentifier, document);
 			} else result = await reactorClient.createEmpty(args.documentType, { parentIdentifier });
@@ -3625,13 +3671,14 @@ async function createEmptyDocument(reactorClient, args, reactorDriveClient) {
 	} catch (error) {
 		throw new GraphQLError(`Failed to create empty document: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	result = await readAsCaller(reactorClient, result, subject);
 	try {
 		return toGqlPhDocument(result);
 	} catch (error) {
 		throw new GraphQLError(`Failed to convert created document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function createDocumentWithInitialState(reactorClient, args, reactorDriveClient) {
+async function createDocumentWithInitialState(reactorClient, args, reactorDriveClient, subject) {
 	const parentIdentifier = fromInputMaybe(args.parentIdentifier);
 	const name = fromInputMaybe(args.name);
 	const slug = fromInputMaybe(args.slug);
@@ -3659,7 +3706,7 @@ async function createDocumentWithInitialState(reactorClient, args, reactorDriveC
 	if (parentIdentifier) {
 		let parent;
 		try {
-			parent = await reactorClient.get(parentIdentifier);
+			parent = await reactorClient.get(parentIdentifier, subject && { subject });
 		} catch (error) {
 			throw new GraphQLError(`Parent document not found: ${error instanceof Error ? error.message : "Unknown error"}`);
 		}
@@ -3680,6 +3727,7 @@ async function createDocumentWithInitialState(reactorClient, args, reactorDriveC
 	} catch (error) {
 		throw new GraphQLError(`Failed to create document: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	result = await readAsCaller(reactorClient, result, subject);
 	try {
 		return toGqlPhDocument(result);
 	} catch (error) {
@@ -3696,12 +3744,12 @@ const DEFAULT_BRANCH = "main";
 * the schema cannot express: a signature travels as one string, and verification
 * reads it as the tuple it was.
 */
-async function execute(reactorClient, args) {
+async function execute(reactorClient, args, subject) {
 	const actions = toSubmittableActions(args.actions);
 	const branch = fromInputMaybe(args.branch) ?? DEFAULT_BRANCH;
 	let result;
 	try {
-		result = await reactorClient.execute(args.documentIdentifier, branch, actions);
+		result = await reactorClient.execute(args.documentIdentifier, branch, actions, void 0, subject);
 	} catch (error) {
 		throw new GraphQLError(`Failed to execute actions: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -3729,7 +3777,7 @@ async function executeAsync(reactorClient, args) {
 	}
 	return toGqlJobInfo(job);
 }
-async function mutateDocument(reactorClient, args) {
+async function mutateDocument(reactorClient, args, subject) {
 	let validatedActions;
 	try {
 		validatedActions = validateActions(args.actions);
@@ -3740,7 +3788,7 @@ async function mutateDocument(reactorClient, args) {
 	const branch = args.view?.branch ?? "main";
 	let result;
 	try {
-		result = await reactorClient.execute(args.documentIdentifier, branch, validatedActions);
+		result = await reactorClient.execute(args.documentIdentifier, branch, validatedActions, void 0, subject);
 	} catch (error) {
 		throw new GraphQLError(`Failed to mutate document: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -3767,7 +3815,7 @@ async function mutateDocumentAsync(reactorClient, args) {
 	}
 	return result.id;
 }
-async function renameDocument(reactorClient, args, signal) {
+async function renameDocument(reactorClient, args, signal, subject) {
 	const branch = fromInputMaybe(args.branch);
 	let result;
 	try {
@@ -3775,13 +3823,14 @@ async function renameDocument(reactorClient, args, signal) {
 	} catch (error) {
 		throw new GraphQLError(`Failed to rename document: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	result = await readAsCaller(reactorClient, result, subject, branch);
 	try {
 		return toGqlPhDocument(result);
 	} catch (error) {
 		throw new GraphQLError(`Failed to convert renamed document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function setPreferredEditor(reactorClient, args, signal) {
+async function setPreferredEditor(reactorClient, args, signal, subject) {
 	const branch = fromInputMaybe(args.branch);
 	const preferredEditor = fromInputMaybe(args.preferredEditor) ?? null;
 	let result;
@@ -3790,13 +3839,14 @@ async function setPreferredEditor(reactorClient, args, signal) {
 	} catch (error) {
 		throw new GraphQLError(`Failed to set preferred editor: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	result = await readAsCaller(reactorClient, result, subject, branch);
 	try {
 		return toGqlPhDocument(result);
 	} catch (error) {
 		throw new GraphQLError(`Failed to convert updated document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function addRelationship(reactorClient, args) {
+async function addRelationship(reactorClient, args, subject) {
 	const branch = fromInputMaybe(args.branch);
 	const metadata = fromInputMaybe(args.metadata);
 	let result;
@@ -3805,13 +3855,14 @@ async function addRelationship(reactorClient, args) {
 	} catch (error) {
 		throw new GraphQLError(`Failed to add relationship: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	result = await readAsCaller(reactorClient, result, subject, branch);
 	try {
 		return toGqlPhDocument(result);
 	} catch (error) {
 		throw new GraphQLError(`Failed to convert document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function updateRelationship(reactorClient, args) {
+async function updateRelationship(reactorClient, args, subject) {
 	const branch = fromInputMaybe(args.branch);
 	const metadata = fromInputMaybe(args.metadata) ?? null;
 	let result;
@@ -3820,13 +3871,14 @@ async function updateRelationship(reactorClient, args) {
 	} catch (error) {
 		throw new GraphQLError(`Failed to update relationship: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	result = await readAsCaller(reactorClient, result, subject, branch);
 	try {
 		return toGqlPhDocument(result);
 	} catch (error) {
 		throw new GraphQLError(`Failed to convert document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function removeRelationship(reactorClient, args) {
+async function removeRelationship(reactorClient, args, subject) {
 	const branch = fromInputMaybe(args.branch);
 	let result;
 	try {
@@ -3834,13 +3886,14 @@ async function removeRelationship(reactorClient, args) {
 	} catch (error) {
 		throw new GraphQLError(`Failed to remove relationship: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	result = await readAsCaller(reactorClient, result, subject, branch);
 	try {
 		return toGqlPhDocument(result);
 	} catch (error) {
 		throw new GraphQLError(`Failed to convert document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function moveRelationship(reactorClient, args) {
+async function moveRelationship(reactorClient, args, subject) {
 	const branch = fromInputMaybe(args.branch);
 	let result;
 	try {
@@ -3848,6 +3901,10 @@ async function moveRelationship(reactorClient, args) {
 	} catch (error) {
 		throw new GraphQLError(`Failed to move relationship: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	result = {
+		source: await readAsCaller(reactorClient, result.source, subject, branch),
+		target: await readAsCaller(reactorClient, result.target, subject, branch)
+	};
 	try {
 		return {
 			source: toGqlPhDocument(result.source),
@@ -4137,6 +4194,16 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 		const documentName = getDocumentModelSchemaName(this.documentModel.documentModel.global);
 		return this.resolvers[`${documentName}Mutations`];
 	}
+	/** Drops the items the host's own ACL refuses the caller. */
+	async #readableItems(page, ctx) {
+		if (this.authorizationService.isSupremeAdmin(ctx.user?.address)) return page;
+		const items = [];
+		for (const item of page.items) if (await this.canReadDocument(item.id, ctx)) items.push(item);
+		return {
+			...page,
+			items
+		};
+	}
 	/**
 	* Generate __resolveType functions for union types found in the document model schema.
 	* Parses the state schema to find union definitions and their member types,
@@ -4197,7 +4264,7 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 					const result = await document(this.reactorClient, {
 						identifier,
 						view
-					});
+					}, this.viewSubject(ctx));
 					if (result.document.documentType !== documentType) throw new GraphQLError(`Document with id ${identifier} is not of type ${documentType}`);
 					await this.assertCanReadCanonical(result.document.id, ctx);
 					return result;
@@ -4207,17 +4274,8 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 					const result = await findDocuments(this.reactorClient, {
 						search: { type: documentType },
 						paging
-					});
-					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
-						const filteredItems = [];
-						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
-						return {
-							...result,
-							items: filteredItems,
-							totalCount: filteredItems.length
-						};
-					}
-					return result;
+					}, this.viewSubject(ctx));
+					return this.#readableItems(result, ctx);
 				},
 				findDocuments: async (_, args, ctx) => {
 					const { search, view, paging } = args;
@@ -4228,17 +4286,8 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						},
 						view,
 						paging
-					});
-					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
-						const filteredItems = [];
-						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
-						return {
-							...result,
-							items: filteredItems,
-							totalCount: filteredItems.length
-						};
-					}
-					return result;
+					}, this.viewSubject(ctx));
+					return this.#readableItems(result, ctx);
 				},
 				documentOutgoingRelationships: async (_, args, ctx) => {
 					const { relationshipType, view, paging } = args;
@@ -4248,23 +4297,24 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						relationshipType,
 						view,
 						paging
-					});
-					const filteredItems = result.items.filter((item) => item.documentType === documentType);
+					}, this.viewSubject(ctx));
+					const readable = await this.#readableItems(result, ctx);
+					const filteredItems = readable.items.filter((item) => item.documentType === documentType);
 					return {
-						...result,
-						items: filteredItems,
-						totalCount: filteredItems.length
+						...readable,
+						items: filteredItems
 					};
 				},
 				documentIncomingRelationships: async (_, args, ctx) => {
 					const { relationshipType, view, paging } = args;
 					const handle = await this.assertCanRead(args.targetIdentifier, ctx);
-					return documentIncomingRelationships(this.reactorClient, {
+					const result = await documentIncomingRelationships(this.reactorClient, {
 						targetIdentifier: handle.fetchIdentifier,
 						relationshipType,
 						view,
 						paging
-					});
+					}, this.viewSubject(ctx));
+					return this.#readableItems(result, ctx);
 				}
 			},
 			Mutation: { [documentName]: () => ({}) },
@@ -4282,14 +4332,14 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						slug,
 						preferredEditor,
 						initialState: initialState ?? {}
-					}, this.graphqlManager.reactorDriveClient);
+					}, this.graphqlManager.reactorDriveClient, this.viewSubject(ctx));
 					else createdDoc = await createEmptyDocument(this.reactorClient, {
 						documentType,
 						parentIdentifier,
 						name
-					}, this.graphqlManager.reactorDriveClient);
+					}, this.graphqlManager.reactorDriveClient, this.viewSubject(ctx));
 					if (ctx.user?.address && createdDoc?.id) await this.documentPermissionService?.initializeDocumentProtection(createdDoc.id, ctx.user.address, this.authorizationService.config.defaultProtection);
-					if (!initialState && !preferredEditor && name && createdDoc.name !== name) return toGqlPhDocument(await this.reactorClient.execute(createdDoc.id, "main", [setName(name)]));
+					if (!initialState && !preferredEditor && name && createdDoc.name !== name) return toGqlPhDocument(await this.reactorClient.execute(createdDoc.id, "main", [setName(name)], void 0, this.viewSubject(ctx)));
 					return createdDoc;
 				},
 				createEmptyDocument: async (_, args, ctx) => {
@@ -4299,7 +4349,7 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 					const result = await createEmptyDocument(this.reactorClient, {
 						documentType,
 						parentIdentifier
-					}, this.graphqlManager.reactorDriveClient);
+					}, this.graphqlManager.reactorDriveClient, this.viewSubject(ctx));
 					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
 				},
@@ -4307,11 +4357,11 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 					mutations[camelCase(op.name)] = async (_, args, ctx) => {
 						const { docId, input } = args;
 						const effectiveDocId = (await this.assertCanExecuteOperation(docId, op.name, ctx)).fetchIdentifier;
-						if ((await this.reactorClient.get(effectiveDocId)).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
+						if ((await this.reactorClient.get(effectiveDocId, { subject: this.viewSubject(ctx) })).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
 						const action = this.documentModel.actions[camelCase(op.name)];
 						if (!action) throw new GraphQLError(`Action ${op.name} not found`);
 						try {
-							return toGqlPhDocument(await this.reactorClient.execute(effectiveDocId, "main", [action(input)]));
+							return toGqlPhDocument(await this.reactorClient.execute(effectiveDocId, "main", [action(input)], void 0, this.viewSubject(ctx)));
 						} catch (error) {
 							throw new GraphQLError(error instanceof Error ? error.message : `Failed to ${op.name}`);
 						}
@@ -4319,7 +4369,7 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 					mutations[`${camelCase(op.name)}Async`] = async (_, args, ctx) => {
 						const { docId, input } = args;
 						const effectiveDocId = (await this.assertCanExecuteOperation(docId, op.name, ctx)).fetchIdentifier;
-						if ((await this.reactorClient.get(effectiveDocId)).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
+						if ((await this.reactorClient.get(effectiveDocId, { subject: this.viewSubject(ctx) })).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
 						const action = this.documentModel.actions[camelCase(op.name)];
 						if (!action) throw new GraphQLError(`Action ${op.name} not found`);
 						try {
@@ -4343,7 +4393,7 @@ const DRIVE_ID_HEADER = "drive-id";
 * in the ownership set yet); other create-shaped operations that may
 * synthesize a drive must be added here too.
 */
-const CACHE_BYPASS_OPERATIONS = new Set(["createDocument", "createEmptyDocument"]);
+const CACHE_BYPASS_OPERATIONS = /* @__PURE__ */ new Set(["createDocument", "createEmptyDocument"]);
 const driveIdMap = /* @__PURE__ */ new WeakMap();
 /** Internal — only `graphql-manager.ts` should call this. */
 function getRequestDriveId(request) {
@@ -4413,6 +4463,7 @@ function wrongShardResponse(driveId) {
 * 421 response.
 */
 var DriveOwnershipCache = class {
+	reactorClient;
 	drives = /* @__PURE__ */ new Set();
 	constructor(reactorClient) {
 		this.reactorClient = reactorClient;
@@ -4530,6 +4581,22 @@ function createWsAuthHandlers(opts) {
 	};
 }
 var GraphQLManager = class {
+	path;
+	httpServer;
+	wsServer;
+	reactorClient;
+	relationalDb;
+	analyticsStore;
+	syncManager;
+	logger;
+	httpAdapter;
+	gatewayAdapter;
+	authService;
+	documentPermissionService;
+	featureFlags;
+	port;
+	syncServingGate;
+	httpRoutes;
 	initialized = false;
 	coreSubgraphsMap = /* @__PURE__ */ new Map();
 	contextFields = {};
@@ -4606,19 +4673,21 @@ var GraphQLManager = class {
 			const matched = driveMatcher(url.pathname);
 			const driveIdOrSlug = matched ? matched.params.drive : void 0;
 			if (!driveIdOrSlug) return Response.json({ error: "Drive ID or slug is required" }, { status: 400 });
+			const user = getAuthContext(request)?.user;
 			try {
-				const driveDoc = await this.reactorClient.get(driveIdOrSlug);
-				if (!await this.authorizationService.canRead(driveDoc.header.id, getAuthContext(request)?.user?.address)) {
+				const driveDoc = await this.reactorClient.get(driveIdOrSlug, { subject: callerSubject(user) });
+				if (!await this.authorizationService.canRead(driveDoc.header.id, user?.address)) {
 					this.logger.debug(`Drive read refused: ${driveIdOrSlug}`);
 					return Response.json({ error: "Drive not found" }, { status: 404 });
 				}
 				const graphqlEndpoint = `${(request.headers.get("x-forwarded-proto")?.split(",")[0].trim() ?? url.protocol.replace(":", "")) + ":"}//${request.headers.get("x-forwarded-host")?.split(",")[0].trim() ?? request.headers.get("host") ?? ""}${(request.headers.get("x-forwarded-prefix")?.split(",")[0].trim().replace(/\/$/, "") ?? "") + (this.path === "/" ? "" : this.path)}/graphql/r`;
+				const global = driveDoc.state.global;
 				return Response.json({
 					id: driveDoc.header.id,
 					slug: driveDoc.header.slug,
 					meta: driveDoc.header.meta,
-					name: driveDoc.state.global.name || driveDoc.header.name,
-					icon: driveDoc.state.global.icon ?? void 0,
+					name: global?.name || driveDoc.header.name,
+					icon: global?.icon ?? void 0,
 					...graphqlEndpoint && { graphqlEndpoint }
 				});
 			} catch (error) {
@@ -5402,7 +5471,6 @@ const DocumentModelStateDTO = z.object({
 }).strip();
 const DocumentModelResultPageDTO = z.object({
 	items: z.array(DocumentModelStateDTO),
-	totalCount: z.number().int(),
 	hasNextPage: z.boolean(),
 	hasPreviousPage: z.boolean(),
 	cursor: z.string().nullable().optional()
@@ -5423,7 +5491,6 @@ const PHDocumentDTO = z.object({
 }).strip();
 const PHDocumentResultPageDTO = z.object({
 	items: z.array(PHDocumentDTO),
-	totalCount: z.number().int(),
 	hasNextPage: z.boolean(),
 	hasPreviousPage: z.boolean(),
 	cursor: z.string().nullable().optional()
@@ -5438,7 +5505,6 @@ const DocumentRelationshipDTO = z.object({
 }).strip();
 const DocumentRelationshipResultPageDTO = z.object({
 	items: z.array(DocumentRelationshipDTO),
-	totalCount: z.number().int(),
 	hasNextPage: z.boolean(),
 	hasPreviousPage: z.boolean(),
 	cursor: z.string().nullable().optional()
@@ -5493,7 +5559,6 @@ const OperationDTO = z.object({
 }).strip();
 const OperationResultPageDTO = z.object({
 	items: z.array(OperationDTO),
-	totalCount: z.number().int(),
 	hasNextPage: z.boolean(),
 	hasPreviousPage: z.boolean(),
 	cursor: z.string().nullable().optional()
@@ -5629,7 +5694,7 @@ function createReactorGraphQLClient(url, fetchImpl = fetch, headers) {
 }
 //#endregion
 //#region src/graphql/reactor/schema.graphql
-var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\n# A directed edge between two documents, with the metadata recorded against it.\ntype DocumentRelationship {\n  sourceId: String!\n  targetId: String!\n  relationshipType: String!\n  metadata: JSONObject\n  createdAt: DateTime!\n  updatedAt: DateTime!\n}\n\ntype DocumentRelationshipResultPage {\n  items: [DocumentRelationship!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  \"\"\"\n  How the origin classified the failure. A peer needs this to mirror the origin's\n  quarantine decision; without it a held auth operation would freeze the document\n  on the peer side while the origin kept syncing.\n  \"\"\"\n  errorType: String\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Null until then, which\n  is the state every job is in when it is handed back from a submission.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Nullable for the same\n  reason as `JobInfo.result`: a job that has not written yet has produced\n  nothing, and an empty object would claim otherwise.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n\"\"\"\nOne operation an authorization preflight predicts a verdict for.\n\n`input` is what a conditional grant reads, so a candidate standing for a\nfilled-in form carries that form's input. Omitting it predicts the verdict an\nempty input earns, not the verdict the filled-in form will get.\n\"\"\"\ninput ActionCandidateInput {\n  scope: String!\n  type: String!\n  input: JSONObject\n}\n\nenum AuthDecision {\n  ALLOW\n  DENY\n}\n\n\"\"\"\nOne candidate's predicted verdict. `reason` carries the refusal a DENY is\nrecorded with, and is null on an ALLOW.\n\"\"\"\ntype ActionEvaluation {\n  decision: AuthDecision!\n  reason: String\n}\n\n\"\"\"\nThe predicted verdicts for a set of candidates, in the order they were given,\nwith the aggregates a caller branches on.\n\nThe aggregates are redundant -- a verdict is binary -- and all four are returned\nso a caller reads the one its question is phrased in rather than negating\nanother. Over no candidates every aggregate is false: nothing is allowed and\nnothing is denied.\n\"\"\"\ntype ActionEvaluations {\n  evaluations: [ActionEvaluation!]!\n  allAllowed: Boolean!\n  anyAllowed: Boolean!\n  allDenied: Boolean!\n  anyDenied: Boolean!\n}\n\n# Input types for sync operations\n\"\"\"\nAn action's context, as a caller submits it.\n\nDeclares every field `ActionContext` carries, because an input object rejects a\nfield it does not declare: an action stamped with the head it applies to - which\nis what a signing client sends - is refused outright if these are missing, and\nthat refusal is a whole-request one, not a per-field one.\n\n`prevOpHash` and `prevOpIndex` are the scope head the action was composed\nagainst. They are recorded rather than enforced; a signature is verified from\nthe params carried in its own tuple, which do not include them.\n\"\"\"\ninput ActionContextInput {\n  \"\"\"\n  The index of the last operation in the scope the action applies to.\n  \"\"\"\n  prevOpIndex: Int\n\n  \"\"\"\n  The hash of the state the action applies to.\n  \"\"\"\n  prevOpHash: String\n\n  \"\"\"\n  Covers replay of an operation that would otherwise be a no-op.\n  \"\"\"\n  nonce: String\n\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get the outgoing relationship edges of a source document. Unlike\n  # documentOutgoingRelationships, which returns the documents at the far end,\n  # this returns the edges themselves, carrying their metadata and timestamps.\n  # Omit relationshipType to return edges of every type.\n  documentOutgoingRelationshipEdges(\n    sourceIdentifier: String!\n    relationshipType: String\n    view: ViewFilterInput\n    paging: PagingInput\n  ): DocumentRelationshipResultPage!\n\n  # Get the incoming relationship edges of a target document. Unlike\n  # documentIncomingRelationships, which returns the documents at the far end,\n  # this returns the edges themselves, carrying their metadata and timestamps.\n  # Omit relationshipType to return edges of every type.\n  documentIncomingRelationshipEdges(\n    targetIdentifier: String!\n    relationshipType: String\n    view: ViewFilterInput\n    paging: PagingInput\n  ): DocumentRelationshipResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  \"\"\"\n  Predicts whether the calling subject would be admitted to execute each of a\n  set of candidate operations, without submitting any of them. A UI asks this to\n  disable a control rather than offer an action that fails on submit.\n\n  The answer is a prediction, not a promise:\n\n  - Real admission compiles an append condition over everything it read and the\n    store enforces it at write time. A preflight reads no future, so a policy\n    change landing between this answer and the submit changes the verdict. The\n    submit path stays the only authority.\n  - The verdict is evaluated at the stream heads, so it is correct for a\n    candidate about to be submitted. A backdated submission is out of contract;\n    the reactor decides that one by position.\n  - A candidate whose verdict depends on its input has to carry that input, since\n    a conditional grant reads it.\n\n  The subject is the authenticated caller and cannot be named in the request:\n  answering for an arbitrary subject would disclose what a policy grants\n  somebody else. It carries both the caller's address and the did:key of the app\n  instance whose token authenticated the request, so a policy naming either\n  matches the same principal the write path presents.\n\n  Requires the reactor's authEnforcement feature flag. Without it the reactor\n  holds no decision model, so this fails with extensions.code\n  AUTH_EVALUATION_UNSUPPORTED rather than guessing.\n  \"\"\"\n  evaluateActions(\n    documentIdentifier: String!\n    branch: String\n    candidates: [ActionCandidateInput!]!\n  ): ActionEvaluations!\n\n  \"\"\"\n  Polls for sync envelopes from a channel.\n\n  An operation stored before the API required an action id cannot be\n  represented by this schema, and rather than serving a partial response beside\n  a bare non-null violation, this fails with extensions.code\n  MALFORMED_STORED_OPERATION naming the operation. That code means the failure\n  is worth polling through: the document holding the operation needs repairing,\n  but the channel serves every other document, and a peer that stopped polling\n  would stop receiving those too.\n  \"\"\"\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  \"\"\"\n  Applies actions to a document and waits for the result.\n\n  Each action is coerced against `ActionInput`, so one missing a field the wire\n  declares is refused before any work starts. The id in particular: it is hashed\n  into the operation id and replay dedupes by it, so an action without one is\n  stored under an operation id shared by every id-less operation on the same\n  document, scope and branch.\n\n  Named for `IReactorClient.execute`, which this is the wire form of. `branch`\n  defaults to `main`.\n  \"\"\"\n  execute(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): PHDocument!\n\n  \"\"\"\n  Submits actions to a document and returns the job that will apply them.\n\n  Coerced exactly as `execute` is, so a malformed action is refused here rather\n  than surfacing later as a failed job. Returns the job rather than only its id,\n  so a caller has the status and the creation time it would otherwise have to\n  ask for; `result` is null until the job produces one.\n  \"\"\"\n  executeAsync(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): JobInfo!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n    @deprecated(\n      reason: \"Use execute. Actions here are untyped, so a malformed one is refused by a hand-written check rather than by the schema, and `view.scopes` is accepted but ignored.\"\n    )\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n    @deprecated(\n      reason: \"Use executeAsync, which is typed and returns the job rather than only its id.\"\n    )\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents. Adding one that already exists is\n  # a no-op, metadata included -- use updateRelationship to change an edge.\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    metadata: JSONObject\n    branch: String\n  ): PHDocument!\n\n  # Replace the metadata of an existing relationship, preserving its createdAt.\n  # Omitting metadata, or passing null, clears it.\n  updateRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    metadata: JSONObject\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
+var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\n# A directed edge between two documents, with the metadata recorded against it.\ntype DocumentRelationship {\n  sourceId: String!\n  targetId: String!\n  relationshipType: String!\n  metadata: JSONObject\n  createdAt: DateTime!\n  updatedAt: DateTime!\n}\n\ntype DocumentRelationshipResultPage {\n  items: [DocumentRelationship!]!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  \"\"\"\n  How the origin classified the failure. A peer needs this to mirror the origin's\n  quarantine decision; without it a held auth operation would freeze the document\n  on the peer side while the origin kept syncing.\n  \"\"\"\n  errorType: String\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Null until then, which\n  is the state every job is in when it is handed back from a submission.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Nullable for the same\n  reason as `JobInfo.result`: a job that has not written yet has produced\n  nothing, and an empty object would claim otherwise.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n\"\"\"\nOne operation an authorization preflight predicts a verdict for.\n\n`input` is what a conditional grant reads, so a candidate standing for a\nfilled-in form carries that form's input. Omitting it predicts the verdict an\nempty input earns, not the verdict the filled-in form will get.\n\"\"\"\ninput ActionCandidateInput {\n  scope: String!\n  type: String!\n  input: JSONObject\n}\n\nenum AuthDecision {\n  ALLOW\n  DENY\n}\n\n\"\"\"\nOne candidate's predicted verdict. `reason` carries the refusal a DENY is\nrecorded with, and is null on an ALLOW.\n\"\"\"\ntype ActionEvaluation {\n  decision: AuthDecision!\n  reason: String\n}\n\n\"\"\"\nThe predicted verdicts for a set of candidates, in the order they were given,\nwith the aggregates a caller branches on.\n\nThe aggregates are redundant -- a verdict is binary -- and all four are returned\nso a caller reads the one its question is phrased in rather than negating\nanother. Over no candidates every aggregate is false: nothing is allowed and\nnothing is denied.\n\"\"\"\ntype ActionEvaluations {\n  evaluations: [ActionEvaluation!]!\n  allAllowed: Boolean!\n  anyAllowed: Boolean!\n  allDenied: Boolean!\n  anyDenied: Boolean!\n}\n\n# Input types for sync operations\n\"\"\"\nAn action's context, as a caller submits it.\n\nDeclares every field `ActionContext` carries, because an input object rejects a\nfield it does not declare: an action stamped with the head it applies to - which\nis what a signing client sends - is refused outright if these are missing, and\nthat refusal is a whole-request one, not a per-field one.\n\n`prevOpHash` and `prevOpIndex` are the scope head the action was composed\nagainst. They are recorded rather than enforced; a signature is verified from\nthe params carried in its own tuple, which do not include them.\n\"\"\"\ninput ActionContextInput {\n  \"\"\"\n  The index of the last operation in the scope the action applies to.\n  \"\"\"\n  prevOpIndex: Int\n\n  \"\"\"\n  The hash of the state the action applies to.\n  \"\"\"\n  prevOpHash: String\n\n  \"\"\"\n  Covers replay of an operation that would otherwise be a no-op.\n  \"\"\"\n  nonce: String\n\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get the outgoing relationship edges of a source document. Unlike\n  # documentOutgoingRelationships, which returns the documents at the far end,\n  # this returns the edges themselves, carrying their metadata and timestamps.\n  # Omit relationshipType to return edges of every type.\n  documentOutgoingRelationshipEdges(\n    sourceIdentifier: String!\n    relationshipType: String\n    view: ViewFilterInput\n    paging: PagingInput\n  ): DocumentRelationshipResultPage!\n\n  # Get the incoming relationship edges of a target document. Unlike\n  # documentIncomingRelationships, which returns the documents at the far end,\n  # this returns the edges themselves, carrying their metadata and timestamps.\n  # Omit relationshipType to return edges of every type.\n  documentIncomingRelationshipEdges(\n    targetIdentifier: String!\n    relationshipType: String\n    view: ViewFilterInput\n    paging: PagingInput\n  ): DocumentRelationshipResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  \"\"\"\n  Predicts whether the calling subject would be admitted to execute each of a\n  set of candidate operations, without submitting any of them. A UI asks this to\n  disable a control rather than offer an action that fails on submit.\n\n  The answer is a prediction, not a promise:\n\n  - Real admission compiles an append condition over everything it read and the\n    store enforces it at write time. A preflight reads no future, so a policy\n    change landing between this answer and the submit changes the verdict. The\n    submit path stays the only authority.\n  - The verdict is evaluated at the stream heads, so it is correct for a\n    candidate about to be submitted. A backdated submission is out of contract;\n    the reactor decides that one by position.\n  - A candidate whose verdict depends on its input has to carry that input, since\n    a conditional grant reads it.\n\n  The subject is the authenticated caller and cannot be named in the request:\n  answering for an arbitrary subject would disclose what a policy grants\n  somebody else. It carries both the caller's address and the did:key of the app\n  instance whose token authenticated the request, so a policy naming either\n  matches the same principal the write path presents.\n\n  Requires the reactor's authEnforcement feature flag. Without it the reactor\n  holds no decision model, so this fails with extensions.code\n  AUTH_EVALUATION_UNSUPPORTED rather than guessing.\n  \"\"\"\n  evaluateActions(\n    documentIdentifier: String!\n    branch: String\n    candidates: [ActionCandidateInput!]!\n  ): ActionEvaluations!\n\n  \"\"\"\n  Polls for sync envelopes from a channel.\n\n  An operation stored before the API required an action id cannot be\n  represented by this schema, and rather than serving a partial response beside\n  a bare non-null violation, this fails with extensions.code\n  MALFORMED_STORED_OPERATION naming the operation. That code means the failure\n  is worth polling through: the document holding the operation needs repairing,\n  but the channel serves every other document, and a peer that stopped polling\n  would stop receiving those too.\n  \"\"\"\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  \"\"\"\n  Applies actions to a document and waits for the result.\n\n  Each action is coerced against `ActionInput`, so one missing a field the wire\n  declares is refused before any work starts. The id in particular: it is hashed\n  into the operation id and replay dedupes by it, so an action without one is\n  stored under an operation id shared by every id-less operation on the same\n  document, scope and branch.\n\n  Named for `IReactorClient.execute`, which this is the wire form of. `branch`\n  defaults to `main`.\n  \"\"\"\n  execute(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): PHDocument!\n\n  \"\"\"\n  Submits actions to a document and returns the job that will apply them.\n\n  Coerced exactly as `execute` is, so a malformed action is refused here rather\n  than surfacing later as a failed job. Returns the job rather than only its id,\n  so a caller has the status and the creation time it would otherwise have to\n  ask for; `result` is null until the job produces one.\n  \"\"\"\n  executeAsync(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): JobInfo!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n    @deprecated(\n      reason: \"Use execute. Actions here are untyped, so a malformed one is refused by a hand-written check rather than by the schema, and `view.scopes` is accepted but ignored.\"\n    )\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n    @deprecated(\n      reason: \"Use executeAsync, which is typed and returns the job rather than only its id.\"\n    )\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents. Adding one that already exists is\n  # a no-op, metadata included -- use updateRelationship to change an edge.\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    metadata: JSONObject\n    branch: String\n  ): PHDocument!\n\n  # Replace the metadata of an existing relationship, preserving its createdAt.\n  # Omitting metadata, or passing null, clears it.\n  updateRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    metadata: JSONObject\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
 //#endregion
 //#region src/graphql/reactor/pubsub.ts
 const pubSub = new PubSub();
@@ -5640,26 +5705,79 @@ const SUBSCRIPTION_TRIGGERS = {
 	DOCUMENT_CHANGES: "DOCUMENT_CHANGES",
 	JOB_CHANGES: "JOB_CHANGES"
 };
-let globalDocumentUnsubscribe = null;
-let documentSubscriberCount = 0;
-function ensureGlobalDocumentSubscription(reactorClient) {
-	if (documentSubscriberCount === 0) globalDocumentUnsubscribe = reactorClient.subscribe({}, (event) => {
-		const payload = {
-			documentChanges: event,
-			search: {},
-			view: void 0
+function subjectKey(subject) {
+	return `${subject.address ?? ""}|${subject.key ?? ""}`;
+}
+/**
+* The reactor's change feed, read once per distinct subject and shared by that
+* subject's GraphQL subscriptions. Each feed is read as its subject, so the
+* client withholds what that subject may not read; one feed read with no view
+* would gate every subscriber as the host.
+*/
+var DocumentChangeFeed = class {
+	reactorClient;
+	#pubSub = new PubSub();
+	#feeds = /* @__PURE__ */ new Map();
+	constructor(reactorClient) {
+		this.reactorClient = reactorClient;
+	}
+	subscribe(subject) {
+		const key = subjectKey(subject);
+		const topic = `${SUBSCRIPTION_TRIGGERS.DOCUMENT_CHANGES}:${key}`;
+		const iterator = this.#pubSub.asyncIterableIterator(topic);
+		this.#acquire(key, topic, subject);
+		let released = false;
+		const release = () => {
+			if (!released) {
+				released = true;
+				this.#release(key);
+			}
 		};
-		pubSub.publish(SUBSCRIPTION_TRIGGERS.DOCUMENT_CHANGES, payload);
-	});
-	documentSubscriberCount++;
-	return () => {
-		documentSubscriberCount--;
-		if (documentSubscriberCount === 0 && globalDocumentUnsubscribe) {
-			globalDocumentUnsubscribe();
-			globalDocumentUnsubscribe = null;
+		return {
+			next: () => iterator.next(),
+			return: () => {
+				release();
+				return iterator.return();
+			},
+			throw: (error) => {
+				release();
+				return iterator.throw(error);
+			},
+			[Symbol.asyncIterator]() {
+				return this;
+			}
+		};
+	}
+	#acquire(key, topic, subject) {
+		const feed = this.#feeds.get(key);
+		if (feed) {
+			feed.subscribers++;
+			return;
 		}
-	};
-}
+		const view = { subject };
+		const unsubscribe = this.reactorClient.subscribe({}, (event) => {
+			const payload = {
+				documentChanges: event,
+				search: {},
+				view
+			};
+			this.#pubSub.publish(topic, payload);
+		}, view);
+		this.#feeds.set(key, {
+			unsubscribe,
+			subscribers: 1
+		});
+	}
+	#release(key) {
+		const feed = this.#feeds.get(key);
+		if (!feed) return;
+		feed.subscribers--;
+		if (feed.subscribers === 0) {
+			this.#feeds.delete(key);
+			feed.unsubscribe();
+		}
+	}
+};
 const activeJobSubscriptions = /* @__PURE__ */ new Map();
 function ensureJobSubscription(reactorClient, jobId) {
 	let subscription = activeJobSubscriptions.get(jobId);
@@ -5724,6 +5842,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 	}
 	name = "r";
 	hasSubscriptions = true;
+	#documentChanges;
+	get documentChanges() {
+		this.#documentChanges ??= new DocumentChangeFeed(this.reactorClient);
+		return this.#documentChanges;
+	}
 	/**
 	* Check operation-level permissions for an array of actions.
 	* Delegates to base assertCanExecuteOperation for each action.
@@ -5762,10 +5885,10 @@ var ReactorSubgraph = class extends BaseSubgraph {
 	* or they become a way to enumerate around that check. Supreme admins read
 	* everything, so the per-edge check is skipped for them.
 	*
-	* The counts describe what is served; the cursor describes where to resume in
-	* the underlying unfiltered stream, so it is left as it came. A filtered page
-	* is therefore often shorter than the requested limit, and that is the stream
-	* continuing rather than a sign it ended.
+	* The cursor describes where to resume in the underlying unfiltered stream,
+	* so it is left as it came. A filtered page is therefore often shorter than
+	* the requested limit, and that is the stream continuing rather than a sign
+	* it ended.
 	*/
 	async filterRelationshipEdges(page, farEnd, ctx) {
 		if (this.authorizationService.isSupremeAdmin(ctx.user?.address)) return page;
@@ -5780,19 +5903,9 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			}
 			if (canRead) items.push(edge);
 		}
-		return this.servedPage(page, items);
-	}
-	/**
-	* Restates a page's totalCount over the items that survived a read filter, so
-	* that the difference between the two cannot be read off as a count of what
-	* the caller was not allowed to see.
-	*/
-	servedPage(page, items) {
-		const withheld = page.items.length - items.length;
 		return {
 			...page,
-			items,
-			totalCount: Math.max(0, page.totalCount - withheld)
+			items
 		};
 	}
 	/**
@@ -5828,9 +5941,9 @@ var ReactorSubgraph = class extends BaseSubgraph {
 	* reports the liveness that keeps it from being reclaimed -- but they never
 	* adopt, since the push path has no drive check to clear the claimant.
 	*
-	* Nothing is enforced or adopted without a serving gate. Below
-	* `authEnforcement` there is no policy being enforced for the channel to
-	* belong to, and refusing a poll there would break sync for no gain.
+	* Nothing is enforced or adopted without a serving gate: with no gate the
+	* channel serves every subject alike, so there is no subject for it to
+	* belong to.
 	*/
 	async #bindOrRefuseChannel(channelId, ctx, options = {}) {
 		if (!this.syncServingGate) return;
@@ -5924,7 +6037,10 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
-						return this.servedPage(result, filteredItems);
+						return {
+							...result,
+							items: filteredItems
+						};
 					}
 					return result;
 				} catch (error) {
@@ -5970,7 +6086,10 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
-						return this.servedPage(result, filteredItems);
+						return {
+							...result,
+							items: filteredItems
+						};
 					}
 					return result;
 				} catch (error) {
@@ -5978,10 +6097,10 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					throw error;
 				}
 			},
-			jobStatus: async (_parent, args) => {
+			jobStatus: async (_parent, args, ctx) => {
 				this.logger.debug("jobStatus(@args)", args);
 				try {
-					return await jobStatus(this.reactorClient, args);
+					return await jobStatus(this.reactorClient, args, (id) => this.servesDocument(id, ctx));
 				} catch (error) {
 					this.logger.error("Error in jobStatus: @Error", error);
 					throw error;
@@ -6003,6 +6122,13 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					throw error;
 				}
 			},
+			/**
+			* Gated on reading the document, the same gate every other read here
+			* carries: a verdict is derived from the document's policy, so a caller
+			* who may not read the document may not preflight against it either.
+			* That gate decides whether the query runs; the answer comes entirely
+			* from the reactor's decision model.
+			*/
 			evaluateActions: async (_parent, args, ctx) => {
 				this.logger.debug("evaluateActions(@args)", args);
 				try {
@@ -6058,7 +6184,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 						const parent = await document(this.reactorClient, { identifier: args.parentIdentifier });
 						await this.assertCanWriteCanonical(parent.document.id, ctx);
 					} else this.assertCanCreate(ctx);
-					const result = await createDocument(this.reactorClient, args, this.graphqlManager.reactorDriveClient);
+					const result = await createDocument(this.reactorClient, args, this.graphqlManager.reactorDriveClient, this.viewSubject(ctx));
 					if (result?.id && isDriveContainerType(result.documentType)) this.graphqlManager.driveOwnershipCache.add(result.id);
 					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
@@ -6074,7 +6200,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 						const parent = await document(this.reactorClient, { identifier: args.parentIdentifier });
 						await this.assertCanWriteCanonical(parent.document.id, ctx);
 					} else this.assertCanCreate(ctx);
-					const result = await createEmptyDocument(this.reactorClient, args, this.graphqlManager.reactorDriveClient);
+					const result = await createEmptyDocument(this.reactorClient, args, this.graphqlManager.reactorDriveClient, this.viewSubject(ctx));
 					if (result?.id && isDriveContainerType(result.documentType)) this.graphqlManager.driveOwnershipCache.add(result.id);
 					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
@@ -6090,7 +6216,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await execute(this.reactorClient, {
 						...args,
 						documentIdentifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in execute(@args): @Error", args, error);
 					throw error;
@@ -6116,7 +6242,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await mutateDocument(this.reactorClient, {
 						...args,
 						documentIdentifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in mutateDocument(@args): @Error", args, error);
 					throw error;
@@ -6142,7 +6268,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await renameDocument(this.reactorClient, {
 						...args,
 						documentIdentifier: handle.fetchIdentifier
-					});
+					}, void 0, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in renameDocument(@args): @Error", args, error);
 					throw error;
@@ -6155,7 +6281,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await setPreferredEditor(this.reactorClient, {
 						...args,
 						documentIdentifier: handle.fetchIdentifier
-					});
+					}, void 0, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in setPreferredEditor(@args): @Error", args, error);
 					throw error;
@@ -6168,7 +6294,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await addRelationship(this.reactorClient, {
 						...args,
 						sourceIdentifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in addRelationship(@args): @Error", args, error);
 					throw error;
@@ -6181,7 +6307,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await updateRelationship(this.reactorClient, {
 						...args,
 						sourceIdentifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in updateRelationship(@args): @Error", args, error);
 					throw error;
@@ -6194,7 +6320,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await removeRelationship(this.reactorClient, {
 						...args,
 						sourceIdentifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in removeRelationship(@args): @Error", args, error);
 					throw error;
@@ -6209,7 +6335,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 						...args,
 						sourceParentIdentifier: sourceHandle.fetchIdentifier,
 						targetParentIdentifier: targetHandle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in moveRelationship(@args): @Error @args", error, args);
 					throw error;
@@ -6320,10 +6446,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			documentChanges: {
 				subscribe: (rootValue, args, ctx, info) => {
 					this.logger.debug("documentChanges subscription started");
-					return withFilter(() => {
-						ensureGlobalDocumentSubscription(this.reactorClient);
-						return getPubSub().asyncIterableIterator(SUBSCRIPTION_TRIGGERS.DOCUMENT_CHANGES);
-					}, async (payload, filterArgs, filterCtx) => {
+					return withFilter(() => this.documentChanges.subscribe(this.viewSubject(ctx)), async (payload, filterArgs, filterCtx) => {
 						if (!payload) return false;
 						const search = {
 							type: filterArgs?.search?.type ?? void 0,
@@ -6350,6 +6473,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					}, async (payload, filterArgs, filterCtx) => {
 						if (!payload || !filterArgs) return false;
 						if (!matchesJobFilter(payload, filterArgs)) return false;
+						if (!await this.servesDocument(payload.documentId, filterCtx)) return false;
 						if (this.authorizationService.isSupremeAdmin(filterCtx?.user?.address)) return true;
 						if (!payload.documentId) return false;
 						return this.canReadDocument(payload.documentId, filterCtx);
@@ -6378,10 +6502,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.3-dev.24";
+	return "6.2.3-dev.26";
 }
 function getGitHash() {
-	return "895cfda0dfc73ba08e40437ca258507d8b2c9377";
+	return "25dd1c83d3dd25a0a08cc0e858e91a55da97043e";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -6482,7 +6606,8 @@ var HttpPackageLoader = class {
 	async loadUpgradeManifests(packageSpec) {
 		const { name: packageName } = this.parsePackageSpec(packageSpec);
 		if (!this.isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
-		const manifests = extractUpgradeManifests(await import(`${this.registryUrl}-/cdn/${packageSpec}/node/document-models/index.mjs`));
+		const module = await import(`${this.registryUrl}-/cdn/${packageSpec}/node/document-models/index.mjs`);
+		const manifests = extractUpgradeManifests(module);
 		if (manifests.length > 0) this.logger.verbose(`Loaded ${manifests.length} upgrade manifests from ${packageName}`);
 		return manifests;
 	}
@@ -6673,10 +6798,11 @@ var ImportPackageLoader = class {
 			this.reportUnbuilt(identifier, root, listPath);
 			return [];
 		}
-		const pieces = piecesFromListModule(await import(
+		const module = await import(
 			/* @vite-ignore */
 			pathToFileURL(listPath).href
-), {
+);
+		const pieces = piecesFromListModule(module, {
 			root,
 			identifier,
 			logger: this.logger
@@ -6726,6 +6852,7 @@ function getUniqueUpgradeManifests(...upgradeManifests) {
 	return Array.from(uniqueManifests.values());
 }
 var PackageManager = class {
+	options;
 	logger = childLogger(["reactor-api", "package-manager"]);
 	loaders;
 	docModelsMap = /* @__PURE__ */ new Map();
@@ -7080,20 +7207,48 @@ async function createStartupAttachmentBackend({ db, env = process.env, s3Depende
 }
 //#endregion
 //#region src/services/attachment-access.service.ts
+/** The scope an attachment's bytes belong to: the document's own domain state. */
+const ATTACHMENT_SCOPE = "global";
+/** The branch an attachment reference is resolved against. */
+const ATTACHMENT_BRANCH = "main";
 const HASH_PATTERN = /^[a-f0-9]{64}$/;
 /**
 * Composes document authorization with the projected document/ref
 * relationship. Order is fixed: validate ref, resolve the canonical document
-* id, check `canRead`, then check the reference index. A denied document
-* never reaches the reference reader, and the facade never touches
-* attachment metadata, storage backends, or presigners.
+* id, decide the read, check the reactor's read gate serves the document, then
+* check the reference index and that the subject may read a scope whose
+* operations reference the attachment. A denied document never reaches the
+* reference reader, and the facade never touches attachment metadata, storage
+* backends, or presigners.
+*
+* The named document decides alone: an attachment several documents reference
+* is readable through each of them on that document's own terms.
+*
+* The read is decided by the document's own policy when this composition has a
+* model to enforce it with, and by the host's permission tables when it does
+* not. That is not a preference between two equivalent answers: a host running
+* document policies keeps no rows in the permission tables, so asking them
+* about such a document returns whatever the host-wide policy says — under
+* `OPEN`, `true`, for everyone. Serving bytes on that answer hands the file to
+* anyone who learns its hash, which the document's own state may well have told
+* them. Both are kept because they are the two halves of one rule: an
+* attachment is readable by whoever may read the document that references it,
+* and each composition can only express that in its own terms.
 */
 var AttachmentAccessService = class {
-	constructor(resolveCanonicalId, authorization, references, projection) {
+	resolveCanonicalId;
+	authorization;
+	references;
+	projection;
+	readGate;
+	scopeGate;
+	constructor(resolveCanonicalId, authorization, references, projection, readGate, scopeGate) {
 		this.resolveCanonicalId = resolveCanonicalId;
 		this.authorization = authorization;
 		this.references = references;
 		this.projection = projection;
+		this.readGate = readGate;
+		this.scopeGate = scopeGate;
 	}
 	async canReadAttachment(request) {
 		if (this.projection.status !== "available") return { kind: "projection-unavailable" };
@@ -7105,14 +7260,51 @@ var AttachmentAccessService = class {
 		} catch {
 			return { kind: "denied" };
 		}
-		if (!await this.authorization.canRead(documentId, request.userAddress)) return { kind: "denied" };
-		if (!await this.references.hasReference(documentId, ref)) return { kind: "denied" };
+		if (!await this.canReadDocument(documentId, request)) return { kind: "denied" };
+		const subject = {
+			address: request.userAddress,
+			key: request.appKey
+		};
+		let served;
+		try {
+			served = await this.readGate.isServed(documentId, { subject });
+		} catch {
+			return { kind: "denied" };
+		}
+		if (!served) return { kind: "denied" };
+		const scopes = await this.references.referencingScopes(documentId, ref);
+		if (scopes.length === 0) return { kind: "denied" };
+		let held;
+		try {
+			held = (await this.readGate.get(documentId, {
+				subject,
+				scopes
+			})).state;
+		} catch {
+			return { kind: "denied" };
+		}
+		if (!scopes.some((scope) => scope in held)) return { kind: "denied" };
 		return {
 			kind: "allowed",
 			documentId,
 			ref
 		};
 	}
+	/**
+	* Whether the caller may read the state the reference lives in.
+	*
+	* A failure here is rethrown rather than turned into a denial. A read side
+	* that is down must not read as a policy: a denial nobody can distinguish
+	* from a refusal is one nobody investigates, and the route answers 500 for a
+	* reason.
+	*/
+	async canReadDocument(documentId, request) {
+		if (!this.scopeGate) return this.authorization.canRead(documentId, request.userAddress);
+		return (await this.scopeGate.scopePredicateById(documentId, {
+			address: request.userAddress,
+			key: request.appKey
+		}, ATTACHMENT_BRANCH))(ATTACHMENT_SCOPE);
+	}
 };
 /**
 * Parses and canonicalizes a caller-supplied ref through the shared parser.
@@ -7596,6 +7788,7 @@ async function createRenownCredentialVerifier(config = {}) {
 * - Users can be granted permission to execute specific operations
 */
 var DocumentPermissionService = class {
+	db;
 	config;
 	constructor(db, config = { defaultProtection: false }) {
 		this.db = db;
@@ -7866,12 +8059,16 @@ function createGetParentIdsFn(reactorClient) {
 * Authorization gate for the /mcp endpoint (AUTH_REVIEW S-C1). MCP tools have
 * unrestricted reactor access, so access is limited to supreme admins when
 * auth is enabled. OPEN policy is public; any other policy without an
-* AuthService fails closed.
+* AuthService fails closed. The tools read as the caller: anonymous under OPEN,
+* else the admin's address and the app key its token carries.
 */
 function createMcpRequestAuthorizer(authService, authorizationService) {
 	return async (req) => {
 		if (!authService) {
-			if (authorizationService.config.policy === AuthorizationPolicy.OPEN) return { authorized: true };
+			if (authorizationService.config.policy === AuthorizationPolicy.OPEN) return {
+				authorized: true,
+				subject: {}
+			};
 			return {
 				authorized: false,
 				status: 401,
@@ -7894,10 +8091,39 @@ function createMcpRequestAuthorizer(authService, authorizationService) {
 			status: 403,
 			message: "Forbidden: MCP access requires an administrator"
 		};
-		return { authorized: true };
+		return {
+			authorized: true,
+			subject: {
+				address: context.user.address,
+				key: context.user.appKey
+			}
+		};
 	};
 }
 //#endregion
+//#region src/services/sync-serving-gate.ts
+/**
+* The gate sync serving evaluates a document's own policy through, deciding
+* what the reactor client's read gate decides at the same flag level.
+*
+* Under `authEnforcement` it is built here rather than taken off the client
+* because it also carries the host's closes-by-default setting, which withholds
+* the domain scopes of a document nobody has policied yet. That answer belongs
+* to serving alone -- replay must keep reading an uninitialized document in
+* full -- so the two gates are separate objects over the same model.
+*
+* Below it the registered model ignores the auth scope, so the client reads
+* through the policy alone, and so does serving: a policy written below the
+* flag still withholds, where serving ungated would sync to a peer what `get`
+* refuses it.
+*/
+function buildSyncServingGate(reactorModule, authorizationConfig, logger) {
+	if (!reactorModule) return;
+	const model = readDecisionModel(reactorModule.featureFlags, reactorModule.documentModelRegistry);
+	if (!model) return new SyncScopeGate(new BareReadGate(), reactorModule.documentView, logger);
+	return new SyncScopeGate(new ModelReadGate(model, reactorModule.documentView, reactorModule.featureFlags.authGroups, reactorModule.operationIndex, logger, { withholdUninitialized: authorizationConfig.defaultProtection }), reactorModule.documentView, logger);
+}
+//#endregion
 //#region src/services/renown-config.ts
 /** Reading credentials from this reactor's own read model needs a host-supplied
 * verifier: core has no idea which subgraph serves that read model. */
@@ -8098,6 +8324,17 @@ function assertRequireAuthenticatedCallerAllowed(requireAuthenticatedCaller, res
 	if (!requireAuthenticatedCaller || resolvesCallerIdentity) return;
 	throw new Error("REQUIRE_AUTHENTICATED_CALLER is set but refused: it rejects every request without a resolved caller, and with neither AUTH_ENABLED nor RESOLVE_CALLER_IDENTITY the server never reads a bearer, so it would reject every caller, including authenticated ones. Enable identity resolution first (RESOLVE_CALLER_IDENTITY=true or AUTH_ENABLED=true).");
 }
+/**
+* Deciding an attachment read by the document's policy needs a policy model to
+* decide with, and that is what auth enforcement supplies. Without one there is
+* nothing to consult, so the setting would silently leave the permission tables
+* in charge — configuration that describes a protection the server is not
+* applying, which is worse than no configuration at all. Refuse instead.
+*/
+function assertAttachmentPolicyReadsAllowed(attachmentReadsFollowDocumentPolicy, hasDecisionModel) {
+	if (!attachmentReadsFollowDocumentPolicy || hasDecisionModel) return;
+	throw new Error("ATTACHMENT_READS_FOLLOW_DOCUMENT_POLICY is set but refused: deciding an attachment read by the referencing document's policy requires a policy model to evaluate, and this composition has none, so the host permission tables would keep deciding while the configuration says otherwise. Enable auth enforcement first (REACTOR_AUTH_ENFORCEMENT=true).");
+}
 function createReadinessGate() {
 	let ready = false;
 	return {
@@ -8152,27 +8389,6 @@ function makeDbClosers(knexInstance, pglite) {
 	return closers;
 }
 /**
-* The gate sync serving evaluates a document's own policy through, or undefined
-* when there is none to evaluate.
-*
-* It is built here rather than taken off the reactor client because it is not
-* the same gate reads use: it carries the host's closes-by-default setting,
-* which withholds the domain scopes of a document nobody has policied yet. That
-* answer belongs to serving alone -- replay must keep reading an uninitialized
-* document in full -- so the two gates are deliberately separate objects over
-* the same model.
-*
-* Undefined below `authEnforcement`, where the registered model ignores the auth
-* scope: gating through it would serve every domain scope of a policied document
-* to anyone, which is worse than not gating at all.
-*/
-function buildSyncServingGate(reactorModule, authorizationConfig, logger) {
-	if (!reactorModule) return;
-	const model = readDecisionModel(reactorModule.featureFlags, reactorModule.documentModelRegistry);
-	if (!model) return;
-	return new SyncScopeGate(new ModelReadGate(model, reactorModule.documentView, reactorModule.featureFlags.authGroups, reactorModule.operationIndex, logger, { withholdUninitialized: authorizationConfig.defaultProtection }), reactorModule.documentView, logger);
-}
-/**
 * Resolves the gateway adapter type from the `GATEWAY_ADAPTER` env var.
 * Defaults to "apollo" (the federation gateway, production behavior).
 * "stitching" selects the in-process graphql-tools merge gateway (#1565
@@ -8288,6 +8504,7 @@ async function _setupCommonInfrastructure(options) {
 	let configuredResolveIdentity;
 	let configuredRequireAuth;
 	let configuredExemptPaths;
+	let configuredAttachmentPolicyReads;
 	let configuredRenown;
 	if (options.configFile) {
 		const config = getConfig(options.configFile);
@@ -8300,8 +8517,9 @@ async function _setupCommonInfrastructure(options) {
 		configuredResolveIdentity = options.auth.resolveIdentity;
 		configuredRequireAuth = options.auth.requireAuthenticatedCaller;
 		configuredExemptPaths = options.auth.requireAuthenticatedCallerExemptPaths;
+		configuredAttachmentPolicyReads = options.auth.attachmentReadsFollowDocumentPolicy;
 	}
-	const { AUTH_ENABLED, RESOLVE_CALLER_IDENTITY, REQUIRE_AUTHENTICATED_CALLER, REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION, CREDENTIAL_VERIFICATION_CACHE_TTL_MS } = process.env;
+	const { AUTH_ENABLED, RESOLVE_CALLER_IDENTITY, REQUIRE_AUTHENTICATED_CALLER, REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS, ATTACHMENT_READS_FOLLOW_DOCUMENT_POLICY, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION, CREDENTIAL_VERIFICATION_CACHE_TTL_MS } = process.env;
 	if (AUTH_ENABLED !== void 0) authEnabled = AUTH_ENABLED === "true";
 	/**
 	* Whether the auth middleware reads the bearer and populates `ctx.user`,
@@ -8344,6 +8562,18 @@ async function _setupCommonInfrastructure(options) {
 	*/
 	let requireAuthenticatedCallerExemptPaths = configuredExemptPaths ?? [];
 	if (REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS !== void 0) requireAuthenticatedCallerExemptPaths = REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS.split(",").map((path) => path.trim()).filter((path) => path.length > 0);
+	/**
+	* Whether an attachment read is decided by the referencing document's own
+	* policy rather than by the host's permission tables.
+	*
+	* Off by default, and a deployment's choice rather than something derived
+	* from the flags around it. Which model governs those bytes is configuration
+	* in the same sense the storage backend behind them is: a host that has said
+	* nothing keeps exactly the behaviour it has, and one that wants the change
+	* asks for it and can take it back without disturbing anything else.
+	*/
+	let attachmentReadsFollowDocumentPolicy = configuredAttachmentPolicyReads ?? false;
+	if (ATTACHMENT_READS_FOLLOW_DOCUMENT_POLICY !== void 0) attachmentReadsFollowDocumentPolicy = ATTACHMENT_READS_FOLLOW_DOCUMENT_POLICY === "true";
 	if (ADMINS !== void 0) admins = ADMINS.split(",").map((a) => a.toLowerCase());
 	let defaultProtection = false;
 	if (DEFAULT_PROTECTION !== void 0) defaultProtection = DEFAULT_PROTECTION.toLowerCase() === "true";
@@ -8420,7 +8650,7 @@ async function _setupCommonInfrastructure(options) {
 	await mkdir(attachmentStoragePath, { recursive: true });
 	const { db: attachmentDb, knex: attachmentKnex, pglite: attachmentPglite } = getDbClient(options.dbPath, options.pgliteFactory);
 	dbClosers.push(...makeDbClosers(attachmentKnex, attachmentPglite));
-	const ATTACHMENT_SWEEP_INTERVAL_MS = 3600 * 1e3;
+	const ATTACHMENT_SWEEP_INTERVAL_MS = 36e5;
 	const attachmentBackend = await createStartupAttachmentBackend({ db: attachmentDb });
 	const attachmentBuilder = new AttachmentBuilder(attachmentDb, attachmentStoragePath).withReservationSweepMs(ATTACHMENT_SWEEP_INTERVAL_MS);
 	if (attachmentBackend) attachmentBuilder.withBackend(attachmentBackend);
@@ -8465,13 +8695,14 @@ async function _setupCommonInfrastructure(options) {
 		attachmentReferenceIndex,
 		packages,
 		dbClosers,
-		readiness
+		readiness,
+		attachmentReadsFollowDocumentPolicy
 	};
 }
 /**
 * Private helper function containing common setup logic for API initialization
 */
-async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient, syncServingGate, httpRoutes) {
+async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient, syncServingGate, httpRoutes, attachmentReadsFollowDocumentPolicy = false) {
 	const hostModuleBase = {
 		...createReactorHostModuleBase({
 			client: reactorClient,
@@ -8513,7 +8744,8 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	const { httpServer, wsServer } = await startServer(httpAdapter, port, options.https, logger);
 	const authorizationService = createAuthorizationService(authorizationConfig, documentPermissionService, createGetParentIdsFn(reactorClient));
 	logger.info(`Authorization service initialized (policy: ${authorizationConfig.policy})`);
-	const attachmentAccess = new AttachmentAccessService(createCanonicalDocumentIdResolver(reactorClient), authorizationService, attachmentReferenceIndex.store, attachmentReferenceProjection);
+	assertAttachmentPolicyReadsAllowed(attachmentReadsFollowDocumentPolicy, syncServingGate !== void 0);
+	const attachmentAccess = new AttachmentAccessService(createCanonicalDocumentIdResolver(reactorClient), authorizationService, attachmentReferenceIndex.store, attachmentReferenceProjection, reactorClient, attachmentReadsFollowDocumentPolicy ? syncServingGate : void 0);
 	const coreSubgraphs = DefaultCoreSubgraphs.slice();
 	coreSubgraphs.push(ReactorSubgraph);
 	if (documentPermissionService) {
@@ -8599,7 +8831,7 @@ function buildApiDispose(args) {
 	};
 }
 async function initializeAndStartAPI(clientInitializer, options, processorApp) {
-	const { port, httpAdapter, httpRoutes, authFetchMiddleware, requireAuthFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, attachmentReferenceIndex, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
+	const { port, httpAdapter, httpRoutes, authFetchMiddleware, requireAuthFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, attachmentReferenceIndex, packages, dbClosers, readiness, attachmentReadsFollowDocumentPolicy } = await _setupCommonInfrastructure(options);
 	const { documentModels, upgradeManifests, processors, subgraphs } = await packages.init();
 	const { module: reactorClientModule, reactorDriveClient, attachmentReferenceProjection = {
 		status: "unavailable",
@@ -8616,7 +8848,7 @@ async function initializeAndStartAPI(clientInitializer, options, processorApp) {
 	const documentModelRegistry = reactorClientModule.reactorModule?.documentModelRegistry;
 	if (!documentModelRegistry) throw new Error("DocumentModelRegistry not available from InProcessReactorClientModule");
 	return {
-		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient, buildSyncServingGate(reactorClientModule.reactorModule, authorizationConfig, options.logger ?? defaultLogger), httpRoutes),
+		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient, buildSyncServingGate(reactorClientModule.reactorModule, authorizationConfig, options.logger ?? defaultLogger), httpRoutes, attachmentReadsFollowDocumentPolicy),
 		client: reactorClient,
 		syncManager,
 		documentModelRegistry,
@@ -8749,7 +8981,7 @@ var PackageManagementService = class {
 	}
 };
 //#endregion
-export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthDecision, AuthDecisionSchema, AuthEvaluationUnsupportedError, AuthService, AuthSubgraph, AuthenticationRequiredError, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CORE_PACKAGE_NAME, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, DocumentRelationshipFieldsFragmentDoc, EvaluateActionsDocument, FindDocumentsDocument, ForbiddenError, GetDocumentDocument, GetDocumentIncomingRelationshipEdgesDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipEdgesDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, HttpRouteService, ImportPackageLoader, InMemoryPackageStorage, InvalidNamespaceError, JobChangesDocument, MalformedStoredOperationError, MemoryWebhookStore, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PACKAGE_ROUTE_SEGMENT, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RelationalWebhookStore, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, UpdateRelationshipDocument, ViewFilterInputSchema, WEBHOOK_SEGMENT, WS_AUTH_CLOSE_REASONS, WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE_REASON_BEARER_REJECTED, WebhookService, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertHostMountPath, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, createWsAuthHandlers, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, namespacePath, namespaceSegments, newWebhookToken, parseDriveUrl, parseWebhookBody, redactHeaders, renderGraphqlPlayground, resolvePackageName, resolveRenownConfig, verifyWebhook };
+export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthDecision, AuthDecisionSchema, AuthEvaluationUnsupportedError, AuthService, AuthSubgraph, AuthenticationRequiredError, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CORE_PACKAGE_NAME, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, DocumentRelationshipFieldsFragmentDoc, EvaluateActionsDocument, FindDocumentsDocument, ForbiddenError, GetDocumentDocument, GetDocumentIncomingRelationshipEdgesDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipEdgesDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, HttpRouteService, ImportPackageLoader, InMemoryPackageStorage, InvalidNamespaceError, JobChangesDocument, MalformedStoredOperationError, MemoryWebhookStore, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PACKAGE_ROUTE_SEGMENT, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RelationalWebhookStore, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, UpdateRelationshipDocument, ViewFilterInputSchema, WEBHOOK_SEGMENT, WS_AUTH_CLOSE_REASONS, WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE_REASON_BEARER_REJECTED, WebhookService, assertAttachmentPolicyReadsAllowed, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertHostMountPath, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, callerSubject, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, createWsAuthHandlers, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, namespacePath, namespaceSegments, newWebhookToken, parseDriveUrl, parseWebhookBody, redactHeaders, renderGraphqlPlayground, resolvePackageName, resolveRenownConfig, verifyWebhook };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=29fbf62b-398f-53fa-ac67-5fcef3d5ac7d
+//# debugId=8ab62893-8127-51eb-9d6f-a5900b1823de