@powerhousedao/reactor-api 6.2.3-dev.35 → 6.2.3-dev.36

package/dist/index.mjs

@@ -1,7 +1,7 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9e720347-46a5-5d4d-a73c-901d11fe454f")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ae77d1e5-904a-549c-a5d4-37e03fc0801e")}catch(e){}}();
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
-import { A as RefusalNotRecordedError, C as AuthorizationPolicy, D as AuthenticationRequiredError, E as AuthEvaluationUnsupportedError, O as ForbiddenError, S as createCanonicalDocumentIdResolver, T as createAuthorizationService, _ as loadProcessors, a as pieceListLocation, b as callerSubject, c as buildGraphQlDocument, d as buildGraphqlOperations, f as isSubgraphClass, g as loadDocumentModels, k as MalformedStoredOperationError, l as buildGraphQlDriveDocument, m as extractUpgradeManifests, o as piecesFromCdnList, p as debounce, r as PIECE_SOURCE_LIST, s as piecesFromListModule, u as buildGraphqlOperation, v as loadSubgraphs, w as AuthorizedDocumentHandle, x as CanonicalDocumentIdResolutionError, y as BaseSubgraph } from "./pieces-Bi5qxpi5.mjs";
+import { A as RefusalNotRecordedError, C as AuthorizationPolicy, D as AuthenticationRequiredError, E as AuthEvaluationUnsupportedError, O as ForbiddenError, S as createCanonicalDocumentIdResolver, T as createAuthorizationService, _ as loadProcessors, a as pieceListLocation, b as callerSubject, c as buildGraphQlDocument, d as buildGraphqlOperations, f as isSubgraphClass, g as loadDocumentModels, k as MalformedStoredOperationError, l as buildGraphQlDriveDocument, m as extractUpgradeManifests, o as piecesFromCdnList, p as debounce, r as PIECE_SOURCE_LIST, s as piecesFromListModule, u as buildGraphqlOperation, v as loadSubgraphs, w as AuthorizedDocumentHandle, x as CanonicalDocumentIdResolutionError, y as BaseSubgraph } from "./pieces-DRY6haAO.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
@@ -34,7 +34,7 @@ import { ReactorGroupV1 } from "@powerhousedao/reactor-group";
 import { driveDocumentModelModule } from "@powerhousedao/shared/document-drive";
 import EventEmitter from "node:events";
 import { PostgresAnalyticsStore } from "@powerhousedao/analytics-engine-pg";
-import { AttachmentBuilder, AttachmentReferenceIndexBuilder, createRef, createS3AttachmentBackend, parseAttachmentStorageConfig, parseRef } from "@powerhousedao/reactor-attachments";
+import { AttachmentBuilder, AttachmentNotFound, AttachmentReferenceIndexBuilder, createRef, createS3AttachmentBackend, parseAttachmentStorageConfig, parseRef, validateReserveMetadata } from "@powerhousedao/reactor-attachments";
 import { createAttachmentClient } from "@powerhousedao/reactor-attachments/client";
 import { setupMcpServer } from "@powerhousedao/reactor-mcp";
 import { mkdir } from "node:fs/promises";
@@ -4834,22 +4834,6 @@ function createWsAuthHandlers(opts) {
 	};
 }
 var GraphQLManager = class {
-	path;
-	httpServer;
-	wsServer;
-	reactorClient;
-	relationalDb;
-	analyticsStore;
-	syncManager;
-	logger;
-	httpAdapter;
-	gatewayAdapter;
-	authService;
-	documentPermissionService;
-	featureFlags;
-	port;
-	syncServingGate;
-	httpRoutes;
 	initialized = false;
 	coreSubgraphsMap = /* @__PURE__ */ new Map();
 	contextFields = {};
@@ -4884,26 +4868,43 @@ var GraphQLManager = class {
 	authorizationService;
 	/** Route service in use: the injected one, or one built on first need. */
 	#fallbackRoutes;
-	constructor(path, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, logger, httpAdapter, gatewayAdapter, authService, documentPermissionService, featureFlags = DefaultFeatureFlags, port = 4001, authorizationService, reactorDriveClient, syncServingGate, httpRoutes) {
-		this.path = path;
-		this.httpServer = httpServer;
-		this.wsServer = wsServer;
-		this.reactorClient = reactorClient;
-		this.relationalDb = relationalDb;
-		this.analyticsStore = analyticsStore;
-		this.syncManager = syncManager;
-		this.logger = logger;
-		this.httpAdapter = httpAdapter;
-		this.gatewayAdapter = gatewayAdapter;
-		this.authService = authService;
-		this.documentPermissionService = documentPermissionService;
-		this.featureFlags = featureFlags;
-		this.port = port;
-		this.syncServingGate = syncServingGate;
-		this.httpRoutes = httpRoutes;
-		if (!authorizationService) throw new Error("GraphQLManager requires an authorizationService");
-		this.authorizationService = authorizationService;
-		this.reactorDriveClient = reactorDriveClient;
+	path;
+	httpServer;
+	wsServer;
+	reactorClient;
+	relationalDb;
+	analyticsStore;
+	syncManager;
+	logger;
+	httpAdapter;
+	gatewayAdapter;
+	authService;
+	documentPermissionService;
+	featureFlags;
+	port;
+	syncServingGate;
+	httpRoutes;
+	attachments;
+	constructor(options) {
+		this.path = options.path;
+		this.httpServer = options.httpServer;
+		this.wsServer = options.wsServer;
+		this.reactorClient = options.reactorClient;
+		this.relationalDb = options.relationalDb;
+		this.analyticsStore = options.analyticsStore;
+		this.syncManager = options.syncManager;
+		this.logger = options.logger;
+		this.httpAdapter = options.httpAdapter;
+		this.gatewayAdapter = options.gatewayAdapter;
+		this.authService = options.authService;
+		this.documentPermissionService = options.documentPermissionService;
+		this.featureFlags = options.featureFlags ?? DefaultFeatureFlags;
+		this.port = options.port ?? 4001;
+		this.authorizationService = options.authorizationService;
+		this.reactorDriveClient = options.reactorDriveClient;
+		this.syncServingGate = options.syncServingGate;
+		this.httpRoutes = options.httpRoutes;
+		this.attachments = options.attachments;
 		this.driveOwnershipCache = new DriveOwnershipCache(this.reactorClient);
 		this.wsServer.setMaxListeners(0);
 	}
@@ -4998,7 +4999,8 @@ var GraphQLManager = class {
 					path: this.path,
 					documentPermissionService: this.documentPermissionService,
 					authorizationService: this.authorizationService,
-					syncServingGate: this.syncServingGate
+					syncServingGate: this.syncServingGate,
+					attachments: this.attachments
 				});
 				await this.#addSubgraphInstance(subgraphInstance, supergraph, false, DOCUMENT_MODEL_SUBGRAPH_SOURCE);
 				registeredNames.add(subgraphInstance.name);
@@ -5135,7 +5137,8 @@ var GraphQLManager = class {
 			path: this.path,
 			documentPermissionService: this.documentPermissionService,
 			authorizationService: this.authorizationService,
-			syncServingGate: this.syncServingGate
+			syncServingGate: this.syncServingGate,
+			attachments: this.attachments
 		});
 		return this.#addSubgraphInstance(subgraphInstance, supergraph, core, packageName);
 	}
@@ -5262,15 +5265,12 @@ var GraphQLManager = class {
 			authService: this.authService,
 			requireAuthenticatedCaller: () => this.#requireAuthMiddleware !== void 0,
 			logger: this.logger,
-			buildContext: (connectionParams, user) => {
-				const context = {
-					headers: connectionParams,
-					db: this.relationalDb,
-					...this.getAdditionalContextFields()
-				};
-				if (user) context.user = user;
-				return context;
-			}
+			buildContext: (connectionParams, user) => ({
+				headers: connectionParams,
+				db: this.relationalDb,
+				...this.getAdditionalContextFields(),
+				user
+			})
 		});
 	}
 	setSupergraph(supergraph, subgraphs) {
@@ -6824,10 +6824,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.3-dev.35";
+	return "6.2.3-dev.36";
 }
 function getGitHash() {
-	return "bc7439e3ee5e24332c3684b0d19bc98d8640fa83";
+	return "1c797c3ea5f26a641d25d06ab300220d7d87acda";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -7579,7 +7579,8 @@ const HASH_PATTERN = /^[a-f0-9]{64}$/;
 * anyone who learns its hash, which the document's own state may well have told
 * them. Both are kept because they are the two halves of one rule: an
 * attachment is readable by whoever may read the document that references it,
-* and each composition can only express that in its own terms.
+* and each composition can only express that in its own terms. The caller
+* decision mirrors the routes' `requireAuth`.
 */
 var AttachmentAccessService = class {
 	resolveCanonicalId;
@@ -7588,13 +7589,19 @@ var AttachmentAccessService = class {
 	projection;
 	readGate;
 	scopeGate;
-	constructor(resolveCanonicalId, authorization, references, projection, readGate, scopeGate) {
+	options;
+	constructor(resolveCanonicalId, authorization, references, projection, readGate, scopeGate, options = {}) {
 		this.resolveCanonicalId = resolveCanonicalId;
 		this.authorization = authorization;
 		this.references = references;
 		this.projection = projection;
 		this.readGate = readGate;
 		this.scopeGate = scopeGate;
+		this.options = options;
+	}
+	admitCaller(request) {
+		if ((request.intent === "read" ? this.options.refuseAnonymousReads ?? false : this.options.refuseAnonymousWrites ?? true) && !request.userAddress) return Promise.resolve({ kind: "unauthenticated" });
+		return Promise.resolve({ kind: "admitted" });
 	}
 	async canReadAttachment(request) {
 		if (this.projection.status !== "available") return { kind: "projection-unavailable" };
@@ -7671,6 +7678,140 @@ function normalizeAttachmentRef(value) {
 	return createRef(hash, version);
 }
 //#endregion
+//#region src/services/authorized-attachment.service.ts
+/** Matches the attachment routes' `documentId` bound. */
+const MAX_DOCUMENT_ID_LEN = 512;
+/** The reference index is not maintained in this composition. */
+var AttachmentAccessUnavailable = class extends Error {
+	constructor() {
+		super("Attachment access is unavailable");
+		this.name = "AttachmentAccessUnavailable";
+	}
+};
+/** The access decision itself failed; the cause is logged, not surfaced. */
+var AttachmentAccessFailed = class extends Error {
+	constructor(cause) {
+		super("Attachment access decision failed", { cause });
+		this.name = "AttachmentAccessFailed";
+	}
+};
+/** An `IAttachmentService` whose reads and writes are decided for one subject. */
+var AuthorizedAttachmentService = class {
+	inner;
+	access;
+	subject;
+	logger;
+	constructor(inner, access, subject, logger) {
+		this.inner = inner;
+		this.access = access;
+		this.subject = subject;
+		this.logger = logger;
+	}
+	/** Hash-first only: an upload-first handle can send after it expires. */
+	async reserve(options) {
+		const { mimeType, fileName, extension, clientHash, sizeBytes } = options;
+		if (clientHash === void 0) throw new Error("Attachment reservations require a client hash");
+		const copy = {
+			mimeType,
+			fileName,
+			extension,
+			clientHash,
+			sizeBytes
+		};
+		await this.admit("write");
+		validateReserveMetadata(copy);
+		return this.inner.reserve(copy);
+	}
+	async stat(ref, options) {
+		const decision = await this.decideRead(ref, options);
+		return this.inner.stat(decision.ref, {
+			...options,
+			documentId: decision.documentId
+		});
+	}
+	async get(ref, options) {
+		const decision = await this.decideRead(ref, options);
+		return this.inner.get(decision.ref, {
+			...options,
+			documentId: decision.documentId
+		});
+	}
+	async getDownloadTarget(ref, options) {
+		const decision = await this.decideRead(ref, options);
+		return this.inner.getDownloadTarget(decision.ref, {
+			...options,
+			documentId: decision.documentId
+		});
+	}
+	async decideRead(ref, options) {
+		const documentId = readDocumentId(options);
+		if (documentId === null) throw new AttachmentNotFound(ref);
+		await this.admit("read");
+		let decision;
+		try {
+			decision = await this.access.canReadAttachment({
+				documentId,
+				attachmentRef: ref,
+				userAddress: this.subject.address,
+				appKey: this.subject.key
+			});
+		} catch (err) {
+			throw this.accessFailed(err);
+		}
+		if (decision.kind === "allowed") return {
+			documentId: decision.documentId,
+			ref: decision.ref
+		};
+		if (decision.kind === "projection-unavailable") throw new AttachmentAccessUnavailable();
+		throw new AttachmentNotFound(ref);
+	}
+	async admit(intent) {
+		let result;
+		try {
+			result = await this.access.admitCaller({
+				intent,
+				userAddress: this.subject.address,
+				appKey: this.subject.key
+			});
+		} catch (err) {
+			throw this.accessFailed(err);
+		}
+		if (result.kind !== "admitted") throw new AuthenticationRequiredError();
+	}
+	accessFailed(err) {
+		this.logger.error("Attachment access decision failed: @error", err);
+		return new AttachmentAccessFailed(err);
+	}
+};
+/** The options' `documentId` when it is one the routes would accept, else null. */
+function readDocumentId(options) {
+	if (typeof options !== "object" || options === null) return null;
+	if (isAbortSignal(options)) return null;
+	const value = options.documentId;
+	if (typeof value !== "string") return null;
+	if (value.trim().length === 0 || value.length > MAX_DOCUMENT_ID_LEN) return null;
+	return value;
+}
+/** Duck-checked too, so a signal from another realm is still a signal. */
+function isAbortSignal(value) {
+	if (value instanceof AbortSignal) return true;
+	const candidate = value;
+	return typeof candidate.aborted === "boolean" && typeof candidate.addEventListener === "function";
+}
+var AttachmentClientProvider = class {
+	service;
+	access;
+	logger;
+	constructor(service, access, logger) {
+		this.service = service;
+		this.access = access;
+		this.logger = logger;
+	}
+	forSubject(subject) {
+		return createAttachmentClient(new AuthorizedAttachmentService(this.service, this.access, subject, this.logger));
+	}
+};
+//#endregion
 //#region src/graphql/gateway/require-auth-middleware.ts
 /**
 * Returns a fetch middleware that rejects anonymous callers with a 401.
@@ -8780,8 +8921,28 @@ function resolveGatewayAdapterType(logger) {
 /**
 * Sets up the subgraph manager and registers subgraphs
 */
-async function setupGraphQLManager(httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate, httpRoutes) {
-	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter(resolveGatewayAdapterType(logger), logger), authService, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient, syncServingGate, httpRoutes);
+async function setupGraphQLManager({ httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate, httpRoutes, attachments }) {
+	const graphqlManager = new GraphQLManager({
+		path: config.basePath,
+		httpServer,
+		wsServer,
+		reactorClient: client,
+		relationalDb,
+		analyticsStore,
+		syncManager,
+		logger,
+		httpAdapter,
+		gatewayAdapter: await createGatewayAdapter(resolveGatewayAdapterType(logger), logger),
+		authService,
+		documentPermissionService,
+		featureFlags: { enableDocumentModelSubgraphs },
+		port,
+		authorizationService,
+		reactorDriveClient,
+		syncServingGate,
+		httpRoutes,
+		attachments
+	});
 	await graphqlManager.init(subgraphs.core, authFetchMiddleware, requireAuthFetchMiddleware);
 	for (const [packageName, collection] of subgraphs.extended.entries()) for (const subgraph of collection) await graphqlManager.registerSubgraph(subgraph, "graphql", false, packageName);
 	await graphqlManager.updateRouter();
@@ -9062,6 +9223,7 @@ async function _setupCommonInfrastructure(options) {
 		httpRoutes,
 		authFetchMiddleware,
 		requireAuthFetchMiddleware,
+		authEnabled,
 		authService,
 		relationalDb,
 		analyticsStore,
@@ -9078,7 +9240,7 @@ async function _setupCommonInfrastructure(options) {
 /**
 * Private helper function containing common setup logic for API initialization
 */
-async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient, syncServingGate, httpRoutes, attachmentReadsFollowDocumentPolicy = false) {
+async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authEnabled, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient, syncServingGate, httpRoutes, attachmentReadsFollowDocumentPolicy = false) {
 	const hostModuleBase = {
 		...createReactorHostModuleBase({
 			client: reactorClient,
@@ -9121,17 +9283,43 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	const authorizationService = createAuthorizationService(authorizationConfig, documentPermissionService, createGetParentIdsFn(reactorClient));
 	logger.info(`Authorization service initialized (policy: ${authorizationConfig.policy})`);
 	assertAttachmentPolicyReadsAllowed(attachmentReadsFollowDocumentPolicy, syncServingGate !== void 0);
-	const attachmentAccess = new AttachmentAccessService(createCanonicalDocumentIdResolver(reactorClient), authorizationService, attachmentReferenceIndex.store, attachmentReferenceProjection, reactorClient, attachmentReadsFollowDocumentPolicy ? syncServingGate : void 0);
+	const floor = requireAuthFetchMiddleware !== void 0;
+	const attachmentAccess = new AttachmentAccessService(createCanonicalDocumentIdResolver(reactorClient), authorizationService, attachmentReferenceIndex.store, attachmentReferenceProjection, reactorClient, attachmentReadsFollowDocumentPolicy ? syncServingGate : void 0, {
+		refuseAnonymousWrites: authEnabled || floor,
+		refuseAnonymousReads: floor
+	});
+	const attachmentClientProvider = new AttachmentClientProvider(attachments.service, attachmentAccess, logger);
 	const coreSubgraphs = DefaultCoreSubgraphs.slice();
 	coreSubgraphs.push(ReactorSubgraph);
 	if (documentPermissionService) {
 		coreSubgraphs.push(AuthSubgraph);
 		logger.info("Auth subgraph registered (document permissions enabled)");
 	}
-	const graphqlManager = await setupGraphQLManager(httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, {
-		extended: subgraphs,
-		core: coreSubgraphs
-	}, logger.child(["graphql-manager"]), authorizationService, authService, documentPermissionService, options.enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate, httpRoutes);
+	const graphqlManager = await setupGraphQLManager({
+		httpAdapter,
+		authFetchMiddleware,
+		requireAuthFetchMiddleware,
+		httpServer,
+		wsServer,
+		client: reactorClient,
+		relationalDb,
+		analyticsStore,
+		syncManager,
+		subgraphs: {
+			extended: subgraphs,
+			core: coreSubgraphs
+		},
+		logger: logger.child(["graphql-manager"]),
+		authorizationService,
+		authService,
+		documentPermissionService,
+		enableDocumentModelSubgraphs: options.enableDocumentModelSubgraphs,
+		port,
+		reactorDriveClient,
+		syncServingGate,
+		httpRoutes,
+		attachments: attachmentClientProvider
+	});
 	setupEventListeners(packages, graphqlManager, reactorProcessorManager, moduleFor, documentModelRegistry);
 	if (mcpServerEnabled) {
 		await setupMcpServer({
@@ -9157,8 +9345,9 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 		attachments,
 		attachmentReferenceIndex,
 		attachmentAccess,
+		attachmentClientProvider,
 		authService,
-		requireAuthenticatedCaller: requireAuthFetchMiddleware !== void 0,
+		requireAuthenticatedCaller: floor,
 		authorizationService,
 		relationalDb,
 		dispose
@@ -9207,7 +9396,7 @@ function buildApiDispose(args) {
 	};
 }
 async function initializeAndStartAPI(clientInitializer, options, processorApp) {
-	const { port, httpAdapter, httpRoutes, authFetchMiddleware, requireAuthFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, attachmentReferenceIndex, packages, dbClosers, readiness, attachmentReadsFollowDocumentPolicy } = await _setupCommonInfrastructure(options);
+	const { port, httpAdapter, httpRoutes, authFetchMiddleware, requireAuthFetchMiddleware, authEnabled, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, attachmentReferenceIndex, packages, dbClosers, readiness, attachmentReadsFollowDocumentPolicy } = await _setupCommonInfrastructure(options);
 	const { documentModels, upgradeManifests, processors, subgraphs } = await packages.init();
 	const { module: reactorClientModule, reactorDriveClient, attachmentReferenceProjection = {
 		status: "unavailable",
@@ -9224,7 +9413,7 @@ async function initializeAndStartAPI(clientInitializer, options, processorApp) {
 	const documentModelRegistry = reactorClientModule.reactorModule?.documentModelRegistry;
 	if (!documentModelRegistry) throw new Error("DocumentModelRegistry not available from InProcessReactorClientModule");
 	return {
-		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient, buildSyncServingGate(reactorClientModule.reactorModule, authorizationConfig, options.logger ?? defaultLogger), httpRoutes, attachmentReadsFollowDocumentPolicy),
+		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authEnabled, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient, buildSyncServingGate(reactorClientModule.reactorModule, authorizationConfig, options.logger ?? defaultLogger), httpRoutes, attachmentReadsFollowDocumentPolicy),
 		client: reactorClient,
 		syncManager,
 		documentModelRegistry,
@@ -9407,7 +9596,7 @@ var PackageManagementService = class {
 	}
 };
 //#endregion
-export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthDecision, AuthDecisionSchema, AuthEvaluationUnsupportedError, AuthService, AuthSubgraph, AuthenticationRequiredError, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CORE_PACKAGE_NAME, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, DocumentRelationshipFieldsFragmentDoc, EvaluateActionsDocument, FindDocumentsDocument, ForbiddenError, GetDocumentDocument, GetDocumentIncomingRelationshipEdgesDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipEdgesDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, HttpRouteService, ImportPackageLoader, InMemoryPackageStorage, InvalidNamespaceError, JobChangesDocument, MalformedStoredOperationError, MemoryWebhookStore, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PACKAGE_ROUTE_SEGMENT, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PrivacyPermissionAdapter, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RefusalNotRecordedError, RelationalWebhookStore, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SyncRefusalInputSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, UpdateRelationshipDocument, ViewFilterInputSchema, WEBHOOK_SEGMENT, WS_AUTH_CLOSE_REASONS, WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE_REASON_BEARER_REJECTED, WebhookService, assertAttachmentPolicyReadsAllowed, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertHostMountPath, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, callerSubject, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, createWsAuthHandlers, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, namespacePath, namespaceSegments, newWebhookToken, parseDriveUrl, parseWebhookBody, piecesBaseUrl, redactHeaders, renderGraphqlPlayground, resolvePackageName, resolveRenownConfig, verifyWebhook };
+export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessFailed, AttachmentAccessService, AttachmentAccessUnavailable, AttachmentClientProvider, AuthDecision, AuthDecisionSchema, AuthEvaluationUnsupportedError, AuthService, AuthSubgraph, AuthenticationRequiredError, AuthorizationPolicy, AuthorizedAttachmentService, AuthorizedDocumentHandle, BaseSubgraph, CORE_PACKAGE_NAME, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, DocumentRelationshipFieldsFragmentDoc, EvaluateActionsDocument, FindDocumentsDocument, ForbiddenError, GetDocumentDocument, GetDocumentIncomingRelationshipEdgesDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipEdgesDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, HttpRouteService, ImportPackageLoader, InMemoryPackageStorage, InvalidNamespaceError, JobChangesDocument, MalformedStoredOperationError, MemoryWebhookStore, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PACKAGE_ROUTE_SEGMENT, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PrivacyPermissionAdapter, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RefusalNotRecordedError, RelationalWebhookStore, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SyncRefusalInputSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, UpdateRelationshipDocument, ViewFilterInputSchema, WEBHOOK_SEGMENT, WS_AUTH_CLOSE_REASONS, WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE_REASON_BEARER_REJECTED, WebhookService, assertAttachmentPolicyReadsAllowed, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertHostMountPath, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, callerSubject, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, createWsAuthHandlers, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, namespacePath, namespaceSegments, newWebhookToken, parseDriveUrl, parseWebhookBody, piecesBaseUrl, redactHeaders, renderGraphqlPlayground, resolvePackageName, resolveRenownConfig, verifyWebhook };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=9e720347-46a5-5d4d-a73c-901d11fe454f
+//# debugId=ae77d1e5-904a-549c-a5d4-37e03fc0801e