@powerhousedao/reactor-api 6.2.3-dev.4 → 6.2.3-dev.41

package/dist/index.mjs

@@ -1,24 +1,27 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a15aa3df-1a6d-517d-93c4-3e8a84cefd09")}catch(e){}}();
-import { _ as createAuthorizationService, a as isSubgraphClass, b as MalformedStoredOperationError, d as loadSubgraphs, f as BaseSubgraph, g as AuthorizedDocumentHandle, h as AuthorizationPolicy, i as buildGraphqlOperations, l as loadDocumentModels, m as createCanonicalDocumentIdResolver, n as buildGraphQlDriveDocument, o as debounce, p as CanonicalDocumentIdResolutionError, r as buildGraphqlOperation, s as extractUpgradeManifests, t as buildGraphQlDocument, u as loadProcessors, v as AuthEvaluationUnsupportedError, y as ForbiddenError } from "./utils-XWVecaNn.mjs";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="65e47e18-15f4-5a67-b94b-f6e795c1eb9b")}catch(e){}}();
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { A as RefusalNotRecordedError, C as AuthorizationPolicy, D as AuthenticationRequiredError, E as AuthEvaluationUnsupportedError, O as ForbiddenError, S as createCanonicalDocumentIdResolver, T as createAuthorizationService, _ as loadProcessors, a as pieceListLocation, b as callerSubject, c as buildGraphQlDocument, d as buildGraphqlOperations, f as isSubgraphClass, g as loadDocumentModels, k as MalformedStoredOperationError, l as buildGraphQlDriveDocument, m as extractUpgradeManifests, o as piecesFromCdnList, p as debounce, r as PIECE_SOURCE_LIST, s as piecesFromListModule, u as buildGraphqlOperation, v as loadSubgraphs, w as AuthorizedDocumentHandle, x as CanonicalDocumentIdResolutionError, y as BaseSubgraph } from "./pieces-DRY6haAO.mjs";
+import { findPackageJSON, isBuiltin } from "node:module";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
-import { GraphQLError, Kind, parse, print } from "graphql";
-import { AuthEnforcementDisabledError, DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, ModelReadGate, PropagationMode as PropagationMode$1, SyncScopeGate, consolidateSyncOperations, createReactorHostModuleBase, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl, readDecisionModel, syncOperationErrorType } from "@powerhousedao/reactor";
+import { GraphQLError, Kind, Lexer, Source, TokenKind, parse, print, visit } from "graphql";
+import { AuthEnforcementDisabledError, BareReadGate, ChannelError, ChannelErrorSource, DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, JobStatus, ModelReadGate, PropagationMode as PropagationMode$1, SyncOperation, SyncScopeGate, consolidateSyncOperations, createReactorHostModuleBase, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl, readDecisionModel, supportsPurgeRefusals, syncOperationErrorType } from "@powerhousedao/reactor";
+import { deserializeSignature, readPeerManifest, serializeSignature, setName, withSignaturePolicy } from "@powerhousedao/shared/document-model";
 import { ConsoleLogger, childLogger, documentModelDocumentModelModule } from "document-model";
-import path, { join } from "node:path";
+import path, { isAbsolute, join } from "node:path";
 import { match } from "path-to-regexp";
 import posix from "node:path/posix";
 import { Readable } from "node:stream";
-import fs, { readFileSync, watchFile } from "node:fs";
+import fs, { existsSync, readFileSync, watchFile } from "node:fs";
 import { pipeline } from "node:stream/promises";
-import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { pathToFileURL } from "node:url";
 import { buildSubgraphSchema } from "@apollo/subgraph";
 import { typeDefs } from "@powerhousedao/document-engineering/graphql";
 import { camelCase, kebabCase, pascalCase } from "change-case";
 import { GraphQLJSON, GraphQLJSONObject } from "graphql-type-json";
-import { deserializeSignature, serializeSignature, setName } from "@powerhousedao/shared/document-model";
 import * as z$1 from "zod";
 import { z } from "zod";
 import { createHandler } from "graphql-sse/lib/use/fetch";
@@ -26,16 +29,17 @@ import lzString from "lz-string";
 import { PubSub, withFilter } from "graphql-subscriptions";
 import dotenv from "dotenv";
 import { buildTreeUrl } from "@powerhousedao/shared";
+import { init, parse as parse$1 } from "es-module-lexer";
+import { chmod, lstat, mkdir, readFile, readdir, readlink, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { getConfig } from "@powerhousedao/config/node";
 import { reactorDriveDocumentModelModule } from "@powerhousedao/reactor-drive";
 import { ReactorGroupV1 } from "@powerhousedao/reactor-group";
 import { driveDocumentModelModule } from "@powerhousedao/shared/document-drive";
 import EventEmitter from "node:events";
 import { PostgresAnalyticsStore } from "@powerhousedao/analytics-engine-pg";
-import { AttachmentBuilder, AttachmentReferenceIndexBuilder, createRef, createS3AttachmentBackend, parseAttachmentStorageConfig, parseRef } from "@powerhousedao/reactor-attachments";
+import { AttachmentBuilder, AttachmentNotFound, AttachmentReferenceIndexBuilder, createRef, createS3AttachmentBackend, parseAttachmentStorageConfig, parseRef, validateReserveMetadata } from "@powerhousedao/reactor-attachments";
 import { createAttachmentClient } from "@powerhousedao/reactor-attachments/client";
 import { setupMcpServer } from "@powerhousedao/reactor-mcp";
-import { mkdir } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { WebSocketServer } from "ws";
 import { createRelationalDb } from "@powerhousedao/shared/processors";
@@ -46,19 +50,8 @@ import { AtomicNodeFs } from "@powerhousedao/pglite-fs";
 import knex from "knex";
 import ClientPgLite from "knex-pglite";
 import { KyselyKnexDialect, PGColdDialect } from "kysely-knex";
-//#region \0rolldown/runtime.js
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-//#endregion
 //#region src/graphql/analytics-subgraph.ts
+const analyticsResolvers = AnalyticsResolvers;
 var AnalyticsSubgraph = class extends BaseSubgraph {
 	analyticsStore;
 	analyticsModel;
@@ -66,17 +59,60 @@ var AnalyticsSubgraph = class extends BaseSubgraph {
 	typeDefs = gql`
     ${typedefs}
   `;
-	resolvers = AnalyticsResolvers;
+	/**
+	* Every analytics field hangs off `Query.analytics`, so gating it gates them
+	* all. Series are aggregates a processor built from many documents and carry
+	* no document to decide on, so only a caller with policy-wide read (anyone
+	* under OPEN, an admin otherwise) may read them.
+	*/
+	resolvers = {
+		...analyticsResolvers,
+		Query: {
+			...analyticsResolvers.Query,
+			analytics: (parent, args, ctx) => {
+				this.#assertCanReadAnalytics(ctx);
+				return analyticsResolvers.Query.analytics(parent, args, ctx);
+			}
+		}
+	};
 	constructor(args) {
 		super(args);
 		this.analyticsStore = args.analyticsStore;
 		this.analyticsModel = new AnalyticsModel(new AnalyticsQueryEngine(this.analyticsStore));
 		args.graphqlManager.setAdditionalContextFields({ dataSources: { db: { Analytics: this.analyticsModel } } });
 	}
+	#assertCanReadAnalytics(ctx) {
+		if (this.authorizationService.isSupremeAdmin(ctx.user?.address)) return;
+		if (ctx.user?.address) throw new ForbiddenError("to read analytics");
+		throw new AuthenticationRequiredError("to read analytics");
+	}
 };
 //#endregion
 //#region src/graphql/auth/schema.graphql
-var schema_default$2 = "# Auth Subgraph Schema\n# Contains all document permission and authorization related types\n\nscalar DateTime\n\n# Permission levels for documents\nenum DocumentPermissionLevel {\n  # Can fetch and read the document\n  READ\n  # Can push updates and modify the document\n  WRITE\n  # Can manage document permissions and settings\n  ADMIN\n}\n\n# Document permission entry\ntype DocumentPermissionEntry {\n  documentId: String!\n  userAddress: String!\n  permission: DocumentPermissionLevel!\n  grantedBy: String!\n  createdAt: DateTime!\n  updatedAt: DateTime!\n}\n\n# Operation user permission entry\ntype OperationUserPermission {\n  documentId: String!\n  operationType: String!\n  userAddress: String!\n  grantedBy: String!\n  createdAt: DateTime!\n}\n\n# Combined document access info\ntype DocumentAccessInfo {\n  documentId: String!\n  permissions: [DocumentPermissionEntry!]!\n}\n\n# Operation permissions info\ntype OperationPermissionsInfo {\n  documentId: String!\n  operationType: String!\n  userPermissions: [OperationUserPermission!]!\n}\n\n# Document protection info\ntype DocumentProtectionInfo {\n  documentId: String!\n  protected: Boolean!\n  ownerAddress: String\n}\n\ntype Query {\n  # Get permissions for a document (requires ADMIN permission or global admin)\n  documentAccess(documentId: String!): DocumentAccessInfo!\n\n  # Get protection status for a document (requires ADMIN permission or global admin)\n  documentProtection(documentId: String!): DocumentProtectionInfo!\n\n  # Get all documents the current user has explicit access to\n  userDocumentPermissions: [DocumentPermissionEntry!]!\n\n  # Get operation permissions for a document and operation type\n  # (requires ADMIN permission or global admin)\n  operationPermissions(\n    documentId: String!\n    operationType: String!\n  ): OperationPermissionsInfo!\n\n  # Check if the current user can execute a specific operation on a document\n  canExecuteOperation(documentId: String!, operationType: String!): Boolean!\n}\n\ntype Mutation {\n  # Set document protection status (requires ADMIN permission or global admin)\n  setDocumentProtection(\n    documentId: String!\n    protected: Boolean!\n  ): DocumentProtectionInfo!\n\n  # Transfer document ownership (requires ADMIN permission or global admin)\n  transferDocumentOwnership(\n    documentId: String!\n    newOwnerAddress: String!\n  ): DocumentProtectionInfo!\n\n  # Grant a user permission on a document (requires ADMIN permission or global admin)\n  grantDocumentPermission(\n    documentId: String!\n    userAddress: String!\n    permission: DocumentPermissionLevel!\n  ): DocumentPermissionEntry!\n\n  # Revoke a user's permission on a document (requires ADMIN permission or global admin)\n  revokeDocumentPermission(documentId: String!, userAddress: String!): Boolean!\n\n  # --- Operation Permissions ---\n\n  # Grant a user permission to execute an operation on a document\n  grantOperationPermission(\n    documentId: String!\n    operationType: String!\n    userAddress: String!\n  ): OperationUserPermission!\n\n  # Revoke a user's permission to execute an operation\n  revokeOperationPermission(\n    documentId: String!\n    operationType: String!\n    userAddress: String!\n  ): Boolean!\n}\n";
+var schema_default$2 = "# Auth Subgraph Schema\n# Contains all document permission and authorization related types\n\nscalar DateTime\n\n# Permission levels for documents\nenum DocumentPermissionLevel {\n  # Can fetch and read the document\n  READ\n  # Can push updates and modify the document\n  WRITE\n  # Can manage document permissions and settings\n  ADMIN\n}\n\n# Document permission entry\ntype DocumentPermissionEntry {\n  documentId: String!\n  userAddress: String!\n  permission: DocumentPermissionLevel!\n  grantedBy: String!\n  createdAt: DateTime!\n  updatedAt: DateTime!\n}\n\n# Operation user permission entry\ntype OperationUserPermission {\n  documentId: String!\n  operationType: String!\n  userAddress: String!\n  grantedBy: String!\n  createdAt: DateTime!\n}\n\n# Combined document access info\ntype DocumentAccessInfo {\n  documentId: String!\n  permissions: [DocumentPermissionEntry!]!\n}\n\n# Operation permissions info\ntype OperationPermissionsInfo {\n  documentId: String!\n  operationType: String!\n  userPermissions: [OperationUserPermission!]!\n}\n\n# Document protection info\ntype DocumentProtectionInfo {\n  documentId: String!\n  protected: Boolean!\n  ownerAddress: String\n}\n\ntype Query {\n  # Get permissions for a document (requires ADMIN permission or global admin)\n  documentAccess(\n    documentIdOrSlug: String\n    documentId: String @deprecated(reason: \"Use documentIdOrSlug.\")\n  ): DocumentAccessInfo!\n\n  # Get protection status for a document (requires ADMIN permission or global admin)\n  documentProtection(\n    documentIdOrSlug: String\n    documentId: String @deprecated(reason: \"Use documentIdOrSlug.\")\n  ): DocumentProtectionInfo!\n\n  # Get all documents the current user has explicit access to\n  userDocumentPermissions: [DocumentPermissionEntry!]!\n\n  # Get operation permissions for a document and operation type\n  # (requires ADMIN permission or global admin)\n  operationPermissions(\n    documentIdOrSlug: String\n    documentId: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    operationType: String!\n  ): OperationPermissionsInfo!\n\n  # Check if the current user can execute a specific operation on a document\n  canExecuteOperation(\n    documentIdOrSlug: String\n    documentId: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    operationType: String!\n  ): Boolean!\n}\n\ntype Mutation {\n  # Set document protection status (requires ADMIN permission or global admin)\n  setDocumentProtection(\n    documentIdOrSlug: String\n    documentId: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    protected: Boolean!\n  ): DocumentProtectionInfo!\n\n  # Transfer document ownership (requires ADMIN permission or global admin)\n  transferDocumentOwnership(\n    documentIdOrSlug: String\n    documentId: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    newOwnerAddress: String!\n  ): DocumentProtectionInfo!\n\n  # Grant a user permission on a document (requires ADMIN permission or global admin)\n  grantDocumentPermission(\n    documentIdOrSlug: String\n    documentId: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    userAddress: String!\n    permission: DocumentPermissionLevel!\n  ): DocumentPermissionEntry!\n\n  # Revoke a user's permission on a document (requires ADMIN permission or global admin)\n  revokeDocumentPermission(\n    documentIdOrSlug: String\n    documentId: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    userAddress: String!\n  ): Boolean!\n\n  # --- Operation Permissions ---\n\n  # Grant a user permission to execute an operation on a document\n  grantOperationPermission(\n    documentIdOrSlug: String\n    documentId: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    operationType: String!\n    userAddress: String!\n  ): OperationUserPermission!\n\n  # Revoke a user's permission to execute an operation\n  revokeOperationPermission(\n    documentIdOrSlug: String\n    documentId: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    operationType: String!\n    userAddress: String!\n  ): Boolean!\n}\n";
+//#endregion
+//#region src/graphql/argument-aliases.ts
+/** A renamed argument given under both names, or a required one under neither. */
+var ArgumentAliasError = class extends GraphQLError {
+	constructor(message) {
+		super(message, { extensions: { code: "BAD_USER_INPUT" } });
+	}
+};
+/** The value of a required argument that may still arrive under its old name. */
+function requireOneOf(args, name, deprecatedName) {
+	const current = args[name] ?? void 0;
+	const deprecated = args[deprecatedName] ?? void 0;
+	if (current !== void 0 && deprecated !== void 0) throw new ArgumentAliasError(`Pass ${name} or ${deprecatedName}, not both.`);
+	if (current === void 0 && deprecated === void 0) throw new ArgumentAliasError(`${name} is required.`);
+	return current ?? deprecated;
+}
+/** The value of an optional argument that may still arrive under its old name. */
+function optionalOneOf(args, name, deprecatedName) {
+	const current = args[name] ?? void 0;
+	const deprecated = args[deprecatedName] ?? void 0;
+	if (current !== void 0 && deprecated !== void 0) throw new ArgumentAliasError(`Pass ${name} or ${deprecatedName}, not both.`);
+	return current ?? deprecated;
+}
 //#endregion
 //#region src/graphql/auth/resolvers.ts
 async function documentAccess(service, authorizationService, args, userAddress) {
@@ -172,7 +208,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("documentAccess(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					return await documentAccess(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
+					return await documentAccess(this.documentPermissionService, this.authorizationService, await this.#withCanonicalDocumentArgs(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in documentAccess: @error", error);
 					throw error;
@@ -193,7 +229,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("operationPermissions(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					return await operationPermissions(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
+					return await operationPermissions(this.documentPermissionService, this.authorizationService, await this.#withCanonicalDocumentArgs(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in operationPermissions: @error", error);
 					throw error;
@@ -202,7 +238,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 			canExecuteOperation: async (_parent, args, ctx) => {
 				this.logger.debug("canExecuteOperation(@args)", args);
 				try {
-					return await canExecuteOperation(this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
+					return await canExecuteOperation(this.authorizationService, await this.#withCanonicalDocumentArgs(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in canExecuteOperation: @error", error);
 					throw error;
@@ -212,7 +248,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("documentProtection(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					return await documentProtection(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
+					return await documentProtection(this.documentPermissionService, this.authorizationService, await this.#withCanonicalDocumentArgs(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in documentProtection: @error", error);
 					throw error;
@@ -224,7 +260,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("setDocumentProtection(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					return await setDocumentProtection(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
+					return await setDocumentProtection(this.documentPermissionService, this.authorizationService, await this.#withCanonicalDocumentArgs(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in setDocumentProtection: @error", error);
 					throw error;
@@ -234,7 +270,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("transferDocumentOwnership(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					return await transferDocumentOwnership(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
+					return await transferDocumentOwnership(this.documentPermissionService, this.authorizationService, await this.#withCanonicalDocumentArgs(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in transferDocumentOwnership: @error", error);
 					throw error;
@@ -244,7 +280,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("grantDocumentPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const resolved = await this.withCanonicalDocumentId(args, ctx);
+					const resolved = await this.#withCanonicalDocumentArgs(args, ctx);
 					return await grantDocumentPermission(this.documentPermissionService, this.authorizationService, {
 						...resolved,
 						permission: resolved.permission
@@ -258,7 +294,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("revokeDocumentPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					return await revokeDocumentPermission(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
+					return await revokeDocumentPermission(this.documentPermissionService, this.authorizationService, await this.#withCanonicalDocumentArgs(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in revokeDocumentPermission: @error", error);
 					throw error;
@@ -268,7 +304,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("grantOperationPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					return await grantOperationPermission(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
+					return await grantOperationPermission(this.documentPermissionService, this.authorizationService, await this.#withCanonicalDocumentArgs(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in grantOperationPermission: @error", error);
 					throw error;
@@ -278,7 +314,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("revokeOperationPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					return await revokeOperationPermission(this.documentPermissionService, this.authorizationService, await this.withCanonicalDocumentId(args, ctx), ctx.user?.address);
+					return await revokeOperationPermission(this.documentPermissionService, this.authorizationService, await this.#withCanonicalDocumentArgs(args, ctx), ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in revokeOperationPermission: @error", error);
 					throw error;
@@ -286,6 +322,16 @@ var AuthSubgraph = class extends BaseSubgraph {
 			}
 		}
 	};
+	#withCanonicalDocumentArgs(args, ctx) {
+		const { documentIdOrSlug, documentId, ...rest } = args;
+		return this.withCanonicalDocumentId({
+			...rest,
+			documentId: requireOneOf({
+				documentIdOrSlug,
+				documentId
+			}, "documentIdOrSlug", "documentId")
+		}, ctx);
+	}
 	onSetup() {
 		this.logger.debug("Setting up AuthSubgraph");
 		return Promise.resolve();
@@ -311,15 +357,15 @@ function createAuthFetchMiddleware(authService) {
 async function createGatewayAdapter(type, logger) {
 	switch (type) {
 		case "apollo": {
-			const { ApolloGatewayAdapter } = await import("./adapter-gateway-apollo-DowrX6E_.mjs");
+			const { ApolloGatewayAdapter } = await import("./adapter-gateway-apollo-D2DNlPY0.mjs");
 			return new ApolloGatewayAdapter(logger);
 		}
 		case "mercurius": {
-			const { MercuriusGatewayAdapter } = await import("./adapter-gateway-mercurius-CZVy88Za.mjs");
+			const { MercuriusGatewayAdapter } = await import("./adapter-gateway-mercurius-rbKlwF9m.mjs");
 			return new MercuriusGatewayAdapter(logger);
 		}
 		case "stitching": {
-			const { StitchingGatewayAdapter } = await import("./adapter-gateway-stitching-CaZjvRzx.mjs");
+			const { StitchingGatewayAdapter } = await import("./adapter-gateway-stitching-Dzv10u8D.mjs");
 			return new StitchingGatewayAdapter(logger);
 		}
 	}
@@ -327,11 +373,11 @@ async function createGatewayAdapter(type, logger) {
 async function createHttpAdapter(type) {
 	switch (type) {
 		case "express": {
-			const { createExpressHttpAdapter } = await import("./adapter-http-express-B39rPhqH.mjs");
+			const { createExpressHttpAdapter } = await import("./adapter-http-express-CWqziB1p.mjs");
 			return createExpressHttpAdapter();
 		}
 		case "fastify": {
-			const { createFastifyHttpAdapter } = await import("./adapter-http-fastify-BwXO6rqE.mjs");
+			const { createFastifyHttpAdapter } = await import("./adapter-http-fastify-CYZQ6FFv.mjs");
 			return createFastifyHttpAdapter();
 		}
 	}
@@ -359,7 +405,7 @@ const WS_AUTH_CLOSE_REASONS = [WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE
 */
 const SEGMENT = /^[a-z0-9][-a-z0-9._]*$/i;
 /** Segments that would read as path traversal rather than as a name. */
-const TRAVERSAL = new Set([".", ".."]);
+const TRAVERSAL = /* @__PURE__ */ new Set([".", ".."]);
 var InvalidNamespaceError = class extends Error {};
 /**
 * Turns a package name into the path segments it occupies.
@@ -845,27 +891,29 @@ var HttpScope = class {
 			headers: fetchHeaders(req),
 			signal: controller.signal
 		};
-		if (method !== "GET" && method !== "HEAD" && body !== "none") if (body === "stream") init = {
-			...init,
-			body: Readable.toWeb(req),
-			duplex: "half"
-		};
-		else {
-			try {
-				raw = await readBody(req, spec.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES$1);
-			} catch (error) {
-				if (error instanceof BodyTooLargeError) {
-					res.setHeader("connection", "close");
-					res.once("finish", () => req.destroy());
-					writeError(res, 413, "Payload too large");
-					return;
-				}
-				throw error;
-			}
-			if (raw.length) init = {
+		if (method !== "GET" && method !== "HEAD" && body !== "none") {
+			if (body === "stream") init = {
 				...init,
-				body: new Uint8Array(raw.buffer, raw.byteOffset, raw.byteLength)
+				body: Readable.toWeb(req),
+				duplex: "half"
 			};
+			else {
+				try {
+					raw = await readBody(req, spec.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES$1);
+				} catch (error) {
+					if (error instanceof BodyTooLargeError) {
+						res.setHeader("connection", "close");
+						res.once("finish", () => req.destroy());
+						writeError(res, 413, "Payload too large");
+						return;
+					}
+					throw error;
+				}
+				if (raw.length) init = {
+					...init,
+					body: new Uint8Array(raw.buffer, raw.byteOffset, raw.byteLength)
+				};
+			}
 		}
 		await writeResponse(res, await spec.handler(new Request(url, init), {
 			...ctx,
@@ -1042,7 +1090,7 @@ function verifyWebhook(options) {
 }
 /** Headers that would put a credential in a log or run journal. The configured signature
 * header joins them: it is an HMAC of the body under a live secret. */
-const REDACTED_HEADERS = new Set([
+const REDACTED_HEADERS = /* @__PURE__ */ new Set([
 	"authorization",
 	"proxy-authorization",
 	"cookie",
@@ -1315,6 +1363,7 @@ function newWebhookToken() {
 const NAMESPACE = "reactor_webhooks";
 /** Relational implementation, over the reactor's own database. */
 var RelationalWebhookStore = class {
+	relationalDb;
 	#db;
 	constructor(relationalDb) {
 		this.relationalDb = relationalDb;
@@ -1329,7 +1378,11 @@ var RelationalWebhookStore = class {
 			"owner_key"
 		]).unique().execute();
 		await db.schema.createTable("webhook_deliveries").ifNotExists().addColumn("token", "text", (col) => col.notNull()).addColumn("dedupe_key", "text", (col) => col.notNull()).addColumn("seen_at", "text", (col) => col.notNull()).addColumn("claim_id", "text", (col) => col.notNull()).execute();
+		try {
+			await db.schema.alterTable("webhook_deliveries").addColumn("expires_at", "text").execute();
+		} catch {}
 		await db.schema.createIndex("webhook_deliveries_key").ifNotExists().on("webhook_deliveries").columns(["token", "dedupe_key"]).unique().execute();
+		await db.schema.createIndex("webhook_deliveries_expires_at").ifNotExists().on("webhook_deliveries").columns(["expires_at"]).execute();
 		await db.schema.createIndex("webhook_deliveries_seen_at").ifNotExists().on("webhook_deliveries").columns(["seen_at"]).execute();
 		this.#db = db;
 	}
@@ -1370,13 +1423,16 @@ var RelationalWebhookStore = class {
 	}
 	async seen(token, key, ttlSeconds) {
 		const now = Date.now();
+		const nowIso = new Date(now).toISOString();
 		const cutoff = (/* @__PURE__ */ new Date(now - ttlSeconds * 1e3)).toISOString();
-		await this.#handle.deleteFrom("webhook_deliveries").where("seen_at", "<", cutoff).execute();
+		await this.#handle.deleteFrom("webhook_deliveries").where((eb) => eb.or([eb("expires_at", "<", nowIso), eb.and([eb("expires_at", "is", null), eb("seen_at", "<", cutoff)])])).execute();
+		await this.#handle.deleteFrom("webhook_deliveries").where("token", "=", token).where("dedupe_key", "=", key).where("seen_at", "<", cutoff).execute();
 		const claimId = randomBytes(16).toString("hex");
 		await this.#handle.insertInto("webhook_deliveries").values({
 			token,
 			dedupe_key: key,
-			seen_at: new Date(now).toISOString(),
+			seen_at: nowIso,
+			expires_at: new Date(now + ttlSeconds * 1e3).toISOString(),
 			claim_id: claimId
 		}).onConflict((oc) => oc.columns(["token", "dedupe_key"]).doNothing()).execute();
 		return (await this.#handle.selectFrom("webhook_deliveries").select("claim_id").where("token", "=", token).where("dedupe_key", "=", key).executeTakeFirst())?.claim_id !== claimId;
@@ -1422,10 +1478,14 @@ var MemoryWebhookStore = class {
 	}
 	seen(token, key, ttlSeconds) {
 		const now = Date.now();
-		for (const [k, at] of this.#deliveries) if (at < now - ttlSeconds * 1e3) this.#deliveries.delete(k);
+		for (const [k, entry] of this.#deliveries) if (entry.expiresAt < now) this.#deliveries.delete(k);
 		const composite = `${token}|${key}`;
-		if (this.#deliveries.has(composite)) return Promise.resolve(true);
-		this.#deliveries.set(composite, now);
+		const existing = this.#deliveries.get(composite);
+		if (existing && existing.seenAt >= now - ttlSeconds * 1e3) return Promise.resolve(true);
+		this.#deliveries.set(composite, {
+			seenAt: now,
+			expiresAt: now + ttlSeconds * 1e3
+		});
 		return Promise.resolve(false);
 	}
 };
@@ -1460,7 +1520,7 @@ const stripScalarDefinitions = (doc) => {
 * whole gateway. We dedupe these by name; field/operation/extension nodes are
 * left untouched.
 */
-const TYPE_DEFINITION_KINDS = new Set([
+const TYPE_DEFINITION_KINDS = /* @__PURE__ */ new Set([
 	Kind.OBJECT_TYPE_DEFINITION,
 	Kind.ENUM_TYPE_DEFINITION,
 	Kind.INPUT_OBJECT_TYPE_DEFINITION,
@@ -1496,6 +1556,98 @@ const dedupeTypeDefinitions = (doc) => {
 		definitions
 	};
 };
+const EMPTY_DOCUMENT = {
+	kind: Kind.DOCUMENT,
+	definitions: []
+};
+const OUTPUT_TYPE_KINDS = [
+	Kind.OBJECT_TYPE_DEFINITION,
+	Kind.OBJECT_TYPE_EXTENSION,
+	Kind.ENUM_TYPE_DEFINITION,
+	Kind.ENUM_TYPE_EXTENSION,
+	Kind.UNION_TYPE_DEFINITION,
+	Kind.UNION_TYPE_EXTENSION,
+	Kind.INTERFACE_TYPE_DEFINITION,
+	Kind.INTERFACE_TYPE_EXTENSION
+];
+const STATE_PREFIX_KINDS = new Set(OUTPUT_TYPE_KINDS);
+const ALL_PREFIX_KINDS = /* @__PURE__ */ new Set([
+	...OUTPUT_TYPE_KINDS,
+	Kind.INPUT_OBJECT_TYPE_DEFINITION,
+	Kind.INPUT_OBJECT_TYPE_EXTENSION
+]);
+const TYPE_NAME_KINDS = /* @__PURE__ */ new Set([
+	...ALL_PREFIX_KINDS,
+	Kind.SCALAR_TYPE_DEFINITION,
+	Kind.SCALAR_TYPE_EXTENSION,
+	Kind.NAMED_TYPE
+]);
+const LOCAL_STATE_STUBS = /* @__PURE__ */ new Set([
+	"AccountSnapshotLocalState",
+	"BudgetStatementLocalState",
+	"ScopeFrameworkLocalState"
+]);
+/** Parse SDL; blank or comment-only input yields an empty document. */
+function parseSdl(sdl) {
+	const source = new Source(sdl);
+	if (new Lexer(source).advance().kind === TokenKind.EOF) return EMPTY_DOCUMENT;
+	try {
+		return parse(source, { noLocation: true });
+	} catch (error) {
+		const withoutSemicolons = sdl.replaceAll(";", "");
+		if (withoutSemicolons === sdl) throw error;
+		return parse(withoutSemicolons, { noLocation: true });
+	}
+}
+function definedTypeNames(doc, kinds) {
+	return doc.definitions.filter((def) => kinds.has(def.kind)).map((def) => def.name.value);
+}
+/** Prefix type definition names and type references found in `names`. */
+function prefixTypeNames(doc, prefix, names) {
+	return visit(doc, { enter(node) {
+		if (!TYPE_NAME_KINDS.has(node.kind)) return void 0;
+		const { name } = node;
+		if (!names.has(name.value)) return void 0;
+		return {
+			...node,
+			name: {
+				...name,
+				value: `${prefix}_${name.value}`
+			}
+		};
+	} });
+}
+/** State schema definitions without inputs, `DateTime` or the given object types. */
+function stateTypeDefinitions(sdl, droppedObjectTypes = /* @__PURE__ */ new Set()) {
+	return parseSdl(sdl).definitions.filter((def) => def.kind !== Kind.INPUT_OBJECT_TYPE_DEFINITION && def.kind !== Kind.INPUT_OBJECT_TYPE_EXTENSION && !(def.kind === Kind.SCALAR_TYPE_DEFINITION && def.name.value === "DateTime") && !(def.kind === Kind.OBJECT_TYPE_DEFINITION && droppedObjectTypes.has(def.name.value)));
+}
+/**
+* Prefixed operation schemas per module. The first definition of each module
+* carries a "Module: <Name>" description unless it has its own.
+*/
+function buildModuleSchemas(specification, documentName, allTypeNames, hasValidSchema) {
+	const names = new Set(allTypeNames);
+	return specification?.modules.map((module) => {
+		const definitions = module.operations.filter((op) => hasValidSchema(op.schema)).flatMap((op) => {
+			const doc = parseSdl(op.schema ?? "");
+			return prefixTypeNames(doc, documentName, /* @__PURE__ */ new Set([...names, ...definedTypeNames(doc, ALL_PREFIX_KINDS)])).definitions;
+		});
+		if (definitions.length === 0) return "";
+		const [first, ...rest] = definitions;
+		const header = "description" in first && !first.description ? {
+			...first,
+			description: {
+				kind: Kind.STRING,
+				value: `Module: ${pascalCase(module.name)}`,
+				block: true
+			}
+		} : first;
+		return print({
+			kind: Kind.DOCUMENT,
+			definitions: [header, ...rest]
+		});
+	}).filter(Boolean).join("\n") ?? "";
+}
 const buildSubgraphSchemaModule = (documentModels, resolvers, typeDefs) => {
 	const newResolvers = {
 		...resolvers,
@@ -1534,20 +1686,13 @@ const getDocumentModelTypeDefs = (documentModels, typeDefs$1) => {
 		const latestSpec = documentModel.global.specifications.at(-1);
 		const globalSchema = latestSpec?.state.global.schema ?? "";
 		const localSchema = latestSpec?.state.local.schema ?? "";
-		let tmpDmSchema = `
-          ${globalSchema.replaceAll("scalar DateTime", "").replaceAll(/input (.*?) {[\s\S]*?}/g, "")};
-
-          ${localSchema.replaceAll("scalar DateTime", "").replaceAll(/input (.*?) {[\s\S]*?}/g, "").replaceAll("type AccountSnapshotLocalState", "").replaceAll("type BudgetStatementLocalState", "").replaceAll("type ScopeFrameworkLocalState", "")};
-
-    \n`;
-		(tmpDmSchema.match(/(type|enum|union|interface)\s+(\w+)[\s{]/g)?.map((f) => f.replaceAll("type ", "").replaceAll("enum ", "").replaceAll("union ", "").replaceAll("interface ", "").replaceAll("{", "").trim()))?.forEach((f) => {
-			const typeRegex = new RegExp(`(?<![_A-Za-z0-9])(${f})(?![_A-Za-z0-9])|\\[(${f})\\]|\\[(${f})!\\]|\\[(${f})\\]!|\\[(${f})!\\]!`, "g");
-			tmpDmSchema = tmpDmSchema.replace(typeRegex, (match, p1, p2, p3, p4, p5) => {
-				if (match.startsWith("[")) return match.replace(p2 || p3 || p4 || p5, `${dmSchemaName}_${p2 || p3 || p4 || p5}`);
-				return `${dmSchemaName}_${p1}`;
-			});
-		});
-		dmSchema += tmpDmSchema;
+		const definitions = [...stateTypeDefinitions(globalSchema), ...stateTypeDefinitions(localSchema, LOCAL_STATE_STUBS)];
+		const stateDoc = {
+			kind: Kind.DOCUMENT,
+			definitions
+		};
+		const prefixed = prefixTypeNames(stateDoc, dmSchemaName, new Set(definedTypeNames(stateDoc, STATE_PREFIX_KINDS)));
+		if (definitions.length > 0) dmSchema += `${print(prefixed)}\n`;
 		dmSchema += `
     type ${dmSchemaName} implements IDocument {
               id: String!
@@ -1562,7 +1707,7 @@ const getDocumentModelTypeDefs = (documentModels, typeDefs$1) => {
               stateJSON: JSONObject
           }\n`;
 	});
-	return dedupeTypeDefinitions(gql`
+	const schema = gql`
     scalar JSONObject
     scalar AttachmentRef
     # Codegen scalars not in the document-engineering set.
@@ -1613,7 +1758,7 @@ const getDocumentModelTypeDefs = (documentModels, typeDefs$1) => {
       operations(first: Int, skip: Int): [Operation!]!
       stateJSON: JSONObject
     }
-    ${dmSchema.replaceAll(";", "")}
+    ${dmSchema}
 
     type GqlDocument implements IDocument {
       id: String!
@@ -1638,34 +1783,32 @@ const getDocumentModelTypeDefs = (documentModels, typeDefs$1) => {
     }
 
     ${stripScalarDefinitions(typeDefs$1)}
-  `);
+  `;
+	return dedupeTypeDefinitions(schema);
 };
 /**
-* Extract type names from a GraphQL schema.
-* @param {string} schema - GraphQL schema string
-* @returns {string[]} Array of type names
+* Extract the names of types defined in a GraphQL schema.
+* Unparseable schemas yield no names.
 */
 function extractTypeNames(schema) {
-	const found = schema.match(/(type|enum|union|interface|input)\s+(\w+)[\s{]/g);
-	if (!found) return [];
-	return found.map((f) => f.replaceAll("type ", "").replaceAll("enum ", "").replaceAll("union ", "").replaceAll("interface ", "").replaceAll("input ", "").replaceAll("{", "").trim());
+	try {
+		return definedTypeNames(parseSdl(schema), ALL_PREFIX_KINDS);
+	} catch (error) {
+		logger.debug(`Skipping unparseable schema: ${String(error)}`);
+		return [];
+	}
 }
 /**
-* Extract input type definitions from a GraphQL schema.
-* @param {string} schema - GraphQL schema string
-* @param {Set<string>} excludeTypeNames - Type names to exclude from extraction
-* @returns {string} All input type definitions as a string
+* Print the input type definitions of a GraphQL schema.
+* @param excludeTypeNames - Input type names to leave out
 */
 function extractInputTypeDefinitions(schema, excludeTypeNames = /* @__PURE__ */ new Set()) {
-	const inputTypeRegex = /input\s+(\w+)\s*\{[^}]*\}/g;
-	const matches = [];
-	let match;
-	while ((match = inputTypeRegex.exec(schema)) !== null) {
-		const typeName = match[1];
-		if (!excludeTypeNames.has(typeName)) matches.push(match[0]);
-	}
-	if (matches.length === 0) return "";
-	return matches.join("\n\n");
+	const definitions = parseSdl(schema).definitions.filter((def) => def.kind === Kind.INPUT_OBJECT_TYPE_DEFINITION && !excludeTypeNames.has(def.name.value));
+	if (definitions.length === 0) return "";
+	return print({
+		kind: Kind.DOCUMENT,
+		definitions
+	});
 }
 /**
 * Extract the root state type name from a scope's GraphQL schema.
@@ -1734,9 +1877,7 @@ function generateStateInputTypes(stateSchema, excludeTypeNames) {
 		case Kind.OBJECT_TYPE_DEFINITION:
 			objectNames.add(def.name.value);
 			break;
-		case Kind.INPUT_OBJECT_TYPE_DEFINITION:
-			existingInputNames.add(def.name.value);
-			break;
+		case Kind.INPUT_OBJECT_TYPE_DEFINITION: existingInputNames.add(def.name.value);
 	}
 	const inputTypes = [];
 	for (const def of ast.definitions) {
@@ -1763,18 +1904,10 @@ function generateStateInputTypes(stateSchema, excludeTypeNames) {
 */
 function applyGraphQLTypePrefixes(schema, prefix, externalTypeNames = []) {
 	if (!schema || !schema.trim()) return schema;
-	let processedSchema = schema;
-	const localTypeNames = extractTypeNames(schema);
-	const allTypeNames = [...new Set([...localTypeNames, ...externalTypeNames])];
-	if (allTypeNames.length === 0) return schema;
-	allTypeNames.forEach((typeName) => {
-		const typeRegex = new RegExp(`(?<![_A-Za-z0-9])(${typeName})(?![_A-Za-z0-9])|\\[(${typeName})\\]|\\[(${typeName})!\\]|\\[(${typeName})\\]!|\\[(${typeName})!\\]!`, "g");
-		processedSchema = processedSchema.replace(typeRegex, (match, p1, p2, p3, p4, p5) => {
-			if (match.startsWith("[")) return match.replace(p2 || p3 || p4 || p5, `${prefix}_${p2 || p3 || p4 || p5}`);
-			return `${prefix}_${p1}`;
-		});
-	});
-	return processedSchema;
+	const doc = parseSdl(schema);
+	const names = /* @__PURE__ */ new Set([...definedTypeNames(doc, ALL_PREFIX_KINDS), ...externalTypeNames]);
+	if (names.size === 0) return schema;
+	return print(prefixTypeNames(doc, prefix, names));
 }
 /**
 * Generate a GraphQL schema for a document model.
@@ -1793,11 +1926,11 @@ function generateDocumentModelSchema(documentModel, options = {}) {
 	const localStateTypeNames = extractTypeNames(localStateSchema ?? "");
 	const stateTypeNames = [...globalStateTypeNames, ...localStateTypeNames];
 	const allOperationTypeNames = specification?.modules.flatMap((module) => module.operations.flatMap((op) => extractTypeNames(op.schema ?? ""))) ?? [];
-	const allTypeNames = [...new Set([...stateTypeNames, ...allOperationTypeNames])];
-	const prefixedStateInputTypes = applyGraphQLTypePrefixes(extractInputTypeDefinitions(globalStateSchema ?? "", new Set(allOperationTypeNames)), documentName, allTypeNames);
+	const allTypeNames = [.../* @__PURE__ */ new Set([...stateTypeNames, ...allOperationTypeNames])];
+	const operationInputTypeNames = new Set(allOperationTypeNames);
+	const prefixedStateInputTypes = applyGraphQLTypePrefixes(extractInputTypeDefinitions(globalStateSchema ?? "", operationInputTypeNames), documentName, allTypeNames);
 	const hasValidSchema = (schema) => !!(schema && /\b(input|type|enum|union|interface)\s+\w+/.test(schema));
-	const stateSchemaTypes = globalStateSchema ? applyGraphQLTypePrefixes(globalStateSchema.replaceAll("scalar DateTime", "").replaceAll(/input (.*?) {[\s\S]*?}/g, ""), documentName, allTypeNames) : "";
-	if (useNewApi) return generateNewApiSchema(documentName, specification, stateSchemaTypes, prefixedStateInputTypes, allTypeNames, hasValidSchema);
+	if (useNewApi) return generateNewApiSchema(documentName, specification, prefixedStateInputTypes, allTypeNames, hasValidSchema);
 	return generateLegacyApiSchema(documentName, specification, prefixedStateInputTypes, allTypeNames, hasValidSchema);
 }
 /**
@@ -1807,10 +1940,7 @@ function generateLegacyApiSchema(documentName, specification, prefixedStateInput
 	const createDocumentMutation = `${documentName}_createDocument(name:String!, driveId:String): String`;
 	const operationMutations = specification?.modules.flatMap((module) => module.operations.filter((op) => op.name && hasValidSchema(op.schema)).map((op) => `${documentName}_${camelCase(op.name)}(
             driveId: String, docId: PHID, input: ${documentName}_${pascalCase(op.name)}Input): Int`)).join("\n        ") ?? "";
-	const moduleSchemas = specification?.modules.filter((module) => module.operations.some((op) => hasValidSchema(op.schema))).map((module) => `"""
-       Module: ${pascalCase(module.name)}
-       """
-       ${module.operations.filter((op) => hasValidSchema(op.schema)).map((op) => applyGraphQLTypePrefixes(op.schema ?? "", documentName, allTypeNames)).join("\n  ")}`).join("\n") ?? "";
+	const moduleSchemas = buildModuleSchemas(specification, documentName, allTypeNames, hasValidSchema);
 	return gql`
     """
     Queries: ${documentName} Document
@@ -1847,7 +1977,7 @@ function generateLegacyApiSchema(documentName, specification, prefixedStateInput
 * in getDocumentModelTypeDefs() which is used during schema composition.
 * Including them here would cause duplicate type definitions.
 */
-function generateNewApiSchema(documentName, specification, _stateSchemaTypes, prefixedStateInputTypes, allTypeNames, hasValidSchema) {
+function generateNewApiSchema(documentName, specification, prefixedStateInputTypes, allTypeNames, hasValidSchema) {
 	const stateType = `${documentName}_FullState!`;
 	const sharedBaseTypes = `
     """Hash configuration for document state"""
@@ -1890,7 +2020,7 @@ function generateNewApiSchema(documentName, specification, _stateSchemaTypes, pr
 
     input ${documentName}_SearchFilterInput {
       parentId: String
-      identifiers: [String!]
+      identifiers: [String!] @deprecated(reason: "Ignored. Filter by parentId.")
     }
   `;
 	const revisionType = RevisionType;
@@ -1924,7 +2054,6 @@ function generateNewApiSchema(documentName, specification, _stateSchemaTypes, pr
     """
     type ${documentName}_DocumentResultPage {
       items: [${documentName}MutationResult!]!
-      totalCount: Int!
       hasNextPage: Boolean!
       hasPreviousPage: Boolean!
       cursor: String
@@ -1933,7 +2062,7 @@ function generateNewApiSchema(documentName, specification, _stateSchemaTypes, pr
 	const queries = `
     type ${documentName}Queries {
       """Get a specific ${documentName} document by identifier"""
-      document(identifier: String!, view: ${documentName}_ViewFilterInput): ${documentName}_DocumentWithChildren
+      document(idOrSlug: String, identifier: String @deprecated(reason: "Use idOrSlug."), view: ${documentName}_ViewFilterInput): ${documentName}_DocumentWithChildren
 
       """Get all ${documentName} documents (paged)"""
       documents(paging: ${documentName}_PagingInput): ${documentName}_DocumentResultPage!
@@ -1942,10 +2071,10 @@ function generateNewApiSchema(documentName, specification, _stateSchemaTypes, pr
       findDocuments(search: ${documentName}_SearchFilterInput, view: ${documentName}_ViewFilterInput, paging: ${documentName}_PagingInput): ${documentName}_DocumentResultPage!
 
       """Get outgoing relationships of a ${documentName} document"""
-      documentOutgoingRelationships(sourceIdentifier: String!, relationshipType: String!, view: ${documentName}_ViewFilterInput, paging: ${documentName}_PagingInput): ${documentName}_DocumentResultPage!
+      documentOutgoingRelationships(sourceIdOrSlug: String, sourceIdentifier: String @deprecated(reason: "Use sourceIdOrSlug."), relationshipType: String!, view: ${documentName}_ViewFilterInput, paging: ${documentName}_PagingInput): ${documentName}_DocumentResultPage!
 
       """Get incoming relationships to a ${documentName} document"""
-      documentIncomingRelationships(targetIdentifier: String!, relationshipType: String!, view: ${documentName}_ViewFilterInput, paging: ${documentName}_PagingInput): ${documentName}_DocumentResultPage!
+      documentIncomingRelationships(targetIdOrSlug: String, targetIdentifier: String @deprecated(reason: "Use targetIdOrSlug."), relationshipType: String!, view: ${documentName}_ViewFilterInput, paging: ${documentName}_PagingInput): ${documentName}_DocumentResultPage!
     }
   `;
 	let initialStateInputSchema = "";
@@ -1976,13 +2105,10 @@ function generateNewApiSchema(documentName, specification, _stateSchemaTypes, pr
 			initialStateInputSchema = inputTypeDefs ? `${inputTypeDefs}\n\n${wrapper}` : wrapper;
 		}
 	}
-	const createDocumentMutation = initialStateInputSchema ? `createDocument(name: String!, parentIdentifier: String, slug: String, preferredEditor: String, initialState: ${documentName}_InitialStateInput): ${documentName}MutationResult!` : `createDocument(name: String!, parentIdentifier: String, preferredEditor: String): ${documentName}MutationResult!`;
-	const createEmptyDocumentMutation = `createEmptyDocument(parentIdentifier: String): ${documentName}MutationResult!`;
-	const operationMutations = specification?.modules.flatMap((module) => module.operations.filter((op) => op.name && hasValidSchema(op.schema)).flatMap((op) => [`${camelCase(op.name)}(docId: PHID!, input: ${documentName}_${pascalCase(op.name)}Input!): ${documentName}MutationResult!`, `${camelCase(op.name)}Async(docId: PHID!, input: ${documentName}_${pascalCase(op.name)}Input!): String!`])).join("\n        ") ?? "";
-	const moduleSchemas = specification?.modules.filter((module) => module.operations.some((op) => hasValidSchema(op.schema))).map((module) => `"""
-       Module: ${pascalCase(module.name)}
-       """
-       ${module.operations.filter((op) => hasValidSchema(op.schema)).map((op) => applyGraphQLTypePrefixes(op.schema ?? "", documentName, allTypeNames)).join("\n  ")}`).join("\n") ?? "";
+	const createDocumentMutation = initialStateInputSchema ? `createDocument(name: String!, parentIdOrSlug: String, parentIdentifier: String @deprecated(reason: "Use parentIdOrSlug."), slug: String, preferredEditor: String, initialState: ${documentName}_InitialStateInput): ${documentName}MutationResult!` : `createDocument(name: String!, parentIdOrSlug: String, parentIdentifier: String @deprecated(reason: "Use parentIdOrSlug."), preferredEditor: String): ${documentName}MutationResult!`;
+	const createEmptyDocumentMutation = `createEmptyDocument(parentIdOrSlug: String, parentIdentifier: String @deprecated(reason: "Use parentIdOrSlug.")): ${documentName}MutationResult!`;
+	const operationMutations = specification?.modules.flatMap((module) => module.operations.filter((op) => op.name && hasValidSchema(op.schema)).flatMap((op) => [`${camelCase(op.name)}(documentIdOrSlug: String, docId: PHID @deprecated(reason: "Use documentIdOrSlug."), input: ${documentName}_${pascalCase(op.name)}Input!): ${documentName}MutationResult!`, `${camelCase(op.name)}Async(documentIdOrSlug: String, docId: PHID @deprecated(reason: "Use documentIdOrSlug."), input: ${documentName}_${pascalCase(op.name)}Input!): String!`])).join("\n        ") ?? "";
+	const moduleSchemas = buildModuleSchemas(specification, documentName, allTypeNames, hasValidSchema);
 	return gql`
     scalar DateTime
     scalar JSONObject
@@ -2135,7 +2261,8 @@ function OperationsFilterInputSchema() {
 	return z$1.object({
 		actionTypes: z$1.array(z$1.string()).nullish(),
 		branch: z$1.string().nullish(),
-		documentId: z$1.string(),
+		documentId: z$1.string().nullish(),
+		documentIdOrSlug: z$1.string().nullish(),
 		scopes: z$1.array(z$1.string()).nullish(),
 		sinceRevision: z$1.number().nullish(),
 		timestampFrom: z$1.string().nullish(),
@@ -2200,11 +2327,19 @@ function SyncEnvelopeInputSchema() {
 		type: SyncEnvelopeTypeSchema
 	});
 }
+function SyncRefusalInputSchema() {
+	return z$1.object({
+		branch: z$1.string(),
+		documentId: z$1.string(),
+		kind: z$1.string().nullish()
+	});
+}
 function TouchChannelInputSchema() {
 	return z$1.object({
 		collectionId: z$1.string(),
 		filter: z$1.lazy(() => RemoteFilterInputSchema()),
 		id: z$1.string(),
+		manifest: z$1.custom((v) => v != null).nullish(),
 		name: z$1.string(),
 		sinceTimestampUtcMs: z$1.string()
 	});
@@ -2230,6 +2365,16 @@ const PhDocumentFieldsFragmentDoc = gql`
     lastModifiedAtUtcIso
   }
 `;
+const DocumentRelationshipFieldsFragmentDoc = gql`
+  fragment DocumentRelationshipFields on DocumentRelationship {
+    sourceId
+    targetId
+    relationshipType
+    metadata
+    createdAt
+    updatedAt
+  }
+`;
 const GetDocumentModelsDocument = gql`
   query GetDocumentModels($namespace: String, $paging: PagingInput) {
     documentModels(namespace: $namespace, paging: $paging) {
@@ -2240,7 +2385,6 @@ const GetDocumentModelsDocument = gql`
         version
         specification
       }
-      totalCount
       hasNextPage
       hasPreviousPage
       cursor
@@ -2299,7 +2443,6 @@ const GetDocumentWithOperationsDocument = gql`
               }
             }
           }
-          totalCount
           hasNextPage
           hasPreviousPage
           cursor
@@ -2326,7 +2469,6 @@ const GetDocumentOutgoingRelationshipsDocument = gql`
       items {
         ...PHDocumentFields
       }
-      totalCount
       hasNextPage
       hasPreviousPage
       cursor
@@ -2350,7 +2492,6 @@ const GetDocumentIncomingRelationshipsDocument = gql`
       items {
         ...PHDocumentFields
       }
-      totalCount
       hasNextPage
       hasPreviousPage
       cursor
@@ -2358,6 +2499,52 @@ const GetDocumentIncomingRelationshipsDocument = gql`
   }
   ${PhDocumentFieldsFragmentDoc}
 `;
+const GetDocumentOutgoingRelationshipEdgesDocument = gql`
+  query GetDocumentOutgoingRelationshipEdges(
+    $sourceIdentifier: String!
+    $relationshipType: String
+    $view: ViewFilterInput
+    $paging: PagingInput
+  ) {
+    documentOutgoingRelationshipEdges(
+      sourceIdentifier: $sourceIdentifier
+      relationshipType: $relationshipType
+      view: $view
+      paging: $paging
+    ) {
+      items {
+        ...DocumentRelationshipFields
+      }
+      hasNextPage
+      hasPreviousPage
+      cursor
+    }
+  }
+  ${DocumentRelationshipFieldsFragmentDoc}
+`;
+const GetDocumentIncomingRelationshipEdgesDocument = gql`
+  query GetDocumentIncomingRelationshipEdges(
+    $targetIdentifier: String!
+    $relationshipType: String
+    $view: ViewFilterInput
+    $paging: PagingInput
+  ) {
+    documentIncomingRelationshipEdges(
+      targetIdentifier: $targetIdentifier
+      relationshipType: $relationshipType
+      view: $view
+      paging: $paging
+    ) {
+      items {
+        ...DocumentRelationshipFields
+      }
+      hasNextPage
+      hasPreviousPage
+      cursor
+    }
+  }
+  ${DocumentRelationshipFieldsFragmentDoc}
+`;
 const FindDocumentsDocument = gql`
   query FindDocuments(
     $search: SearchFilterInput
@@ -2368,7 +2555,6 @@ const FindDocumentsDocument = gql`
       items {
         ...PHDocumentFields
       }
-      totalCount
       hasNextPage
       hasPreviousPage
       cursor
@@ -2412,7 +2598,6 @@ const GetDocumentOperationsDocument = gql`
           }
         }
       }
-      totalCount
       hasNextPage
       hasPreviousPage
       cursor
@@ -2548,12 +2733,34 @@ const AddRelationshipDocument = gql`
     $sourceIdentifier: String!
     $targetIdentifier: String!
     $relationshipType: String!
+    $metadata: JSONObject
     $branch: String
   ) {
     addRelationship(
       sourceIdentifier: $sourceIdentifier
       targetIdentifier: $targetIdentifier
       relationshipType: $relationshipType
+      metadata: $metadata
+      branch: $branch
+    ) {
+      ...PHDocumentFields
+    }
+  }
+  ${PhDocumentFieldsFragmentDoc}
+`;
+const UpdateRelationshipDocument = gql`
+  mutation UpdateRelationship(
+    $sourceIdentifier: String!
+    $targetIdentifier: String!
+    $relationshipType: String!
+    $metadata: JSONObject
+    $branch: String
+  ) {
+    updateRelationship(
+      sourceIdentifier: $sourceIdentifier
+      targetIdentifier: $targetIdentifier
+      relationshipType: $relationshipType
+      metadata: $metadata
       branch: $branch
     ) {
       ...PHDocumentFields
@@ -2650,11 +2857,15 @@ const PollSyncEnvelopesDocument = gql`
     $channelId: String!
     $outboxAck: Int!
     $outboxLatest: Int!
+    $manifestRevision: String
+    $refusals: [SyncRefusalInput!]
   ) {
     pollSyncEnvelopes(
       channelId: $channelId
       outboxAck: $outboxAck
       outboxLatest: $outboxLatest
+      manifestRevision: $manifestRevision
+      refusals: $refusals
     ) {
       envelopes {
         type
@@ -2714,6 +2925,8 @@ const PollSyncEnvelopesDocument = gql`
         errorType
       }
       hasMore
+      manifestRevision
+      peerManifestRevision
     }
   }
 `;
@@ -2722,12 +2935,19 @@ const TouchChannelDocument = gql`
     touchChannel(input: $input) {
       success
       ackOrdinal
+      manifest
     }
   }
 `;
 const PushSyncEnvelopesDocument = gql`
-  mutation PushSyncEnvelopes($envelopes: [SyncEnvelopeInput!]!) {
-    pushSyncEnvelopes(envelopes: $envelopes)
+  mutation PushSyncEnvelopes(
+    $envelopes: [SyncEnvelopeInput!]!
+    $peerManifestRevision: String
+  ) {
+    pushSyncEnvelopes(
+      envelopes: $envelopes
+      peerManifestRevision: $peerManifestRevision
+    )
   }
 `;
 function getSdk(requester) {
@@ -2747,6 +2967,12 @@ function getSdk(requester) {
 		GetDocumentIncomingRelationships(variables, options) {
 			return requester(GetDocumentIncomingRelationshipsDocument, variables, options);
 		},
+		GetDocumentOutgoingRelationshipEdges(variables, options) {
+			return requester(GetDocumentOutgoingRelationshipEdgesDocument, variables, options);
+		},
+		GetDocumentIncomingRelationshipEdges(variables, options) {
+			return requester(GetDocumentIncomingRelationshipEdgesDocument, variables, options);
+		},
 		FindDocuments(variables, options) {
 			return requester(FindDocumentsDocument, variables, options);
 		},
@@ -2780,6 +3006,9 @@ function getSdk(requester) {
 		AddRelationship(variables, options) {
 			return requester(AddRelationshipDocument, variables, options);
 		},
+		UpdateRelationship(variables, options) {
+			return requester(UpdateRelationshipDocument, variables, options);
+		},
 		RemoveRelationship(variables, options) {
 			return requester(RemoveRelationshipDocument, variables, options);
 		},
@@ -2820,8 +3049,7 @@ function toDocumentModelResultPage(result) {
 		cursor: result.nextCursor ?? null,
 		hasNextPage: !!result.nextCursor,
 		hasPreviousPage: !!result.options.cursor,
-		items: models.map(toGqlDocumentModelState),
-		totalCount: result.results.length
+		items: models.map(toGqlDocumentModelState)
 	};
 }
 /**
@@ -2853,8 +3081,32 @@ function toPhDocumentResultPage(result) {
 		cursor: result.nextCursor ?? null,
 		hasNextPage: !!result.nextCursor,
 		hasPreviousPage: !!result.options.cursor,
-		items: result.results.map(toGqlPhDocument),
-		totalCount: result.totalCount ?? result.results.length
+		items: result.results.map(toGqlPhDocument)
+	};
+}
+/**
+* Converts a relationship edge from the indexer to GraphQL format.
+*/
+function toGqlDocumentRelationship(relationship) {
+	return {
+		sourceId: relationship.sourceId,
+		targetId: relationship.targetId,
+		relationshipType: relationship.relationshipType,
+		metadata: relationship.metadata ?? null,
+		createdAt: relationship.createdAt,
+		updatedAt: relationship.updatedAt
+	};
+}
+/**
+* Converts a PagedResults of relationship edges to GraphQL
+* DocumentRelationshipResultPage format
+*/
+function toDocumentRelationshipResultPage(result) {
+	return {
+		cursor: result.nextCursor ?? null,
+		hasNextPage: !!result.nextCursor,
+		hasPreviousPage: !!result.options.cursor,
+		items: result.results.map(toGqlDocumentRelationship)
 	};
 }
 /**
@@ -2904,8 +3156,8 @@ function fromInputMaybe(value) {
 function toReactorPropagationMode(gqlMode) {
 	if (gqlMode == null) return;
 	switch (gqlMode) {
-		case PropagationMode.Cascade: return PropagationMode$1.Cascade;
-		case PropagationMode.Orphan: return PropagationMode$1.None;
+		case "CASCADE": return PropagationMode$1.Cascade;
+		case "ORPHAN": return PropagationMode$1.None;
 	}
 }
 /**
@@ -2915,10 +3167,10 @@ function toReactorPropagationMode(gqlMode) {
 */
 function toGqlActionEvaluation(evaluation) {
 	return evaluation.decision === "allow" ? {
-		decision: AuthDecision.Allow,
+		decision: "ALLOW",
 		reason: null
 	} : {
-		decision: AuthDecision.Deny,
+		decision: "DENY",
 		reason: evaluation.reason
 	};
 }
@@ -3123,8 +3375,7 @@ function toOperationResultPage(result) {
 		cursor: result.nextCursor ?? null,
 		hasNextPage: !!result.nextCursor,
 		hasPreviousPage: !!result.options.cursor && result.options.cursor !== "0",
-		items: result.results.map(serializeOperationForGraphQL),
-		totalCount: result.results.length
+		items: result.results.map(serializeOperationForGraphQL)
 	};
 }
 function toGqlDocumentChangeEvent(event) {
@@ -3196,6 +3447,21 @@ function pickDriveClient(reactorClient, driveContainerType, reactorDriveClient)
 	}
 	return reactorClient.drives;
 }
+/**
+* A mutation's document re-read as the caller, since the client reads it back
+* as its signer. A caller who may write but not read gets it stripped.
+*/
+async function readAsCaller(reactorClient, document, subject, branch) {
+	if (!subject) return document;
+	try {
+		return await reactorClient.get(document.header.id, {
+			subject,
+			branch
+		});
+	} catch (error) {
+		throw new GraphQLError(`Failed to read the document back: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+}
 async function documentModels(reactorClient, args) {
 	const namespace = fromInputMaybe(args.namespace);
 	let paging;
@@ -3228,13 +3494,13 @@ async function document(reactorClient, args, subject) {
 	};
 	let result;
 	try {
-		result = await reactorClient.get(args.identifier, view);
+		result = await reactorClient.get(args.idOrSlug, view);
 	} catch (error) {
 		throw new GraphQLError(`Failed to fetch document: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 	let children;
 	try {
-		children = await reactorClient.getOutgoingRelationships(args.identifier, "child", view);
+		children = await reactorClient.getOutgoingRelationships(args.idOrSlug, "child", view);
 	} catch (error) {
 		throw new GraphQLError(`Failed to fetch children: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -3265,7 +3531,7 @@ async function documentOutgoingRelationships(reactorClient, args, subject) {
 	}
 	let result;
 	try {
-		result = await reactorClient.getOutgoingRelationships(args.sourceIdentifier, args.relationshipType, view, paging);
+		result = await reactorClient.getOutgoingRelationships(args.sourceIdOrSlug, args.relationshipType, view, paging);
 	} catch (error) {
 		throw new GraphQLError(`Failed to fetch outgoing relationships: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -3293,7 +3559,7 @@ async function documentIncomingRelationships(reactorClient, args, subject) {
 	}
 	let result;
 	try {
-		result = await reactorClient.getIncomingRelationships(args.targetIdentifier, args.relationshipType, view, paging);
+		result = await reactorClient.getIncomingRelationships(args.targetIdOrSlug, args.relationshipType, view, paging);
 	} catch (error) {
 		throw new GraphQLError(`Failed to fetch incoming relationships: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -3303,6 +3569,54 @@ async function documentIncomingRelationships(reactorClient, args, subject) {
 		throw new GraphQLError(`Failed to convert incoming relationships to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
+async function documentOutgoingRelationshipEdges(reactorClient, args, subject) {
+	const view = toRelationshipViewFilter(args.view, subject);
+	const paging = toRelationshipPagingOptions(args.paging);
+	let result;
+	try {
+		result = await reactorClient.getOutgoingRelationshipEdges(args.sourceIdOrSlug, fromInputMaybe(args.relationshipType), view, paging);
+	} catch (error) {
+		throw new GraphQLError(`Failed to fetch outgoing relationship edges: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+	try {
+		return toDocumentRelationshipResultPage(result);
+	} catch (error) {
+		throw new GraphQLError(`Failed to convert outgoing relationship edges to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+}
+async function documentIncomingRelationshipEdges(reactorClient, args, subject) {
+	const view = toRelationshipViewFilter(args.view, subject);
+	const paging = toRelationshipPagingOptions(args.paging);
+	let result;
+	try {
+		result = await reactorClient.getIncomingRelationshipEdges(args.targetIdOrSlug, fromInputMaybe(args.relationshipType), view, paging);
+	} catch (error) {
+		throw new GraphQLError(`Failed to fetch incoming relationship edges: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+	try {
+		return toDocumentRelationshipResultPage(result);
+	} catch (error) {
+		throw new GraphQLError(`Failed to convert incoming relationship edges to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+}
+function toRelationshipViewFilter(input, subject) {
+	if (!input) return subject ? { subject } : void 0;
+	return {
+		subject,
+		branch: fromInputMaybe(input.branch),
+		scopes: toMutableArray(fromInputMaybe(input.scopes))
+	};
+}
+function toRelationshipPagingOptions(input) {
+	if (!input) return;
+	const cursor = fromInputMaybe(input.cursor);
+	const limit = fromInputMaybe(input.limit);
+	if (!cursor && !limit) return;
+	return {
+		cursor: cursor || "",
+		limit: limit || 10
+	};
+}
 async function findDocuments(reactorClient, args, subject) {
 	let view = subject ? { subject } : void 0;
 	if (args.view) view = {
@@ -3335,13 +3649,42 @@ async function findDocuments(reactorClient, args, subject) {
 		throw new GraphQLError(`Failed to convert documents to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function jobStatus(reactorClient, args) {
+/**
+* The answer for a job the caller may not see, shaped as the reactor answers
+* an unknown one so that the two cannot be told apart.
+*/
+function unknownJob(jobId) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	return {
+		id: jobId,
+		documentId: "",
+		status: JobStatus.FAILED,
+		createdAtUtcIso: now,
+		completedAtUtcIso: now,
+		error: {
+			name: "Error",
+			message: "Job not found",
+			stack: ""
+		},
+		consistencyToken: {
+			version: 1,
+			createdAtUtcIso: now,
+			coordinates: []
+		},
+		meta: {
+			batchId: jobId,
+			batchJobIds: [jobId]
+		}
+	};
+}
+async function jobStatus(reactorClient, args, serves) {
 	let result;
 	try {
 		result = await reactorClient.getJobStatus(args.jobId);
 	} catch (error) {
 		throw new GraphQLError(`Failed to fetch job status: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	if (!await serves(result.documentId)) result = unknownJob(args.jobId);
 	try {
 		return toGqlJobInfo(result);
 	} catch (error) {
@@ -3379,7 +3722,7 @@ async function documentOperations(reactorClient, args, subject) {
 	}
 	let result;
 	try {
-		result = await reactorClient.getOperations(args.filter.documentId, view, operationFilter, paging);
+		result = await reactorClient.getOperations(args.filter.documentIdOrSlug, view, operationFilter, paging);
 	} catch (error) {
 		throw new GraphQLError(`Failed to fetch document operations: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -3411,7 +3754,7 @@ async function evaluateActions(reactorClient, args, subject) {
 	}));
 	let result;
 	try {
-		result = await reactorClient.evaluateActions(args.documentIdentifier, branch, candidates, subject);
+		result = await reactorClient.evaluateActions(args.documentIdOrSlug, branch, candidates, subject);
 	} catch (error) {
 		if (AuthEnforcementDisabledError.isError(error)) throw new AuthEvaluationUnsupportedError();
 		throw new GraphQLError(`Failed to evaluate actions: ${error instanceof Error ? error.message : "Unknown error"}`);
@@ -3424,51 +3767,54 @@ async function evaluateActions(reactorClient, args, subject) {
 		anyDenied: result.anyDenied
 	};
 }
-async function createDocument(reactorClient, args, reactorDriveClient) {
+async function createDocument(reactorClient, args, reactorDriveClient, subject) {
 	if (!args.document || typeof args.document !== "object") throw new GraphQLError("Invalid document: must be an object");
 	const document = args.document;
 	if (!document.header || typeof document.header !== "object") throw new GraphQLError("Invalid document: missing or invalid header");
-	const parentIdentifier = fromInputMaybe(args.parentIdentifier);
+	const parentIdOrSlug = fromInputMaybe(args.parentIdOrSlug);
 	let result;
 	try {
-		if (parentIdentifier) {
-			const parent = await reactorClient.get(parentIdentifier);
-			if (isDriveContainerType(parent.header.documentType)) result = await pickDriveClient(reactorClient, parent.header.documentType, reactorDriveClient).addFile(parentIdentifier, document);
-			else result = await reactorClient.create(document, parentIdentifier);
+		if (parentIdOrSlug) {
+			const parent = await reactorClient.get(parentIdOrSlug, subject && { subject });
+			if (isDriveContainerType(parent.header.documentType)) result = await pickDriveClient(reactorClient, parent.header.documentType, reactorDriveClient).addFile(parent.header.id, document);
+			else result = await reactorClient.create(document, parentIdOrSlug);
 		} else result = await reactorClient.create(document);
 	} catch (error) {
 		throw new GraphQLError(`Failed to create document: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	result = await readAsCaller(reactorClient, result, subject);
 	try {
 		return toGqlPhDocument(result);
 	} catch (error) {
 		throw new GraphQLError(`Failed to convert created document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function createEmptyDocument(reactorClient, args, reactorDriveClient) {
-	const parentIdentifier = fromInputMaybe(args.parentIdentifier);
+async function createEmptyDocument(reactorClient, args, reactorDriveClient, subject) {
+	const parentIdOrSlug = fromInputMaybe(args.parentIdOrSlug);
 	const name = fromInputMaybe(args.name);
 	let result;
 	try {
-		if (parentIdentifier) {
-			const parent = await reactorClient.get(parentIdentifier);
+		if (parentIdOrSlug) {
+			const parent = await reactorClient.get(parentIdOrSlug, subject && { subject });
 			if (isDriveContainerType(parent.header.documentType)) {
-				const document = (await reactorClient.getDocumentModelModule(args.documentType)).utils.createDocument();
+				const module = await reactorClient.getDocumentModelModule(args.documentType);
+				const document = withSignaturePolicy(module.utils.createDocument(), await reactorClient.getCreateSignaturePolicy());
 				if (name) document.header.name = name;
-				result = await pickDriveClient(reactorClient, parent.header.documentType, reactorDriveClient).addFile(parentIdentifier, document);
-			} else result = await reactorClient.createEmpty(args.documentType, { parentIdentifier });
+				result = await pickDriveClient(reactorClient, parent.header.documentType, reactorDriveClient).addFile(parent.header.id, document);
+			} else result = await reactorClient.createEmpty(args.documentType, { parentIdentifier: parentIdOrSlug });
 		} else result = await reactorClient.createEmpty(args.documentType, {});
 	} catch (error) {
 		throw new GraphQLError(`Failed to create empty document: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	result = await readAsCaller(reactorClient, result, subject);
 	try {
 		return toGqlPhDocument(result);
 	} catch (error) {
 		throw new GraphQLError(`Failed to convert created document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function createDocumentWithInitialState(reactorClient, args, reactorDriveClient) {
-	const parentIdentifier = fromInputMaybe(args.parentIdentifier);
+async function createDocumentWithInitialState(reactorClient, args, reactorDriveClient, subject) {
+	const parentIdOrSlug = fromInputMaybe(args.parentIdOrSlug);
 	const name = fromInputMaybe(args.name);
 	const slug = fromInputMaybe(args.slug);
 	const preferredEditor = fromInputMaybe(args.preferredEditor);
@@ -3478,7 +3824,7 @@ async function createDocumentWithInitialState(reactorClient, args, reactorDriveC
 	} catch (error) {
 		throw new GraphQLError(`Document model not found for type ${args.documentType}: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
-	const document = module.utils.createDocument();
+	const document = withSignaturePolicy(module.utils.createDocument(), await reactorClient.getCreateSignaturePolicy());
 	const allowedScopes = new Set(Object.keys(module.documentModel.global.specifications.at(-1)?.state ?? {}));
 	const state = document.state;
 	for (const [scope, scopeState] of Object.entries(args.initialState)) if (allowedScopes.has(scope) && scope in state) state[scope] = {
@@ -3492,22 +3838,22 @@ async function createDocumentWithInitialState(reactorClient, args, reactorDriveC
 		preferredEditor
 	};
 	let result;
-	if (parentIdentifier) {
+	if (parentIdOrSlug) {
 		let parent;
 		try {
-			parent = await reactorClient.get(parentIdentifier);
+			parent = await reactorClient.get(parentIdOrSlug, subject && { subject });
 		} catch (error) {
 			throw new GraphQLError(`Parent document not found: ${error instanceof Error ? error.message : "Unknown error"}`);
 		}
 		if (isDriveContainerType(parent.header.documentType)) {
 			const driveClient = pickDriveClient(reactorClient, parent.header.documentType, reactorDriveClient);
 			try {
-				result = await driveClient.addFile(parentIdentifier, document);
+				result = await driveClient.addFile(parent.header.id, document);
 			} catch (error) {
 				throw new GraphQLError(`Failed to create document in drive: ${error instanceof Error ? error.message : "Unknown error"}`);
 			}
 		} else try {
-			result = await reactorClient.create(document, parentIdentifier);
+			result = await reactorClient.create(document, parentIdOrSlug);
 		} catch (error) {
 			throw new GraphQLError(`Failed to create document with parent: ${error instanceof Error ? error.message : "Unknown error"}`);
 		}
@@ -3516,6 +3862,7 @@ async function createDocumentWithInitialState(reactorClient, args, reactorDriveC
 	} catch (error) {
 		throw new GraphQLError(`Failed to create document: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	result = await readAsCaller(reactorClient, result, subject);
 	try {
 		return toGqlPhDocument(result);
 	} catch (error) {
@@ -3532,12 +3879,12 @@ const DEFAULT_BRANCH = "main";
 * the schema cannot express: a signature travels as one string, and verification
 * reads it as the tuple it was.
 */
-async function execute(reactorClient, args) {
+async function execute(reactorClient, args, subject) {
 	const actions = toSubmittableActions(args.actions);
 	const branch = fromInputMaybe(args.branch) ?? DEFAULT_BRANCH;
 	let result;
 	try {
-		result = await reactorClient.execute(args.documentIdentifier, branch, actions);
+		result = await reactorClient.execute(args.documentIdOrSlug, branch, actions, void 0, subject);
 	} catch (error) {
 		throw new GraphQLError(`Failed to execute actions: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -3559,13 +3906,13 @@ async function executeAsync(reactorClient, args) {
 	const branch = fromInputMaybe(args.branch) ?? DEFAULT_BRANCH;
 	let job;
 	try {
-		job = await reactorClient.executeAsync(args.documentIdentifier, branch, actions);
+		job = await reactorClient.executeAsync(args.documentIdOrSlug, branch, actions);
 	} catch (error) {
 		throw new GraphQLError(`Failed to submit actions: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 	return toGqlJobInfo(job);
 }
-async function mutateDocument(reactorClient, args) {
+async function mutateDocument(reactorClient, args, subject) {
 	let validatedActions;
 	try {
 		validatedActions = validateActions(args.actions);
@@ -3576,7 +3923,7 @@ async function mutateDocument(reactorClient, args) {
 	const branch = args.view?.branch ?? "main";
 	let result;
 	try {
-		result = await reactorClient.execute(args.documentIdentifier, branch, validatedActions);
+		result = await reactorClient.execute(args.documentIdentifier, branch, validatedActions, void 0, subject);
 	} catch (error) {
 		throw new GraphQLError(`Failed to mutate document: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -3603,71 +3950,96 @@ async function mutateDocumentAsync(reactorClient, args) {
 	}
 	return result.id;
 }
-async function renameDocument(reactorClient, args, signal) {
+async function renameDocument(reactorClient, args, signal, subject) {
 	const branch = fromInputMaybe(args.branch);
 	let result;
 	try {
-		result = await reactorClient.rename(args.documentIdentifier, args.name, branch, signal);
+		result = await reactorClient.rename(args.documentIdOrSlug, args.name, branch, signal);
 	} catch (error) {
 		throw new GraphQLError(`Failed to rename document: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	result = await readAsCaller(reactorClient, result, subject, branch);
 	try {
 		return toGqlPhDocument(result);
 	} catch (error) {
 		throw new GraphQLError(`Failed to convert renamed document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function setPreferredEditor(reactorClient, args, signal) {
+async function setPreferredEditor(reactorClient, args, signal, subject) {
 	const branch = fromInputMaybe(args.branch);
 	const preferredEditor = fromInputMaybe(args.preferredEditor) ?? null;
 	let result;
 	try {
-		result = await reactorClient.setPreferredEditor(args.documentIdentifier, preferredEditor, branch, signal);
+		result = await reactorClient.setPreferredEditor(args.documentIdOrSlug, preferredEditor, branch, signal);
 	} catch (error) {
 		throw new GraphQLError(`Failed to set preferred editor: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	result = await readAsCaller(reactorClient, result, subject, branch);
 	try {
 		return toGqlPhDocument(result);
 	} catch (error) {
 		throw new GraphQLError(`Failed to convert updated document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function addRelationship(reactorClient, args) {
+async function addRelationship(reactorClient, args, subject) {
 	const branch = fromInputMaybe(args.branch);
+	const metadata = fromInputMaybe(args.metadata);
 	let result;
 	try {
-		result = await reactorClient.addRelationship(args.sourceIdentifier, args.targetIdentifier, args.relationshipType, branch);
+		result = await reactorClient.addRelationship(args.sourceIdOrSlug, args.targetIdOrSlug, args.relationshipType, metadata, branch);
 	} catch (error) {
 		throw new GraphQLError(`Failed to add relationship: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	result = await readAsCaller(reactorClient, result, subject, branch);
+	try {
+		return toGqlPhDocument(result);
+	} catch (error) {
+		throw new GraphQLError(`Failed to convert document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+}
+async function updateRelationship(reactorClient, args, subject) {
+	const branch = fromInputMaybe(args.branch);
+	const metadata = fromInputMaybe(args.metadata) ?? null;
+	let result;
+	try {
+		result = await reactorClient.updateRelationship(args.sourceIdOrSlug, args.targetIdOrSlug, args.relationshipType, metadata, branch);
+	} catch (error) {
+		throw new GraphQLError(`Failed to update relationship: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+	result = await readAsCaller(reactorClient, result, subject, branch);
 	try {
 		return toGqlPhDocument(result);
 	} catch (error) {
 		throw new GraphQLError(`Failed to convert document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function removeRelationship(reactorClient, args) {
+async function removeRelationship(reactorClient, args, subject) {
 	const branch = fromInputMaybe(args.branch);
 	let result;
 	try {
-		result = await reactorClient.removeRelationship(args.sourceIdentifier, args.targetIdentifier, args.relationshipType, branch);
+		result = await reactorClient.removeRelationship(args.sourceIdOrSlug, args.targetIdOrSlug, args.relationshipType, branch);
 	} catch (error) {
 		throw new GraphQLError(`Failed to remove relationship: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	result = await readAsCaller(reactorClient, result, subject, branch);
 	try {
 		return toGqlPhDocument(result);
 	} catch (error) {
 		throw new GraphQLError(`Failed to convert document to GraphQL: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
-async function moveRelationship(reactorClient, args) {
+async function moveRelationship(reactorClient, args, subject) {
 	const branch = fromInputMaybe(args.branch);
 	let result;
 	try {
-		result = await reactorClient.moveRelationship(args.sourceParentIdentifier, args.targetParentIdentifier, args.targetIdentifier, args.relationshipType, branch);
+		result = await reactorClient.moveRelationship(args.sourceParentIdOrSlug, args.targetParentIdOrSlug, args.targetIdOrSlug, args.relationshipType, branch);
 	} catch (error) {
 		throw new GraphQLError(`Failed to move relationship: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
+	result = {
+		source: await readAsCaller(reactorClient, result.source, subject, branch),
+		target: await readAsCaller(reactorClient, result.target, subject, branch)
+	};
 	try {
 		return {
 			source: toGqlPhDocument(result.source),
@@ -3680,9 +4052,12 @@ async function moveRelationship(reactorClient, args) {
 async function deleteDocument(reactorClient, args, reactorDriveClient) {
 	const propagate = toReactorPropagationMode(args.propagate);
 	try {
-		const driveParent = (await reactorClient.getIncomingRelationships(args.identifier, "child")).results.find((p) => isDriveContainerType(p.header.documentType));
-		if (driveParent) await pickDriveClient(reactorClient, driveParent.header.documentType, reactorDriveClient).removeNode(driveParent.header.id, args.identifier);
-		else await reactorClient.deleteDocument(args.identifier, propagate);
+		const driveParent = (await reactorClient.getIncomingRelationships(args.idOrSlug, "child")).results.find((p) => isDriveContainerType(p.header.documentType));
+		if (driveParent) {
+			const driveClient = pickDriveClient(reactorClient, driveParent.header.documentType, reactorDriveClient);
+			const documentId = await reactorClient.resolveIdOrSlug(args.idOrSlug);
+			await driveClient.removeNode(driveParent.header.id, documentId);
+		} else await reactorClient.deleteDocument(args.idOrSlug, propagate);
 		return true;
 	} catch (error) {
 		throw new GraphQLError(`Failed to delete document: ${error instanceof Error ? error.message : "Unknown error"}`);
@@ -3690,9 +4065,9 @@ async function deleteDocument(reactorClient, args, reactorDriveClient) {
 }
 async function deleteDocuments(reactorClient, args) {
 	const propagate = toReactorPropagationMode(args.propagate);
-	const identifiers = [...args.identifiers];
+	const idsOrSlugs = [...args.idsOrSlugs];
 	try {
-		await reactorClient.deleteDocuments(identifiers, propagate);
+		await reactorClient.deleteDocuments(idsOrSlugs, propagate);
 		return true;
 	} catch (error) {
 		throw new GraphQLError(`Failed to delete documents: ${error instanceof Error ? error.message : "Unknown error"}`);
@@ -3706,12 +4081,19 @@ async function deleteDocuments(reactorClient, args) {
 * an unanswered question: the first authenticated subject to use it adopts it.
 */
 async function touchChannel(syncManager, args, boundAddress) {
+	const peer = readPeerManifest(args.input.manifest);
+	let existing;
 	try {
+		existing = syncManager.getById(args.input.id);
+	} catch {}
+	if (existing) {
+		await syncManager.setPeerManifest(args.input.id, peer);
 		return {
 			success: true,
-			ackOrdinal: syncManager.getById(args.input.id).channel.inbox.ackOrdinal
+			ackOrdinal: existing.channel.inbox.ackOrdinal,
+			manifest: syncManager.localManifest()
 		};
-	} catch {}
+	}
 	const filter = {
 		documentId: [...args.input.filter.documentId],
 		scope: [...args.input.filter.scope],
@@ -3725,13 +4107,45 @@ async function touchChannel(syncManager, args, boundAddress) {
 		await syncManager.add(args.input.name, DriveCollectionId.fromKey(args.input.collectionId), {
 			type: "polling",
 			parameters: {}
-		}, filter, options, args.input.id);
+		}, filter, options, args.input.id, peer);
 	} catch (error) {
 		throw new GraphQLError(`Failed to create channel: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 	return {
 		success: true,
-		ackOrdinal: 0
+		ackOrdinal: 0,
+		manifest: syncManager.localManifest()
+	};
+}
+async function syncHolds(syncManager, args) {
+	return (await syncManager.listHolds({
+		remoteName: args.remoteName ?? void 0,
+		documentId: args.documentId ?? void 0
+	})).map((hold) => ({
+		...hold,
+		reason: {
+			...hold.reason,
+			peerSupports: [...hold.reason.peerSupports]
+		},
+		heldAtUtcMs: String(hold.heldAtUtcMs)
+	}));
+}
+function peerAgreement(syncManager, args) {
+	const agreement = syncManager.agreement();
+	const members = [...agreement.members([args.collectionId])].map(([remoteName, supports]) => ({
+		remoteName,
+		announced: "revision" in supports,
+		protocols: supports.protocols,
+		features: supports.features
+	}));
+	return {
+		collectionId: args.collectionId,
+		local: agreement.local(),
+		members,
+		limitedBy: Object.keys(agreement.basis().wanted).map((protocol) => ({
+			protocol,
+			remoteNames: agreement.limitedBy(args.collectionId, protocol)
+		}))
 	};
 }
 /**
@@ -3786,7 +4200,8 @@ async function collectHeldSyncOperations(syncOps, gate, subject, signal) {
 *   client ordinal the switchboard has successfully applied, so the client
 *   can trim its own outbox)
 */
-function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new Set(), heldOpIds = /* @__PURE__ */ new Set()) {
+function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new Set(), heldOpIds = /* @__PURE__ */ new Set(), gatedOpIds) {
+	const isHeld = (syncOp) => heldOpIds.has(syncOp.id) || gatedOpIds !== void 0 && !gatedOpIds.has(syncOp.id);
 	let remote;
 	try {
 		remote = syncManager.getById(args.channelId);
@@ -3794,7 +4209,11 @@ function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new
 		throw new GraphQLError(`Channel not found: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 	remote.channel.notePoll();
-	const deadLetters = remote.channel.deadLetter.items.filter((syncOp) => !forbiddenIds.has(syncOp.documentId) && !heldOpIds.has(syncOp.id)).map((syncOp) => ({
+	const revisions = {
+		manifestRevision: syncManager.localManifest().revision,
+		peerManifestRevision: remote.meta.peer?.manifest?.revision ?? null
+	};
+	const deadLetters = remote.channel.deadLetter.items.filter((syncOp) => !forbiddenIds.has(syncOp.documentId) && !isHeld(syncOp)).map((syncOp) => ({
 		documentId: syncOp.documentId,
 		error: syncOp.error?.message ?? "Unknown error",
 		errorType: syncOperationErrorType(syncOp.error),
@@ -3829,7 +4248,8 @@ function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new
 		envelopes: [],
 		ackOrdinal: remote.channel.inbox.ackOrdinal,
 		deadLetters,
-		hasMore: false
+		hasMore: false,
+		...revisions
 	};
 	const sorted = [...operations].sort((a, b) => {
 		return (a.operations[0]?.context.ordinal ?? 0) - (b.operations[0]?.context.ordinal ?? 0);
@@ -3843,9 +4263,10 @@ function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new
 			hasMore = true;
 			break;
 		}
-		if (heldOpIds.has(syncOp.id)) continue;
+		if (isHeld(syncOp)) continue;
 		syncOp.deliveredCount ??= 0;
 		syncOp.emittedCount ??= 0;
+		if (!forbiddenIds.has(syncOp.documentId)) while (syncOp.deliveredCount > 0 && syncOp.operations[syncOp.deliveredCount - 1].context.ordinal > args.outboxLatest) syncOp.deliveredCount -= 1;
 		while (syncOp.deliveredCount < syncOp.emittedCount && syncOp.operations[syncOp.deliveredCount].context.ordinal <= args.outboxLatest) syncOp.deliveredCount += 1;
 		const remaining = syncOp.operations.slice(syncOp.deliveredCount);
 		if (remaining.length === 0) continue;
@@ -3897,9 +4318,71 @@ function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new
 		envelopes,
 		ackOrdinal: remote.channel.inbox.ackOrdinal,
 		deadLetters,
-		hasMore
+		hasMore,
+		...revisions
 	};
 }
+const MARKER_REFUSAL = "marker";
+/**
+* The client's UNSUPPORTED_PROTOCOL refusals of polled rows. Each becomes a hold
+* for that client, as a pushed refusal does, rather than counting as delivered.
+* A refused marker is not a hold: {@link recordPollMarkerRefusals} takes it.
+* A kind this server does not know is ignored.
+*/
+function holdPollRefusals(syncManager, channelId, all) {
+	const refusals = all?.filter((refusal) => refusal.kind === void 0 || refusal.kind === null);
+	if (!refusals?.length) return;
+	let remote;
+	try {
+		remote = syncManager.getById(channelId);
+	} catch {
+		return;
+	}
+	const refused = refusals.map((refusal) => {
+		const syncOp = new SyncOperation(crypto.randomUUID(), "", [], remote.meta.name, refusal.documentId, [], refusal.branch, []);
+		syncOp.failed(new ChannelError(ChannelErrorSource.Outbox, /* @__PURE__ */ new Error(`Refused by ${remote.meta.name}`), "UNSUPPORTED_PROTOCOL"));
+		return syncOp;
+	});
+	remote.channel.deadLetter.add(...refused);
+}
+/**
+* The client's refusals of purge markers it polled. Persisted before the poll is
+* served; a failure fails the poll, and the client reports them again. The sync
+* manager keeps only refusals of markers this remote was owed.
+*/
+async function recordPollMarkerRefusals(syncManager, channelId, all) {
+	const refusals = all?.filter((refusal) => refusal.kind === MARKER_REFUSAL);
+	if (!refusals?.length) return;
+	if (!supportsPurgeRefusals(syncManager)) return;
+	let remote;
+	try {
+		remote = syncManager.getById(channelId);
+	} catch {
+		return;
+	}
+	try {
+		await syncManager.recordPolledMarkerRefusals(remote.meta.name, refusals.map(({ documentId, branch }) => ({
+			documentId,
+			branch
+		})));
+	} catch (error) {
+		throw new RefusalNotRecordedError(error);
+	}
+}
+/**
+* A poll naming no revision is from a client without peer agreement: it is
+* recorded silent, and what it can no longer run is held, before it is served.
+*/
+async function silenceUnversionedPoll(syncManager, channelId, manifestRevision) {
+	if (typeof manifestRevision === "string") return;
+	let remote;
+	try {
+		remote = syncManager.getById(channelId);
+	} catch {
+		return;
+	}
+	if (remote.meta.peer?.manifest) await syncManager.setPeerManifest(channelId, null);
+}
 /**
 * Receives sync envelopes pushed by a client and adds them to the
 * appropriate channel inboxes.
@@ -3908,7 +4391,7 @@ function pollSyncEnvelopes(syncManager, args, forbiddenIds = /* @__PURE__ */ new
 * It must be preserved because the inbox mailbox tracks applied ordinals
 * and returns the highest one as `ackOrdinal` in pollSyncEnvelopes.
 */
-function pushSyncEnvelopes(syncManager, args) {
+async function pushSyncEnvelopes(syncManager, args) {
 	const remoteSyncOps = /* @__PURE__ */ new Map();
 	for (const envelope of args.envelopes) {
 		let remote;
@@ -3929,7 +4412,12 @@ function pushSyncEnvelopes(syncManager, args) {
 		for (const syncOp of consolidated) syncOp.jobDependencies = syncOp.jobDependencies.filter((dep) => validKeys.has(dep));
 		remote.channel.inbox.add(...consolidated);
 	}
-	return Promise.resolve(true);
+	try {
+		await syncManager.receiptsStored?.([...remoteSyncOps.keys()].map((remote) => remote.meta.name));
+	} catch (error) {
+		throw new GraphQLError(`Failed to store received markers: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	return true;
 }
 //#endregion
 //#region src/graphql/document-model-subgraph.ts
@@ -3956,6 +4444,16 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 		const documentName = getDocumentModelSchemaName(this.documentModel.documentModel.global);
 		return this.resolvers[`${documentName}Mutations`];
 	}
+	/** Drops the items the host's own ACL refuses the caller. */
+	async #readableItems(page, ctx) {
+		if (this.authorizationService.isSupremeAdmin(ctx.user?.address)) return page;
+		const items = [];
+		for (const item of page.items) if (await this.canReadDocument(item.id, ctx)) items.push(item);
+		return {
+			...page,
+			items
+		};
+	}
 	/**
 	* Generate __resolveType functions for union types found in the document model schema.
 	* Parses the state schema to find union definitions and their member types,
@@ -4011,13 +4509,14 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 			Query: { [documentName]: () => ({}) },
 			[`${documentName}Queries`]: {
 				document: async (_, args, ctx) => {
-					const { identifier, view } = args;
-					if (!identifier) throw new GraphQLError("Document identifier is required");
+					const idOrSlug = requireOneOf(args, "idOrSlug", "identifier");
+					const { view } = args;
+					if (!idOrSlug) throw new GraphQLError("Document identifier is required");
 					const result = await document(this.reactorClient, {
-						identifier,
+						idOrSlug,
 						view
-					});
-					if (result.document.documentType !== documentType) throw new GraphQLError(`Document with id ${identifier} is not of type ${documentType}`);
+					}, this.viewSubject(ctx));
+					if (result.document.documentType !== documentType) throw new GraphQLError(`Document with id ${idOrSlug} is not of type ${documentType}`);
 					await this.assertCanReadCanonical(result.document.id, ctx);
 					return result;
 				},
@@ -4026,17 +4525,8 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 					const result = await findDocuments(this.reactorClient, {
 						search: { type: documentType },
 						paging
-					});
-					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
-						const filteredItems = [];
-						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
-						return {
-							...result,
-							items: filteredItems,
-							totalCount: filteredItems.length
-						};
-					}
-					return result;
+					}, this.viewSubject(ctx));
+					return this.#readableItems(result, ctx);
 				},
 				findDocuments: async (_, args, ctx) => {
 					const { search, view, paging } = args;
@@ -4047,98 +4537,94 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						},
 						view,
 						paging
-					});
-					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
-						const filteredItems = [];
-						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
-						return {
-							...result,
-							items: filteredItems,
-							totalCount: filteredItems.length
-						};
-					}
-					return result;
+					}, this.viewSubject(ctx));
+					return this.#readableItems(result, ctx);
 				},
 				documentOutgoingRelationships: async (_, args, ctx) => {
+					const sourceIdOrSlug = requireOneOf(args, "sourceIdOrSlug", "sourceIdentifier");
 					const { relationshipType, view, paging } = args;
-					const handle = await this.assertCanRead(args.sourceIdentifier, ctx);
+					const handle = await this.assertCanRead(sourceIdOrSlug, ctx);
 					const result = await documentOutgoingRelationships(this.reactorClient, {
-						sourceIdentifier: handle.fetchIdentifier,
+						sourceIdOrSlug: handle.fetchIdentifier,
 						relationshipType,
 						view,
 						paging
-					});
-					const filteredItems = result.items.filter((item) => item.documentType === documentType);
+					}, this.viewSubject(ctx));
+					const readable = await this.#readableItems(result, ctx);
+					const filteredItems = readable.items.filter((item) => item.documentType === documentType);
 					return {
-						...result,
-						items: filteredItems,
-						totalCount: filteredItems.length
+						...readable,
+						items: filteredItems
 					};
 				},
 				documentIncomingRelationships: async (_, args, ctx) => {
+					const targetIdOrSlug = requireOneOf(args, "targetIdOrSlug", "targetIdentifier");
 					const { relationshipType, view, paging } = args;
-					const handle = await this.assertCanRead(args.targetIdentifier, ctx);
-					return documentIncomingRelationships(this.reactorClient, {
-						targetIdentifier: handle.fetchIdentifier,
+					const handle = await this.assertCanRead(targetIdOrSlug, ctx);
+					const result = await documentIncomingRelationships(this.reactorClient, {
+						targetIdOrSlug: handle.fetchIdentifier,
 						relationshipType,
 						view,
 						paging
-					});
+					}, this.viewSubject(ctx));
+					return this.#readableItems(result, ctx);
 				}
 			},
 			Mutation: { [documentName]: () => ({}) },
 			[`${documentName}Mutations`]: {
 				createDocument: async (_, args, ctx) => {
 					const { name, slug, preferredEditor, initialState } = args;
-					let parentIdentifier = args.parentIdentifier;
-					if (parentIdentifier) parentIdentifier = (await this.assertCanWrite(parentIdentifier, ctx)).fetchIdentifier;
+					let parentIdOrSlug = optionalOneOf(args, "parentIdOrSlug", "parentIdentifier");
+					if (parentIdOrSlug) parentIdOrSlug = (await this.assertCanWrite(parentIdOrSlug, ctx)).fetchIdentifier;
 					else this.assertCanCreate(ctx);
 					let createdDoc;
 					if (initialState || preferredEditor) createdDoc = await createDocumentWithInitialState(this.reactorClient, {
 						documentType,
-						parentIdentifier,
+						parentIdOrSlug,
 						name,
 						slug,
 						preferredEditor,
 						initialState: initialState ?? {}
-					}, this.graphqlManager.reactorDriveClient);
+					}, this.graphqlManager.reactorDriveClient, this.viewSubject(ctx));
 					else createdDoc = await createEmptyDocument(this.reactorClient, {
 						documentType,
-						parentIdentifier,
+						parentIdOrSlug,
 						name
-					}, this.graphqlManager.reactorDriveClient);
+					}, this.graphqlManager.reactorDriveClient, this.viewSubject(ctx));
 					if (ctx.user?.address && createdDoc?.id) await this.documentPermissionService?.initializeDocumentProtection(createdDoc.id, ctx.user.address, this.authorizationService.config.defaultProtection);
-					if (!initialState && !preferredEditor && name && createdDoc.name !== name) return toGqlPhDocument(await this.reactorClient.execute(createdDoc.id, "main", [setName(name)]));
+					if (!initialState && !preferredEditor && name && createdDoc.name !== name) return toGqlPhDocument(await this.reactorClient.execute(createdDoc.id, "main", [setName(name)], void 0, this.viewSubject(ctx)));
 					return createdDoc;
 				},
 				createEmptyDocument: async (_, args, ctx) => {
-					let parentIdentifier = args.parentIdentifier;
-					if (parentIdentifier) parentIdentifier = (await this.assertCanWrite(parentIdentifier, ctx)).fetchIdentifier;
+					let parentIdOrSlug = optionalOneOf(args, "parentIdOrSlug", "parentIdentifier");
+					if (parentIdOrSlug) parentIdOrSlug = (await this.assertCanWrite(parentIdOrSlug, ctx)).fetchIdentifier;
 					else this.assertCanCreate(ctx);
 					const result = await createEmptyDocument(this.reactorClient, {
 						documentType,
-						parentIdentifier
-					}, this.graphqlManager.reactorDriveClient);
+						parentIdOrSlug
+					}, this.graphqlManager.reactorDriveClient, this.viewSubject(ctx));
 					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
 				},
 				...operations.reduce((mutations, op) => {
 					mutations[camelCase(op.name)] = async (_, args, ctx) => {
-						const { docId, input } = args;
-						const effectiveDocId = (await this.assertCanExecuteOperation(docId, op.name, ctx)).fetchIdentifier;
-						if ((await this.reactorClient.get(effectiveDocId)).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
+						const documentIdOrSlug = requireOneOf(args, "documentIdOrSlug", "docId");
+						const { input } = args;
+						const effectiveDocId = (await this.assertCanExecuteOperation(documentIdOrSlug, op.name, ctx)).fetchIdentifier;
+						if ((await this.reactorClient.get(effectiveDocId, { subject: this.viewSubject(ctx) })).header.documentType !== documentType) throw new GraphQLError(`Document with id ${documentIdOrSlug} is not of type ${documentType}`);
 						const action = this.documentModel.actions[camelCase(op.name)];
 						if (!action) throw new GraphQLError(`Action ${op.name} not found`);
 						try {
-							return toGqlPhDocument(await this.reactorClient.execute(effectiveDocId, "main", [action(input)]));
+							return toGqlPhDocument(await this.reactorClient.execute(effectiveDocId, "main", [action(input)], void 0, this.viewSubject(ctx)));
 						} catch (error) {
 							throw new GraphQLError(error instanceof Error ? error.message : `Failed to ${op.name}`);
 						}
 					};
 					mutations[`${camelCase(op.name)}Async`] = async (_, args, ctx) => {
-						const { docId, input } = args;
-						const effectiveDocId = (await this.assertCanExecuteOperation(docId, op.name, ctx)).fetchIdentifier;
-						if ((await this.reactorClient.get(effectiveDocId)).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
+						const documentIdOrSlug = requireOneOf(args, "documentIdOrSlug", "docId");
+						const { input } = args;
+						const effectiveDocId = (await this.assertCanExecuteOperation(documentIdOrSlug, op.name, ctx)).fetchIdentifier;
+						if ((await this.reactorClient.get(effectiveDocId, { subject: this.viewSubject(ctx) })).header.documentType !== documentType) throw new GraphQLError(`Document with id ${documentIdOrSlug} is not of type ${documentType}`);
 						const action = this.documentModel.actions[camelCase(op.name)];
 						if (!action) throw new GraphQLError(`Action ${op.name} not found`);
 						try {
@@ -4162,7 +4648,7 @@ const DRIVE_ID_HEADER = "drive-id";
 * in the ownership set yet); other create-shaped operations that may
 * synthesize a drive must be added here too.
 */
-const CACHE_BYPASS_OPERATIONS = new Set(["createDocument", "createEmptyDocument"]);
+const CACHE_BYPASS_OPERATIONS = /* @__PURE__ */ new Set(["createDocument", "createEmptyDocument"]);
 const driveIdMap = /* @__PURE__ */ new WeakMap();
 /** Internal — only `graphql-manager.ts` should call this. */
 function getRequestDriveId(request) {
@@ -4232,6 +4718,7 @@ function wrongShardResponse(driveId) {
 * 421 response.
 */
 var DriveOwnershipCache = class {
+	reactorClient;
 	drives = /* @__PURE__ */ new Set();
 	constructor(reactorClient) {
 		this.reactorClient = reactorClient;
@@ -4363,8 +4850,8 @@ var GraphQLManager = class {
 	subgraphHandlerCache = /* @__PURE__ */ new Map();
 	/** subgraphPath → the http adapter handle of its mounted route. */
 	subgraphRouteHandles = /* @__PURE__ */ new Map();
-	/** Handle of the currently mounted supergraph SSE route, if any. */
-	sseRouteHandle;
+	/** Mounted SSE routes, keyed by path: the supergraph's and each subgraph's. */
+	sseRouteHandles = /* @__PURE__ */ new Map();
 	/**
 	* Package name → the subgraph instances registered from it, keyed by
 	* subgraph name. Tracks the package association so that removed packages
@@ -4383,26 +4870,43 @@ var GraphQLManager = class {
 	authorizationService;
 	/** Route service in use: the injected one, or one built on first need. */
 	#fallbackRoutes;
-	constructor(path, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, logger, httpAdapter, gatewayAdapter, authService, documentPermissionService, featureFlags = DefaultFeatureFlags, port = 4001, authorizationService, reactorDriveClient, syncServingGate, httpRoutes) {
-		this.path = path;
-		this.httpServer = httpServer;
-		this.wsServer = wsServer;
-		this.reactorClient = reactorClient;
-		this.relationalDb = relationalDb;
-		this.analyticsStore = analyticsStore;
-		this.syncManager = syncManager;
-		this.logger = logger;
-		this.httpAdapter = httpAdapter;
-		this.gatewayAdapter = gatewayAdapter;
-		this.authService = authService;
-		this.documentPermissionService = documentPermissionService;
-		this.featureFlags = featureFlags;
-		this.port = port;
-		this.syncServingGate = syncServingGate;
-		this.httpRoutes = httpRoutes;
-		if (!authorizationService) throw new Error("GraphQLManager requires an authorizationService");
-		this.authorizationService = authorizationService;
-		this.reactorDriveClient = reactorDriveClient;
+	path;
+	httpServer;
+	wsServer;
+	reactorClient;
+	relationalDb;
+	analyticsStore;
+	syncManager;
+	logger;
+	httpAdapter;
+	gatewayAdapter;
+	authService;
+	documentPermissionService;
+	featureFlags;
+	port;
+	syncServingGate;
+	httpRoutes;
+	attachments;
+	constructor(options) {
+		this.path = options.path;
+		this.httpServer = options.httpServer;
+		this.wsServer = options.wsServer;
+		this.reactorClient = options.reactorClient;
+		this.relationalDb = options.relationalDb;
+		this.analyticsStore = options.analyticsStore;
+		this.syncManager = options.syncManager;
+		this.logger = options.logger;
+		this.httpAdapter = options.httpAdapter;
+		this.gatewayAdapter = options.gatewayAdapter;
+		this.authService = options.authService;
+		this.documentPermissionService = options.documentPermissionService;
+		this.featureFlags = options.featureFlags ?? DefaultFeatureFlags;
+		this.port = options.port ?? 4001;
+		this.authorizationService = options.authorizationService;
+		this.reactorDriveClient = options.reactorDriveClient;
+		this.syncServingGate = options.syncServingGate;
+		this.httpRoutes = options.httpRoutes;
+		this.attachments = options.attachments;
 		this.driveOwnershipCache = new DriveOwnershipCache(this.reactorClient);
 		this.wsServer.setMaxListeners(0);
 	}
@@ -4425,23 +4929,25 @@ var GraphQLManager = class {
 			const matched = driveMatcher(url.pathname);
 			const driveIdOrSlug = matched ? matched.params.drive : void 0;
 			if (!driveIdOrSlug) return Response.json({ error: "Drive ID or slug is required" }, { status: 400 });
+			const user = getAuthContext(request)?.user;
 			try {
-				const driveDoc = await this.reactorClient.get(driveIdOrSlug);
-				if (!await this.authorizationService.canRead(driveDoc.header.id, getAuthContext(request)?.user?.address)) {
+				const driveDoc = await this.reactorClient.get(driveIdOrSlug, { subject: callerSubject(user) });
+				if (!await this.authorizationService.canRead(driveDoc.header.id, user?.address)) {
 					this.logger.debug(`Drive read refused: ${driveIdOrSlug}`);
 					return Response.json({ error: "Drive not found" }, { status: 404 });
 				}
 				const graphqlEndpoint = `${(request.headers.get("x-forwarded-proto")?.split(",")[0].trim() ?? url.protocol.replace(":", "")) + ":"}//${request.headers.get("x-forwarded-host")?.split(",")[0].trim() ?? request.headers.get("host") ?? ""}${(request.headers.get("x-forwarded-prefix")?.split(",")[0].trim().replace(/\/$/, "") ?? "") + (this.path === "/" ? "" : this.path)}/graphql/r`;
+				const global = driveDoc.state.global;
 				return Response.json({
 					id: driveDoc.header.id,
 					slug: driveDoc.header.slug,
 					meta: driveDoc.header.meta,
-					name: driveDoc.state.global.name || driveDoc.header.name,
-					icon: driveDoc.state.global.icon ?? void 0,
+					name: global?.name || driveDoc.header.name,
+					icon: global?.icon ?? void 0,
 					...graphqlEndpoint && { graphqlEndpoint }
 				});
 			} catch (error) {
-				this.logger.debug(`Drive not found: ${driveIdOrSlug}`, error);
+				this.logger.debug("Drive not found: @drive (@error)", driveIdOrSlug, error);
 				return Response.json({ error: "Drive not found" }, { status: 404 });
 			}
 		};
@@ -4474,7 +4980,7 @@ var GraphQLManager = class {
 		for (const subgraph of coreSubgraphs) try {
 			await this.registerSubgraph(subgraph, supergraph, true);
 		} catch (error) {
-			this.logger.error(`Failed to setup core subgraph ${subgraph.name}`, error);
+			this.logger.error("Failed to setup core subgraph @subgraph: @error", subgraph.name, error);
 		}
 		return this.#setupSubgraphs(this.coreSubgraphsMap);
 	}
@@ -4495,12 +5001,13 @@ var GraphQLManager = class {
 					path: this.path,
 					documentPermissionService: this.documentPermissionService,
 					authorizationService: this.authorizationService,
-					syncServingGate: this.syncServingGate
+					syncServingGate: this.syncServingGate,
+					attachments: this.attachments
 				});
 				await this.#addSubgraphInstance(subgraphInstance, supergraph, false, DOCUMENT_MODEL_SUBGRAPH_SOURCE);
 				registeredNames.add(subgraphInstance.name);
 			} catch (error) {
-				this.logger.error(`Failed to setup document model subgraph for ${documentModel.documentModel.global.id}`, error instanceof Error ? error.message : error);
+				this.logger.error("Failed to setup document model subgraph for @documentType: @error", documentModel.documentModel.global.id, error instanceof Error ? error.message : error);
 				this.logger.debug("@error", error);
 			}
 		}
@@ -4562,6 +5069,7 @@ var GraphQLManager = class {
 				routeHandle.dispose();
 				this.subgraphRouteHandles.delete(subgraphPath);
 			}
+			this.#disposeSSERoute(subgraphPath);
 			const wsDisposer = this.subgraphWsDisposers.get(subgraphPath);
 			if (wsDisposer) {
 				this.subgraphWsDisposers.delete(subgraphPath);
@@ -4631,7 +5139,8 @@ var GraphQLManager = class {
 			path: this.path,
 			documentPermissionService: this.documentPermissionService,
 			authorizationService: this.authorizationService,
-			syncServingGate: this.syncServingGate
+			syncServingGate: this.syncServingGate,
+			attachments: this.attachments
 		});
 		return this.#addSubgraphInstance(subgraphInstance, supergraph, core, packageName);
 	}
@@ -4658,7 +5167,7 @@ var GraphQLManager = class {
 		try {
 			routes?.disposeScope(packageName);
 		} catch (error) {
-			this.logger.warn(`Failed to release HTTP routes for "${packageName}": @error`, error);
+			this.logger.warn(`Failed to release HTTP routes for "@package": @error`, packageName, error);
 		}
 	}
 	/**
@@ -4758,15 +5267,12 @@ var GraphQLManager = class {
 			authService: this.authService,
 			requireAuthenticatedCaller: () => this.#requireAuthMiddleware !== void 0,
 			logger: this.logger,
-			buildContext: (connectionParams, user) => {
-				const context = {
-					headers: connectionParams,
-					db: this.relationalDb,
-					...this.getAdditionalContextFields()
-				};
-				if (user) context.user = user;
-				return context;
-			}
+			buildContext: (connectionParams, user) => ({
+				headers: connectionParams,
+				db: this.relationalDb,
+				...this.getAdditionalContextFields(),
+				user
+			})
 		});
 	}
 	setSupergraph(supergraph, subgraphs) {
@@ -4901,10 +5407,7 @@ var GraphQLManager = class {
 		const allSubgraphs = this.#getAllSubgraphs();
 		const modules = Array.from(allSubgraphs.values()).filter((subgraph) => subgraph.hasSubscriptions).map((subgraph) => this.#buildSubgraphSchemaModule(subgraph));
 		if (modules.length === 0) {
-			if (this.sseRouteHandle !== void 0) {
-				this.sseRouteHandle.dispose();
-				this.sseRouteHandle = void 0;
-			}
+			this.#disposeSSERoute(superGraphPath);
 			return;
 		}
 		try {
@@ -4930,8 +5433,16 @@ var GraphQLManager = class {
 			contextFactory: this.#makeContextFactory()
 		});
 		const handler = this.#composeFetchMiddleware(rawHandler);
-		if (this.sseRouteHandle !== void 0) this.sseRouteHandle.dispose();
-		this.sseRouteHandle = this.httpAdapter.mount(ssePath, handler, { exact: true });
+		this.#disposeSSERoute(basePath);
+		this.sseRouteHandles.set(ssePath, this.httpAdapter.mount(ssePath, handler, { exact: true }));
+	}
+	#disposeSSERoute(basePath) {
+		const ssePath = basePath + "/stream";
+		const handle = this.sseRouteHandles.get(ssePath);
+		if (handle !== void 0) {
+			handle.dispose();
+			this.sseRouteHandles.delete(ssePath);
+		}
 	}
 	/**
 	* Compose the request-level fetch middleware chain. Auth runs first
@@ -5215,7 +5726,6 @@ const DocumentModelStateDTO = z.object({
 }).strip();
 const DocumentModelResultPageDTO = z.object({
 	items: z.array(DocumentModelStateDTO),
-	totalCount: z.number().int(),
 	hasNextPage: z.boolean(),
 	hasPreviousPage: z.boolean(),
 	cursor: z.string().nullable().optional()
@@ -5236,7 +5746,20 @@ const PHDocumentDTO = z.object({
 }).strip();
 const PHDocumentResultPageDTO = z.object({
 	items: z.array(PHDocumentDTO),
-	totalCount: z.number().int(),
+	hasNextPage: z.boolean(),
+	hasPreviousPage: z.boolean(),
+	cursor: z.string().nullable().optional()
+}).strip();
+const DocumentRelationshipDTO = z.object({
+	sourceId: z.string(),
+	targetId: z.string(),
+	relationshipType: z.string(),
+	metadata: JSONObjectDTO.nullable().optional(),
+	createdAt: DateTimeDTO,
+	updatedAt: DateTimeDTO
+}).strip();
+const DocumentRelationshipResultPageDTO = z.object({
+	items: z.array(DocumentRelationshipDTO),
 	hasNextPage: z.boolean(),
 	hasPreviousPage: z.boolean(),
 	cursor: z.string().nullable().optional()
@@ -5291,7 +5814,6 @@ const OperationDTO = z.object({
 }).strip();
 const OperationResultPageDTO = z.object({
 	items: z.array(OperationDTO),
-	totalCount: z.number().int(),
 	hasNextPage: z.boolean(),
 	hasPreviousPage: z.boolean(),
 	cursor: z.string().nullable().optional()
@@ -5344,6 +5866,12 @@ const operationValidators = {
 	GetDocumentIncomingRelationships: (data) => {
 		if (data.documentIncomingRelationships) PHDocumentResultPageDTO.parse(data.documentIncomingRelationships);
 	},
+	GetDocumentOutgoingRelationshipEdges: (data) => {
+		if (data.documentOutgoingRelationshipEdges) DocumentRelationshipResultPageDTO.parse(data.documentOutgoingRelationshipEdges);
+	},
+	GetDocumentIncomingRelationshipEdges: (data) => {
+		if (data.documentIncomingRelationshipEdges) DocumentRelationshipResultPageDTO.parse(data.documentIncomingRelationshipEdges);
+	},
 	FindDocuments: (data) => {
 		if (data.findDocuments) PHDocumentResultPageDTO.parse(data.findDocuments);
 	},
@@ -5377,6 +5905,9 @@ const operationValidators = {
 	AddRelationship: (data) => {
 		if (data.addRelationship) PHDocumentDTO.parse(data.addRelationship);
 	},
+	UpdateRelationship: (data) => {
+		if (data.updateRelationship) PHDocumentDTO.parse(data.updateRelationship);
+	},
 	RemoveRelationship: (data) => {
 		if (data.removeRelationship) PHDocumentDTO.parse(data.removeRelationship);
 	},
@@ -5418,7 +5949,7 @@ function createReactorGraphQLClient(url, fetchImpl = fetch, headers) {
 }
 //#endregion
 //#region src/graphql/reactor/schema.graphql
-var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n}\n\ninput OperationsFilterInput {\n  documentId: String!\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  totalCount: Int!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  \"\"\"\n  How the origin classified the failure. A peer needs this to mirror the origin's\n  quarantine decision; without it a held auth operation would freeze the document\n  on the peer side while the origin kept syncing.\n  \"\"\"\n  errorType: String\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Null until then, which\n  is the state every job is in when it is handed back from a submission.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n  result: JSONObject!\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n\"\"\"\nOne operation an authorization preflight predicts a verdict for.\n\n`input` is what a conditional grant reads, so a candidate standing for a\nfilled-in form carries that form's input. Omitting it predicts the verdict an\nempty input earns, not the verdict the filled-in form will get.\n\"\"\"\ninput ActionCandidateInput {\n  scope: String!\n  type: String!\n  input: JSONObject\n}\n\nenum AuthDecision {\n  ALLOW\n  DENY\n}\n\n\"\"\"\nOne candidate's predicted verdict. `reason` carries the refusal a DENY is\nrecorded with, and is null on an ALLOW.\n\"\"\"\ntype ActionEvaluation {\n  decision: AuthDecision!\n  reason: String\n}\n\n\"\"\"\nThe predicted verdicts for a set of candidates, in the order they were given,\nwith the aggregates a caller branches on.\n\nThe aggregates are redundant -- a verdict is binary -- and all four are returned\nso a caller reads the one its question is phrased in rather than negating\nanother. Over no candidates every aggregate is false: nothing is allowed and\nnothing is denied.\n\"\"\"\ntype ActionEvaluations {\n  evaluations: [ActionEvaluation!]!\n  allAllowed: Boolean!\n  anyAllowed: Boolean!\n  allDenied: Boolean!\n  anyDenied: Boolean!\n}\n\n# Input types for sync operations\n\"\"\"\nAn action's context, as a caller submits it.\n\nDeclares every field `ActionContext` carries, because an input object rejects a\nfield it does not declare: an action stamped with the head it applies to - which\nis what a signing client sends - is refused outright if these are missing, and\nthat refusal is a whole-request one, not a per-field one.\n\n`prevOpHash` and `prevOpIndex` are the scope head the action was composed\nagainst. They are recorded rather than enforced; a signature is verified from\nthe params carried in its own tuple, which do not include them.\n\"\"\"\ninput ActionContextInput {\n  \"\"\"The index of the last operation in the scope the action applies to.\"\"\"\n  prevOpIndex: Int\n\n  \"\"\"The hash of the state the action applies to.\"\"\"\n  prevOpHash: String\n\n  \"\"\"Covers replay of an operation that would otherwise be a no-op.\"\"\"\n  nonce: String\n\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(identifier: String!, view: ViewFilterInput): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdentifier: String!\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  \"\"\"\n  Predicts whether the calling subject would be admitted to execute each of a\n  set of candidate operations, without submitting any of them. A UI asks this to\n  disable a control rather than offer an action that fails on submit.\n\n  The answer is a prediction, not a promise:\n\n  - Real admission compiles an append condition over everything it read and the\n    store enforces it at write time. A preflight reads no future, so a policy\n    change landing between this answer and the submit changes the verdict. The\n    submit path stays the only authority.\n  - The verdict is evaluated at the stream heads, so it is correct for a\n    candidate about to be submitted. A backdated submission is out of contract;\n    the reactor decides that one by position.\n  - A candidate whose verdict depends on its input has to carry that input, since\n    a conditional grant reads it.\n\n  The subject is the authenticated caller and cannot be named in the request:\n  answering for an arbitrary subject would disclose what a policy grants\n  somebody else. It carries both the caller's address and the did:key of the app\n  instance whose token authenticated the request, so a policy naming either\n  matches the same principal the write path presents.\n\n  Requires the reactor's authEnforcement feature flag. Without it the reactor\n  holds no decision model, so this fails with extensions.code\n  AUTH_EVALUATION_UNSUPPORTED rather than guessing.\n  \"\"\"\n  evaluateActions(\n    documentIdentifier: String!\n    branch: String\n    candidates: [ActionCandidateInput!]!\n  ): ActionEvaluations!\n\n  \"\"\"\n  Polls for sync envelopes from a channel.\n\n  An operation stored before the API required an action id cannot be\n  represented by this schema, and rather than serving a partial response beside\n  a bare non-null violation, this fails with extensions.code\n  MALFORMED_STORED_OPERATION naming the operation. That code means the failure\n  is worth polling through: the document holding the operation needs repairing,\n  but the channel serves every other document, and a peer that stopped polling\n  would stop receiving those too.\n  \"\"\"\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n  ): PollSyncEnvelopesResult!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(document: JSONObject!, parentIdentifier: String): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdentifier: String\n  ): PHDocument!\n\n  \"\"\"\n  Applies actions to a document and waits for the result.\n\n  Each action is coerced against `ActionInput`, so one missing a field the wire\n  declares is refused before any work starts. The id in particular: it is hashed\n  into the operation id and replay dedupes by it, so an action without one is\n  stored under an operation id shared by every id-less operation on the same\n  document, scope and branch.\n\n  Named for `IReactorClient.execute`, which this is the wire form of. `branch`\n  defaults to `main`.\n  \"\"\"\n  execute(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): PHDocument!\n\n  \"\"\"\n  Submits actions to a document and returns the job that will apply them.\n\n  Coerced exactly as `execute` is, so a malformed action is refused here rather\n  than surfacing later as a failed job. Returns the job rather than only its id,\n  so a caller has the status and the creation time it would otherwise have to\n  ask for; `result` is null until the job produces one.\n  \"\"\"\n  executeAsync(\n    documentIdentifier: String!\n    actions: [ActionInput!]!\n    branch: String\n  ): JobInfo!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n    @deprecated(\n      reason: \"Use execute. Actions here are untyped, so a malformed one is refused by a hand-written check rather than by the schema, and `view.scopes` is accepted but ignored.\"\n    )\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n    @deprecated(\n      reason: \"Use executeAsync, which is typed and returns the job rather than only its id.\"\n    )\n\n  # Rename a document\n  renameDocument(\n    documentIdentifier: String!\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdentifier: String!\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents\n  addRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdentifier: String!\n    targetParentIdentifier: String!\n    targetIdentifier: String!\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(identifier: String!, propagate: PropagationMode): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(identifiers: [String!]!, propagate: PropagationMode): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(envelopes: [SyncEnvelopeInput!]!): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
+var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n    @deprecated(reason: \"Ignored. Filter by type or parentId.\")\n}\n\ninput OperationsFilterInput {\n  documentIdOrSlug: String\n  documentId: String @deprecated(reason: \"Use documentIdOrSlug.\")\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\n# A directed edge between two documents, with the metadata recorded against it.\ntype DocumentRelationship {\n  sourceId: String!\n  targetId: String!\n  relationshipType: String!\n  metadata: JSONObject\n  createdAt: DateTime!\n  updatedAt: DateTime!\n}\n\ntype DocumentRelationshipResultPage {\n  items: [DocumentRelationship!]!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  \"\"\"\n  How the origin classified the failure. A peer needs this to mirror the origin's\n  quarantine decision; without it a held auth operation would freeze the document\n  on the peer side while the origin kept syncing.\n  \"\"\"\n  errorType: String\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n  # The server's current manifest revision\n  manifestRevision: String\n  # The client's manifest revision as the server holds it\n  peerManifestRevision: String\n}\n\ntype SyncHoldReason {\n  protocol: String!\n  version: Int!\n  peerSupports: [Int!]!\n}\n\n# A document held back from a remote whose peer cannot run its versions\ntype SyncHold {\n  remoteName: String!\n  documentId: String!\n  branch: String!\n  reason: SyncHoldReason!\n  heldAtUtcMs: String!\n}\n\ntype PeerAgreementMember {\n  remoteName: String!\n  # False for a peer that announced nothing: it gets the baselines\n  announced: Boolean!\n  protocols: JSONObject!\n  features: JSONObject!\n}\n\ntype PeerAgreementLimit {\n  protocol: String!\n  # The remotes whose peers lack the version new documents would take\n  remoteNames: [String!]!\n}\n\ntype PeerAgreement {\n  collectionId: String!\n  local: JSONObject!\n  members: [PeerAgreementMember!]!\n  limitedBy: [PeerAgreementLimit!]!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype JobInfo {\n  id: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Null until then, which\n  is the state every job is in when it is handed back from a submission.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n  createdAt: DateTime!\n  completedAt: DateTime\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Nullable for the same\n  reason as `JobInfo.result`: a job that has not written yet has produced\n  nothing, and an empty object would claim otherwise.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n\"\"\"\nOne operation an authorization preflight predicts a verdict for.\n\n`input` is what a conditional grant reads, so a candidate standing for a\nfilled-in form carries that form's input. Omitting it predicts the verdict an\nempty input earns, not the verdict the filled-in form will get.\n\"\"\"\ninput ActionCandidateInput {\n  scope: String!\n  type: String!\n  input: JSONObject\n}\n\nenum AuthDecision {\n  ALLOW\n  DENY\n}\n\n\"\"\"\nOne candidate's predicted verdict. `reason` carries the refusal a DENY is\nrecorded with, and is null on an ALLOW.\n\"\"\"\ntype ActionEvaluation {\n  decision: AuthDecision!\n  reason: String\n}\n\n\"\"\"\nThe predicted verdicts for a set of candidates, in the order they were given,\nwith the aggregates a caller branches on.\n\nThe aggregates are redundant -- a verdict is binary -- and all four are returned\nso a caller reads the one its question is phrased in rather than negating\nanother. Over no candidates every aggregate is false: nothing is allowed and\nnothing is denied.\n\"\"\"\ntype ActionEvaluations {\n  evaluations: [ActionEvaluation!]!\n  allAllowed: Boolean!\n  anyAllowed: Boolean!\n  allDenied: Boolean!\n  anyDenied: Boolean!\n}\n\n# Input types for sync operations\n\"\"\"\nAn action's context, as a caller submits it.\n\nDeclares every field `ActionContext` carries, because an input object rejects a\nfield it does not declare: an action stamped with the head it applies to - which\nis what a signing client sends - is refused outright if these are missing, and\nthat refusal is a whole-request one, not a per-field one.\n\n`prevOpHash` and `prevOpIndex` are the scope head the action was composed\nagainst. They are recorded rather than enforced; a signature is verified from\nthe params carried in its own tuple, which do not include them.\n\"\"\"\ninput ActionContextInput {\n  \"\"\"\n  The index of the last operation in the scope the action applies to.\n  \"\"\"\n  prevOpIndex: Int\n\n  \"\"\"\n  The hash of the state the action applies to.\n  \"\"\"\n  prevOpHash: String\n\n  \"\"\"\n  Covers replay of an operation that would otherwise be a no-op.\n  \"\"\"\n  nonce: String\n\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput SyncRefusalInput {\n  documentId: String!\n  branch: String!\n  # \"marker\" for a refused purge marker; absent for UNSUPPORTED_PROTOCOL\n  kind: String\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n  # The client's peer manifest; absent from a client without peer agreement\n  manifest: JSONObject\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n  # The server's peer manifest\n  manifest: JSONObject\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(\n    idOrSlug: String\n    identifier: String @deprecated(reason: \"Use idOrSlug.\")\n    view: ViewFilterInput\n  ): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdOrSlug: String\n    sourceIdentifier: String @deprecated(reason: \"Use sourceIdOrSlug.\")\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get the outgoing relationship edges of a source document. Unlike\n  # documentOutgoingRelationships, which returns the documents at the far end,\n  # this returns the edges themselves, carrying their metadata and timestamps.\n  # Omit relationshipType to return edges of every type.\n  documentOutgoingRelationshipEdges(\n    sourceIdOrSlug: String\n    sourceIdentifier: String @deprecated(reason: \"Use sourceIdOrSlug.\")\n    relationshipType: String\n    view: ViewFilterInput\n    paging: PagingInput\n  ): DocumentRelationshipResultPage!\n\n  # Get the incoming relationship edges of a target document. Unlike\n  # documentIncomingRelationships, which returns the documents at the far end,\n  # this returns the edges themselves, carrying their metadata and timestamps.\n  # Omit relationshipType to return edges of every type.\n  documentIncomingRelationshipEdges(\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String\n    view: ViewFilterInput\n    paging: PagingInput\n  ): DocumentRelationshipResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  \"\"\"\n  Predicts whether the calling subject would be admitted to execute each of a\n  set of candidate operations, without submitting any of them. A UI asks this to\n  disable a control rather than offer an action that fails on submit.\n\n  The answer is a prediction, not a promise:\n\n  - Real admission compiles an append condition over everything it read and the\n    store enforces it at write time. A preflight reads no future, so a policy\n    change landing between this answer and the submit changes the verdict. The\n    submit path stays the only authority.\n  - The verdict is evaluated at the stream heads, so it is correct for a\n    candidate about to be submitted. A backdated submission is out of contract;\n    the reactor decides that one by position.\n  - A candidate whose verdict depends on its input has to carry that input, since\n    a conditional grant reads it.\n\n  The subject is the authenticated caller and cannot be named in the request:\n  answering for an arbitrary subject would disclose what a policy grants\n  somebody else. It carries both the caller's address and the did:key of the app\n  instance whose token authenticated the request, so a policy naming either\n  matches the same principal the write path presents.\n\n  Requires the reactor's authEnforcement feature flag. Without it the reactor\n  holds no decision model, so this fails with extensions.code\n  AUTH_EVALUATION_UNSUPPORTED rather than guessing.\n  \"\"\"\n  evaluateActions(\n    documentIdOrSlug: String\n    documentIdentifier: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    branch: String\n    candidates: [ActionCandidateInput!]!\n  ): ActionEvaluations!\n\n  \"\"\"\n  Polls for sync envelopes from a channel.\n\n  An operation stored before the API required an action id cannot be\n  represented by this schema, and rather than serving a partial response beside\n  a bare non-null violation, this fails with extensions.code\n  MALFORMED_STORED_OPERATION naming the operation. That code means the failure\n  is worth polling through: the document holding the operation needs repairing,\n  but the channel serves every other document, and a peer that stopped polling\n  would stop receiving those too.\n  \"\"\"\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n    # The client's manifest revision; absent from a client without peer agreement\n    manifestRevision: String\n    # Documents the client refused from earlier polls: held, or a refused marker\n    refusals: [SyncRefusalInput!]\n  ): PollSyncEnvelopesResult!\n\n  # Supreme admin, or the address the named remote's channel is bound to\n  syncHolds(remoteName: String, documentId: String): [SyncHold!]!\n\n  # Supreme admin, or an address bound to a channel in the collection\n  peerAgreement(collectionId: String!): PeerAgreement!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(\n    document: JSONObject!\n    parentIdOrSlug: String\n    parentIdentifier: String @deprecated(reason: \"Use parentIdOrSlug.\")\n  ): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdOrSlug: String\n    parentIdentifier: String @deprecated(reason: \"Use parentIdOrSlug.\")\n  ): PHDocument!\n\n  \"\"\"\n  Applies actions to a document and waits for the result.\n\n  Each action is coerced against `ActionInput`, so one missing a field the wire\n  declares is refused before any work starts. The id in particular: it is hashed\n  into the operation id and replay dedupes by it, so an action without one is\n  stored under an operation id shared by every id-less operation on the same\n  document, scope and branch.\n\n  Named for `IReactorClient.execute`, which this is the wire form of. `branch`\n  defaults to `main`.\n  \"\"\"\n  execute(\n    documentIdOrSlug: String\n    documentIdentifier: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    actions: [ActionInput!]!\n    branch: String\n  ): PHDocument!\n\n  \"\"\"\n  Submits actions to a document and returns the job that will apply them.\n\n  Coerced exactly as `execute` is, so a malformed action is refused here rather\n  than surfacing later as a failed job. Returns the job rather than only its id,\n  so a caller has the status and the creation time it would otherwise have to\n  ask for; `result` is null until the job produces one.\n  \"\"\"\n  executeAsync(\n    documentIdOrSlug: String\n    documentIdentifier: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    actions: [ActionInput!]!\n    branch: String\n  ): JobInfo!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n    @deprecated(\n      reason: \"Use execute. Actions here are untyped, so a malformed one is refused by a hand-written check rather than by the schema, and `view.scopes` is accepted but ignored.\"\n    )\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n    @deprecated(\n      reason: \"Use executeAsync, which is typed and returns the job rather than only its id.\"\n    )\n\n  # Rename a document\n  renameDocument(\n    documentIdOrSlug: String\n    documentIdentifier: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdOrSlug: String\n    documentIdentifier: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents. Adding one that already exists is\n  # a no-op, metadata included -- use updateRelationship to change an edge.\n  addRelationship(\n    sourceIdOrSlug: String\n    sourceIdentifier: String @deprecated(reason: \"Use sourceIdOrSlug.\")\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String!\n    metadata: JSONObject\n    branch: String\n  ): PHDocument!\n\n  # Replace the metadata of an existing relationship, preserving its createdAt.\n  # Omitting metadata, or passing null, clears it.\n  updateRelationship(\n    sourceIdOrSlug: String\n    sourceIdentifier: String @deprecated(reason: \"Use sourceIdOrSlug.\")\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String!\n    metadata: JSONObject\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdOrSlug: String\n    sourceIdentifier: String @deprecated(reason: \"Use sourceIdOrSlug.\")\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdOrSlug: String\n    sourceParentIdentifier: String\n      @deprecated(reason: \"Use sourceParentIdOrSlug.\")\n    targetParentIdOrSlug: String\n    targetParentIdentifier: String\n      @deprecated(reason: \"Use targetParentIdOrSlug.\")\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(\n    idOrSlug: String\n    identifier: String @deprecated(reason: \"Use idOrSlug.\")\n    propagate: PropagationMode\n  ): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(\n    idsOrSlugs: [String!]\n    identifiers: [String!] @deprecated(reason: \"Use idsOrSlugs.\")\n    propagate: PropagationMode\n  ): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(\n    envelopes: [SyncEnvelopeInput!]!\n    # The server's manifest revision the client gated these envelopes under\n    peerManifestRevision: String\n  ): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
 //#endregion
 //#region src/graphql/reactor/pubsub.ts
 const pubSub = new PubSub();
@@ -5429,26 +5960,79 @@ const SUBSCRIPTION_TRIGGERS = {
 	DOCUMENT_CHANGES: "DOCUMENT_CHANGES",
 	JOB_CHANGES: "JOB_CHANGES"
 };
-let globalDocumentUnsubscribe = null;
-let documentSubscriberCount = 0;
-function ensureGlobalDocumentSubscription(reactorClient) {
-	if (documentSubscriberCount === 0) globalDocumentUnsubscribe = reactorClient.subscribe({}, (event) => {
-		const payload = {
-			documentChanges: event,
-			search: {},
-			view: void 0
+function subjectKey(subject) {
+	return `${subject.address ?? ""}|${subject.key ?? ""}`;
+}
+/**
+* The reactor's change feed, read once per distinct subject and shared by that
+* subject's GraphQL subscriptions. Each feed is read as its subject, so the
+* client withholds what that subject may not read; one feed read with no view
+* would gate every subscriber as the host.
+*/
+var DocumentChangeFeed = class {
+	reactorClient;
+	#pubSub = new PubSub();
+	#feeds = /* @__PURE__ */ new Map();
+	constructor(reactorClient) {
+		this.reactorClient = reactorClient;
+	}
+	subscribe(subject) {
+		const key = subjectKey(subject);
+		const topic = `${SUBSCRIPTION_TRIGGERS.DOCUMENT_CHANGES}:${key}`;
+		const iterator = this.#pubSub.asyncIterableIterator(topic);
+		this.#acquire(key, topic, subject);
+		let released = false;
+		const release = () => {
+			if (!released) {
+				released = true;
+				this.#release(key);
+			}
 		};
-		pubSub.publish(SUBSCRIPTION_TRIGGERS.DOCUMENT_CHANGES, payload);
-	});
-	documentSubscriberCount++;
-	return () => {
-		documentSubscriberCount--;
-		if (documentSubscriberCount === 0 && globalDocumentUnsubscribe) {
-			globalDocumentUnsubscribe();
-			globalDocumentUnsubscribe = null;
+		return {
+			next: () => iterator.next(),
+			return: () => {
+				release();
+				return iterator.return();
+			},
+			throw: (error) => {
+				release();
+				return iterator.throw(error);
+			},
+			[Symbol.asyncIterator]() {
+				return this;
+			}
+		};
+	}
+	#acquire(key, topic, subject) {
+		const feed = this.#feeds.get(key);
+		if (feed) {
+			feed.subscribers++;
+			return;
 		}
-	};
-}
+		const view = { subject };
+		const unsubscribe = this.reactorClient.subscribe({}, (event) => {
+			const payload = {
+				documentChanges: event,
+				search: {},
+				view
+			};
+			this.#pubSub.publish(topic, payload);
+		}, view);
+		this.#feeds.set(key, {
+			unsubscribe,
+			subscribers: 1
+		});
+	}
+	#release(key) {
+		const feed = this.#feeds.get(key);
+		if (!feed) return;
+		feed.subscribers--;
+		if (feed.subscribers === 0) {
+			this.#feeds.delete(key);
+			feed.unsubscribe();
+		}
+	}
+};
 const activeJobSubscriptions = /* @__PURE__ */ new Map();
 function ensureJobSubscription(reactorClient, jobId) {
 	let subscription = activeJobSubscriptions.get(jobId);
@@ -5465,7 +6049,7 @@ function ensureJobSubscription(reactorClient, jobId) {
 					createdAt: jobInfo.createdAtUtcIso,
 					completedAt: jobInfo.completedAtUtcIso ?? null,
 					error: jobInfo.error?.message ?? null,
-					result: jobInfo.result ?? {}
+					result: jobInfo.result ?? null
 				},
 				jobId,
 				documentId: jobInfo.documentId
@@ -5513,6 +6097,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 	}
 	name = "r";
 	hasSubscriptions = true;
+	#documentChanges;
+	get documentChanges() {
+		this.#documentChanges ??= new DocumentChangeFeed(this.reactorClient);
+		return this.#documentChanges;
+	}
 	/**
 	* Check operation-level permissions for an array of actions.
 	* Delegates to base assertCanExecuteOperation for each action.
@@ -5543,6 +6132,38 @@ var ReactorSubgraph = class extends BaseSubgraph {
 		}
 	}
 	/**
+	* Drops the relationship edges whose far-end document the caller cannot read.
+	*
+	* An edge names two documents, so returning it discloses the far end's id. The
+	* document-shaped relationship queries already withhold far-end documents the
+	* caller cannot read; the edge-shaped queries have to withhold the same ones,
+	* or they become a way to enumerate around that check. Supreme admins read
+	* everything, so the per-edge check is skipped for them.
+	*
+	* The cursor describes where to resume in the underlying unfiltered stream,
+	* so it is left as it came. A filtered page is therefore often shorter than
+	* the requested limit, and that is the stream continuing rather than a sign
+	* it ended.
+	*/
+	async filterRelationshipEdges(page, farEnd, ctx) {
+		if (this.authorizationService.isSupremeAdmin(ctx.user?.address)) return page;
+		const decisions = /* @__PURE__ */ new Map();
+		const items = [];
+		for (const edge of page.items) {
+			const documentId = edge[farEnd];
+			let canRead = decisions.get(documentId);
+			if (canRead === void 0) {
+				canRead = await this.canReadDocument(documentId, ctx);
+				decisions.set(documentId, canRead);
+			}
+			if (canRead) items.push(edge);
+		}
+		return {
+			...page,
+			items
+		};
+	}
+	/**
 	* Adds to `forbidden` the canonical document ids in `syncOps` that the caller
 	* cannot read, checking each distinct id once. Sync operation document ids are
 	* canonical (never slugs), so no resolution is needed.
@@ -5575,9 +6196,9 @@ var ReactorSubgraph = class extends BaseSubgraph {
 	* reports the liveness that keeps it from being reclaimed -- but they never
 	* adopt, since the push path has no drive check to clear the claimant.
 	*
-	* Nothing is enforced or adopted without a serving gate. Below
-	* `authEnforcement` there is no policy being enforced for the channel to
-	* belong to, and refusing a poll there would break sync for no gain.
+	* Nothing is enforced or adopted without a serving gate: with no gate the
+	* channel serves every subject alike, so there is no subject for it to
+	* belong to.
 	*/
 	async #bindOrRefuseChannel(channelId, ctx, options = {}) {
 		if (!this.syncServingGate) return;
@@ -5607,7 +6228,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			await this.assertCanReadCanonical(parent.id, ctx);
 			try {
 				const filter = {
-					documentId: parent.id,
+					documentIdOrSlug: parent.id,
 					branch: args.filter?.branch,
 					scopes: args.filter?.scopes,
 					actionTypes: args.filter?.actionTypes,
@@ -5637,10 +6258,11 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			document: async (_parent, args, ctx) => {
 				this.logger.debug("document(@args)", args);
 				try {
-					const handle = await this.assertCanRead(args.identifier, ctx);
+					const idOrSlug = requireOneOf(args, "idOrSlug", "identifier");
+					const handle = await this.assertCanRead(idOrSlug, ctx);
 					return await document(this.reactorClient, {
-						...args,
-						identifier: handle.fetchIdentifier
+						idOrSlug: handle.fetchIdentifier,
+						view: args.view
 					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in document: @Error", error);
@@ -5650,10 +6272,13 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			documentOutgoingRelationships: async (_parent, args, ctx) => {
 				this.logger.debug("documentOutgoingRelationships(@args)", args);
 				try {
-					const handle = await this.assertCanRead(args.sourceIdentifier, ctx);
+					const sourceIdOrSlug = requireOneOf(args, "sourceIdOrSlug", "sourceIdentifier");
+					const handle = await this.assertCanRead(sourceIdOrSlug, ctx);
 					return await documentOutgoingRelationships(this.reactorClient, {
-						...args,
-						sourceIdentifier: handle.fetchIdentifier
+						sourceIdOrSlug: handle.fetchIdentifier,
+						relationshipType: args.relationshipType,
+						view: args.view,
+						paging: args.paging
 					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in documentOutgoingRelationships: @Error", error);
@@ -5663,10 +6288,13 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			documentIncomingRelationships: async (_parent, args, ctx) => {
 				this.logger.debug("documentIncomingRelationships(@args)", args);
 				try {
-					const handle = await this.assertCanRead(args.targetIdentifier, ctx);
+					const targetIdOrSlug = requireOneOf(args, "targetIdOrSlug", "targetIdentifier");
+					const handle = await this.assertCanRead(targetIdOrSlug, ctx);
 					const result = await documentIncomingRelationships(this.reactorClient, {
-						...args,
-						targetIdentifier: handle.fetchIdentifier
+						targetIdOrSlug: handle.fetchIdentifier,
+						relationshipType: args.relationshipType,
+						view: args.view,
+						paging: args.paging
 					}, this.viewSubject(ctx));
 					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
@@ -5682,6 +6310,40 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					throw error;
 				}
 			},
+			documentOutgoingRelationshipEdges: async (_parent, args, ctx) => {
+				this.logger.debug("documentOutgoingRelationshipEdges(@args)", args);
+				try {
+					const sourceIdOrSlug = requireOneOf(args, "sourceIdOrSlug", "sourceIdentifier");
+					const handle = await this.assertCanRead(sourceIdOrSlug, ctx);
+					const result = await documentOutgoingRelationshipEdges(this.reactorClient, {
+						sourceIdOrSlug: handle.fetchIdentifier,
+						relationshipType: args.relationshipType,
+						view: args.view,
+						paging: args.paging
+					}, this.viewSubject(ctx));
+					return await this.filterRelationshipEdges(result, "targetId", ctx);
+				} catch (error) {
+					this.logger.error("Error in documentOutgoingRelationshipEdges: @Error", error);
+					throw error;
+				}
+			},
+			documentIncomingRelationshipEdges: async (_parent, args, ctx) => {
+				this.logger.debug("documentIncomingRelationshipEdges(@args)", args);
+				try {
+					const targetIdOrSlug = requireOneOf(args, "targetIdOrSlug", "targetIdentifier");
+					const handle = await this.assertCanRead(targetIdOrSlug, ctx);
+					const result = await documentIncomingRelationshipEdges(this.reactorClient, {
+						targetIdOrSlug: handle.fetchIdentifier,
+						relationshipType: args.relationshipType,
+						view: args.view,
+						paging: args.paging
+					}, this.viewSubject(ctx));
+					return await this.filterRelationshipEdges(result, "sourceId", ctx);
+				} catch (error) {
+					this.logger.error("Error in documentIncomingRelationshipEdges: @Error", error);
+					throw error;
+				}
+			},
 			findDocuments: async (_parent, args, ctx) => {
 				this.logger.debug("findDocuments(@args)", args);
 				try {
@@ -5703,10 +6365,10 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					throw error;
 				}
 			},
-			jobStatus: async (_parent, args) => {
+			jobStatus: async (_parent, args, ctx) => {
 				this.logger.debug("jobStatus(@args)", args);
 				try {
-					return await jobStatus(this.reactorClient, args);
+					return await jobStatus(this.reactorClient, args, (id) => this.servesDocument(id, ctx));
 				} catch (error) {
 					this.logger.error("Error in jobStatus: @Error", error);
 					throw error;
@@ -5715,32 +6377,63 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			documentOperations: async (_parent, args, ctx) => {
 				this.logger.debug("documentOperations(@args)", args);
 				try {
-					const handle = await this.assertCanRead(args.filter.documentId, ctx);
+					const { documentIdOrSlug, documentId, ...filter } = args.filter;
+					const handle = await this.assertCanRead(requireOneOf({
+						documentIdOrSlug,
+						documentId
+					}, "documentIdOrSlug", "documentId"), ctx);
 					return await documentOperations(this.reactorClient, {
-						...args,
 						filter: {
-							...args.filter,
-							documentId: handle.fetchIdentifier
-						}
+							...filter,
+							documentIdOrSlug: handle.fetchIdentifier
+						},
+						paging: args.paging
 					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in documentOperations: @Error", error);
 					throw error;
 				}
 			},
+			/**
+			* Gated on reading the document, the same gate every other read here
+			* carries: a verdict is derived from the document's policy, so a caller
+			* who may not read the document may not preflight against it either.
+			* That gate decides whether the query runs; the answer comes entirely
+			* from the reactor's decision model.
+			*/
 			evaluateActions: async (_parent, args, ctx) => {
 				this.logger.debug("evaluateActions(@args)", args);
 				try {
-					const handle = await this.assertCanRead(args.documentIdentifier, ctx);
+					const documentIdOrSlug = requireOneOf(args, "documentIdOrSlug", "documentIdentifier");
+					const handle = await this.assertCanRead(documentIdOrSlug, ctx);
 					return await evaluateActions(this.reactorClient, {
-						...args,
-						documentIdentifier: handle.fetchIdentifier
+						documentIdOrSlug: handle.fetchIdentifier,
+						branch: args.branch,
+						candidates: args.candidates
 					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in evaluateActions: @Error", error);
 					throw error;
 				}
 			},
+			syncHolds: async (_parent, args, ctx) => {
+				const address = ctx.user?.address;
+				if (!this.authorizationService.isSupremeAdmin(address)) {
+					let bound;
+					try {
+						bound = args.remoteName ? this.syncManager.getByName(args.remoteName).meta.options.boundAddress : void 0;
+					} catch {
+						bound = void 0;
+					}
+					if (address === void 0 || bound !== address) throw new ForbiddenError("to list sync holds");
+				}
+				return syncHolds(this.syncManager, args);
+			},
+			peerAgreement: (_parent, args, ctx) => {
+				const address = ctx.user?.address;
+				if (!this.authorizationService.isSupremeAdmin(address) && (address === void 0 || !this.syncManager.list().some((remote) => remote.meta.collectionId.key === args.collectionId && remote.meta.options.boundAddress === address))) throw new ForbiddenError("to read peer agreement");
+				return peerAgreement(this.syncManager, args);
+			},
 			pollSyncEnvelopes: async (_parent, args, ctx) => {
 				this.logger.debug("pollSyncEnvelopes(@args)", args);
 				try {
@@ -5754,19 +6447,18 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					const isAdmin = this.authorizationService.isSupremeAdmin(ctx.user?.address);
 					if (!isAdmin) await this.assertCanReadCanonical(driveId, ctx);
 					await this.#bindOrRefuseChannel(args.channelId, ctx);
+					holdPollRefusals(this.syncManager, args.channelId, args.refusals);
+					await recordPollMarkerRefusals(this.syncManager, args.channelId, args.refusals);
+					await silenceUnversionedPoll(this.syncManager, args.channelId, args.manifestRevision);
 					const forbiddenIds = /* @__PURE__ */ new Set();
 					if (!isAdmin) {
 						if (await this.authorizationService.canRead(driveId, void 0)) await this.#collectForbiddenDocuments(remote.channel.outbox.items, forbiddenIds, ctx);
 						await this.#collectForbiddenDocuments(remote.channel.deadLetter.items, forbiddenIds, ctx);
 					}
-					const heldOpIds = this.syncServingGate ? await collectHeldSyncOperations([...remote.channel.outbox.items, ...remote.channel.deadLetter.items], this.syncServingGate, this.viewSubject(ctx)) : /* @__PURE__ */ new Set();
-					const { envelopes, ackOrdinal, deadLetters, hasMore } = pollSyncEnvelopes(this.syncManager, args, forbiddenIds, heldOpIds);
-					return {
-						envelopes,
-						ackOrdinal,
-						deadLetters,
-						hasMore
-					};
+					const gate = this.syncServingGate;
+					const gated = gate ? [...remote.channel.outbox.items, ...remote.channel.deadLetter.items] : void 0;
+					const heldOpIds = gate && gated ? await collectHeldSyncOperations(gated, gate, this.viewSubject(ctx)) : /* @__PURE__ */ new Set();
+					return pollSyncEnvelopes(this.syncManager, args, forbiddenIds, heldOpIds, gated && new Set(gated.map((syncOp) => syncOp.id)));
 				} catch (error) {
 					this.logger.error("Error in pollSyncEnvelopes(@args): @Error", args, error);
 					throw error;
@@ -5777,11 +6469,15 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			createDocument: async (_parent, args, ctx) => {
 				this.logger.debug("createDocument(@args)", args);
 				try {
-					if (args.parentIdentifier) {
-						const parent = await document(this.reactorClient, { identifier: args.parentIdentifier });
+					const parentIdOrSlug = optionalOneOf(args, "parentIdOrSlug", "parentIdentifier");
+					if (parentIdOrSlug) {
+						const parent = await document(this.reactorClient, { idOrSlug: parentIdOrSlug });
 						await this.assertCanWriteCanonical(parent.document.id, ctx);
 					} else this.assertCanCreate(ctx);
-					const result = await createDocument(this.reactorClient, args, this.graphqlManager.reactorDriveClient);
+					const result = await createDocument(this.reactorClient, {
+						document: args.document,
+						parentIdOrSlug
+					}, this.graphqlManager.reactorDriveClient, this.viewSubject(ctx));
 					if (result?.id && isDriveContainerType(result.documentType)) this.graphqlManager.driveOwnershipCache.add(result.id);
 					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
@@ -5793,11 +6489,15 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			createEmptyDocument: async (_parent, args, ctx) => {
 				this.logger.debug("createEmptyDocument(@args)", args);
 				try {
-					if (args.parentIdentifier) {
-						const parent = await document(this.reactorClient, { identifier: args.parentIdentifier });
+					const parentIdOrSlug = optionalOneOf(args, "parentIdOrSlug", "parentIdentifier");
+					if (parentIdOrSlug) {
+						const parent = await document(this.reactorClient, { idOrSlug: parentIdOrSlug });
 						await this.assertCanWriteCanonical(parent.document.id, ctx);
 					} else this.assertCanCreate(ctx);
-					const result = await createEmptyDocument(this.reactorClient, args, this.graphqlManager.reactorDriveClient);
+					const result = await createEmptyDocument(this.reactorClient, {
+						documentType: args.documentType,
+						parentIdOrSlug
+					}, this.graphqlManager.reactorDriveClient, this.viewSubject(ctx));
 					if (result?.id && isDriveContainerType(result.documentType)) this.graphqlManager.driveOwnershipCache.add(result.id);
 					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
@@ -5809,11 +6509,13 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			execute: async (_parent, args, ctx) => {
 				this.logger.debug("execute(@args)", args);
 				try {
-					const handle = await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
+					const documentIdOrSlug = requireOneOf(args, "documentIdOrSlug", "documentIdentifier");
+					const handle = await this.assertCanExecuteOperations(documentIdOrSlug, args.actions, ctx);
 					return await execute(this.reactorClient, {
-						...args,
-						documentIdentifier: handle.fetchIdentifier
-					});
+						documentIdOrSlug: handle.fetchIdentifier,
+						actions: args.actions,
+						branch: args.branch
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in execute(@args): @Error", args, error);
 					throw error;
@@ -5822,10 +6524,12 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			executeAsync: async (_parent, args, ctx) => {
 				this.logger.debug("executeAsync(@args)", args);
 				try {
-					const handle = await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
+					const documentIdOrSlug = requireOneOf(args, "documentIdOrSlug", "documentIdentifier");
+					const handle = await this.assertCanExecuteOperations(documentIdOrSlug, args.actions, ctx);
 					return await executeAsync(this.reactorClient, {
-						...args,
-						documentIdentifier: handle.fetchIdentifier
+						documentIdOrSlug: handle.fetchIdentifier,
+						actions: args.actions,
+						branch: args.branch
 					});
 				} catch (error) {
 					this.logger.error("Error in executeAsync(@args): @Error", args, error);
@@ -5839,7 +6543,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					return await mutateDocument(this.reactorClient, {
 						...args,
 						documentIdentifier: handle.fetchIdentifier
-					});
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in mutateDocument(@args): @Error", args, error);
 					throw error;
@@ -5861,11 +6565,13 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			renameDocument: async (_parent, args, ctx) => {
 				this.logger.debug("renameDocument(@args)", args);
 				try {
-					const handle = await this.assertCanWrite(args.documentIdentifier, ctx);
+					const documentIdOrSlug = requireOneOf(args, "documentIdOrSlug", "documentIdentifier");
+					const handle = await this.assertCanWrite(documentIdOrSlug, ctx);
 					return await renameDocument(this.reactorClient, {
-						...args,
-						documentIdentifier: handle.fetchIdentifier
-					});
+						documentIdOrSlug: handle.fetchIdentifier,
+						name: args.name,
+						branch: args.branch
+					}, void 0, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in renameDocument(@args): @Error", args, error);
 					throw error;
@@ -5874,11 +6580,13 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			setPreferredEditor: async (_parent, args, ctx) => {
 				this.logger.debug("setPreferredEditor(@args)", args);
 				try {
-					const handle = await this.assertCanWrite(args.documentIdentifier, ctx);
+					const documentIdOrSlug = requireOneOf(args, "documentIdOrSlug", "documentIdentifier");
+					const handle = await this.assertCanWrite(documentIdOrSlug, ctx);
 					return await setPreferredEditor(this.reactorClient, {
-						...args,
-						documentIdentifier: handle.fetchIdentifier
-					});
+						documentIdOrSlug: handle.fetchIdentifier,
+						preferredEditor: args.preferredEditor,
+						branch: args.branch
+					}, void 0, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in setPreferredEditor(@args): @Error", args, error);
 					throw error;
@@ -5887,24 +6595,51 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			addRelationship: async (_parent, args, ctx) => {
 				this.logger.debug("addRelationship(@args)", args);
 				try {
-					const handle = await this.assertCanWrite(args.sourceIdentifier, ctx);
+					const sourceIdOrSlug = requireOneOf(args, "sourceIdOrSlug", "sourceIdentifier");
+					const targetIdOrSlug = requireOneOf(args, "targetIdOrSlug", "targetIdentifier");
+					const handle = await this.assertCanWrite(sourceIdOrSlug, ctx);
 					return await addRelationship(this.reactorClient, {
-						...args,
-						sourceIdentifier: handle.fetchIdentifier
-					});
+						sourceIdOrSlug: handle.fetchIdentifier,
+						targetIdOrSlug,
+						relationshipType: args.relationshipType,
+						metadata: args.metadata,
+						branch: args.branch
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in addRelationship(@args): @Error", args, error);
 					throw error;
 				}
 			},
+			updateRelationship: async (_parent, args, ctx) => {
+				this.logger.debug("updateRelationship(@args)", args);
+				try {
+					const sourceIdOrSlug = requireOneOf(args, "sourceIdOrSlug", "sourceIdentifier");
+					const targetIdOrSlug = requireOneOf(args, "targetIdOrSlug", "targetIdentifier");
+					const handle = await this.assertCanWrite(sourceIdOrSlug, ctx);
+					return await updateRelationship(this.reactorClient, {
+						sourceIdOrSlug: handle.fetchIdentifier,
+						targetIdOrSlug,
+						relationshipType: args.relationshipType,
+						metadata: args.metadata,
+						branch: args.branch
+					}, this.viewSubject(ctx));
+				} catch (error) {
+					this.logger.error("Error in updateRelationship(@args): @Error", args, error);
+					throw error;
+				}
+			},
 			removeRelationship: async (_parent, args, ctx) => {
 				this.logger.debug("removeRelationship(@args)", args);
 				try {
-					const handle = await this.assertCanWrite(args.sourceIdentifier, ctx);
+					const sourceIdOrSlug = requireOneOf(args, "sourceIdOrSlug", "sourceIdentifier");
+					const targetIdOrSlug = requireOneOf(args, "targetIdOrSlug", "targetIdentifier");
+					const handle = await this.assertCanWrite(sourceIdOrSlug, ctx);
 					return await removeRelationship(this.reactorClient, {
-						...args,
-						sourceIdentifier: handle.fetchIdentifier
-					});
+						sourceIdOrSlug: handle.fetchIdentifier,
+						targetIdOrSlug,
+						relationshipType: args.relationshipType,
+						branch: args.branch
+					}, this.viewSubject(ctx));
 				} catch (error) {
 					this.logger.error("Error in removeRelationship(@args): @Error", args, error);
 					throw error;
@@ -5913,26 +6648,31 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			moveRelationship: async (_parent, args, ctx) => {
 				this.logger.debug("moveRelationship(@args)", args);
 				try {
-					const sourceHandle = await this.assertCanWrite(args.sourceParentIdentifier, ctx);
-					const targetHandle = await this.assertCanWrite(args.targetParentIdentifier, ctx);
+					const sourceParentIdOrSlug = requireOneOf(args, "sourceParentIdOrSlug", "sourceParentIdentifier");
+					const targetParentIdOrSlug = requireOneOf(args, "targetParentIdOrSlug", "targetParentIdentifier");
+					const targetIdOrSlug = requireOneOf(args, "targetIdOrSlug", "targetIdentifier");
+					const sourceHandle = await this.assertCanWrite(sourceParentIdOrSlug, ctx);
+					const targetHandle = await this.assertCanWrite(targetParentIdOrSlug, ctx);
 					return await moveRelationship(this.reactorClient, {
-						...args,
-						sourceParentIdentifier: sourceHandle.fetchIdentifier,
-						targetParentIdentifier: targetHandle.fetchIdentifier
-					});
+						sourceParentIdOrSlug: sourceHandle.fetchIdentifier,
+						targetParentIdOrSlug: targetHandle.fetchIdentifier,
+						targetIdOrSlug,
+						relationshipType: args.relationshipType,
+						branch: args.branch
+					}, this.viewSubject(ctx));
 				} catch (error) {
-					this.logger.error("Error in moveRelationship(@args): @Error @args", error, args);
+					this.logger.error("Error in moveRelationship(@args): @Error", args, error);
 					throw error;
 				}
 			},
 			deleteDocument: async (_parent, args, ctx) => {
 				this.logger.debug("deleteDocument(@args)", args);
 				try {
-					const identifier = (await this.assertCanWrite(args.identifier, ctx)).fetchIdentifier;
-					const driveIdToInvalidate = await this.#resolveDriveId(identifier);
+					const idOrSlug = (await this.assertCanWrite(requireOneOf(args, "idOrSlug", "identifier"), ctx)).fetchIdentifier;
+					const driveIdToInvalidate = await this.#resolveDriveId(idOrSlug);
 					const result = await deleteDocument(this.reactorClient, {
-						...args,
-						identifier
+						idOrSlug,
+						propagate: args.propagate
 					}, this.graphqlManager.reactorDriveClient);
 					if (result && driveIdToInvalidate) this.graphqlManager.driveOwnershipCache.remove(driveIdToInvalidate);
 					return result;
@@ -5944,14 +6684,14 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			deleteDocuments: async (_parent, args, ctx) => {
 				this.logger.debug("deleteDocuments(@args)", args);
 				try {
-					const identifiers = [];
-					for (const identifier of args.identifiers) {
-						const handle = await this.assertCanWrite(identifier, ctx);
-						identifiers.push(handle.fetchIdentifier);
+					const idsOrSlugs = [];
+					for (const idOrSlug of requireOneOf(args, "idsOrSlugs", "identifiers")) {
+						const handle = await this.assertCanWrite(idOrSlug, ctx);
+						idsOrSlugs.push(handle.fetchIdentifier);
 					}
 					return await deleteDocuments(this.reactorClient, {
-						...args,
-						identifiers
+						idsOrSlugs,
+						propagate: args.propagate
 					});
 				} catch (error) {
 					this.logger.error("Error in deleteDocuments(@args): @Error", args, error);
@@ -6030,10 +6770,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			documentChanges: {
 				subscribe: (rootValue, args, ctx, info) => {
 					this.logger.debug("documentChanges subscription started");
-					return withFilter(() => {
-						ensureGlobalDocumentSubscription(this.reactorClient);
-						return getPubSub().asyncIterableIterator(SUBSCRIPTION_TRIGGERS.DOCUMENT_CHANGES);
-					}, async (payload, filterArgs, filterCtx) => {
+					return withFilter(() => this.documentChanges.subscribe(this.viewSubject(ctx)), async (payload, filterArgs, filterCtx) => {
 						if (!payload) return false;
 						const search = {
 							type: filterArgs?.search?.type ?? void 0,
@@ -6060,6 +6797,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					}, async (payload, filterArgs, filterCtx) => {
 						if (!payload || !filterArgs) return false;
 						if (!matchesJobFilter(payload, filterArgs)) return false;
+						if (!await this.servesDocument(payload.documentId, filterCtx)) return false;
 						if (this.authorizationService.isSupremeAdmin(filterCtx?.user?.address)) return true;
 						if (!payload.documentId) return false;
 						return this.canReadDocument(payload.documentId, filterCtx);
@@ -6088,10 +6826,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.3-dev.4";
+	return "6.2.3-dev.41";
 }
 function getGitHash() {
-	return "e30f072e1e13237f4a9ce0f7c5ca18700cab7845";
+	return "84f56c54bfdb09f7789448e0c77f6c57454a47a6";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -6119,7 +6857,446 @@ var SystemSubgraph = class extends BaseSubgraph {
 	}) } };
 };
 //#endregion
+//#region src/packages/registry-cache.ts
+/** Entry files a registry package's node build is served from, CDN-relative. */
+const PACKAGE_ENTRIES = {
+	documentModels: "node/document-models/index.mjs",
+	subgraphs: "node/subgraphs/index.mjs",
+	processors: "node/processors/index.mjs"
+};
+const REGISTRY_ENTRY_ABSENT = "ERR_REGISTRY_ENTRY_ABSENT";
+const MANIFEST_FILE = "manifest.json";
+function defaultRegistryCacheDir(cwd = process.cwd()) {
+	return path.join(cwd, ".ph", "registry-packages");
+}
+const EXACT_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const PACKAGE_NAME = /^(@[a-z0-9][-a-z0-9._]*\/)?[a-z0-9][-a-z0-9._]*$/i;
+function isValidPackageName(name) {
+	return PACKAGE_NAME.test(name) && !name.includes("..") && name.length <= 214;
+}
+const MAX_FILE_BYTES = 16777216;
+const MAX_TOTAL_BYTES = 134217728;
+const MAX_FILES = 2e3;
+const MAX_IN_FLIGHT = 4;
+const FETCH_TIMEOUT_MS = 3e4;
+const DEAD_PID_GRACE_MS = 6e4;
+const ABANDONED_AFTER_MS = 36e5;
+const LEFTOVER = /\.(?:tmp|stale)-(\d+)-[0-9a-f]{8}$/;
+const STATIC_IMPORT = 1;
+const DYNAMIC_IMPORT = 2;
+var RegistryPackageCache = class {
+	cacheDir;
+	registryUrl;
+	logger;
+	fetchTimeoutMs;
+	inFlight = /* @__PURE__ */ new Map();
+	verified = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.registryUrl = options.registryUrl.endsWith("/") ? options.registryUrl : `${options.registryUrl}/`;
+		this.cacheDir = path.resolve(options.cacheDir ?? defaultRegistryCacheDir());
+		this.logger = options.logger ?? childLogger(["reactor-api", "registry-cache"]);
+		this.fetchTimeoutMs = options.fetchTimeoutMs ?? FETCH_TIMEOUT_MS;
+	}
+	/** Base URL every file of `name@version` is fetched under. */
+	baseUrl(name, version) {
+		return `${this.registryUrl}-/cdn/${name}@${version}/`;
+	}
+	entryDir(name, version) {
+		assertCoordinate(name, version);
+		const dir = path.join(this.cacheDir, `${name}@${version}`);
+		assertWithin(dir, this.cacheDir);
+		return dir;
+	}
+	/** Complete cached versions of `name`, newest-agnostic. */
+	async cachedVersions(name) {
+		if (!isValidPackageName(name)) return [];
+		const parent = path.dirname(path.join(this.cacheDir, `${name}@0.0.0`));
+		const leaf = path.basename(name);
+		let names;
+		try {
+			names = await readdir(parent);
+		} catch {
+			return [];
+		}
+		const versions = [];
+		for (const entry of names) {
+			if (!entry.startsWith(`${leaf}@`)) continue;
+			const version = entry.slice(leaf.length + 1);
+			if (!EXACT_VERSION.test(version)) continue;
+			try {
+				await stat(path.join(parent, entry, MANIFEST_FILE));
+				versions.push(version);
+			} catch {}
+		}
+		return versions;
+	}
+	async ensurePackage(name, version) {
+		const dir = this.entryDir(name, version);
+		const done = this.verified.get(dir);
+		if (done) return {
+			...done,
+			source: "cache"
+		};
+		const pending = this.inFlight.get(dir);
+		if (pending) return pending;
+		const started = this.resolveEntry(name, version, dir).finally(() => this.inFlight.delete(dir));
+		this.inFlight.set(dir, started);
+		return started;
+	}
+	async resolveEntry(name, version, dir) {
+		let manifest = await this.verify(dir, name, version);
+		let source = "cache";
+		if (!manifest) {
+			manifest = await this.fill(name, version, dir);
+			source = "download";
+		}
+		await this.linkBareImports(manifest.bareImports);
+		const entries = {};
+		for (const [kind, rel] of Object.entries(manifest.entries)) entries[kind] = path.join(dir, rel);
+		const result = {
+			name,
+			version,
+			dir,
+			entries,
+			source
+		};
+		this.verified.set(dir, result);
+		return result;
+	}
+	/** The manifest when every listed file is present and hashes to it. */
+	async verify(dir, name, version) {
+		let manifest;
+		try {
+			manifest = parseManifest(await readFile(path.join(dir, MANIFEST_FILE), "utf8"));
+		} catch (error) {
+			if (error.code === "ENOENT") return null;
+			this.logger.warn("Unreadable cache manifest in @dir: @error", dir, error);
+			await this.discard(dir);
+			return null;
+		}
+		if (manifest.name !== name || manifest.version !== version || Object.values(manifest.entries).some((rel) => !(rel in manifest.files))) {
+			this.logger.warn("Cache manifest in @dir names another package", dir);
+			await this.discard(dir);
+			return null;
+		}
+		for (const [rel, expected] of Object.entries(manifest.files)) {
+			let actual;
+			try {
+				const file = path.join(dir, rel);
+				assertWithin(file, dir);
+				actual = sha256(await readFile(file));
+			} catch {
+				actual = null;
+			}
+			if (actual !== expected) {
+				this.logger.warn("Cached @file of @package failed verification; fetching it again", rel, `${name}@${version}`);
+				await this.discard(dir);
+				return null;
+			}
+		}
+		return manifest;
+	}
+	async discard(dir) {
+		const aside = `${dir}.stale-${process.pid}-${randomUUID().slice(0, 8)}`;
+		try {
+			await rename(dir, aside);
+		} catch {
+			return;
+		}
+		await rm(aside, {
+			recursive: true,
+			force: true
+		});
+	}
+	async fill(name, version, dir) {
+		const staging = `${dir}.tmp-${process.pid}-${randomUUID().slice(0, 8)}`;
+		assertWithin(staging, this.cacheDir);
+		await sweepLeftovers(path.dirname(dir));
+		await mkdir(staging, { recursive: true });
+		try {
+			const manifest = await this.download(name, version, staging);
+			await writeFile(path.join(staging, MANIFEST_FILE), JSON.stringify(manifest, null, 2));
+			await chmod(staging, 493);
+			try {
+				await rename(staging, dir);
+			} catch {
+				const theirs = await this.verify(dir, name, version);
+				if (theirs) return theirs;
+				await this.discard(dir);
+				await rename(staging, dir);
+			}
+			return manifest;
+		} finally {
+			await rm(staging, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+	async download(name, version, staging) {
+		await init;
+		const base = this.baseUrl(name, version);
+		const files = {};
+		const bare = /* @__PURE__ */ new Set();
+		const entryRels = new Set(Object.values(PACKAGE_ENTRIES));
+		const queue = [...entryRels];
+		const seen = new Set(queue);
+		let totalBytes = 0;
+		const processOne = async (rel) => {
+			const url = new URL(rel, base).href;
+			const body = await this.fetchBounded(url, entryRels.has(rel));
+			if (!body) return;
+			totalBytes += body.byteLength;
+			if (totalBytes > MAX_TOTAL_BYTES) throw new Error(`${name}@${version} exceeds the ${MAX_TOTAL_BYTES}-byte cache cap`);
+			const target = path.join(staging, rel);
+			assertWithin(target, staging);
+			for (const dep of this.dependenciesOf(body.toString("utf8"), url, base)) {
+				if (dep.kind === "bare") {
+					bare.add(dep.specifier);
+					continue;
+				}
+				if (seen.has(dep.rel)) continue;
+				if (seen.size >= MAX_FILES) throw new Error(`${name}@${version} imports more than ${MAX_FILES} files`);
+				seen.add(dep.rel);
+				queue.push(dep.rel);
+			}
+			files[rel] = sha256(body);
+			await mkdir(path.dirname(target), { recursive: true });
+			await writeFile(target, body);
+		};
+		const active = /* @__PURE__ */ new Set();
+		let failure;
+		while ((queue.length > 0 || active.size > 0) && failure === void 0) {
+			while (queue.length > 0 && active.size < MAX_IN_FLIGHT) {
+				const task = processOne(queue.shift()).then(() => {
+					active.delete(task);
+				}, (error) => {
+					active.delete(task);
+					failure ??= error instanceof Error ? error : new Error(String(error));
+				});
+				active.add(task);
+			}
+			if (active.size > 0) await Promise.race(active);
+		}
+		if (failure !== void 0) {
+			await Promise.allSettled(active);
+			throw failure;
+		}
+		const entries = {};
+		for (const [kind, rel] of Object.entries(PACKAGE_ENTRIES)) if (rel in files) entries[kind] = rel;
+		if (Object.keys(entries).length === 0) throw new Error(`${name}@${version} serves no document models, subgraphs or processors`);
+		return {
+			name,
+			version,
+			entries,
+			files: Object.fromEntries(Object.entries(files).sort(([a], [b]) => a.localeCompare(b))),
+			bareImports: [...bare].sort()
+		};
+	}
+	dependenciesOf(source, url, base) {
+		const [imports] = parse$1(source, url);
+		const deps = [];
+		for (const imp of imports) {
+			const kind = imp.t;
+			if (kind !== STATIC_IMPORT && kind !== DYNAMIC_IMPORT) continue;
+			const specifier = imp.n;
+			if (specifier === void 0) {
+				if (kind === DYNAMIC_IMPORT) this.logger.warn("Non-literal dynamic import in @url is not cached: @expr", url, source.slice(imp.s, imp.e));
+				continue;
+			}
+			if (isBuiltin(specifier)) continue;
+			if (specifier.startsWith("./") || specifier.startsWith("../") || specifier.startsWith("/") || /^https?:\/\//i.test(specifier)) {
+				deps.push({
+					kind: "file",
+					rel: relativeTo(base, specifier, url)
+				});
+				continue;
+			}
+			if (/^[a-z][a-z0-9+.-]*:/i.test(specifier)) throw new Error(`${url} imports an unsupported URL: ${specifier}`);
+			deps.push({
+				kind: "bare",
+				specifier
+			});
+		}
+		return deps;
+	}
+	async fetchBounded(url, optional = false) {
+		const response = await fetch(url, { signal: AbortSignal.timeout(this.fetchTimeoutMs) });
+		if (optional && response.status === 404) {
+			await response.body?.cancel();
+			return null;
+		}
+		if (!response.ok) {
+			await response.body?.cancel();
+			throw new Error(`${url} responded ${response.status}`);
+		}
+		const declared = response.headers.get("content-length");
+		if (declared && Number(declared) > MAX_FILE_BYTES) {
+			await response.body?.cancel();
+			throw new Error(`${url} exceeds the ${MAX_FILE_BYTES}-byte file cap`);
+		}
+		if (!response.body) return Buffer.from(await response.arrayBuffer());
+		const reader = response.body.getReader();
+		const chunks = [];
+		let total = 0;
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			total += value.byteLength;
+			if (total > MAX_FILE_BYTES) {
+				await reader.cancel();
+				throw new Error(`${url} exceeds the ${MAX_FILE_BYTES}-byte file cap`);
+			}
+			chunks.push(value);
+		}
+		return Buffer.concat(chunks);
+	}
+	async linkBareImports(specifiers) {
+		const outsideUrl = pathToFileURL(path.join(path.dirname(this.cacheDir), "/")).href;
+		const linkRoot = path.join(this.cacheDir, "node_modules");
+		for (const specifier of specifiers) {
+			const pkg = packageNameOf(specifier);
+			if (!pkg || !isValidPackageName(pkg)) continue;
+			const link = path.join(linkRoot, pkg);
+			assertWithin(link, linkRoot);
+			if (packageRoot(specifier, pkg, outsideUrl)) {
+				await removeLink(link);
+				continue;
+			}
+			const fallback = packageRoot(specifier, pkg, import.meta.url);
+			if (!fallback) {
+				this.logger.warn("Registry package import @specifier resolves from neither the project nor reactor-api", specifier);
+				continue;
+			}
+			try {
+				await ensureLink(link, await realpath(fallback));
+			} catch (error) {
+				this.logger.warn("Could not link @pkg for cached registry packages: @error", pkg, error);
+			}
+		}
+	}
+};
+function sha256(data) {
+	return createHash("sha256").update(data).digest("hex");
+}
+function assertCoordinate(name, version) {
+	if (!isValidPackageName(name)) throw new Error(`Invalid registry package name: ${name}`);
+	if (!EXACT_VERSION.test(version)) throw new Error(`Invalid registry package version: ${version}`);
+}
+function assertWithin(target, root) {
+	const resolvedRoot = path.resolve(root);
+	const resolved = path.resolve(target);
+	if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + path.sep)) throw new Error(`Path escapes the registry cache: ${target}`);
+}
+function relativeTo(base, specifier, fromUrl) {
+	const resolved = new URL(specifier, fromUrl);
+	resolved.search = "";
+	resolved.hash = "";
+	if (!resolved.href.startsWith(base)) throw new Error(`${fromUrl} imports ${specifier}, which is outside the package`);
+	const rel = decodeURIComponent(resolved.href.slice(base.length));
+	if (rel === "" || rel === "manifest.json" || rel.includes("\\") || rel.includes("\0") || rel.split("/").some((s) => s === "" || s === "." || s === "..")) throw new Error(`${fromUrl} imports an unusable path: ${specifier}`);
+	return rel;
+}
+function parseManifest(raw) {
+	const value = JSON.parse(raw);
+	if (typeof value.name !== "string" || typeof value.version !== "string" || typeof value.entries !== "object" || value.entries === null || typeof value.files !== "object" || value.files === null || !Array.isArray(value.bareImports)) throw new Error("malformed manifest");
+	return value;
+}
+function packageNameOf(specifier) {
+	const parts = specifier.split("/");
+	if (specifier.startsWith("@")) return parts.length >= 2 ? `${parts[0]}/${parts[1]}` : null;
+	return parts[0] || null;
+}
+function packageRoot(specifier, pkg, base) {
+	let found;
+	try {
+		found = findPackageJSON(specifier, base);
+	} catch {
+		return null;
+	}
+	if (!found) return null;
+	let dir = path.dirname(found);
+	for (let i = 0; i < 16; i++) {
+		if (dir.endsWith(`${path.sep}node_modules${path.sep}${pkg}`)) return dir;
+		if (readPackageName(path.join(dir, "package.json")) === pkg) return dir;
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return null;
+}
+function readPackageName(file) {
+	try {
+		return JSON.parse(readFileSync(file, "utf8")).name;
+	} catch {
+		return;
+	}
+}
+async function sweepLeftovers(parent) {
+	let names;
+	try {
+		names = await readdir(parent);
+	} catch {
+		return;
+	}
+	const now = Date.now();
+	for (const name of names) {
+		const match = LEFTOVER.exec(name);
+		if (!match) continue;
+		const pid = Number(match[1]);
+		if (pid === process.pid) continue;
+		const full = path.join(parent, name);
+		let age;
+		try {
+			age = now - (await lstat(full)).mtimeMs;
+		} catch {
+			continue;
+		}
+		if (age > ABANDONED_AFTER_MS || age > DEAD_PID_GRACE_MS && !isAlive(pid)) await rm(full, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+function isAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code === "EPERM";
+	}
+}
+async function ensureLink(link, target) {
+	try {
+		if (await readlink(link) === target) return;
+	} catch {}
+	await mkdir(path.dirname(link), { recursive: true });
+	await sweepLeftovers(path.dirname(link));
+	const temp = `${link}.tmp-${process.pid}-${randomUUID().slice(0, 8)}`;
+	await symlink(target, temp, "junction");
+	try {
+		await rename(temp, link);
+	} catch (error) {
+		await rm(temp, { force: true });
+		throw error;
+	}
+}
+async function removeLink(link) {
+	try {
+		await readlink(link);
+	} catch {
+		return;
+	}
+	await rm(link, { force: true });
+}
+//#endregion
 //#region src/packages/http-loader.ts
+function piecesBaseUrl(registryUrl, packageName, version) {
+	return `${registryUrl.endsWith("/") ? registryUrl : `${registryUrl}/`}-/cdn/${packageName}@${version}/node/pieces/`;
+}
+function documentModelsOf(module) {
+	return Object.values(module).filter((m) => m !== null && typeof m === "object" && "documentModel" in m && m.documentModel !== null);
+}
 /**
 * Extract subgraph classes from the imported subgraphs/index.mjs module shape.
 *
@@ -6146,8 +7323,14 @@ var HttpPackageLoader = class {
 	logger = childLogger(["reactor-api", "http-loader"]);
 	name = "HttpPackageLoader";
 	documentModelLoader;
+	cache;
+	versions = /* @__PURE__ */ new Map();
 	constructor(options) {
 		this.registryUrl = options.registryUrl.endsWith("/") ? options.registryUrl : `${options.registryUrl}/`;
+		this.cache = new RegistryPackageCache({
+			registryUrl: this.registryUrl,
+			cacheDir: options.cacheDir
+		});
 		this.documentModelLoader = new HttpDocumentModelLoader(this);
 	}
 	/**
@@ -6179,38 +7362,95 @@ var HttpPackageLoader = class {
 			tag: void 0
 		};
 	}
+	resolveVersion(packageSpec) {
+		const known = this.versions.get(packageSpec);
+		if (known) return known;
+		const lookup = this.lookUpVersion(packageSpec).then((version) => {
+			if (!version) this.versions.delete(packageSpec);
+			return version;
+		});
+		this.versions.set(packageSpec, lookup);
+		return lookup;
+	}
+	async lookUpVersion(packageSpec) {
+		const { name, tag } = this.parsePackageSpec(packageSpec);
+		if (tag && EXACT_VERSION.test(tag)) return tag;
+		const version = await this.packageVersion(packageSpec);
+		if (version) return version;
+		const cached = await this.cache.cachedVersions(name);
+		if (cached.length === 1) {
+			this.logger.warn("Could not resolve a version for @package; using cached @version", packageSpec, cached[0]);
+			return cached[0];
+		}
+	}
+	/** Caches the pinned version of `packageSpec` on disk. */
+	async cachePackage(packageSpec) {
+		const { name: packageName } = this.parsePackageSpec(packageSpec);
+		if (!isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
+		const version = await this.resolveVersion(packageSpec);
+		if (!version) throw new Error(`No exact version found for ${packageSpec}`);
+		const cached = await this.cache.ensurePackage(packageName, version);
+		this.logger.verbose(`Package ${packageName}@${version} at ${cached.dir} (${cached.source})`);
+		return cached;
+	}
+	/** One entry module of the package, plus the cached file it came from. */
+	async importEntry(packageSpec, kind) {
+		const { name: packageName } = this.parsePackageSpec(packageSpec);
+		if (!isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
+		const version = await this.resolveVersion(packageSpec);
+		let cached;
+		if (version) try {
+			cached = await this.cache.ensurePackage(packageName, version);
+		} catch (error) {
+			this.logger.warn("Could not cache @package, importing it over HTTP: @error", packageSpec, error);
+		}
+		if (cached) {
+			const filePath = cached.entries[kind];
+			if (!filePath) throw Object.assign(/* @__PURE__ */ new Error(`${packageName}@${cached.version} serves no ${kind}`), { code: REGISTRY_ENTRY_ABSENT });
+			return {
+				module: await import(
+					/* @vite-ignore */
+					pathToFileURL(filePath).href
+),
+				filePath
+			};
+		}
+		const pinned = version ? `${packageName}@${version}` : packageSpec;
+		const url = `${this.registryUrl}-/cdn/${pinned}/${PACKAGE_ENTRIES[kind]}`;
+		this.logger.verbose(`Importing ${kind} from: ${url}`);
+		return { module: await import(
+			/* @vite-ignore */
+			url
+) };
+	}
+	importDocumentModels(packageSpec) {
+		return this.importEntry(packageSpec, "documentModels");
+	}
 	async loadDocumentModels(packageSpec) {
 		const { name: packageName } = this.parsePackageSpec(packageSpec);
-		if (!this.isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
-		const url = `${this.registryUrl}-/cdn/${packageSpec}/node/document-models/index.mjs`;
-		this.logger.verbose(`Importing document-models from: ${url}`);
-		const module = await import(url);
-		const models = Object.values(module).filter((m) => m !== null && typeof m === "object" && "documentModel" in m && m.documentModel !== null);
+		const { module } = await this.importDocumentModels(packageSpec);
+		const models = documentModelsOf(module);
 		this.logger.verbose(`Loaded ${models.length} document models from ${packageName}`);
 		return models;
 	}
 	async loadUpgradeManifests(packageSpec) {
 		const { name: packageName } = this.parsePackageSpec(packageSpec);
-		if (!this.isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
-		const manifests = extractUpgradeManifests(await import(`${this.registryUrl}-/cdn/${packageSpec}/node/document-models/index.mjs`));
+		const { module } = await this.importDocumentModels(packageSpec);
+		const manifests = extractUpgradeManifests(module);
 		if (manifests.length > 0) this.logger.verbose(`Loaded ${manifests.length} upgrade manifests from ${packageName}`);
 		return manifests;
 	}
 	async loadSubgraphs(packageSpec) {
 		const { name: packageName } = this.parsePackageSpec(packageSpec);
-		if (!this.isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
-		const url = `${this.registryUrl}-/cdn/${packageSpec}/node/subgraphs/index.mjs`;
-		this.logger.verbose(`Importing subgraphs from: ${url}`);
-		const subgraphs = extractSubgraphsFromModule(await import(url));
+		const { module } = await this.importEntry(packageSpec, "subgraphs");
+		const subgraphs = extractSubgraphsFromModule(module);
 		this.logger.verbose(`Loaded ${subgraphs.length} subgraphs from ${packageName}`);
 		return subgraphs;
 	}
 	async loadProcessors(packageSpec) {
 		const { name: packageName } = this.parsePackageSpec(packageSpec);
-		if (!this.isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
-		const url = `${this.registryUrl}-/cdn/${packageSpec}/node/processors/index.mjs`;
-		this.logger.verbose(`Importing processors from: ${url}`);
-		const factory = (await import(url)).processorFactory;
+		const { module } = await this.importEntry(packageSpec, "processors");
+		const factory = module.processorFactory;
 		if (factory && typeof factory === "function") {
 			this.logger.verbose(`Loaded processor factory from ${packageName}`);
 			return factory;
@@ -6218,6 +7458,27 @@ var HttpPackageLoader = class {
 		this.logger.verbose(`No processor factory found in ${packageName}`);
 		return null;
 	}
+	async loadPieces(packageSpec) {
+		const { name: packageName } = this.parsePackageSpec(packageSpec);
+		if (!isValidPackageName(packageName)) throw new Error(`Invalid package name: ${packageName}`);
+		const version = await this.resolveVersion(packageSpec);
+		if (!version) {
+			this.logger.verbose(`No package version found for: ${packageSpec}`);
+			return [];
+		}
+		const base = piecesBaseUrl(this.registryUrl, packageName, version);
+		this.logger.verbose(`Importing pieces from: ${base}index.mjs`);
+		let module;
+		try {
+			module = await import(`${base}index.mjs`);
+		} catch (error) {
+			this.logger.verbose("No pieces found for @package: @error", packageName, error);
+			return [];
+		}
+		const pieces = piecesFromCdnList(module, base, packageName, this.logger, version);
+		this.logger.verbose(`Loaded ${pieces.length} pieces from ${packageName}`);
+		return pieces;
+	}
 	/**
 	* Load document models from multiple packages.
 	* Continues loading even if some packages fail.
@@ -6234,28 +7495,30 @@ var HttpPackageLoader = class {
 				logger?.info(logMsg);
 				this.logger.info(logMsg);
 			} catch (error) {
-				const errMsg = `Failed to load package ${trimmedName}`;
-				logger?.error(errMsg, error);
-				this.logger.error(errMsg, error);
+				logger?.error(`Failed to load package ${trimmedName}`, error);
+				this.logger.error("Failed to load package @package: @error", trimmedName, error);
 			}
 		}
 		return allModels;
 	}
-	isValidPackageName(name) {
-		return /^(@[a-z0-9][-a-z0-9._]*\/)?[a-z0-9][-a-z0-9._]*$/i.test(name) && !name.includes("..") && name.length <= 214;
+	async packageVersion(packageSpec) {
+		try {
+			const response = await fetch(`${this.registryUrl}-/cdn/${packageSpec}/package.json`);
+			if (!response.ok) return void 0;
+			const pkg = await response.json();
+			return typeof pkg.version === "string" && EXACT_VERSION.test(pkg.version) ? pkg.version : void 0;
+		} catch (error) {
+			this.logger.verbose("Could not read the version of @package: @error", packageSpec, error);
+			return;
+		}
 	}
 };
-/**
-* Returns live modules (host-only sources): dynamically loaded models are
-* registered on the host registry but never reach executor worker threads.
-* Making them worker-executable means returning an importable source here
-* (the CDN URL as a package specifier, given process-wide https hooks).
-*/
 var HttpDocumentModelLoader = class {
 	loader;
 	logger = childLogger(["reactor-api", "http-document-model-loader"]);
 	documentTypeCache = /* @__PURE__ */ new Map();
 	packageModulesCache = /* @__PURE__ */ new Map();
+	packageFileCache = /* @__PURE__ */ new Map();
 	onModelLoaded;
 	constructor(loader) {
 		this.loader = loader;
@@ -6266,15 +7529,16 @@ var HttpDocumentModelLoader = class {
 	clearCache() {
 		this.documentTypeCache.clear();
 		this.packageModulesCache.clear();
+		this.packageFileCache.clear();
 	}
 	async load(documentType) {
 		const packageName = await this.findPackageByDocumentType(documentType);
-		let models;
-		const cachedModels = this.packageModulesCache.get(packageName);
-		if (cachedModels) models = cachedModels;
-		else {
-			models = await this.loader.loadDocumentModels(packageName);
+		let models = this.packageModulesCache.get(packageName);
+		if (!models) {
+			const { module, filePath } = await this.loader.importDocumentModels(packageName);
+			models = documentModelsOf(module);
 			this.packageModulesCache.set(packageName, models);
+			if (filePath) this.packageFileCache.set(packageName, filePath);
 		}
 		const model = models.find((m) => m.documentModel.global.id === documentType);
 		if (!model) {
@@ -6283,7 +7547,8 @@ var HttpDocumentModelLoader = class {
 		}
 		this.logger.info(`Loaded document model "${documentType}" from package "${packageName}"`);
 		if (this.onModelLoaded) this.onModelLoaded(model);
-		return model;
+		const filePath = this.packageFileCache.get(packageName);
+		return filePath ? { filePath } : model;
 	}
 	async findPackageByDocumentType(documentType) {
 		const cached = this.documentTypeCache.get(documentType);
@@ -6306,6 +7571,7 @@ var HttpDocumentModelLoader = class {
 	}
 	removeFromCache(packageName) {
 		this.packageModulesCache.delete(packageName);
+		this.packageFileCache.delete(packageName);
 		for (const [docType, pkg] of this.documentTypeCache) if (pkg === packageName) this.documentTypeCache.delete(docType);
 	}
 };
@@ -6315,8 +7581,13 @@ var HttpDocumentModelLoader = class {
 * This class is used to load packages using the import keyword.
 */
 var ImportPackageLoader = class {
+	hostDir;
 	logger = childLogger(["reactor-api", "import-loader"]);
 	name = "ImportPackageLoader";
+	constructor(hostDir = process.cwd()) {
+		this.hostDir = hostDir;
+	}
+	reportedUnbuilt = /* @__PURE__ */ new Set();
 	async loadDocumentModels(identifier) {
 		this.logger.verbose(`Loading document models from package: ${identifier}`);
 		const pkgModule = await loadDocumentModels(identifier);
@@ -6359,6 +7630,31 @@ var ImportPackageLoader = class {
 		this.logger.verbose(`  ➜  No Processor Factory found: ${identifier}`);
 		return null;
 	}
+	async loadPieces(identifier) {
+		this.logger.verbose(`Loading pieces from package: ${identifier}`);
+		const { root, listPath } = pieceListLocation(identifier, this.hostDir);
+		if (!existsSync(listPath)) {
+			this.reportUnbuilt(identifier, root, listPath);
+			return [];
+		}
+		const module = await import(
+			/* @vite-ignore */
+			pathToFileURL(listPath).href
+);
+		const pieces = piecesFromListModule(module, {
+			root,
+			identifier,
+			logger: this.logger
+		});
+		this.logger.verbose(`  ➜  Loaded ${pieces.length} Pieces from: ${identifier}`);
+		return pieces;
+	}
+	reportUnbuilt(identifier, root, listPath) {
+		if (!isAbsolute(identifier) || this.reportedUnbuilt.has(identifier)) return;
+		if (!existsSync(join(root, PIECE_SOURCE_LIST))) return;
+		this.reportedUnbuilt.add(identifier);
+		this.logger.warn("@pkg declares pieces but @list was never built; run `ph build`", identifier, listPath);
+	}
 };
 //#endregion
 //#region src/packages/package-manager.ts
@@ -6374,10 +7670,13 @@ var ImportPackageLoader = class {
 * either bare (`'pkg'`) or as a subpath (`'pkg/subgraphs'`), since loaders
 * import sub-entries like `${pkg}/subgraphs` / `${pkg}/document-models`.
 */
-function isExpectedLoaderMiss(error, pkg) {
+function isExpectedLoaderMiss(error, pkg, subPath) {
 	if (!(error instanceof Error)) return false;
 	const code = error.code;
 	if (code === "ERR_UNSUPPORTED_DIR_IMPORT") return true;
+	if (code === "ERR_REGISTRY_ENTRY_ABSENT") return true;
+	if (code === "ERR_PACKAGE_PATH_NOT_EXPORTED" && subPath !== void 0 && error.message.includes(`'./${subPath}'`)) return true;
+	if (subPath !== void 0 && new RegExp(`^Failed to fetch \\S*/${subPath}/index\\.mjs: 404$`).test(error.message)) return true;
 	if (error.message.startsWith("Invalid package name:")) return true;
 	if (code === "ERR_MODULE_NOT_FOUND") return error.message.includes(`'${pkg}'`) || error.message.includes(`"${pkg}"`) || error.message.includes(`'${pkg}/`) || error.message.includes(`"${pkg}/`);
 	return false;
@@ -6393,12 +7692,14 @@ function getUniqueUpgradeManifests(...upgradeManifests) {
 	return Array.from(uniqueManifests.values());
 }
 var PackageManager = class {
+	options;
 	logger = childLogger(["reactor-api", "package-manager"]);
 	loaders;
 	docModelsMap = /* @__PURE__ */ new Map();
 	upgradeManifestsMap = /* @__PURE__ */ new Map();
 	subgraphsMap = /* @__PURE__ */ new Map();
 	processorMap = /* @__PURE__ */ new Map();
+	piecesMap = /* @__PURE__ */ new Map();
 	configWatcher;
 	debouncedUpdateCallbacks = /* @__PURE__ */ new Map();
 	eventEmitter = new EventEmitter();
@@ -6417,10 +7718,12 @@ var PackageManager = class {
 		const upgradeManifestsMap = await this.loadUpgradeManifests(packages);
 		const subgraphsMap = await this.loadSubgraphs(packages);
 		const processorsMap = await this.loadProcessors(packages);
+		const piecesMap = await this.loadPieces(packages);
 		this.upgradeManifestsMap = upgradeManifestsMap;
 		this.updatePackagesMap(documentModelsMap);
 		this.updateSubgraphsMap(subgraphsMap);
 		this.updateProcessorsMap(processorsMap);
+		this.updatePiecesMap(piecesMap);
 		try {
 			this.subscribePackages(packages);
 		} catch (error) {
@@ -6430,7 +7733,8 @@ var PackageManager = class {
 			documentModels: getUniqueDocumentModels(...Array.from(documentModelsMap.values())),
 			upgradeManifests: this.getUniqueUpgradeManifests(),
 			subgraphs: subgraphsMap,
-			processors: processorsMap
+			processors: processorsMap,
+			pieces: piecesMap
 		};
 	}
 	async loadDocumentModels(packages) {
@@ -6499,7 +7803,7 @@ var PackageManager = class {
 					loader: loader.name,
 					error
 				});
-				this.logger.debug(`[${loader.name}] Failed to load subgraphs from package ${pkg}`, error);
+				this.logger.debug("[@loader] Failed to load subgraphs from package @package: @error", loader.name, pkg, error);
 			}
 			this.maybeWarnAllLoadersFailed("subgraphs", pkg, succeeded, failures);
 			subgraphsMap.set(pkg, allSubgraphs);
@@ -6523,16 +7827,41 @@ var PackageManager = class {
 					loader: loader.name,
 					error
 				});
-				this.logger.debug(`[${loader.name}] Failed to load processors from package ${pkg}`, error);
+				this.logger.debug("[@loader] Failed to load processors from package @package: @error", loader.name, pkg, error);
 			}
 			this.maybeWarnAllLoadersFailed("processors", pkg, succeeded, failures);
 			processorsMap.set(pkg, allProcessors);
 		}
 		return processorsMap;
 	}
+	async loadPieces(packages) {
+		this.logger.debug(`Loading pieces from packages: ${packages.join(", ")}`);
+		const piecesMap = /* @__PURE__ */ new Map();
+		for (const pkg of packages) {
+			const allPieces = [];
+			const failures = [];
+			let succeeded = false;
+			for (const loader of this.loaders) try {
+				allPieces.push(...await loader.loadPieces(pkg));
+				succeeded = true;
+				break;
+			} catch (error) {
+				failures.push({
+					loader: loader.name,
+					error
+				});
+				this.logger.debug("[@loader] Failed to load pieces from package @package: @error", loader.name, pkg, error);
+			}
+			this.maybeWarnAllLoadersFailed("pieces", pkg, succeeded, failures);
+			if (allPieces.length > 0) this.logger.info("Loaded @count piece(s) from package @pkg: @pieces", allPieces.length, pkg, allPieces.map((piece) => piece.name).join(", "));
+			piecesMap.set(pkg, allPieces);
+		}
+		return piecesMap;
+	}
 	maybeWarnAllLoadersFailed(kind, pkg, succeeded, failures) {
 		if (succeeded || failures.length === 0) return;
-		const realFailures = failures.filter(({ error }) => !isExpectedLoaderMiss(error, pkg));
+		const subPath = kind === "document models" ? "document-models" : kind;
+		const realFailures = failures.filter(({ error }) => !isExpectedLoaderMiss(error, pkg, subPath));
 		if (realFailures.length === 0) return;
 		const details = realFailures.map(({ loader, error }) => {
 			return `  [${loader}] ${error instanceof Error ? error.message : String(error)}`;
@@ -6572,6 +7901,15 @@ var PackageManager = class {
 		else processorsMap.set(pkg, pkgProcessors);
 		this.updateProcessorsMap(processorsMap);
 	}
+	async updatePiecesForPackage(pkg) {
+		this.logger.debug(`Updating pieces for package: ${pkg}`);
+		const pieces = await this.loadPieces([pkg]);
+		const piecesMap = new Map(this.piecesMap);
+		const pkgPieces = pieces.get(pkg) ?? [];
+		if (pkgPieces.length === 0) piecesMap.delete(pkg);
+		else piecesMap.set(pkg, pkgPieces);
+		this.updatePiecesMap(piecesMap);
+	}
 	/** Debounced per key so repeated subscribePackages calls reuse one timer. */
 	getDebouncedUpdateCallback(key, update) {
 		if (!this.debouncedUpdateCallbacks.has(key)) {
@@ -6590,10 +7928,12 @@ var PackageManager = class {
 			const onDocumentModels = this.getDebouncedUpdateCallback(`${pkg}:document-models`, () => this.updateDocumentModelsForPackage(pkg));
 			const onSubgraphs = this.getDebouncedUpdateCallback(`${pkg}:subgraphs`, () => this.updateSubgraphsForPackage(pkg));
 			const onProcessors = this.getDebouncedUpdateCallback(`${pkg}:processors`, () => this.updateProcessorsForPackage(pkg));
+			const onPieces = this.getDebouncedUpdateCallback(`${pkg}:pieces`, () => this.updatePiecesForPackage(pkg));
 			for (const loader of this.loaders) {
 				if (loader.onDocumentModelsChange) unsubs.push(loader.onDocumentModelsChange(pkg, onDocumentModels));
 				if (loader.onSubgraphsChange) unsubs.push(loader.onSubgraphsChange(pkg, onSubgraphs));
 				if (loader.onProcessorsChange) unsubs.push(loader.onProcessorsChange(pkg, onProcessors));
+				if (loader.onPiecesChange) unsubs.push(loader.onPiecesChange(pkg, onPieces));
 			}
 		}
 		return () => {
@@ -6641,6 +7981,19 @@ var PackageManager = class {
 		this.processorMap = processorsMap;
 		this.eventEmitter.emit("processorsChange", processorsMap);
 	}
+	updatePiecesMap(piecesMap) {
+		const oldPackages = Array.from(this.piecesMap.keys());
+		const newPackages = Array.from(piecesMap.keys());
+		oldPackages.filter((pkg) => !newPackages.includes(pkg)).forEach((pkg) => {
+			this.logger.info("Removed pieces from: @pkg", pkg);
+		});
+		this.piecesMap = piecesMap;
+		this.eventEmitter.emit("piecesChange", piecesMap);
+	}
+	/** The pieces every loaded package ships, keyed by the package. */
+	getPieces() {
+		return new Map(this.piecesMap);
+	}
 	/**
 	* Remove `pkg` from all package maps and emit the change events, tearing
 	* down everything the package registered (subgraphs, processors, document
@@ -6659,9 +8012,11 @@ var PackageManager = class {
 		this.upgradeManifestsMap = dropKey(this.upgradeManifestsMap);
 		this.subgraphsMap = dropKey(this.subgraphsMap);
 		this.processorMap = dropKey(this.processorMap);
+		this.piecesMap = dropKey(this.piecesMap);
 		this.updatePackagesMap(this.docModelsMap);
 		this.updateSubgraphsMap(this.subgraphsMap);
 		this.updateProcessorsMap(this.processorMap);
+		this.updatePiecesMap(this.piecesMap);
 	}
 	onDocumentModelsChange(handler) {
 		this.eventEmitter.on("documentModelsChange", handler);
@@ -6672,6 +8027,9 @@ var PackageManager = class {
 	onProcessorsChange(handler) {
 		this.eventEmitter.on("processorsChange", handler);
 	}
+	onPiecesChange(handler) {
+		this.eventEmitter.on("piecesChange", handler);
+	}
 };
 //#endregion
 //#region src/config.ts
@@ -6689,20 +8047,55 @@ async function createStartupAttachmentBackend({ db, env = process.env, s3Depende
 }
 //#endregion
 //#region src/services/attachment-access.service.ts
+/** The scope an attachment's bytes belong to: the document's own domain state. */
+const ATTACHMENT_SCOPE = "global";
+/** The branch an attachment reference is resolved against. */
+const ATTACHMENT_BRANCH = "main";
 const HASH_PATTERN = /^[a-f0-9]{64}$/;
 /**
 * Composes document authorization with the projected document/ref
 * relationship. Order is fixed: validate ref, resolve the canonical document
-* id, check `canRead`, then check the reference index. A denied document
-* never reaches the reference reader, and the facade never touches
-* attachment metadata, storage backends, or presigners.
+* id, decide the read, check the reactor's read gate serves the document, then
+* check the reference index and that the subject may read a scope whose
+* operations reference the attachment. A denied document never reaches the
+* reference reader, and the facade never touches attachment metadata, storage
+* backends, or presigners.
+*
+* The named document decides alone: an attachment several documents reference
+* is readable through each of them on that document's own terms.
+*
+* The read is decided by the document's own policy when this composition has a
+* model to enforce it with, and by the host's permission tables when it does
+* not. That is not a preference between two equivalent answers: a host running
+* document policies keeps no rows in the permission tables, so asking them
+* about such a document returns whatever the host-wide policy says — under
+* `OPEN`, `true`, for everyone. Serving bytes on that answer hands the file to
+* anyone who learns its hash, which the document's own state may well have told
+* them. Both are kept because they are the two halves of one rule: an
+* attachment is readable by whoever may read the document that references it,
+* and each composition can only express that in its own terms. The caller
+* decision mirrors the routes' `requireAuth`.
 */
 var AttachmentAccessService = class {
-	constructor(resolveCanonicalId, authorization, references, projection) {
+	resolveCanonicalId;
+	authorization;
+	references;
+	projection;
+	readGate;
+	scopeGate;
+	options;
+	constructor(resolveCanonicalId, authorization, references, projection, readGate, scopeGate, options = {}) {
 		this.resolveCanonicalId = resolveCanonicalId;
 		this.authorization = authorization;
 		this.references = references;
 		this.projection = projection;
+		this.readGate = readGate;
+		this.scopeGate = scopeGate;
+		this.options = options;
+	}
+	admitCaller(request) {
+		if ((request.intent === "read" ? this.options.refuseAnonymousReads ?? false : this.options.refuseAnonymousWrites ?? true) && !request.userAddress) return Promise.resolve({ kind: "unauthenticated" });
+		return Promise.resolve({ kind: "admitted" });
 	}
 	async canReadAttachment(request) {
 		if (this.projection.status !== "available") return { kind: "projection-unavailable" };
@@ -6714,14 +8107,51 @@ var AttachmentAccessService = class {
 		} catch {
 			return { kind: "denied" };
 		}
-		if (!await this.authorization.canRead(documentId, request.userAddress)) return { kind: "denied" };
-		if (!await this.references.hasReference(documentId, ref)) return { kind: "denied" };
+		if (!await this.canReadDocument(documentId, request)) return { kind: "denied" };
+		const subject = {
+			address: request.userAddress,
+			key: request.appKey
+		};
+		let served;
+		try {
+			served = await this.readGate.isServed(documentId, { subject });
+		} catch {
+			return { kind: "denied" };
+		}
+		if (!served) return { kind: "denied" };
+		const scopes = await this.references.referencingScopes(documentId, ref);
+		if (scopes.length === 0) return { kind: "denied" };
+		let held;
+		try {
+			held = (await this.readGate.get(documentId, {
+				subject,
+				scopes
+			})).state;
+		} catch {
+			return { kind: "denied" };
+		}
+		if (!scopes.some((scope) => scope in held)) return { kind: "denied" };
 		return {
 			kind: "allowed",
 			documentId,
 			ref
 		};
 	}
+	/**
+	* Whether the caller may read the state the reference lives in.
+	*
+	* A failure here is rethrown rather than turned into a denial. A read side
+	* that is down must not read as a policy: a denial nobody can distinguish
+	* from a refusal is one nobody investigates, and the route answers 500 for a
+	* reason.
+	*/
+	async canReadDocument(documentId, request) {
+		if (!this.scopeGate) return this.authorization.canRead(documentId, request.userAddress);
+		return (await this.scopeGate.scopePredicateById(documentId, {
+			address: request.userAddress,
+			key: request.appKey
+		}, ATTACHMENT_BRANCH))(ATTACHMENT_SCOPE);
+	}
 };
 /**
 * Parses and canonicalizes a caller-supplied ref through the shared parser.
@@ -6742,6 +8172,140 @@ function normalizeAttachmentRef(value) {
 	return createRef(hash, version);
 }
 //#endregion
+//#region src/services/authorized-attachment.service.ts
+/** Matches the attachment routes' `documentId` bound. */
+const MAX_DOCUMENT_ID_LEN = 512;
+/** The reference index is not maintained in this composition. */
+var AttachmentAccessUnavailable = class extends Error {
+	constructor() {
+		super("Attachment access is unavailable");
+		this.name = "AttachmentAccessUnavailable";
+	}
+};
+/** The access decision itself failed; the cause is logged, not surfaced. */
+var AttachmentAccessFailed = class extends Error {
+	constructor(cause) {
+		super("Attachment access decision failed", { cause });
+		this.name = "AttachmentAccessFailed";
+	}
+};
+/** An `IAttachmentService` whose reads and writes are decided for one subject. */
+var AuthorizedAttachmentService = class {
+	inner;
+	access;
+	subject;
+	logger;
+	constructor(inner, access, subject, logger) {
+		this.inner = inner;
+		this.access = access;
+		this.subject = subject;
+		this.logger = logger;
+	}
+	/** Hash-first only: an upload-first handle can send after it expires. */
+	async reserve(options) {
+		const { mimeType, fileName, extension, clientHash, sizeBytes } = options;
+		if (clientHash === void 0) throw new Error("Attachment reservations require a client hash");
+		const copy = {
+			mimeType,
+			fileName,
+			extension,
+			clientHash,
+			sizeBytes
+		};
+		await this.admit("write");
+		validateReserveMetadata(copy);
+		return this.inner.reserve(copy);
+	}
+	async stat(ref, options) {
+		const decision = await this.decideRead(ref, options);
+		return this.inner.stat(decision.ref, {
+			...options,
+			documentId: decision.documentId
+		});
+	}
+	async get(ref, options) {
+		const decision = await this.decideRead(ref, options);
+		return this.inner.get(decision.ref, {
+			...options,
+			documentId: decision.documentId
+		});
+	}
+	async getDownloadTarget(ref, options) {
+		const decision = await this.decideRead(ref, options);
+		return this.inner.getDownloadTarget(decision.ref, {
+			...options,
+			documentId: decision.documentId
+		});
+	}
+	async decideRead(ref, options) {
+		const documentId = readDocumentId(options);
+		if (documentId === null) throw new AttachmentNotFound(ref);
+		await this.admit("read");
+		let decision;
+		try {
+			decision = await this.access.canReadAttachment({
+				documentId,
+				attachmentRef: ref,
+				userAddress: this.subject.address,
+				appKey: this.subject.key
+			});
+		} catch (err) {
+			throw this.accessFailed(err);
+		}
+		if (decision.kind === "allowed") return {
+			documentId: decision.documentId,
+			ref: decision.ref
+		};
+		if (decision.kind === "projection-unavailable") throw new AttachmentAccessUnavailable();
+		throw new AttachmentNotFound(ref);
+	}
+	async admit(intent) {
+		let result;
+		try {
+			result = await this.access.admitCaller({
+				intent,
+				userAddress: this.subject.address,
+				appKey: this.subject.key
+			});
+		} catch (err) {
+			throw this.accessFailed(err);
+		}
+		if (result.kind !== "admitted") throw new AuthenticationRequiredError();
+	}
+	accessFailed(err) {
+		this.logger.error("Attachment access decision failed: @error", err);
+		return new AttachmentAccessFailed(err);
+	}
+};
+/** The options' `documentId` when it is one the routes would accept, else null. */
+function readDocumentId(options) {
+	if (typeof options !== "object" || options === null) return null;
+	if (isAbortSignal(options)) return null;
+	const value = options.documentId;
+	if (typeof value !== "string") return null;
+	if (value.trim().length === 0 || value.length > MAX_DOCUMENT_ID_LEN) return null;
+	return value;
+}
+/** Duck-checked too, so a signal from another realm is still a signal. */
+function isAbortSignal(value) {
+	if (value instanceof AbortSignal) return true;
+	const candidate = value;
+	return typeof candidate.aborted === "boolean" && typeof candidate.addEventListener === "function";
+}
+var AttachmentClientProvider = class {
+	service;
+	access;
+	logger;
+	constructor(service, access, logger) {
+		this.service = service;
+		this.access = access;
+		this.logger = logger;
+	}
+	forSubject(subject) {
+		return createAttachmentClient(new AuthorizedAttachmentService(this.service, this.access, subject, this.logger));
+	}
+};
+//#endregion
 //#region src/graphql/gateway/require-auth-middleware.ts
 /**
 * Returns a fetch middleware that rejects anonymous callers with a 401.
@@ -6767,14 +8331,42 @@ function normalizeAttachmentRef(value) {
 * context has no caller, and is rejected. The server never composes this
 * middleware without the auth middleware in the chain (see
 * `assertRequireAuthenticatedCallerAllowed` in `server.ts`).
+*
+* `exemptPaths` names the mounted paths that stay reachable anonymously — a
+* deployment whose product has a flow that runs before sign-in, such as
+* previewing an invitation from its code, needs somewhere to serve it from.
+* Each entry is a hole in the floor, so the match is deliberately the
+* narrowest one that works: the request's pathname, compared in full. A
+* prefix rule would exempt `/graphql/public-admin` along with
+* `/graphql/public`, and an exempt surface nobody can enumerate by reading
+* the configuration is not one anybody audits.
 */
-function createRequireAuthFetchMiddleware() {
+function createRequireAuthFetchMiddleware(exemptPaths = []) {
+	const exempt = new Set(exemptPaths.map(normalizeExemptPath));
 	return (next) => async (request) => {
 		if (request.method === "OPTIONS") return next(request);
+		if (exempt.size > 0 && exempt.has(normalizeExemptPath(new URL(request.url).pathname))) return next(request);
 		if (getAuthContext(request)?.user === void 0) return new globalThis.Response(JSON.stringify({ error: "Authentication required" }), { status: 401 });
 		return next(request);
 	};
 }
+/**
+* The form both sides of the comparison are reduced to: surrounding whitespace
+* gone, and one trailing slash gone, so `/graphql/public/` and
+* `/graphql/public` are the same path. A client that appends a slash is not
+* asking for a different route, and a configuration that carries one is not
+* asking for a different rule.
+*
+* Deliberately NOT normalized: case, percent-encoding, and a missing leading
+* slash. The first two would let two spellings of one path diverge from how
+* the router itself matches; the third is a configuration error, and
+* `assertRequireAuthenticatedCallerAllowed` refuses to boot on it rather than
+* leaving an exemption that silently never applies.
+*/
+function normalizeExemptPath(path) {
+	const trimmed = path.trim();
+	return trimmed.length > 1 && trimmed.endsWith("/") ? trimmed.slice(0, -1) : trimmed;
+}
 //#endregion
 //#region src/migrations/001_create_document_permissions.ts
 var _001_create_document_permissions_exports = /* @__PURE__ */ __exportAll({
@@ -7177,6 +8769,7 @@ async function createRenownCredentialVerifier(config = {}) {
 * - Users can be granted permission to execute specific operations
 */
 var DocumentPermissionService = class {
+	db;
 	config;
 	constructor(db, config = { defaultProtection: false }) {
 		this.db = db;
@@ -7252,8 +8845,38 @@ var DocumentPermissionService = class {
 	* Delete all permissions for a document (used when deleting a document)
 	*/
 	async deleteAllDocumentPermissions(documentId) {
-		await this.db.deleteFrom("DocumentPermission").where("documentId", "=", documentId).execute();
-		await this.db.deleteFrom("OperationUserPermission").where("documentId", "=", documentId).execute();
+		const permissions = await this.db.deleteFrom("DocumentPermission").where("documentId", "=", documentId).returning("id").execute();
+		const operations = await this.db.deleteFrom("OperationUserPermission").where("documentId", "=", documentId).returning("id").execute();
+		return {
+			DocumentPermission: permissions.length,
+			OperationUserPermission: operations.length
+		};
+	}
+	/** Delete a document's protection row, which names its owner. */
+	async deleteDocumentProtection(documentId) {
+		return (await this.db.deleteFrom("DocumentProtection").where("documentId", "=", documentId).returning("documentId").execute()).length;
+	}
+	/** Every row that names the address, for a subject access request. */
+	async rowsForAddress(address) {
+		const lower = address.toLowerCase();
+		return {
+			permissions: await this.db.selectFrom("DocumentPermission").select([
+				"documentId",
+				"userAddress",
+				"permission",
+				"grantedBy",
+				"createdAt",
+				"updatedAt"
+			]).where((eb) => eb.or([eb("userAddress", "=", lower), eb("grantedBy", "=", lower)])).orderBy("documentId").execute(),
+			operationPermissions: await this.db.selectFrom("OperationUserPermission").select([
+				"documentId",
+				"operationType",
+				"userAddress",
+				"grantedBy",
+				"createdAt"
+			]).where((eb) => eb.or([eb("userAddress", "=", lower), eb("grantedBy", "=", lower)])).orderBy("documentId").execute(),
+			ownedDocumentIds: (await this.db.selectFrom("DocumentProtection").select("documentId").where("ownerAddress", "=", lower).orderBy("documentId").execute()).map((row) => row.documentId)
+		};
 	}
 	/**
 	* Grant a user permission to execute an operation on a document
@@ -7447,12 +9070,16 @@ function createGetParentIdsFn(reactorClient) {
 * Authorization gate for the /mcp endpoint (AUTH_REVIEW S-C1). MCP tools have
 * unrestricted reactor access, so access is limited to supreme admins when
 * auth is enabled. OPEN policy is public; any other policy without an
-* AuthService fails closed.
+* AuthService fails closed. The tools read as the caller: anonymous under OPEN,
+* else the admin's address and the app key its token carries.
 */
 function createMcpRequestAuthorizer(authService, authorizationService) {
 	return async (req) => {
 		if (!authService) {
-			if (authorizationService.config.policy === AuthorizationPolicy.OPEN) return { authorized: true };
+			if (authorizationService.config.policy === AuthorizationPolicy.OPEN) return {
+				authorized: true,
+				subject: {}
+			};
 			return {
 				authorized: false,
 				status: 401,
@@ -7475,10 +9102,39 @@ function createMcpRequestAuthorizer(authService, authorizationService) {
 			status: 403,
 			message: "Forbidden: MCP access requires an administrator"
 		};
-		return { authorized: true };
+		return {
+			authorized: true,
+			subject: {
+				address: context.user.address,
+				key: context.user.appKey
+			}
+		};
 	};
 }
 //#endregion
+//#region src/services/sync-serving-gate.ts
+/**
+* The gate sync serving evaluates a document's own policy through, deciding
+* what the reactor client's read gate decides at the same flag level.
+*
+* Under `authEnforcement` it is built here rather than taken off the client
+* because it also carries the host's closes-by-default setting, which withholds
+* the domain scopes of a document nobody has policied yet. That answer belongs
+* to serving alone -- replay must keep reading an uninitialized document in
+* full -- so the two gates are separate objects over the same model.
+*
+* Below it the registered model ignores the auth scope, so the client reads
+* through the policy alone, and so does serving: a policy written below the
+* flag still withholds, where serving ungated would sync to a peer what `get`
+* refuses it.
+*/
+function buildSyncServingGate(reactorModule, authorizationConfig, logger) {
+	if (!reactorModule) return;
+	const model = readDecisionModel(reactorModule.featureFlags, reactorModule.documentModelRegistry);
+	if (!model) return new SyncScopeGate(new BareReadGate(), reactorModule.documentView, logger);
+	return new SyncScopeGate(new ModelReadGate(model, reactorModule.documentView, reactorModule.featureFlags.authGroups, reactorModule.operationIndex, logger, { withholdUninitialized: authorizationConfig.defaultProtection }), reactorModule.documentView, logger);
+}
+//#endregion
 //#region src/services/renown-config.ts
 /** Reading credentials from this reactor's own read model needs a host-supplied
 * verifier: core has no idea which subgraph serves that read model. */
@@ -7660,10 +9316,36 @@ function assertSkipCredentialVerificationAllowed(resolvesCallerIdentity, skipCre
 * require-authenticated-caller middleware would reject every caller —
 * authenticated ones included. Refuse to boot rather than run broken.
 */
-function assertRequireAuthenticatedCallerAllowed(requireAuthenticatedCaller, resolvesCallerIdentity) {
+function assertRequireAuthenticatedCallerAllowed(requireAuthenticatedCaller, resolvesCallerIdentity, exemptPaths = []) {
+	/**
+	* An exemption is only ever a hole in this floor, so configuring one while
+	* the floor is off is not a harmless no-op: it reads, to anyone auditing the
+	* configuration, as a surface that was deliberately opened — and therefore
+	* as a floor that exists. Refuse rather than let the two drift.
+	*/
+	if (!requireAuthenticatedCaller && exemptPaths.length > 0) throw new Error("REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS is set but refused: REQUIRE_AUTHENTICATED_CALLER is off, so nothing is being exempted from anything and the configuration claims a protection the server is not applying. Enable the floor, or drop the exemptions.");
+	/**
+	* A path that cannot match anything is worse than no path: the operator
+	* believes the flow is reachable, and finds out when the first user cannot
+	* claim an invitation. `URL.pathname` is always absolute, so an entry that
+	* does not start with `/` never matches, whatever the router does.
+	*/
+	const relative = exemptPaths.filter((path) => !path.trim().startsWith("/"));
+	if (relative.length > 0) throw new Error(`REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS contains ${relative.map((path) => `"${path}"`).join(", ")}, which cannot match: an exempt path is compared against the request's pathname and must start with '/' (for example '/graphql/public').`);
 	if (!requireAuthenticatedCaller || resolvesCallerIdentity) return;
 	throw new Error("REQUIRE_AUTHENTICATED_CALLER is set but refused: it rejects every request without a resolved caller, and with neither AUTH_ENABLED nor RESOLVE_CALLER_IDENTITY the server never reads a bearer, so it would reject every caller, including authenticated ones. Enable identity resolution first (RESOLVE_CALLER_IDENTITY=true or AUTH_ENABLED=true).");
 }
+/**
+* Deciding an attachment read by the document's policy needs a policy model to
+* decide with, and that is what auth enforcement supplies. Without one there is
+* nothing to consult, so the setting would silently leave the permission tables
+* in charge — configuration that describes a protection the server is not
+* applying, which is worse than no configuration at all. Refuse instead.
+*/
+function assertAttachmentPolicyReadsAllowed(attachmentReadsFollowDocumentPolicy, hasDecisionModel) {
+	if (!attachmentReadsFollowDocumentPolicy || hasDecisionModel) return;
+	throw new Error("ATTACHMENT_READS_FOLLOW_DOCUMENT_POLICY is set but refused: deciding an attachment read by the referencing document's policy requires a policy model to evaluate, and this composition has none, so the host permission tables would keep deciding while the configuration says otherwise. Enable auth enforcement first (REACTOR_AUTH_ENFORCEMENT=true).");
+}
 function createReadinessGate() {
 	let ready = false;
 	return {
@@ -7718,27 +9400,6 @@ function makeDbClosers(knexInstance, pglite) {
 	return closers;
 }
 /**
-* The gate sync serving evaluates a document's own policy through, or undefined
-* when there is none to evaluate.
-*
-* It is built here rather than taken off the reactor client because it is not
-* the same gate reads use: it carries the host's closes-by-default setting,
-* which withholds the domain scopes of a document nobody has policied yet. That
-* answer belongs to serving alone -- replay must keep reading an uninitialized
-* document in full -- so the two gates are deliberately separate objects over
-* the same model.
-*
-* Undefined below `authEnforcement`, where the registered model ignores the auth
-* scope: gating through it would serve every domain scope of a policied document
-* to anyone, which is worse than not gating at all.
-*/
-function buildSyncServingGate(reactorModule, authorizationConfig, logger) {
-	if (!reactorModule) return;
-	const model = readDecisionModel(reactorModule.featureFlags, reactorModule.documentModelRegistry);
-	if (!model) return;
-	return new SyncScopeGate(new ModelReadGate(model, reactorModule.documentView, reactorModule.featureFlags.authGroups, reactorModule.operationIndex, logger, { withholdUninitialized: authorizationConfig.defaultProtection }), reactorModule.documentView, logger);
-}
-/**
 * Resolves the gateway adapter type from the `GATEWAY_ADAPTER` env var.
 * Defaults to "apollo" (the federation gateway, production behavior).
 * "stitching" selects the in-process graphql-tools merge gateway (#1565
@@ -7754,8 +9415,28 @@ function resolveGatewayAdapterType(logger) {
 /**
 * Sets up the subgraph manager and registers subgraphs
 */
-async function setupGraphQLManager(httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate, httpRoutes) {
-	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter(resolveGatewayAdapterType(logger), logger), authService, documentPermissionService, { enableDocumentModelSubgraphs }, port, authorizationService, reactorDriveClient, syncServingGate, httpRoutes);
+async function setupGraphQLManager({ httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate, httpRoutes, attachments }) {
+	const graphqlManager = new GraphQLManager({
+		path: config.basePath,
+		httpServer,
+		wsServer,
+		reactorClient: client,
+		relationalDb,
+		analyticsStore,
+		syncManager,
+		logger,
+		httpAdapter,
+		gatewayAdapter: await createGatewayAdapter(resolveGatewayAdapterType(logger), logger),
+		authService,
+		documentPermissionService,
+		featureFlags: { enableDocumentModelSubgraphs },
+		port,
+		authorizationService,
+		reactorDriveClient,
+		syncServingGate,
+		httpRoutes,
+		attachments
+	});
 	await graphqlManager.init(subgraphs.core, authFetchMiddleware, requireAuthFetchMiddleware);
 	for (const [packageName, collection] of subgraphs.extended.entries()) for (const subgraph of collection) await graphqlManager.registerSubgraph(subgraph, "graphql", false, packageName);
 	await graphqlManager.updateRouter();
@@ -7853,6 +9534,8 @@ async function _setupCommonInfrastructure(options) {
 	let authEnabled = false;
 	let configuredResolveIdentity;
 	let configuredRequireAuth;
+	let configuredExemptPaths;
+	let configuredAttachmentPolicyReads;
 	let configuredRenown;
 	if (options.configFile) {
 		const config = getConfig(options.configFile);
@@ -7864,8 +9547,10 @@ async function _setupCommonInfrastructure(options) {
 		authEnabled = options.auth.enabled;
 		configuredResolveIdentity = options.auth.resolveIdentity;
 		configuredRequireAuth = options.auth.requireAuthenticatedCaller;
+		configuredExemptPaths = options.auth.requireAuthenticatedCallerExemptPaths;
+		configuredAttachmentPolicyReads = options.auth.attachmentReadsFollowDocumentPolicy;
 	}
-	const { AUTH_ENABLED, RESOLVE_CALLER_IDENTITY, REQUIRE_AUTHENTICATED_CALLER, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION, CREDENTIAL_VERIFICATION_CACHE_TTL_MS } = process.env;
+	const { AUTH_ENABLED, RESOLVE_CALLER_IDENTITY, REQUIRE_AUTHENTICATED_CALLER, REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS, ATTACHMENT_READS_FOLLOW_DOCUMENT_POLICY, ADMINS, DEFAULT_PROTECTION, DOCUMENT_PERMISSIONS_ENABLED, SKIP_CREDENTIAL_VERIFICATION, CREDENTIAL_VERIFICATION_CACHE_TTL_MS } = process.env;
 	if (AUTH_ENABLED !== void 0) authEnabled = AUTH_ENABLED === "true";
 	/**
 	* Whether the auth middleware reads the bearer and populates `ctx.user`,
@@ -7896,6 +9581,30 @@ async function _setupCommonInfrastructure(options) {
 	*/
 	let requireAuthenticatedCaller = configuredRequireAuth ?? false;
 	if (REQUIRE_AUTHENTICATED_CALLER !== void 0) requireAuthenticatedCaller = REQUIRE_AUTHENTICATED_CALLER === "true";
+	/**
+	* The paths the floor above does not apply to. Comma-separated, like
+	* `ADMINS`, because a deployment configures this the same way it configures
+	* everything else: one variable, one line, however many values it has.
+	*
+	* Empty entries are dropped rather than refused, so a trailing comma or a
+	* value split across lines in a manifest is not a boot failure; a value that
+	* cannot ever match is refused, in
+	* {@link assertRequireAuthenticatedCallerAllowed}.
+	*/
+	let requireAuthenticatedCallerExemptPaths = configuredExemptPaths ?? [];
+	if (REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS !== void 0) requireAuthenticatedCallerExemptPaths = REQUIRE_AUTHENTICATED_CALLER_EXEMPT_PATHS.split(",").map((path) => path.trim()).filter((path) => path.length > 0);
+	/**
+	* Whether an attachment read is decided by the referencing document's own
+	* policy rather than by the host's permission tables.
+	*
+	* Off by default, and a deployment's choice rather than something derived
+	* from the flags around it. Which model governs those bytes is configuration
+	* in the same sense the storage backend behind them is: a host that has said
+	* nothing keeps exactly the behaviour it has, and one that wants the change
+	* asks for it and can take it back without disturbing anything else.
+	*/
+	let attachmentReadsFollowDocumentPolicy = configuredAttachmentPolicyReads ?? false;
+	if (ATTACHMENT_READS_FOLLOW_DOCUMENT_POLICY !== void 0) attachmentReadsFollowDocumentPolicy = ATTACHMENT_READS_FOLLOW_DOCUMENT_POLICY === "true";
 	if (ADMINS !== void 0) admins = ADMINS.split(",").map((a) => a.toLowerCase());
 	let defaultProtection = false;
 	if (DEFAULT_PROTECTION !== void 0) defaultProtection = DEFAULT_PROTECTION.toLowerCase() === "true";
@@ -7910,7 +9619,7 @@ async function _setupCommonInfrastructure(options) {
 	const documentPermissionsRequested = options.documentPermissionService !== void 0 || DOCUMENT_PERMISSIONS_ENABLED === "true";
 	assertAuthRequiredForDocumentPermissions(authEnabled, documentPermissionsRequested);
 	assertSkipCredentialVerificationAllowed(resolveCallerIdentity, skipCredentialVerification, process.env);
-	assertRequireAuthenticatedCallerAllowed(requireAuthenticatedCaller, resolveCallerIdentity);
+	assertRequireAuthenticatedCallerAllowed(requireAuthenticatedCaller, resolveCallerIdentity, requireAuthenticatedCallerExemptPaths);
 	if (authEnabled && skipCredentialVerification) logger.warn("SECURITY: SKIP_CREDENTIAL_VERIFICATION is enabled — Renown credential verification is disabled and a bearer token's claimed address is NOT cryptographically bound to its signing key. Identity is unverifiable; use only in development or test.");
 	httpAdapter.getRoute("/health", () => new Response("OK", { status: 200 }));
 	const readiness = createReadinessGate();
@@ -7946,8 +9655,8 @@ async function _setupCommonInfrastructure(options) {
 		});
 		authFetchMiddleware = createAuthFetchMiddleware(authService);
 		if (requireAuthenticatedCaller) {
-			requireAuthFetchMiddleware = createRequireAuthFetchMiddleware();
-			logger.info("Require-authenticated-caller middleware enabled: anonymous callers are rejected with a 401 before any subgraph");
+			requireAuthFetchMiddleware = createRequireAuthFetchMiddleware(requireAuthenticatedCallerExemptPaths);
+			logger.info(requireAuthenticatedCallerExemptPaths.length > 0 ? `Require-authenticated-caller middleware enabled: anonymous callers are rejected with a 401 before any subgraph, except on ${requireAuthenticatedCallerExemptPaths.join(", ")}` : "Require-authenticated-caller middleware enabled: anonymous callers are rejected with a 401 before any subgraph");
 		} else logger.warn("Anonymous callers are admitted on every transport, including WebSocket subscriptions: REQUIRE_AUTHENTICATED_CALLER is not set. The authorization policy gates the reactor's own documents, but a package-provided subgraph authorizes nothing on its own. Set REQUIRE_AUTHENTICATED_CALLER=true to refuse anonymous callers before any subgraph sees them.");
 	}
 	const dbClosers = [];
@@ -7972,7 +9681,7 @@ async function _setupCommonInfrastructure(options) {
 	await mkdir(attachmentStoragePath, { recursive: true });
 	const { db: attachmentDb, knex: attachmentKnex, pglite: attachmentPglite } = getDbClient(options.dbPath, options.pgliteFactory);
 	dbClosers.push(...makeDbClosers(attachmentKnex, attachmentPglite));
-	const ATTACHMENT_SWEEP_INTERVAL_MS = 3600 * 1e3;
+	const ATTACHMENT_SWEEP_INTERVAL_MS = 36e5;
 	const attachmentBackend = await createStartupAttachmentBackend({ db: attachmentDb });
 	const attachmentBuilder = new AttachmentBuilder(attachmentDb, attachmentStoragePath).withReservationSweepMs(ATTACHMENT_SWEEP_INTERVAL_MS);
 	if (attachmentBackend) attachmentBuilder.withBackend(attachmentBackend);
@@ -8008,6 +9717,7 @@ async function _setupCommonInfrastructure(options) {
 		httpRoutes,
 		authFetchMiddleware,
 		requireAuthFetchMiddleware,
+		authEnabled,
 		authService,
 		relationalDb,
 		analyticsStore,
@@ -8017,13 +9727,14 @@ async function _setupCommonInfrastructure(options) {
 		attachmentReferenceIndex,
 		packages,
 		dbClosers,
-		readiness
+		readiness,
+		attachmentReadsFollowDocumentPolicy
 	};
 }
 /**
 * Private helper function containing common setup logic for API initialization
 */
-async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient, syncServingGate, httpRoutes) {
+async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authEnabled, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient, syncServingGate, httpRoutes, attachmentReadsFollowDocumentPolicy = false) {
 	const hostModuleBase = {
 		...createReactorHostModuleBase({
 			client: reactorClient,
@@ -8048,7 +9759,7 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 			try {
 				return fn(moduleFor(packageName));
 			} catch (e) {
-				logger.error(`Error initializing processor factory for package ${packageName}:`, e);
+				logger.error("Error initializing processor factory for package @package: @error", packageName, e);
 				return null;
 			}
 		}))).filter((factory) => factory.status === "fulfilled" && factory.value !== null && typeof factory.value === "function");
@@ -8065,17 +9776,44 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	const { httpServer, wsServer } = await startServer(httpAdapter, port, options.https, logger);
 	const authorizationService = createAuthorizationService(authorizationConfig, documentPermissionService, createGetParentIdsFn(reactorClient));
 	logger.info(`Authorization service initialized (policy: ${authorizationConfig.policy})`);
-	const attachmentAccess = new AttachmentAccessService(createCanonicalDocumentIdResolver(reactorClient), authorizationService, attachmentReferenceIndex.store, attachmentReferenceProjection);
+	assertAttachmentPolicyReadsAllowed(attachmentReadsFollowDocumentPolicy, syncServingGate !== void 0);
+	const floor = requireAuthFetchMiddleware !== void 0;
+	const attachmentAccess = new AttachmentAccessService(createCanonicalDocumentIdResolver(reactorClient), authorizationService, attachmentReferenceIndex.store, attachmentReferenceProjection, reactorClient, attachmentReadsFollowDocumentPolicy ? syncServingGate : void 0, {
+		refuseAnonymousWrites: authEnabled || floor,
+		refuseAnonymousReads: floor
+	});
+	const attachmentClientProvider = new AttachmentClientProvider(attachments.service, attachmentAccess, logger);
 	const coreSubgraphs = DefaultCoreSubgraphs.slice();
 	coreSubgraphs.push(ReactorSubgraph);
 	if (documentPermissionService) {
 		coreSubgraphs.push(AuthSubgraph);
 		logger.info("Auth subgraph registered (document permissions enabled)");
 	}
-	const graphqlManager = await setupGraphQLManager(httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, {
-		extended: subgraphs,
-		core: coreSubgraphs
-	}, logger.child(["graphql-manager"]), authorizationService, authService, documentPermissionService, options.enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate, httpRoutes);
+	const graphqlManager = await setupGraphQLManager({
+		httpAdapter,
+		authFetchMiddleware,
+		requireAuthFetchMiddleware,
+		httpServer,
+		wsServer,
+		client: reactorClient,
+		relationalDb,
+		analyticsStore,
+		syncManager,
+		subgraphs: {
+			extended: subgraphs,
+			core: coreSubgraphs
+		},
+		logger: logger.child(["graphql-manager"]),
+		authorizationService,
+		authService,
+		documentPermissionService,
+		enableDocumentModelSubgraphs: options.enableDocumentModelSubgraphs,
+		port,
+		reactorDriveClient,
+		syncServingGate,
+		httpRoutes,
+		attachments: attachmentClientProvider
+	});
 	setupEventListeners(packages, graphqlManager, reactorProcessorManager, moduleFor, documentModelRegistry);
 	if (mcpServerEnabled) {
 		await setupMcpServer({
@@ -8101,7 +9839,11 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 		attachments,
 		attachmentReferenceIndex,
 		attachmentAccess,
+		attachmentClientProvider,
 		authService,
+		requireAuthenticatedCaller: floor,
+		authorizationService,
+		relationalDb,
 		dispose
 	};
 }
@@ -8148,7 +9890,7 @@ function buildApiDispose(args) {
 	};
 }
 async function initializeAndStartAPI(clientInitializer, options, processorApp) {
-	const { port, httpAdapter, httpRoutes, authFetchMiddleware, requireAuthFetchMiddleware, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, attachmentReferenceIndex, packages, dbClosers, readiness } = await _setupCommonInfrastructure(options);
+	const { port, httpAdapter, httpRoutes, authFetchMiddleware, requireAuthFetchMiddleware, authEnabled, authService, relationalDb, analyticsStore, documentPermissionService, authorizationConfig, attachments, attachmentReferenceIndex, packages, dbClosers, readiness, attachmentReadsFollowDocumentPolicy } = await _setupCommonInfrastructure(options);
 	const { documentModels, upgradeManifests, processors, subgraphs } = await packages.init();
 	const { module: reactorClientModule, reactorDriveClient, attachmentReferenceProjection = {
 		status: "unavailable",
@@ -8165,13 +9907,14 @@ async function initializeAndStartAPI(clientInitializer, options, processorApp) {
 	const documentModelRegistry = reactorClientModule.reactorModule?.documentModelRegistry;
 	if (!documentModelRegistry) throw new Error("DocumentModelRegistry not available from InProcessReactorClientModule");
 	return {
-		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient, buildSyncServingGate(reactorClientModule.reactorModule, authorizationConfig, options.logger ?? defaultLogger), httpRoutes),
+		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authEnabled, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient, buildSyncServingGate(reactorClientModule.reactorModule, authorizationConfig, options.logger ?? defaultLogger), httpRoutes, attachmentReadsFollowDocumentPolicy),
 		client: reactorClient,
 		syncManager,
 		documentModelRegistry,
 		readiness,
 		attachmentReferenceProjection,
-		packageManager: packages
+		packageManager: packages,
+		documentPermissionService
 	};
 }
 /**
@@ -8195,6 +9938,55 @@ function withScheme(origin) {
 	return /^https?:\/\//.test(trimmed) ? trimmed : `https://${trimmed}`;
 }
 //#endregion
+//#region src/services/privacy-permissions.ts
+/**
+* reactor-privacy's permission lookup and eraser, over this host's
+* DocumentPermissionService. Typed structurally on the privacy side.
+*/
+var PrivacyPermissionAdapter = class {
+	service;
+	constructor(service) {
+		this.service = service;
+	}
+	async rowsForAddress(address) {
+		const lower = address.toLowerCase();
+		const found = await this.service.rowsForAddress(address);
+		const rows = [];
+		for (const row of found.permissions) for (const column of ["userAddress", "grantedBy"]) {
+			if (row[column] !== lower) continue;
+			rows.push({
+				table: "DocumentPermission",
+				column,
+				documentId: row.documentId,
+				detail: { permission: row.permission }
+			});
+		}
+		for (const row of found.operationPermissions) for (const column of ["userAddress", "grantedBy"]) {
+			if (row[column] !== lower) continue;
+			rows.push({
+				table: "OperationUserPermission",
+				column,
+				documentId: row.documentId,
+				detail: { operationType: row.operationType }
+			});
+		}
+		for (const documentId of found.ownedDocumentIds) rows.push({
+			table: "DocumentProtection",
+			column: "ownerAddress",
+			documentId
+		});
+		return rows;
+	}
+	async erasePermissions(documentId) {
+		const permissions = await this.service.deleteAllDocumentPermissions(documentId);
+		const protection = await this.service.deleteDocumentProtection(documentId);
+		return {
+			...permissions,
+			DocumentProtection: protection
+		};
+	}
+};
+//#endregion
 //#region src/services/package-storage.ts
 var InMemoryPackageStorage = class {
 	packages = /* @__PURE__ */ new Map();
@@ -8298,7 +10090,7 @@ var PackageManagementService = class {
 	}
 };
 //#endregion
-export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessService, AuthDecision, AuthDecisionSchema, AuthService, AuthSubgraph, AuthorizationPolicy, AuthorizedDocumentHandle, BaseSubgraph, CORE_PACKAGE_NAME, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, EvaluateActionsDocument, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, HttpRouteService, ImportPackageLoader, InMemoryPackageStorage, InvalidNamespaceError, JobChangesDocument, MemoryWebhookStore, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PACKAGE_ROUTE_SEGMENT, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RelationalWebhookStore, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, WEBHOOK_SEGMENT, WS_AUTH_CLOSE_REASONS, WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE_REASON_BEARER_REJECTED, WebhookService, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertHostMountPath, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, createWsAuthHandlers, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, namespacePath, namespaceSegments, newWebhookToken, parseDriveUrl, parseWebhookBody, redactHeaders, renderGraphqlPlayground, resolvePackageName, resolveRenownConfig, verifyWebhook };
+export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessFailed, AttachmentAccessService, AttachmentAccessUnavailable, AttachmentClientProvider, AuthDecision, AuthDecisionSchema, AuthEvaluationUnsupportedError, AuthService, AuthSubgraph, AuthenticationRequiredError, AuthorizationPolicy, AuthorizedAttachmentService, AuthorizedDocumentHandle, BaseSubgraph, CORE_PACKAGE_NAME, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, DocumentRelationshipFieldsFragmentDoc, EvaluateActionsDocument, FindDocumentsDocument, ForbiddenError, GetDocumentDocument, GetDocumentIncomingRelationshipEdgesDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipEdgesDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, HttpRouteService, ImportPackageLoader, InMemoryPackageStorage, InvalidNamespaceError, JobChangesDocument, MalformedStoredOperationError, MemoryWebhookStore, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PACKAGE_ROUTE_SEGMENT, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PrivacyPermissionAdapter, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RefusalNotRecordedError, RelationalWebhookStore, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SyncRefusalInputSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, UpdateRelationshipDocument, ViewFilterInputSchema, WEBHOOK_SEGMENT, WS_AUTH_CLOSE_REASONS, WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE_REASON_BEARER_REJECTED, WebhookService, assertAttachmentPolicyReadsAllowed, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertHostMountPath, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, callerSubject, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, createWsAuthHandlers, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, namespacePath, namespaceSegments, newWebhookToken, parseDriveUrl, parseWebhookBody, piecesBaseUrl, redactHeaders, renderGraphqlPlayground, resolvePackageName, resolveRenownConfig, verifyWebhook };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=a15aa3df-1a6d-517d-93c4-3e8a84cefd09
+//# debugId=65e47e18-15f4-5a67-b94b-f6e795c1eb9b