@powerhousedao/reactor-api 6.2.3-dev.50 → 6.2.3-dev.52

package/dist/index.mjs

@@ -1,14 +1,14 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="dc27a51b-c565-5dcc-a85a-eac64c78db3e")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="980be7cc-16d9-5965-b60e-0c7ca7a4e3c8")}catch(e){}}();
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
-import { A as AuthenticationRequiredError, C as callerSubject, D as AuthorizedDocumentHandle, E as AuthorizationPolicy, M as MalformedStoredOperationError, N as RefusalNotRecordedError, O as createAuthorizationService, S as BaseSubgraph, T as createCanonicalDocumentIdResolver, b as loadSubgraphs, c as piecesFromListModule, d as buildGraphQlDriveDocument, f as buildGraphqlOperation, g as extractUpgradeManifests, h as debounce, i as PIECE_SOURCE_LIST, j as ForbiddenError, k as AuthEvaluationUnsupportedError, l as extractDocumentModels, m as isSubgraphClass, o as pieceListLocation, p as buildGraphqlOperations, s as piecesFromCdnList, t as extractSubgraphs, u as buildGraphQlDocument, v as loadDocumentModels, w as CanonicalDocumentIdResolutionError, x as manifestDeclaredSubgraphs, y as loadProcessors } from "./subgraph-extraction-DTFoN_bS.mjs";
+import { A as AuthenticationRequiredError, C as callerSubject, D as AuthorizedDocumentHandle, E as AuthorizationPolicy, M as MalformedStoredOperationError, N as RefusalNotRecordedError, O as createAuthorizationService, S as BaseSubgraph, T as createCanonicalDocumentIdResolver, b as loadSubgraphs, c as piecesFromListModule, d as buildGraphQlDriveDocument, f as buildGraphqlOperation, g as extractUpgradeManifests, h as debounce, i as PIECE_SOURCE_LIST, j as ForbiddenError, k as AuthEvaluationUnsupportedError, l as extractDocumentModels, m as isSubgraphClass, o as pieceListLocation, p as buildGraphqlOperations, s as piecesFromCdnList, t as extractSubgraphs, u as buildGraphQlDocument, v as loadDocumentModels, w as CanonicalDocumentIdResolutionError, x as manifestDeclaredSubgraphs, y as loadProcessors } from "./subgraph-extraction-sQlZLLPH.mjs";
 import { l as createDurableNodeFs, n as openCurrentPgliteForVerify, r as preparePgliteDataDir, u as resolvePgliteFsync } from "./pglite-node-Ow9i5Rb4.mjs";
 import { findPackageJSON, isBuiltin } from "node:module";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
-import { GraphQLError, Kind, Lexer, Source, TokenKind, parse, print, visit } from "graphql";
-import { AuthEnforcementDisabledError, BareReadGate, BatchJobFailedError, ChannelError, ChannelErrorSource, DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, JobStatus, ModelReadGate, PropagationMode as PropagationMode$1, SyncOperation, SyncScopeGate, consolidateSyncOperations, createReactorHostModuleBase, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl, readDecisionModel, supportsPurgeRefusals, syncOperationErrorType } from "@powerhousedao/reactor";
+import { GraphQLError, Kind, Lexer, OperationTypeNode, Source, TokenKind, parse, print, valueFromASTUntyped, visit } from "graphql";
+import { AuthEnforcementDisabledError, BareReadGate, BatchJobFailedError, ChannelError, ChannelErrorSource, DEFAULT_DRIVE_CONTAINER_TYPES, DriveCollectionId, DriveInspection, InvalidDeadLetterCursorError, JOB_NOT_FOUND_ERROR_NAME, JobStatus, ModelReadGate, PropagationMode as PropagationMode$1, READ_ONLY_ACCESS, SyncOperation, SyncScopeGate, consolidateSyncOperations, createReactorHostModuleBase, createReactorInspector, driveIdFromUrl, envelopesToSyncOperations, parseDriveUrl, readDecisionModel, supportsPurgeRefusals, syncOperationErrorType, toWireDeadLetter, toWireQueueState } from "@powerhousedao/reactor";
 import { deserializeSignature, readPeerManifest, serializeSignature, setName, withSignaturePolicy } from "@powerhousedao/shared/document-model";
 import { ConsoleLogger, childLogger, documentModelDocumentModelModule } from "document-model";
 import path, { isAbsolute, join } from "node:path";
@@ -44,6 +44,7 @@ import { setupMcpServer } from "@powerhousedao/reactor-mcp";
 import { tmpdir } from "node:os";
 import { WebSocketServer } from "ws";
 import { createRelationalDb } from "@powerhousedao/shared/processors";
+import { isAttachmentHash, readGateAllowsAttachmentRead, scopeGateAllowsAttachmentRead } from "@powerhousedao/reactor-attachments/replication";
 import { Kysely, Migrator, sql } from "kysely";
 import { fetchDelegationCredential, resolveSwitchboardEndpoint, verifyAuthBearerToken } from "@renown/sdk";
 import { PGlite } from "@electric-sql/pglite";
@@ -1290,8 +1291,10 @@ var WebhookService = class {
 				res.end(challenge);
 				return;
 			}
+			let recordedKey;
 			if (policy.dedupe) {
 				const key = dedupeKey(policy.dedupe.field, queryParams, headers, body);
+				recordedKey = key;
 				if (key !== void 0 && await this.#store.seen(token, key, policy.dedupe.ttlSeconds ?? DEFAULT_DEDUPE_TTL_SECONDS)) {
 					res.statusCode = 200;
 					res.end();
@@ -1307,6 +1310,11 @@ var WebhookService = class {
 				raw,
 				body
 			});
+			if (reply.unprocessed === true && recordedKey !== void 0) try {
+				await this.#store.forget(token, recordedKey);
+			} catch (error) {
+				logger$2.warn("Could not forget an unprocessed webhook delivery: @error", error);
+			}
 			res.statusCode = reply.status;
 			if (reply.body !== void 0 && method !== "HEAD") {
 				res.setHeader("content-type", reply.contentType ?? "text/plain");
@@ -1422,6 +1430,9 @@ var RelationalWebhookStore = class {
 	async revoke(namespace, endpoint, ownerKey) {
 		await this.#handle.deleteFrom("webhook_endpoints").where("namespace", "=", namespace).where("endpoint", "=", endpoint).where("owner_key", "=", ownerKey).execute();
 	}
+	async forget(token, key) {
+		await this.#handle.deleteFrom("webhook_deliveries").where("token", "=", token).where("dedupe_key", "=", key).execute();
+	}
 	async seen(token, key, ttlSeconds) {
 		const now = Date.now();
 		const nowIso = new Date(now).toISOString();
@@ -1470,6 +1481,10 @@ var MemoryWebhookStore = class {
 	find(token) {
 		return Promise.resolve(this.#byToken.get(token));
 	}
+	forget(token, key) {
+		this.#deliveries.delete(`${token}|${key}`);
+		return Promise.resolve();
+	}
 	list(namespace, endpoint) {
 		return Promise.resolve([...this.#byToken.values()].filter((row) => row.namespace === namespace && (endpoint === void 0 || row.endpoint === endpoint)));
 	}
@@ -2651,6 +2666,19 @@ const GetJobStatusDocument = gql`
   }
   ${JobInfoFieldsFragmentDoc}
 `;
+const GetDocumentServedDocument = gql`
+  query GetDocumentServed($idOrSlug: String!, $view: ViewFilterInput) {
+    documentServed(idOrSlug: $idOrSlug, view: $view)
+  }
+`;
+const GetCreateDefaultsDocument = gql`
+  query GetCreateDefaults($parentIdOrSlug: String) {
+    createDefaults(parentIdOrSlug: $parentIdOrSlug) {
+      signaturePolicy
+      protocolVersions
+    }
+  }
+`;
 const EvaluateActionsDocument = gql`
   query EvaluateActions(
     $documentIdentifier: String!
@@ -3026,6 +3054,12 @@ function getSdk(requester) {
 		GetJobStatus(variables, options) {
 			return requester(GetJobStatusDocument, variables, options);
 		},
+		GetDocumentServed(variables, options) {
+			return requester(GetDocumentServedDocument, variables, options);
+		},
+		GetCreateDefaults(variables, options) {
+			return requester(GetCreateDefaultsDocument, variables, options);
+		},
 		EvaluateActions(variables, options) {
 			return requester(EvaluateActionsDocument, variables, options);
 		},
@@ -3527,6 +3561,14 @@ async function readAsCaller(reactorClient, document, subject, branch) {
 		throw new GraphQLError(`Failed to read the document back: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
 }
+/** The defaults `create` gives a new document; the parent must already be gated. */
+async function createDefaults(reactorClient, parentIdOrSlug) {
+	const [signaturePolicy, protocolVersions] = await Promise.all([reactorClient.getCreateSignaturePolicy(), reactorClient.getCreateProtocolVersions(parentIdOrSlug)]);
+	return {
+		signaturePolicy,
+		protocolVersions
+	};
+}
 async function documentModels(reactorClient, args) {
 	const namespace = fromInputMaybe(args.namespace);
 	let paging;
@@ -3727,7 +3769,7 @@ function unknownJob(jobId) {
 		createdAtUtcIso: now,
 		completedAtUtcIso: now,
 		error: {
-			name: "Error",
+			name: JOB_NOT_FOUND_ERROR_NAME,
 			message: "Job not found",
 			stack: ""
 		},
@@ -4602,12 +4644,9 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 	}
 	/** Drops the items the host's own ACL refuses the caller. */
 	async #readableItems(page, ctx) {
-		if (this.authorizationService.isSupremeAdmin(ctx.user?.address)) return page;
-		const items = [];
-		for (const item of page.items) if (await this.canReadDocument(item.id, ctx)) items.push(item);
 		return {
 			...page,
-			items
+			items: await this.readableByHost(page.items, ctx)
 		};
 	}
 	/**
@@ -4816,11 +4855,13 @@ function getRequestDriveId(request) {
 *
 * - No header → pass through. The LB has already round-robined; nothing
 *   to validate here.
-* - Header present and drive in cache → record on the request map (for
-*   the context factory to read into `context.driveId`) and pass through.
-* - Header present, drive missing, but the operation is `createDocument`
-*   or `createEmptyDocument` → pass through. The drive may be in the
-*   process of being created.
+* - Header present and the drive held here (the cache, else the reactor) →
+*   record on the request map (for the context factory to read into
+*   `context.driveId`) and pass through. A failed lookup passes through.
+* - Header present, drive missing, but the operation is named
+*   `createDocument` or `createEmptyDocument`, or it creates, with no
+*   parent, the very drive the header names → pass through. The drive is
+*   being created.
 * - Otherwise → return `421 Misdirected Request` with a structured body.
 *   The client (or LB) can surface this as a wrong-shard signal.
 */
@@ -4828,25 +4869,59 @@ function createDriveFetchMiddleware(cache) {
 	return (next) => async (request) => {
 		const driveId = request.headers.get(DRIVE_ID_HEADER) ?? "";
 		if (driveId === "") return next(request);
-		if (cache.has(driveId)) {
+		let held;
+		try {
+			held = await cache.holds(driveId);
+		} catch {
+			return next(request);
+		}
+		if (held) {
 			driveIdMap.set(request, driveId);
 			return next(request);
 		}
-		if (await isCacheBypassOperation(request)) return next(request);
+		if (await isCacheBypassOperation(request, driveId)) return next(request);
 		return wrongShardResponse(driveId);
 	};
 }
-async function isCacheBypassOperation(request) {
+async function isCacheBypassOperation(request, driveId) {
 	if (request.method !== "POST") return false;
 	try {
 		const body = await request.clone().json();
-		if (typeof body.operationName === "string") return CACHE_BYPASS_OPERATIONS.has(body.operationName);
-		if (typeof body.query === "string") return CACHE_BYPASS_OPERATIONS.has(extractOperationName(body.query));
-		return false;
+		const operationName = typeof body.operationName === "string" ? body.operationName : void 0;
+		if (operationName !== void 0) {
+			if (CACHE_BYPASS_OPERATIONS.has(operationName)) return true;
+		} else if (typeof body.query === "string" && CACHE_BYPASS_OPERATIONS.has(extractOperationName(body.query))) return true;
+		return typeof body.query === "string" && createsTheNamedDrive(body.query, operationName, isRecord(body.variables) ? body.variables : {}, driveId);
 	} catch {
 		return false;
 	}
 }
+/**
+* Whether the operation does nothing but create, with no parent, the drive the
+* Drive-Id names: whatever the client named it (reactor-browser sends
+* `CreateDocument`), and with the document resolved through its variables.
+*/
+function createsTheNamedDrive(query, operationName, variables, driveId) {
+	const operations = parse(query).definitions.filter((definition) => definition.kind === Kind.OPERATION_DEFINITION);
+	const operation = operationName === void 0 ? operations.length === 1 ? operations[0] : void 0 : operations.find((candidate) => candidate.name?.value === operationName);
+	if (!operation || operation.operation !== OperationTypeNode.MUTATION || operation.selectionSet.selections.length !== 1) return false;
+	const [field] = operation.selectionSet.selections;
+	if (field.kind !== Kind.FIELD || field.name.value !== "createDocument") return false;
+	const argument = (name) => {
+		const node = field.arguments?.find((arg) => arg.name.value === name);
+		return node ? valueFromASTUntyped(node.value, variables) : void 0;
+	};
+	if (PARENT_ARGUMENTS.some((name) => {
+		const parent = argument(name);
+		return parent !== void 0 && parent !== null;
+	})) return false;
+	const header = argument("document")?.header;
+	return isRecord(header) && header.id === driveId && typeof header.documentType === "string" && DEFAULT_DRIVE_CONTAINER_TYPES.has(header.documentType);
+}
+const PARENT_ARGUMENTS = ["parentIdOrSlug", "parentIdentifier"];
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 const OPERATION_NAME_PATTERN = /\b(?:mutation|query|subscription)\s+(\w+)/;
 function extractOperationName(query) {
 	const match = OPERATION_NAME_PATTERN.exec(query);
@@ -4874,15 +4949,15 @@ function wrongShardResponse(driveId) {
 * 421 response.
 */
 var DriveOwnershipCache = class {
-	reactorClient;
+	store;
 	drives = /* @__PURE__ */ new Set();
-	constructor(reactorClient) {
-		this.reactorClient = reactorClient;
+	constructor(store) {
+		this.store = store;
 	}
 	async init() {
 		this.drives.clear();
 		for (const driveType of DEFAULT_DRIVE_CONTAINER_TYPES) {
-			let page = await this.reactorClient.find({ type: driveType });
+			let page = await this.store.find({ type: driveType });
 			while (true) {
 				for (const drive of page.results) this.drives.add(drive.header.id);
 				if (!page.next) break;
@@ -4893,6 +4968,17 @@ var DriveOwnershipCache = class {
 	has(driveId) {
 		return this.drives.has(driveId);
 	}
+	/**
+	* Whether this host holds the drive, asking the reactor on a miss: drives
+	* also arrive by sync and by writes that bypass the create resolvers. A
+	* positive answer is cached; a failure to ask throws.
+	*/
+	async holds(driveId) {
+		if (this.drives.has(driveId)) return true;
+		const held = (await this.store.find({ ids: [driveId] })).results.some((document) => document.header.id === driveId && DEFAULT_DRIVE_CONTAINER_TYPES.has(document.header.documentType));
+		if (held) this.drives.add(driveId);
+		return held;
+	}
 	add(driveId) {
 		this.drives.add(driveId);
 	}
@@ -5043,6 +5129,7 @@ var GraphQLManager = class {
 	syncServingGate;
 	httpRoutes;
 	attachments;
+	inspection;
 	constructor(options) {
 		this.path = options.path;
 		this.httpServer = options.httpServer;
@@ -5063,7 +5150,8 @@ var GraphQLManager = class {
 		this.syncServingGate = options.syncServingGate;
 		this.httpRoutes = options.httpRoutes;
 		this.attachments = options.attachments;
-		this.driveOwnershipCache = new DriveOwnershipCache(this.reactorClient);
+		this.inspection = options.inspection;
+		this.driveOwnershipCache = new DriveOwnershipCache(options.driveStore ?? this.reactorClient);
 		this.wsServer.setMaxListeners(0);
 	}
 	async init(coreSubgraphs, authMiddleware, requireAuthMiddleware) {
@@ -5158,7 +5246,8 @@ var GraphQLManager = class {
 					documentPermissionService: this.documentPermissionService,
 					authorizationService: this.authorizationService,
 					syncServingGate: this.syncServingGate,
-					attachments: this.attachments
+					attachments: this.attachments,
+					inspection: this.inspection
 				});
 				await this.#addSubgraphInstance(subgraphInstance, supergraph, false, DOCUMENT_MODEL_SUBGRAPH_SOURCE);
 				registeredNames.add(subgraphInstance.name);
@@ -5296,7 +5385,8 @@ var GraphQLManager = class {
 			documentPermissionService: this.documentPermissionService,
 			authorizationService: this.authorizationService,
 			syncServingGate: this.syncServingGate,
-			attachments: this.attachments
+			attachments: this.attachments,
+			inspection: this.inspection
 		});
 		return this.#addSubgraphInstance(subgraphInstance, supergraph, core, packageName);
 	}
@@ -5616,6 +5706,453 @@ var GraphQLManager = class {
 	}
 };
 //#endregion
+//#region src/graphql/inspection/resolvers.ts
+function operatorRequired() {
+	return new ForbiddenError("to read the reactor's operational state");
+}
+function noSyncInspector() {
+	return new GraphQLError("This host does not serve sync inspection");
+}
+function toOrdinal(value) {
+	return Number(value);
+}
+function toWireDrive(drive) {
+	return {
+		...drive,
+		icon: drive.icon ?? null
+	};
+}
+function toWireProcessor(info) {
+	return {
+		processorId: info.processorId,
+		factoryId: info.factoryId,
+		driveId: info.driveId,
+		processorIndex: info.processorIndex,
+		lastOrdinal: toOrdinal(info.lastOrdinal),
+		status: info.status,
+		lastError: info.lastError ?? null,
+		lastErrorTimestampUtcMs: info.lastErrorTimestamp ? info.lastErrorTimestamp.getTime() : null
+	};
+}
+function toWireCursor(cursor) {
+	return {
+		cursorType: cursor.cursorType,
+		cursorOrdinal: toOrdinal(cursor.cursorOrdinal),
+		lastSyncedAtUtcMs: cursor.lastSyncedAtUtcMs ?? null,
+		liveAckOrdinal: toOrdinal(cursor.liveAckOrdinal),
+		liveLatestOrdinal: toOrdinal(cursor.liveLatestOrdinal)
+	};
+}
+function toWireRemotes(inspections, remotes) {
+	const byName = new Map(remotes.map((remote) => [remote.meta.name, remote]));
+	return inspections.map((inspection) => ({
+		remoteName: inspection.remoteName,
+		remoteId: inspection.remoteId,
+		inboxCursor: toWireCursor(inspection.inboxCursor),
+		outboxCursor: toWireCursor(inspection.outboxCursor),
+		mailboxDepths: inspection.mailboxDepths,
+		connection: {
+			snapshot: inspection.connection.snapshot,
+			neverSucceeded: inspection.connection.neverSucceeded,
+			stalenessMs: inspection.connection.stalenessMs ?? null
+		},
+		meta: byName.get(inspection.remoteName)?.meta ?? {
+			id: inspection.remoteId,
+			name: inspection.remoteName
+		}
+	}));
+}
+function servedIssues(result, scopes) {
+	const keyframeIssues = result.keyframeIssues.filter((i) => scopes.has(i.scope));
+	const snapshotIssues = result.snapshotIssues.filter((i) => scopes.has(i.scope));
+	const streamOrderIssues = result.streamOrderIssues.filter((i) => scopes.has(i.scope));
+	return {
+		documentId: result.documentId,
+		isConsistent: keyframeIssues.length === 0 && snapshotIssues.length === 0 && streamOrderIssues.length === 0,
+		keyframeIssues,
+		snapshotIssues,
+		streamOrderIssues
+	};
+}
+/** The read half of the inspection surface; no lever has a field here. */
+function createInspectionResolvers(source, sync, gate) {
+	const inspector = source.inspector;
+	const operator = (run) => (_parent, args, ctx) => {
+		if (!gate.isOperator(ctx)) throw operatorRequired();
+		return run(args);
+	};
+	const syncInspector = () => {
+		if (!source.syncInspector) throw noSyncInspector();
+		return source.syncInspector;
+	};
+	const accessFor = (ctx, access) => gate.isOperator(ctx) ? access : null;
+	return {
+		Query: { inspection: () => ({}) },
+		ReactorInspection: {
+			info: async (_parent, _args, ctx) => {
+				const info = await inspector.info();
+				return {
+					...info,
+					access: accessFor(ctx, info.access)
+				};
+			},
+			documentModels: () => inspector.listDocumentModels(),
+			drives: async (_parent, args, ctx) => {
+				const page = await new DriveInspection(gate.readerFor(ctx), source.documentModelRegistry).listDrives(args.cursor ?? void 0, args.limit ?? void 0);
+				const readable = await gate.readableIds(page.results.map((drive) => drive.driveId), ctx);
+				return {
+					results: page.results.filter((drive) => readable.has(drive.driveId)).map(toWireDrive),
+					nextCursor: page.nextCursor ?? null
+				};
+			},
+			driveIntegrity: async (_parent, args, ctx) => {
+				const identifier = await gate.assertCanRead(args.driveId, ctx);
+				const served = await gate.servedDocument(identifier, args.branch, ctx);
+				if (!served) throw new ForbiddenError("to read this document");
+				return new DriveInspection(gate.readerFor(ctx), source.documentModelRegistry).checkDriveIntegrity(served.id, args.branch);
+			},
+			attachmentInfo: operator(async () => {
+				const info = await inspector.getAttachmentInfo();
+				return {
+					...info,
+					lastError: info.lastError ?? null
+				};
+			}),
+			queueState: operator(async () => toWireQueueState(await inspector.getQueueState())),
+			processors: operator(async () => (await inspector.getProcessors()).map(toWireProcessor)),
+			catchUpStatus: operator(() => inspector.getCatchUpStatus()),
+			storageHealth: operator(() => inspector.getStorageHealth()),
+			validateDocument: async (_parent, args, ctx) => {
+				const branch = args.branch ?? void 0;
+				const identifier = await gate.assertCanRead(args.documentId, ctx);
+				const served = await gate.servedDocument(identifier, branch, ctx);
+				if (!served) throw new ForbiddenError("to read this document");
+				return servedIssues(await inspector.validateDocument(served.id, branch), served.scopes);
+			},
+			remotes: operator(async () => toWireRemotes(await syncInspector().inspectRemotes(), sync.list())),
+			remote: operator(async (args) => {
+				return toWireRemotes([await syncInspector().inspectRemote(args.remoteName)], sync.list())[0];
+			}),
+			deadLetters: operator(async (args) => {
+				let page;
+				try {
+					page = await syncInspector().listDeadLetters(args.remoteName, args.cursor ?? void 0, args.limit ?? void 0);
+				} catch (error) {
+					if (error instanceof InvalidDeadLetterCursorError) throw new GraphQLError(error.message, { extensions: { code: "BAD_USER_INPUT" } });
+					throw error;
+				}
+				return {
+					remoteName: page.remoteName,
+					results: page.results.map(toWireDeadLetter),
+					nextCursor: page.nextCursor ?? null
+				};
+			})
+		}
+	};
+}
+//#endregion
+//#region src/graphql/inspection/schema.ts
+const inspectionTypeDefs = gql`
+  type ReactorStorageFacts {
+    engine: String!
+    persistence: String!
+    durable: Boolean!
+    selfHeal: Boolean!
+  }
+
+  type InspectorAccess {
+    admin: Boolean!
+    sql: Boolean!
+  }
+
+  """
+  What this reactor reports about itself. access is null unless the caller is
+  one of the host's admins.
+  """
+  type ReactorInfo {
+    storage: ReactorStorageFacts!
+    workflows: Boolean!
+    syncChannels: [String!]!
+    access: InspectorAccess
+  }
+
+  type InspectionDocumentModel {
+    documentType: String!
+    name: String!
+    version: Int!
+    supportedVersions: [Int!]!
+  }
+
+  type InspectionDrive {
+    driveId: String!
+    name: String!
+    branch: String!
+    collectionId: String!
+    documentType: String!
+    nodeCount: Int!
+    fileCount: Int!
+    folderCount: Int!
+    otherNodeCount: Int!
+    unreadableNodeCount: Int!
+    icon: String
+  }
+
+  type InspectionDrivePage {
+    results: [InspectionDrive!]!
+    nextCursor: String
+  }
+
+  type InspectionDriveIntegrityRef {
+    id: String!
+    documentType: String!
+  }
+
+  type InspectionDriveIntegrity {
+    driveId: String!
+    checkedNodeCount: Int!
+    totalFileNodeCount: Int!
+    """
+    File nodes whose document is missing or not served to you; the two are
+    reported alike so a withheld document's existence does not leak.
+    """
+    missingDocuments: [InspectionDriveIntegrityRef!]!
+    unsupportedTypes: [InspectionDriveIntegrityRef!]!
+  }
+
+  type InspectionAttachmentInfo {
+    present: Boolean!
+    storeKind: String!
+    hasReplicator: Boolean!
+    replicatorRunning: Boolean!
+    backlogScanned: Boolean!
+    refsSeen: Int!
+    held: Int!
+    bytesHeld: Float!
+    queued: Int!
+    fetching: Int!
+    pendingFetches: Int!
+    waiting: Int!
+    notFound: Int!
+    failed: Int!
+    lastError: String
+  }
+
+  """
+  A queued job without its actions or operations.
+  """
+  type InspectionQueueJob {
+    id: String!
+    kind: String!
+    documentId: String!
+    scope: String!
+    branch: String!
+    status: String!
+    actionCount: Int!
+    operationCount: Int!
+    retryCount: Int!
+  }
+
+  type InspectionQueueState {
+    isPaused: Boolean!
+    totalPending: Int!
+    totalExecuting: Int!
+    pendingJobs: [InspectionQueueJob!]!
+    executingJobs: [InspectionQueueJob!]!
+  }
+
+  type InspectionProcessor {
+    processorId: String!
+    factoryId: String!
+    driveId: String!
+    processorIndex: Int!
+    lastOrdinal: Float!
+    status: String!
+    lastError: String
+    lastErrorTimestampUtcMs: Float
+  }
+
+  """
+  healthy means something only when tracked; an untracked store reports false.
+  """
+  type InspectionStorageHealth {
+    tracked: Boolean!
+    healthy: Boolean!
+    everRecreated: Boolean!
+    recreateCount: Int!
+  }
+
+  """
+  Issues in scopes the caller may not read are left out.
+  """
+  type InspectionValidation {
+    documentId: String!
+    isConsistent: Boolean!
+    keyframeIssues: [JSONObject!]!
+    snapshotIssues: [JSONObject!]!
+    streamOrderIssues: [JSONObject!]!
+  }
+
+  type InspectionCursor {
+    cursorType: String!
+    cursorOrdinal: Float!
+    lastSyncedAtUtcMs: Float
+    liveAckOrdinal: Float!
+    liveLatestOrdinal: Float!
+  }
+
+  type InspectionMailboxDepths {
+    inbox: Int!
+    outbox: Int!
+    deadLetter: Int!
+  }
+
+  type InspectionConnectionHealth {
+    snapshot: JSONObject!
+    neverSucceeded: Boolean!
+    stalenessMs: Float
+  }
+
+  type InspectionRemote {
+    remoteName: String!
+    remoteId: String!
+    inboxCursor: InspectionCursor!
+    outboxCursor: InspectionCursor!
+    mailboxDepths: InspectionMailboxDepths!
+    connection: InspectionConnectionHealth!
+    meta: JSONObject!
+  }
+
+  """
+  A dead letter without its operations.
+  """
+  type InspectionDeadLetter {
+    id: String!
+    jobId: String!
+    documentId: String!
+    branch: String!
+    scopes: [String!]!
+    errorType: String!
+    errorMessage: String!
+    operationCount: Int!
+  }
+
+  type InspectionDeadLetterPage {
+    remoteName: String!
+    results: [InspectionDeadLetter!]!
+    nextCursor: String
+  }
+
+  """
+  Reads only. info and documentModels serve every caller; drive and document
+  reads are made as the caller through the reactor read gate; the rest need
+  one of the host's admins.
+  """
+  type ReactorInspection {
+    info: ReactorInfo!
+    documentModels: [InspectionDocumentModel!]!
+    drives(cursor: String, limit: Int): InspectionDrivePage!
+    driveIntegrity(driveId: String!, branch: String!): InspectionDriveIntegrity!
+    attachmentInfo: InspectionAttachmentInfo!
+    queueState: InspectionQueueState!
+    processors: [InspectionProcessor!]!
+    catchUpStatus: JSONObject!
+    storageHealth: InspectionStorageHealth!
+    """
+    Replays the whole document; expensive.
+    """
+    validateDocument(documentId: String!, branch: String): InspectionValidation!
+    remotes: [InspectionRemote!]!
+    remote(remoteName: String!): InspectionRemote!
+    deadLetters(
+      remoteName: String!
+      cursor: String
+      limit: Int
+    ): InspectionDeadLetterPage!
+  }
+
+  type Query {
+    inspection: ReactorInspection!
+  }
+`;
+//#endregion
+//#region src/graphql/inspection/source.ts
+function createReactorInspectionSource(module, options = {}) {
+	const inspector = createReactorInspector(module, {
+		storageHealth: options.storageHealth,
+		attachmentStore: options.attachmentStore,
+		workflows: options.workflows,
+		access: READ_ONLY_ACCESS
+	});
+	return {
+		inspector,
+		syncInspector: module.syncModule?.syncInspector,
+		documentModelRegistry: module.documentModelRegistry,
+		facts: inspector
+	};
+}
+//#endregion
+//#region src/graphql/inspection/subgraph.ts
+function isListedAdmin(config, address) {
+	if (!address) return false;
+	const caller = address.toLowerCase();
+	return config.admins.some((admin) => admin.toLowerCase() === caller);
+}
+/** The read half of the reactor's inspection surface. */
+var InspectionSubgraph = class extends BaseSubgraph {
+	name = "inspection";
+	hasSubscriptions = false;
+	typeDefs = inspectionTypeDefs;
+	resolvers;
+	constructor(args) {
+		super(args);
+		if (!args.inspection) throw new Error("InspectionSubgraph requires an inspection source; the host did not provide one");
+		this.resolvers = createInspectionResolvers(args.inspection, this.syncManager, this.callerGate());
+	}
+	callerGate() {
+		return {
+			isOperator: (ctx) => isListedAdmin(this.authorizationService.config, ctx.user?.address),
+			readerFor: (ctx) => this.readerFor(ctx),
+			assertCanRead: async (identifier, ctx) => (await this.assertCanRead(identifier, ctx)).fetchIdentifier,
+			readableIds: async (ids, ctx) => {
+				const readable = await this.readableByHost(ids.map((id) => ({ id })), ctx);
+				return new Set(readable.map((item) => item.id));
+			},
+			servedDocument: (identifier, branch, ctx) => this.servedDocument(identifier, branch, ctx)
+		};
+	}
+	readerFor(ctx) {
+		const subject = this.viewSubject(ctx);
+		return {
+			find: (search, view, paging) => this.reactorClient.find(search, {
+				...view,
+				subject
+			}, paging),
+			get: (id, view) => this.reactorClient.get(id, {
+				...view,
+				subject
+			})
+		};
+	}
+	async servedDocument(identifier, branch, ctx) {
+		const view = {
+			branch,
+			subject: this.viewSubject(ctx)
+		};
+		let served;
+		try {
+			served = await this.reactorClient.isServed(identifier, view);
+		} catch {
+			return;
+		}
+		if (!served) return;
+		const document = await this.reactorClient.get(identifier, view);
+		return {
+			id: document.header.id,
+			scopes: new Set(Object.keys(document.state ?? {}))
+		};
+	}
+};
+//#endregion
 //#region src/graphql/packages/resolvers.ts
 function requireAdmin(authorizationService, ctx) {
 	if (!authorizationService.isSupremeAdmin(ctx.user?.address)) throw new GraphQLError("Admin access required");
@@ -6009,6 +6546,10 @@ const DocumentChangeEventDTO = z.object({
 	documents: z.array(PHDocumentDTO),
 	context: DocumentChangeContextDTO.nullable().optional()
 }).strip();
+const CreateDefaultsDTO = z.object({
+	signaturePolicy: z.string(),
+	protocolVersions: JSONObjectDTO
+}).strip();
 const ActionEvaluationDTO = z.object({
 	decision: z.enum(["ALLOW", "DENY"]),
 	reason: z.string().nullable().optional()
@@ -6059,6 +6600,10 @@ const operationValidators = {
 	GetJobStatus: (data) => {
 		if (data.jobStatus) JobInfoFieldsDTO.parse(data.jobStatus);
 	},
+	GetDocumentServed: () => {},
+	GetCreateDefaults: (data) => {
+		if (data.createDefaults) CreateDefaultsDTO.parse(data.createDefaults);
+	},
 	EvaluateActions: (data) => {
 		if (data.evaluateActions) ActionEvaluationsDTO.parse(data.evaluateActions);
 	},
@@ -6130,7 +6675,7 @@ function createReactorGraphQLClient(url, fetchImpl = fetch, headers) {
 }
 //#endregion
 //#region src/graphql/reactor/schema.graphql
-var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n    @deprecated(reason: \"Ignored. Filter by type or parentId.\")\n}\n\ninput OperationsFilterInput {\n  documentIdOrSlug: String\n  documentId: String @deprecated(reason: \"Use documentIdOrSlug.\")\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  meta: JSONObject\n  protocolVersions: JSONObject\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\n# A directed edge between two documents, with the metadata recorded against it.\ntype DocumentRelationship {\n  sourceId: String!\n  targetId: String!\n  relationshipType: String!\n  metadata: JSONObject\n  createdAt: DateTime!\n  updatedAt: DateTime!\n}\n\ntype DocumentRelationshipResultPage {\n  items: [DocumentRelationship!]!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  \"\"\"\n  How the origin classified the failure. A peer needs this to mirror the origin's\n  quarantine decision; without it a held auth operation would freeze the document\n  on the peer side while the origin kept syncing.\n  \"\"\"\n  errorType: String\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n  # The server's current manifest revision\n  manifestRevision: String\n  # The client's manifest revision as the server holds it\n  peerManifestRevision: String\n}\n\ntype SyncHoldReason {\n  protocol: String!\n  version: Int!\n  peerSupports: [Int!]!\n}\n\n# A document held back from a remote whose peer cannot run its versions\ntype SyncHold {\n  remoteName: String!\n  documentId: String!\n  branch: String!\n  reason: SyncHoldReason!\n  heldAtUtcMs: String!\n}\n\ntype PeerAgreementMember {\n  remoteName: String!\n  # False for a peer that announced nothing: it gets the baselines\n  announced: Boolean!\n  protocols: JSONObject!\n  features: JSONObject!\n}\n\ntype PeerAgreementLimit {\n  protocol: String!\n  # The remotes whose peers lack the version new documents would take\n  remoteNames: [String!]!\n}\n\ntype PeerAgreement {\n  collectionId: String!\n  local: JSONObject!\n  members: [PeerAgreementMember!]!\n  limitedBy: [PeerAgreementLimit!]!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype ConsistencyCoordinate {\n  documentId: String!\n  scope: String!\n  branch: String!\n  operationIndex: Int!\n}\n\n\"\"\"\nThe write positions a job reached, for read-after-write. Only meaningful once\nthe job has completed.\n\"\"\"\ntype ConsistencyToken {\n  version: Int!\n  createdAtUtcIso: String!\n  coordinates: [ConsistencyCoordinate!]!\n}\n\n\"The batch a job was submitted in.\"\ntype JobBatchMeta {\n  batchId: String!\n  batchJobIds: [String!]!\n}\n\ntype JobInfo {\n  id: String!\n\n  \"\"\"\n  The document the job operates on. Empty for a job this server does not know,\n  which then comes back FAILED with \"Job not found\".\n  \"\"\"\n  documentId: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Null until then, which\n  is the state every job is in when it is handed back from a submission.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n\n  \"The error's class name, such as `DocumentAlreadyExistsError`, when it failed.\"\n  errorName: String\n  createdAt: DateTime!\n  completedAt: DateTime\n  consistencyToken: ConsistencyToken!\n  meta: JobBatchMeta!\n}\n\n\"\"\"\nOne job's outcome within a batch, pairing the plan key the caller gave with the\njob that applied it. Mirrors one entry of the `Record<string, JobInfo>` that\n`IReactor.executeBatch` returns (packages/reactor/src/core/types.ts).\n\"\"\"\ntype BatchJobResult {\n  key: String!\n  job: JobInfo!\n}\n\n\"\"\"\nThe outcome of a batch mutation, one entry per job the request named. The wire\nshape of `BatchExecutionResult` (`{ jobs }`), keyed on each entry by the plan\nkey rather than by position so the client can rebuild the record. The batch is\nnot atomic: each job commits on its own and a failed job releases its\ndependents, so each entry's status says what happened to that job, and\nre-submitting re-applies the jobs that succeeded.\n\"\"\"\ntype BatchExecutionResult {\n  jobs: [BatchJobResult!]!\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Nullable for the same\n  reason as `JobInfo.result`: a job that has not written yet has produced\n  nothing, and an empty object would claim otherwise.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n\"\"\"\nOne operation an authorization preflight predicts a verdict for.\n\n`input` is what a conditional grant reads, so a candidate standing for a\nfilled-in form carries that form's input. Omitting it predicts the verdict an\nempty input earns, not the verdict the filled-in form will get.\n\"\"\"\ninput ActionCandidateInput {\n  scope: String!\n  type: String!\n  input: JSONObject\n}\n\nenum AuthDecision {\n  ALLOW\n  DENY\n}\n\n\"\"\"\nOne candidate's predicted verdict. `reason` carries the refusal a DENY is\nrecorded with, and is null on an ALLOW.\n\"\"\"\ntype ActionEvaluation {\n  decision: AuthDecision!\n  reason: String\n}\n\n\"\"\"\nThe predicted verdicts for a set of candidates, in the order they were given,\nwith the aggregates a caller branches on.\n\nThe aggregates are redundant -- a verdict is binary -- and all four are returned\nso a caller reads the one its question is phrased in rather than negating\nanother. Over no candidates every aggregate is false: nothing is allowed and\nnothing is denied.\n\"\"\"\ntype ActionEvaluations {\n  evaluations: [ActionEvaluation!]!\n  allAllowed: Boolean!\n  anyAllowed: Boolean!\n  allDenied: Boolean!\n  anyDenied: Boolean!\n}\n\n# Input types for sync operations\n\"\"\"\nAn action's context, as a caller submits it.\n\nDeclares every field `ActionContext` carries, because an input object rejects a\nfield it does not declare: an action stamped with the head it applies to - which\nis what a signing client sends - is refused outright if these are missing, and\nthat refusal is a whole-request one, not a per-field one.\n\n`prevOpHash` and `prevOpIndex` are the scope head the action was composed\nagainst. They are recorded rather than enforced; a signature is verified from\nthe params carried in its own tuple, which do not include them.\n\"\"\"\ninput ActionContextInput {\n  \"\"\"\n  The index of the last operation in the scope the action applies to.\n  \"\"\"\n  prevOpIndex: Int\n\n  \"\"\"\n  The hash of the state the action applies to.\n  \"\"\"\n  prevOpHash: String\n\n  \"\"\"\n  Covers replay of an operation that would otherwise be a no-op.\n  \"\"\"\n  nonce: String\n\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n\"\"\"\nOne mutation job of a batch, mirroring the reactor's `ExecutionJobPlan`\n(packages/reactor/src/core/types.ts). The batch runs its jobs in dependency\norder only, not atomically: each job commits on its own with no batch rollback,\nand a failed job still releases its dependents.\n\n`documentIdOrSlug` is the document the job's actions apply to -- an id that does\nnot yet exist when the job's actions create it. `actions` are coerced against\n`ActionInput` and passed through exactly as `execute` does, so a client-signed\naction keeps its signature. `scope` is the single scope every action in the job\nshares, and `dependsOn` names the plan keys this job is ordered after. `branch`\ndefaults to `main`.\n\"\"\"\ninput ExecutionJobInput {\n  key: String!\n  documentIdOrSlug: String!\n  scope: String!\n  branch: String\n  actions: [ActionInput!]!\n  dependsOn: [String!]!\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput SyncRefusalInput {\n  documentId: String!\n  branch: String!\n  # \"marker\" for a refused purge marker; absent for UNSUPPORTED_PROTOCOL\n  kind: String\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n  # The client's peer manifest; absent from a client without peer agreement\n  manifest: JSONObject\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n  # The server's peer manifest\n  manifest: JSONObject\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(\n    idOrSlug: String\n    identifier: String @deprecated(reason: \"Use idOrSlug.\")\n    view: ViewFilterInput\n  ): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdOrSlug: String\n    sourceIdentifier: String @deprecated(reason: \"Use sourceIdOrSlug.\")\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get the outgoing relationship edges of a source document. Unlike\n  # documentOutgoingRelationships, which returns the documents at the far end,\n  # this returns the edges themselves, carrying their metadata and timestamps.\n  # Omit relationshipType to return edges of every type.\n  documentOutgoingRelationshipEdges(\n    sourceIdOrSlug: String\n    sourceIdentifier: String @deprecated(reason: \"Use sourceIdOrSlug.\")\n    relationshipType: String\n    view: ViewFilterInput\n    paging: PagingInput\n  ): DocumentRelationshipResultPage!\n\n  # Get the incoming relationship edges of a target document. Unlike\n  # documentIncomingRelationships, which returns the documents at the far end,\n  # this returns the edges themselves, carrying their metadata and timestamps.\n  # Omit relationshipType to return edges of every type.\n  documentIncomingRelationshipEdges(\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String\n    view: ViewFilterInput\n    paging: PagingInput\n  ): DocumentRelationshipResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  \"\"\"\n  Predicts whether the calling subject would be admitted to execute each of a\n  set of candidate operations, without submitting any of them. A UI asks this to\n  disable a control rather than offer an action that fails on submit.\n\n  The answer is a prediction, not a promise:\n\n  - Real admission compiles an append condition over everything it read and the\n    store enforces it at write time. A preflight reads no future, so a policy\n    change landing between this answer and the submit changes the verdict. The\n    submit path stays the only authority.\n  - The verdict is evaluated at the stream heads, so it is correct for a\n    candidate about to be submitted. A backdated submission is out of contract;\n    the reactor decides that one by position.\n  - A candidate whose verdict depends on its input has to carry that input, since\n    a conditional grant reads it.\n\n  The subject is the authenticated caller and cannot be named in the request:\n  answering for an arbitrary subject would disclose what a policy grants\n  somebody else. It carries both the caller's address and the did:key of the app\n  instance whose token authenticated the request, so a policy naming either\n  matches the same principal the write path presents.\n\n  Requires the reactor's authEnforcement feature flag. Without it the reactor\n  holds no decision model, so this fails with extensions.code\n  AUTH_EVALUATION_UNSUPPORTED rather than guessing.\n  \"\"\"\n  evaluateActions(\n    documentIdOrSlug: String\n    documentIdentifier: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    branch: String\n    candidates: [ActionCandidateInput!]!\n  ): ActionEvaluations!\n\n  \"\"\"\n  Polls for sync envelopes from a channel.\n\n  An operation stored before the API required an action id cannot be\n  represented by this schema, and rather than serving a partial response beside\n  a bare non-null violation, this fails with extensions.code\n  MALFORMED_STORED_OPERATION naming the operation. That code means the failure\n  is worth polling through: the document holding the operation needs repairing,\n  but the channel serves every other document, and a peer that stopped polling\n  would stop receiving those too.\n  \"\"\"\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n    # The client's manifest revision; absent from a client without peer agreement\n    manifestRevision: String\n    # Documents the client refused from earlier polls: held, or a refused marker\n    refusals: [SyncRefusalInput!]\n  ): PollSyncEnvelopesResult!\n\n  # Supreme admin, or the address the named remote's channel is bound to\n  syncHolds(remoteName: String, documentId: String): [SyncHold!]!\n\n  # Supreme admin, or an address bound to a channel in the collection\n  peerAgreement(collectionId: String!): PeerAgreement!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(\n    document: JSONObject!\n    parentIdOrSlug: String\n    parentIdentifier: String @deprecated(reason: \"Use parentIdOrSlug.\")\n  ): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdOrSlug: String\n    parentIdentifier: String @deprecated(reason: \"Use parentIdOrSlug.\")\n  ): PHDocument!\n\n  \"\"\"\n  Applies actions to a document and waits for the result.\n\n  Each action is coerced against `ActionInput`, so one missing a field the wire\n  declares is refused before any work starts. The id in particular: it is hashed\n  into the operation id and replay dedupes by it, so an action without one is\n  stored under an operation id shared by every id-less operation on the same\n  document, scope and branch.\n\n  Named for `IReactorClient.execute`, which this is the wire form of. `branch`\n  defaults to `main`.\n  \"\"\"\n  execute(\n    documentIdOrSlug: String\n    documentIdentifier: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    actions: [ActionInput!]!\n    branch: String\n  ): PHDocument!\n\n  \"\"\"\n  Submits actions to a document and returns the job that will apply them.\n\n  Coerced exactly as `execute` is, so a malformed action is refused here rather\n  than surfacing later as a failed job. Returns the job rather than only its id,\n  so a caller has the status and the creation time it would otherwise have to\n  ask for; `result` is null until the job produces one.\n  \"\"\"\n  executeAsync(\n    documentIdOrSlug: String\n    documentIdentifier: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    actions: [ActionInput!]!\n    branch: String\n  ): JobInfo!\n\n  \"\"\"\n  Applies multiple mutation jobs in dependency order and waits for all of them,\n  the wire form of `IReactorClient.executeBatch`. Each job's actions are coerced\n  against `ActionInput` exactly as `execute` is, so client-signed actions pass\n  through unchanged, and `dependsOn` orders the jobs. It is synchronous: the jobs\n  are applied and awaited before the result returns, so every returned `JobInfo`\n  is a completed one rather than the pending receipt the in-process reactor hands\n  back. A batch is ordering, not a transaction: each job commits on its own, and\n  a failed job still releases the jobs that depend on it, so any job, before or\n  after a failure, may have committed. A failed job is therefore returned as a\n  FAILED entry with its `error` and `errorName`, beside the final state of every\n  other job, rather than failing the mutation. The mutation itself fails only\n  when no job state can be reported.\n\n  A job carrying `CREATE_DOCUMENT` must be the batch's only job, with the create\n  as its first action naming the job's document. Its other actions may only be\n  an `UPGRADE_DOCUMENT` of the new document and `ADD_RELATIONSHIP`s targeting\n  it. It is authorized like `createDocument`: write on every source of those\n  relationships, or the right to create when there is none.\n  \"\"\"\n  executeBatch(jobs: [ExecutionJobInput!]!): BatchExecutionResult!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n    @deprecated(\n      reason: \"Use execute. Actions here are untyped, so a malformed one is refused by a hand-written check rather than by the schema, and `view.scopes` is accepted but ignored.\"\n    )\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n    @deprecated(\n      reason: \"Use executeAsync, which is typed and returns the job rather than only its id.\"\n    )\n\n  # Rename a document\n  renameDocument(\n    documentIdOrSlug: String\n    documentIdentifier: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdOrSlug: String\n    documentIdentifier: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents. Adding one that already exists is\n  # a no-op, metadata included -- use updateRelationship to change an edge.\n  addRelationship(\n    sourceIdOrSlug: String\n    sourceIdentifier: String @deprecated(reason: \"Use sourceIdOrSlug.\")\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String!\n    metadata: JSONObject\n    branch: String\n  ): PHDocument!\n\n  # Replace the metadata of an existing relationship, preserving its createdAt.\n  # Omitting metadata, or passing null, clears it.\n  updateRelationship(\n    sourceIdOrSlug: String\n    sourceIdentifier: String @deprecated(reason: \"Use sourceIdOrSlug.\")\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String!\n    metadata: JSONObject\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdOrSlug: String\n    sourceIdentifier: String @deprecated(reason: \"Use sourceIdOrSlug.\")\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdOrSlug: String\n    sourceParentIdentifier: String\n      @deprecated(reason: \"Use sourceParentIdOrSlug.\")\n    targetParentIdOrSlug: String\n    targetParentIdentifier: String\n      @deprecated(reason: \"Use targetParentIdOrSlug.\")\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(\n    idOrSlug: String\n    identifier: String @deprecated(reason: \"Use idOrSlug.\")\n    propagate: PropagationMode\n  ): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(\n    idsOrSlugs: [String!]\n    identifiers: [String!] @deprecated(reason: \"Use idsOrSlugs.\")\n    propagate: PropagationMode\n  ): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(\n    envelopes: [SyncEnvelopeInput!]!\n    # The server's manifest revision the client gated these envelopes under\n    peerManifestRevision: String\n  ): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
+var schema_default = "# Scalar types (for codegen - also defined in create-schema.ts)\nscalar JSONObject\nscalar DateTime\n\n# Input types\ninput PagingInput {\n  limit: Int\n  offset: Int\n  cursor: String\n}\n\ninput ViewFilterInput {\n  branch: String\n  scopes: [String!]\n}\n\ninput SearchFilterInput {\n  type: String\n  parentId: String\n  identifiers: [String!]\n    @deprecated(reason: \"Ignored. Filter by type or parentId.\")\n}\n\ninput OperationsFilterInput {\n  documentIdOrSlug: String\n  documentId: String @deprecated(reason: \"Use documentIdOrSlug.\")\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\ninput DocumentOperationsFilterInput {\n  branch: String\n  scopes: [String!]\n  actionTypes: [String!]\n  sinceRevision: Int\n  timestampFrom: String\n  timestampTo: String\n}\n\n# Enums\nenum PropagationMode {\n  CASCADE\n  ORPHAN\n}\n\nenum DocumentChangeType {\n  CREATED\n  DELETED\n  UPDATED\n  PARENT_ADDED\n  PARENT_REMOVED\n  CHILD_ADDED\n  CHILD_REMOVED\n}\n\n# Object types\ntype DocumentModelGlobalState {\n  id: String!\n  name: String!\n  namespace: String\n  version: String\n  specification: JSONObject!\n}\n\ntype DocumentModelResultPage {\n  items: [DocumentModelGlobalState!]!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype Revision {\n  scope: String!\n  revision: Int!\n}\n\ntype PHDocument {\n  id: String!\n  slug: String\n  preferredEditor: String\n  meta: JSONObject\n  protocolVersions: JSONObject\n  name: String!\n  documentType: String!\n  state: JSONObject!\n  revisionsList: [Revision!]!\n  createdAtUtcIso: DateTime!\n  lastModifiedAtUtcIso: DateTime!\n  operations(\n    filter: DocumentOperationsFilterInput\n    paging: PagingInput\n  ): ReactorOperationResultPage\n}\n\ntype PHDocumentResultPage {\n  items: [PHDocument!]!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\n# A directed edge between two documents, with the metadata recorded against it.\ntype DocumentRelationship {\n  sourceId: String!\n  targetId: String!\n  relationshipType: String!\n  metadata: JSONObject\n  createdAt: DateTime!\n  updatedAt: DateTime!\n}\n\ntype DocumentRelationshipResultPage {\n  items: [DocumentRelationship!]!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype ReactorOperationResultPage {\n  items: [ReactorOperation!]!\n  hasNextPage: Boolean!\n  hasPreviousPage: Boolean!\n  cursor: String\n}\n\ntype DeadLetterInfo {\n  documentId: String!\n  error: String!\n  \"\"\"\n  How the origin classified the failure. A peer needs this to mirror the origin's\n  quarantine decision; without it a held auth operation would freeze the document\n  on the peer side while the origin kept syncing.\n  \"\"\"\n  errorType: String\n  jobId: String!\n  branch: String!\n  scopes: [String!]!\n  operationCount: Int!\n}\n\ntype PollSyncEnvelopesResult {\n  envelopes: [SyncEnvelope!]!\n  ackOrdinal: Int!\n  deadLetters: [DeadLetterInfo!]!\n  hasMore: Boolean!\n  # The server's current manifest revision\n  manifestRevision: String\n  # The client's manifest revision as the server holds it\n  peerManifestRevision: String\n}\n\ntype SyncHoldReason {\n  protocol: String!\n  version: Int!\n  peerSupports: [Int!]!\n}\n\n# A document held back from a remote whose peer cannot run its versions\ntype SyncHold {\n  remoteName: String!\n  documentId: String!\n  branch: String!\n  reason: SyncHoldReason!\n  heldAtUtcMs: String!\n}\n\ntype PeerAgreementMember {\n  remoteName: String!\n  # False for a peer that announced nothing: it gets the baselines\n  announced: Boolean!\n  protocols: JSONObject!\n  features: JSONObject!\n}\n\ntype PeerAgreementLimit {\n  protocol: String!\n  # The remotes whose peers lack the version new documents would take\n  remoteNames: [String!]!\n}\n\ntype PeerAgreement {\n  collectionId: String!\n  local: JSONObject!\n  members: [PeerAgreementMember!]!\n  limitedBy: [PeerAgreementLimit!]!\n}\n\ntype DocumentWithChildren {\n  document: PHDocument!\n  childIds: [String!]!\n}\n\n# What a new document gets when its creator chooses nothing\ntype CreateDefaults {\n  # \"legacy\" or \"v2-required\"; a client refuses a value it does not know\n  signaturePolicy: String!\n  protocolVersions: JSONObject!\n}\n\ntype MoveRelationshipResult {\n  source: PHDocument!\n  target: PHDocument!\n}\n\ntype ConsistencyCoordinate {\n  documentId: String!\n  scope: String!\n  branch: String!\n  operationIndex: Int!\n}\n\n\"\"\"\nThe write positions a job reached, for read-after-write. Only meaningful once\nthe job has completed.\n\"\"\"\ntype ConsistencyToken {\n  version: Int!\n  createdAtUtcIso: String!\n  coordinates: [ConsistencyCoordinate!]!\n}\n\n\"The batch a job was submitted in.\"\ntype JobBatchMeta {\n  batchId: String!\n  batchJobIds: [String!]!\n}\n\ntype JobInfo {\n  id: String!\n\n  \"\"\"\n  The document the job operates on. Empty for a job this server does not know,\n  which then comes back FAILED with \"Job not found\".\n  \"\"\"\n  documentId: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Null until then, which\n  is the state every job is in when it is handed back from a submission.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n\n  \"The error's class name, such as `DocumentAlreadyExistsError`, when it failed.\"\n  errorName: String\n  createdAt: DateTime!\n  completedAt: DateTime\n  consistencyToken: ConsistencyToken!\n  meta: JobBatchMeta!\n}\n\n\"\"\"\nOne job's outcome within a batch, pairing the plan key the caller gave with the\njob that applied it. Mirrors one entry of the `Record<string, JobInfo>` that\n`IReactor.executeBatch` returns (packages/reactor/src/core/types.ts).\n\"\"\"\ntype BatchJobResult {\n  key: String!\n  job: JobInfo!\n}\n\n\"\"\"\nThe outcome of a batch mutation, one entry per job the request named. The wire\nshape of `BatchExecutionResult` (`{ jobs }`), keyed on each entry by the plan\nkey rather than by position so the client can rebuild the record. The batch is\nnot atomic: each job commits on its own and a failed job releases its\ndependents, so each entry's status says what happened to that job, and\nre-submitting re-applies the jobs that succeeded.\n\"\"\"\ntype BatchExecutionResult {\n  jobs: [BatchJobResult!]!\n}\n\ntype DocumentChangeEvent {\n  type: DocumentChangeType!\n  documents: [PHDocument!]!\n  context: DocumentChangeContext\n}\n\ntype DocumentChangeContext {\n  parentId: String\n  childId: String\n}\n\ntype JobChangeEvent {\n  jobId: String!\n  status: String!\n\n  \"\"\"\n  What the job produced, once it has produced anything. Nullable for the same\n  reason as `JobInfo.result`: a job that has not written yet has produced\n  nothing, and an empty object would claim otherwise.\n  \"\"\"\n  result: JSONObject\n\n  error: String\n}\n\ntype ReactorSignerUser {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ntype ReactorSignerApp {\n  name: String!\n  key: String!\n}\n\ntype ReactorSigner {\n  user: ReactorSignerUser\n  app: ReactorSignerApp\n  signatures: [String!]!\n}\n\ntype ActionContext {\n  signer: ReactorSigner\n}\n\ntype Action {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContext\n}\n\n\"\"\"\nOne operation an authorization preflight predicts a verdict for.\n\n`input` is what a conditional grant reads, so a candidate standing for a\nfilled-in form carries that form's input. Omitting it predicts the verdict an\nempty input earns, not the verdict the filled-in form will get.\n\"\"\"\ninput ActionCandidateInput {\n  scope: String!\n  type: String!\n  input: JSONObject\n}\n\nenum AuthDecision {\n  ALLOW\n  DENY\n}\n\n\"\"\"\nOne candidate's predicted verdict. `reason` carries the refusal a DENY is\nrecorded with, and is null on an ALLOW.\n\"\"\"\ntype ActionEvaluation {\n  decision: AuthDecision!\n  reason: String\n}\n\n\"\"\"\nThe predicted verdicts for a set of candidates, in the order they were given,\nwith the aggregates a caller branches on.\n\nThe aggregates are redundant -- a verdict is binary -- and all four are returned\nso a caller reads the one its question is phrased in rather than negating\nanother. Over no candidates every aggregate is false: nothing is allowed and\nnothing is denied.\n\"\"\"\ntype ActionEvaluations {\n  evaluations: [ActionEvaluation!]!\n  allAllowed: Boolean!\n  anyAllowed: Boolean!\n  allDenied: Boolean!\n  anyDenied: Boolean!\n}\n\n# Input types for sync operations\n\"\"\"\nAn action's context, as a caller submits it.\n\nDeclares every field `ActionContext` carries, because an input object rejects a\nfield it does not declare: an action stamped with the head it applies to - which\nis what a signing client sends - is refused outright if these are missing, and\nthat refusal is a whole-request one, not a per-field one.\n\n`prevOpHash` and `prevOpIndex` are the scope head the action was composed\nagainst. They are recorded rather than enforced; a signature is verified from\nthe params carried in its own tuple, which do not include them.\n\"\"\"\ninput ActionContextInput {\n  \"\"\"\n  The index of the last operation in the scope the action applies to.\n  \"\"\"\n  prevOpIndex: Int\n\n  \"\"\"\n  The hash of the state the action applies to.\n  \"\"\"\n  prevOpHash: String\n\n  \"\"\"\n  Covers replay of an operation that would otherwise be a no-op.\n  \"\"\"\n  nonce: String\n\n  signer: ReactorSignerInput\n}\n\ninput ReactorSignerInput {\n  user: ReactorSignerUserInput\n  app: ReactorSignerAppInput\n  signatures: [String!]!\n}\n\ninput ReactorSignerUserInput {\n  address: String!\n  networkId: String!\n  chainId: Int!\n}\n\ninput ReactorSignerAppInput {\n  name: String!\n  key: String!\n}\n\ninput ActionInput {\n  id: String!\n  type: String!\n  timestampUtcMs: String!\n  input: JSONObject!\n  scope: String!\n  context: ActionContextInput\n}\n\n\"\"\"\nOne mutation job of a batch, mirroring the reactor's `ExecutionJobPlan`\n(packages/reactor/src/core/types.ts). The batch runs its jobs in dependency\norder only, not atomically: each job commits on its own with no batch rollback,\nand a failed job still releases its dependents.\n\n`documentIdOrSlug` is the document the job's actions apply to -- an id that does\nnot yet exist when the job's actions create it. `actions` are coerced against\n`ActionInput` and passed through exactly as `execute` does, so a client-signed\naction keeps its signature. `scope` is the single scope every action in the job\nshares, and `dependsOn` names the plan keys this job is ordered after. `branch`\ndefaults to `main`.\n\"\"\"\ninput ExecutionJobInput {\n  key: String!\n  documentIdOrSlug: String!\n  scope: String!\n  branch: String\n  actions: [ActionInput!]!\n  dependsOn: [String!]!\n}\n\n# Synchronization types\ntype ReactorOperation {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: Action!\n}\n\ninput OperationInput {\n  index: Int!\n  timestampUtcMs: String!\n  hash: String!\n  skip: Int!\n  error: String\n  deniedReason: String\n  id: String\n  action: ActionInput!\n}\n\ntype OperationContext {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ninput OperationContextInput {\n  documentId: String!\n  documentType: String!\n  scope: String!\n  branch: String!\n  ordinal: Int!\n}\n\ntype OperationWithContext {\n  operation: ReactorOperation!\n  context: OperationContext!\n}\n\ninput OperationWithContextInput {\n  operation: OperationInput!\n  context: OperationContextInput!\n}\n\ntype ChannelMeta {\n  id: String!\n}\n\ninput ChannelMetaInput {\n  id: String!\n}\n\ntype RemoteCursor {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\ninput RemoteCursorInput {\n  remoteName: String!\n  cursorOrdinal: Int!\n  lastSyncedAtUtcMs: String\n}\n\nenum SyncEnvelopeType {\n  OPERATIONS\n  ACK\n}\n\ntype SyncEnvelope {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMeta!\n  operations: [OperationWithContext!]\n  cursor: RemoteCursor\n  key: String\n  dependsOn: [String!]\n}\n\ninput SyncEnvelopeInput {\n  type: SyncEnvelopeType!\n  channelMeta: ChannelMetaInput!\n  operations: [OperationWithContextInput!]\n  cursor: RemoteCursorInput\n  key: String\n  dependsOn: [String!]\n}\n\ninput RemoteFilterInput {\n  documentId: [String!]!\n  scope: [String!]!\n  branch: String!\n}\n\ninput SyncRefusalInput {\n  documentId: String!\n  branch: String!\n  # \"marker\" for a refused purge marker; absent for UNSUPPORTED_PROTOCOL\n  kind: String\n}\n\ninput TouchChannelInput {\n  id: String!\n  name: String!\n  collectionId: String!\n  filter: RemoteFilterInput!\n  sinceTimestampUtcMs: String!\n  # The client's peer manifest; absent from a client without peer agreement\n  manifest: JSONObject\n}\n\ntype TouchChannelResult {\n  success: Boolean!\n  ackOrdinal: Int!\n  # The server's peer manifest\n  manifest: JSONObject\n}\n\ntype Query {\n  # Get document models for a namespace\n  documentModels(\n    namespace: String\n    paging: PagingInput\n  ): DocumentModelResultPage!\n\n  # Get a specific document by ID or slug\n  document(\n    idOrSlug: String\n    identifier: String @deprecated(reason: \"Use idOrSlug.\")\n    view: ViewFilterInput\n  ): DocumentWithChildren\n\n  # Get outgoing relationships of a given type from a source document\n  documentOutgoingRelationships(\n    sourceIdOrSlug: String\n    sourceIdentifier: String @deprecated(reason: \"Use sourceIdOrSlug.\")\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get incoming relationships of a given type to a target document\n  documentIncomingRelationships(\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String!\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get the outgoing relationship edges of a source document. Unlike\n  # documentOutgoingRelationships, which returns the documents at the far end,\n  # this returns the edges themselves, carrying their metadata and timestamps.\n  # Omit relationshipType to return edges of every type.\n  documentOutgoingRelationshipEdges(\n    sourceIdOrSlug: String\n    sourceIdentifier: String @deprecated(reason: \"Use sourceIdOrSlug.\")\n    relationshipType: String\n    view: ViewFilterInput\n    paging: PagingInput\n  ): DocumentRelationshipResultPage!\n\n  # Get the incoming relationship edges of a target document. Unlike\n  # documentIncomingRelationships, which returns the documents at the far end,\n  # this returns the edges themselves, carrying their metadata and timestamps.\n  # Omit relationshipType to return edges of every type.\n  documentIncomingRelationshipEdges(\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String\n    view: ViewFilterInput\n    paging: PagingInput\n  ): DocumentRelationshipResultPage!\n\n  # Find documents by search criteria\n  findDocuments(\n    search: SearchFilterInput\n    view: ViewFilterInput\n    paging: PagingInput\n  ): PHDocumentResultPage!\n\n  # Get job status\n  jobStatus(jobId: String!): JobInfo\n\n  # Whether findDocuments would serve the document to the caller. Absent or\n  # withheld is false; a server that cannot decide answers with an error.\n  documentServed(idOrSlug: String!, view: ViewFilterInput): Boolean!\n\n  # The signature policy and protocol versions a new document gets, under the\n  # parent when one is named. A parent the caller may not read is refused.\n  createDefaults(parentIdOrSlug: String): CreateDefaults!\n\n  # Get operations for a document with filtering and pagination\n  documentOperations(\n    filter: OperationsFilterInput!\n    paging: PagingInput\n  ): ReactorOperationResultPage!\n\n  \"\"\"\n  Predicts whether the calling subject would be admitted to execute each of a\n  set of candidate operations, without submitting any of them. A UI asks this to\n  disable a control rather than offer an action that fails on submit.\n\n  The answer is a prediction, not a promise:\n\n  - Real admission compiles an append condition over everything it read and the\n    store enforces it at write time. A preflight reads no future, so a policy\n    change landing between this answer and the submit changes the verdict. The\n    submit path stays the only authority.\n  - The verdict is evaluated at the stream heads, so it is correct for a\n    candidate about to be submitted. A backdated submission is out of contract;\n    the reactor decides that one by position.\n  - A candidate whose verdict depends on its input has to carry that input, since\n    a conditional grant reads it.\n\n  The subject is the authenticated caller and cannot be named in the request:\n  answering for an arbitrary subject would disclose what a policy grants\n  somebody else. It carries both the caller's address and the did:key of the app\n  instance whose token authenticated the request, so a policy naming either\n  matches the same principal the write path presents.\n\n  Requires the reactor's authEnforcement feature flag. Without it the reactor\n  holds no decision model, so this fails with extensions.code\n  AUTH_EVALUATION_UNSUPPORTED rather than guessing.\n  \"\"\"\n  evaluateActions(\n    documentIdOrSlug: String\n    documentIdentifier: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    branch: String\n    candidates: [ActionCandidateInput!]!\n  ): ActionEvaluations!\n\n  \"\"\"\n  Polls for sync envelopes from a channel.\n\n  An operation stored before the API required an action id cannot be\n  represented by this schema, and rather than serving a partial response beside\n  a bare non-null violation, this fails with extensions.code\n  MALFORMED_STORED_OPERATION naming the operation. That code means the failure\n  is worth polling through: the document holding the operation needs repairing,\n  but the channel serves every other document, and a peer that stopped polling\n  would stop receiving those too.\n  \"\"\"\n  pollSyncEnvelopes(\n    channelId: String!\n    outboxAck: Int!\n    outboxLatest: Int!\n    # The client's manifest revision; absent from a client without peer agreement\n    manifestRevision: String\n    # Documents the client refused from earlier polls: held, or a refused marker\n    refusals: [SyncRefusalInput!]\n  ): PollSyncEnvelopesResult!\n\n  # Supreme admin, or the address the named remote's channel is bound to\n  syncHolds(remoteName: String, documentId: String): [SyncHold!]!\n\n  # Supreme admin, or an address bound to a channel in the collection\n  peerAgreement(collectionId: String!): PeerAgreement!\n}\n\ntype Mutation {\n  # Create a new document\n  createDocument(\n    document: JSONObject!\n    parentIdOrSlug: String\n    parentIdentifier: String @deprecated(reason: \"Use parentIdOrSlug.\")\n  ): PHDocument!\n\n  # Create an empty document of specified type\n  createEmptyDocument(\n    documentType: String!\n    parentIdOrSlug: String\n    parentIdentifier: String @deprecated(reason: \"Use parentIdOrSlug.\")\n  ): PHDocument!\n\n  \"\"\"\n  Applies actions to a document and waits for the result.\n\n  Each action is coerced against `ActionInput`, so one missing a field the wire\n  declares is refused before any work starts. The id in particular: it is hashed\n  into the operation id and replay dedupes by it, so an action without one is\n  stored under an operation id shared by every id-less operation on the same\n  document, scope and branch.\n\n  Named for `IReactorClient.execute`, which this is the wire form of. `branch`\n  defaults to `main`.\n  \"\"\"\n  execute(\n    documentIdOrSlug: String\n    documentIdentifier: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    actions: [ActionInput!]!\n    branch: String\n  ): PHDocument!\n\n  \"\"\"\n  Submits actions to a document and returns the job that will apply them.\n\n  Coerced exactly as `execute` is, so a malformed action is refused here rather\n  than surfacing later as a failed job. Returns the job rather than only its id,\n  so a caller has the status and the creation time it would otherwise have to\n  ask for; `result` is null until the job produces one.\n  \"\"\"\n  executeAsync(\n    documentIdOrSlug: String\n    documentIdentifier: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    actions: [ActionInput!]!\n    branch: String\n  ): JobInfo!\n\n  \"\"\"\n  Applies multiple mutation jobs in dependency order and waits for all of them,\n  the wire form of `IReactorClient.executeBatch`. Each job's actions are coerced\n  against `ActionInput` exactly as `execute` is, so client-signed actions pass\n  through unchanged, and `dependsOn` orders the jobs. It is synchronous: the jobs\n  are applied and awaited before the result returns, so every returned `JobInfo`\n  is a completed one rather than the pending receipt the in-process reactor hands\n  back. A batch is ordering, not a transaction: each job commits on its own, and\n  a failed job still releases the jobs that depend on it, so any job, before or\n  after a failure, may have committed. A failed job is therefore returned as a\n  FAILED entry with its `error` and `errorName`, beside the final state of every\n  other job, rather than failing the mutation. The mutation itself fails only\n  when no job state can be reported.\n\n  A job carrying `CREATE_DOCUMENT` must be the batch's only job, with the create\n  as its first action naming the job's document. Its other actions may only be\n  an `UPGRADE_DOCUMENT` of the new document and `ADD_RELATIONSHIP`s targeting\n  it. It is authorized like `createDocument`: write on every source of those\n  relationships, or the right to create when there is none.\n  \"\"\"\n  executeBatch(jobs: [ExecutionJobInput!]!): BatchExecutionResult!\n\n  # Apply actions to a document (synchronous)\n  mutateDocument(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): PHDocument!\n    @deprecated(\n      reason: \"Use execute. Actions here are untyped, so a malformed one is refused by a hand-written check rather than by the schema, and `view.scopes` is accepted but ignored.\"\n    )\n\n  # Submit actions to a document (asynchronous)\n  mutateDocumentAsync(\n    documentIdentifier: String!\n    actions: [JSONObject!]!\n    view: ViewFilterInput\n  ): String!\n    @deprecated(\n      reason: \"Use executeAsync, which is typed and returns the job rather than only its id.\"\n    )\n\n  # Rename a document\n  renameDocument(\n    documentIdOrSlug: String\n    documentIdentifier: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    name: String!\n    branch: String\n  ): PHDocument!\n\n  # Update the preferred editor recorded in the document header meta.\n  # Pass null/omit to clear it.\n  setPreferredEditor(\n    documentIdOrSlug: String\n    documentIdentifier: String @deprecated(reason: \"Use documentIdOrSlug.\")\n    preferredEditor: String\n    branch: String\n  ): PHDocument!\n\n  # Add a relationship between two documents. Adding one that already exists is\n  # a no-op, metadata included -- use updateRelationship to change an edge.\n  addRelationship(\n    sourceIdOrSlug: String\n    sourceIdentifier: String @deprecated(reason: \"Use sourceIdOrSlug.\")\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String!\n    metadata: JSONObject\n    branch: String\n  ): PHDocument!\n\n  # Replace the metadata of an existing relationship, preserving its createdAt.\n  # Omitting metadata, or passing null, clears it.\n  updateRelationship(\n    sourceIdOrSlug: String\n    sourceIdentifier: String @deprecated(reason: \"Use sourceIdOrSlug.\")\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String!\n    metadata: JSONObject\n    branch: String\n  ): PHDocument!\n\n  # Remove a relationship between two documents\n  removeRelationship(\n    sourceIdOrSlug: String\n    sourceIdentifier: String @deprecated(reason: \"Use sourceIdOrSlug.\")\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String!\n    branch: String\n  ): PHDocument!\n\n  # Move a relationship from one source to another\n  moveRelationship(\n    sourceParentIdOrSlug: String\n    sourceParentIdentifier: String\n      @deprecated(reason: \"Use sourceParentIdOrSlug.\")\n    targetParentIdOrSlug: String\n    targetParentIdentifier: String\n      @deprecated(reason: \"Use targetParentIdOrSlug.\")\n    targetIdOrSlug: String\n    targetIdentifier: String @deprecated(reason: \"Use targetIdOrSlug.\")\n    relationshipType: String!\n    branch: String\n  ): MoveRelationshipResult!\n\n  # Delete a single document\n  deleteDocument(\n    idOrSlug: String\n    identifier: String @deprecated(reason: \"Use idOrSlug.\")\n    propagate: PropagationMode\n  ): Boolean!\n\n  # Delete multiple documents\n  deleteDocuments(\n    idsOrSlugs: [String!]\n    identifiers: [String!] @deprecated(reason: \"Use idsOrSlugs.\")\n    propagate: PropagationMode\n  ): Boolean!\n\n  # Touch (create or update) a channel for sync\n  touchChannel(input: TouchChannelInput!): TouchChannelResult!\n\n  # Push sync envelopes to a channel\n  pushSyncEnvelopes(\n    envelopes: [SyncEnvelopeInput!]!\n    # The server's manifest revision the client gated these envelopes under\n    peerManifestRevision: String\n  ): Boolean!\n}\n\ntype Subscription {\n  # Subscribe to document changes\n  documentChanges(\n    search: SearchFilterInput\n    view: ViewFilterInput\n  ): DocumentChangeEvent!\n\n  # Subscribe to job changes\n  jobChanges(jobId: String!): JobChangeEvent!\n}\n";
 //#endregion
 //#region src/graphql/reactor/pubsub.ts
 const pubSub = new PubSub();
@@ -6477,15 +7022,10 @@ var ReactorSubgraph = class extends BaseSubgraph {
 						view: args.view,
 						paging: args.paging
 					}, this.viewSubject(ctx));
-					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
-						const filteredItems = [];
-						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
-						return {
-							...result,
-							items: filteredItems
-						};
-					}
-					return result;
+					return {
+						...result,
+						items: await this.readableByHost(result.items, ctx)
+					};
 				} catch (error) {
 					this.logger.error("Error in documentIncomingRelationships: @Error", error);
 					throw error;
@@ -6532,15 +7072,10 @@ var ReactorSubgraph = class extends BaseSubgraph {
 						...args,
 						search: args.search ?? {}
 					}, this.viewSubject(ctx));
-					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
-						const filteredItems = [];
-						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
-						return {
-							...result,
-							items: filteredItems
-						};
-					}
-					return result;
+					return {
+						...result,
+						items: await this.readableByHost(result.items, ctx)
+					};
 				} catch (error) {
 					this.logger.error("Error in findDocuments: @Error", error);
 					throw error;
@@ -6565,6 +7100,29 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					throw error;
 				}
 			},
+			documentServed: async (_parent, args, ctx) => {
+				this.logger.debug("documentServed(@args)", args);
+				try {
+					return await this.listsDocument(args.idOrSlug, ctx, {
+						branch: args.view?.branch ?? void 0,
+						scopes: args.view?.scopes ? [...args.view.scopes] : void 0
+					});
+				} catch (error) {
+					this.logger.error("Error in documentServed: @Error", error);
+					throw error;
+				}
+			},
+			createDefaults: async (_parent, args, ctx) => {
+				this.logger.debug("createDefaults(@args)", args);
+				try {
+					const parentIdOrSlug = args.parentIdOrSlug ?? void 0;
+					if (parentIdOrSlug !== void 0 && !await this.listsDocument(parentIdOrSlug, ctx)) throw new ForbiddenError("to read this document");
+					return await createDefaults(this.reactorClient, parentIdOrSlug);
+				} catch (error) {
+					this.logger.error("Error in createDefaults: @Error", error);
+					throw error;
+				}
+			},
 			documentOperations: async (_parent, args, ctx) => {
 				this.logger.debug("documentOperations(@args)", args);
 				try {
@@ -7044,10 +7602,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.3-dev.50";
+	return "6.2.3-dev.52";
 }
 function getGitHash() {
-	return "01a5b0227313c401002362834697fee1ddd28fed";
+	return "a37f3ca1923c9cdd7aca3c82e8cc7ef5f3abc035";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -7083,6 +7641,8 @@ const PACKAGE_ENTRIES = {
 	processors: "node/processors/index.mjs"
 };
 const REGISTRY_ENTRY_ABSENT = "ERR_REGISTRY_ENTRY_ABSENT";
+const REGISTRY_EXTERNAL_DEPS_MISSING = "ERR_REGISTRY_EXTERNAL_DEPS_MISSING";
+const PACKAGE_MANIFEST = "powerhouse.manifest.json";
 const MANIFEST_FILE = "manifest.json";
 function defaultRegistryCacheDir(cwd = process.cwd()) {
 	return path.join(cwd, ".ph", "registry-packages");
@@ -7168,7 +7728,8 @@ var RegistryPackageCache = class {
 			manifest = await this.fill(name, version, dir);
 			source = "download";
 		}
-		await this.linkBareImports(manifest.bareImports);
+		const external = Object.keys(manifest.externalDependencies);
+		await this.linkBareImports(manifest.bareImports, external);
 		const entries = {};
 		for (const [kind, rel] of Object.entries(manifest.entries)) entries[kind] = path.join(dir, rel);
 		const result = {
@@ -7176,7 +7737,12 @@ var RegistryPackageCache = class {
 			version,
 			dir,
 			entries,
-			source
+			source,
+			externalDependencies: manifest.externalDependencies,
+			missingExternalDependencies: external.filter((pkg) => {
+				const imported = manifest.bareImports.filter((s) => s === pkg || s.startsWith(`${pkg}/`));
+				return !(imported.length > 0 ? imported : [pkg]).some((s) => this.resolvesForCachedPackages(s, pkg));
+			})
 		};
 		this.verified.set(dir, result);
 		return result;
@@ -7192,6 +7758,10 @@ var RegistryPackageCache = class {
 			await this.discard(dir);
 			return null;
 		}
+		if (typeof manifest.externalDependencies !== "object") {
+			await this.discard(dir);
+			return null;
+		}
 		if (manifest.name !== name || manifest.version !== version || Object.values(manifest.entries).some((rel) => !(rel in manifest.files))) {
 			this.logger.warn("Cache manifest in @dir names another package", dir);
 			await this.discard(dir);
@@ -7303,12 +7873,14 @@ var RegistryPackageCache = class {
 		const entries = {};
 		for (const [kind, rel] of Object.entries(PACKAGE_ENTRIES)) if (rel in files) entries[kind] = rel;
 		if (Object.keys(entries).length === 0) throw new Error(`${name}@${version} serves no document models, subgraphs or processors`);
+		const packageManifest = await this.fetchBounded(new URL(PACKAGE_MANIFEST, base).href, true);
 		return {
 			name,
 			version,
 			entries,
 			files: Object.fromEntries(Object.entries(files).sort(([a], [b]) => a.localeCompare(b))),
-			bareImports: [...bare].sort()
+			bareImports: [...bare].sort(),
+			externalDependencies: externalDependenciesOf(packageManifest)
 		};
 	}
 	dependenciesOf(source, url, base) {
@@ -7369,8 +7941,15 @@ var RegistryPackageCache = class {
 		}
 		return Buffer.concat(chunks);
 	}
-	async linkBareImports(specifiers) {
-		const outsideUrl = pathToFileURL(path.join(path.dirname(this.cacheDir), "/")).href;
+	outsideUrl() {
+		return pathToFileURL(path.join(path.dirname(this.cacheDir), "/")).href;
+	}
+	/** Whether `specifier` resolves from the project or from reactor-api. */
+	resolvesForCachedPackages(specifier, pkg) {
+		return packageRoot(specifier, pkg, this.outsideUrl()) !== null || packageRoot(specifier, pkg, import.meta.url) !== null;
+	}
+	async linkBareImports(specifiers, external) {
+		const outsideUrl = this.outsideUrl();
 		const linkRoot = path.join(this.cacheDir, "node_modules");
 		for (const specifier of specifiers) {
 			const pkg = packageNameOf(specifier);
@@ -7383,6 +7962,7 @@ var RegistryPackageCache = class {
 			}
 			const fallback = packageRoot(specifier, pkg, import.meta.url);
 			if (!fallback) {
+				if (external.includes(pkg)) continue;
 				this.logger.warn("Registry package import @specifier resolves from neither the project nor reactor-api", specifier);
 				continue;
 			}
@@ -7420,6 +8000,17 @@ function parseManifest(raw) {
 	if (typeof value.name !== "string" || typeof value.version !== "string" || typeof value.entries !== "object" || value.entries === null || typeof value.files !== "object" || value.files === null || !Array.isArray(value.bareImports)) throw new Error("malformed manifest");
 	return value;
 }
+function externalDependenciesOf(body) {
+	if (!body) return {};
+	let value;
+	try {
+		value = JSON.parse(body.toString("utf8")).externalDependencies;
+	} catch {
+		return {};
+	}
+	if (typeof value !== "object" || value === null) return {};
+	return Object.fromEntries(Object.entries(value).filter(([name, version]) => isValidPackageName(name) && typeof version === "string"));
+}
 function packageNameOf(specifier) {
 	const parts = specifier.split("/");
 	if (specifier.startsWith("@")) return parts.length >= 2 ? `${parts[0]}/${parts[1]}` : null;
@@ -7542,6 +8133,7 @@ var HttpPackageLoader = class {
 	documentModelLoader;
 	cache;
 	versions = /* @__PURE__ */ new Map();
+	reportedExternal = /* @__PURE__ */ new Set();
 	constructor(options) {
 		this.registryUrl = options.registryUrl.endsWith("/") ? options.registryUrl : `${options.registryUrl}/`;
 		this.cache = new RegistryPackageCache({
@@ -7624,6 +8216,7 @@ var HttpPackageLoader = class {
 		if (cached) {
 			const filePath = cached.entries[kind];
 			if (!filePath) throw Object.assign(/* @__PURE__ */ new Error(`${packageName}@${cached.version} serves no ${kind}`), { code: REGISTRY_ENTRY_ABSENT });
+			if (kind !== "documentModels") this.assertExternalDependencies(cached);
 			return {
 				module: await import(
 					/* @vite-ignore */
@@ -7640,6 +8233,17 @@ var HttpPackageLoader = class {
 			url
 ) };
 	}
+	assertExternalDependencies(cached) {
+		const missing = cached.missingExternalDependencies;
+		if (missing.length === 0) return;
+		const id = `${cached.name}@${cached.version}`;
+		const list = missing.map((dep) => `${dep}@${cached.externalDependencies[dep]}`).join(", ");
+		if (!this.reportedExternal.has(id)) {
+			this.reportedExternal.add(id);
+			this.logger.error("@package needs packages with native addons or WebAssembly modules that are not installed (@deps); its subgraphs and processors are not loaded, its document models and pieces are. Install it locally with `ph install --local @name`, or list it in PH_PACKAGES for a Docker image.", id, list, cached.name);
+		}
+		throw Object.assign(/* @__PURE__ */ new Error(`${id} needs external dependencies that are not installed: ${list}`), { code: REGISTRY_EXTERNAL_DEPS_MISSING });
+	}
 	importDocumentModels(packageSpec) {
 		return this.importEntry(packageSpec, "documentModels");
 	}
@@ -8080,7 +8684,7 @@ var PackageManager = class {
 	maybeWarnAllLoadersFailed(kind, pkg, succeeded, failures) {
 		if (succeeded || failures.length === 0) return;
 		const subPath = kind === "document models" ? "document-models" : kind;
-		const realFailures = failures.filter(({ error }) => !isExpectedLoaderMiss(error, pkg, subPath));
+		const realFailures = failures.filter(({ error }) => !isExpectedLoaderMiss(error, pkg, subPath) && error?.code !== "ERR_REGISTRY_EXTERNAL_DEPS_MISSING");
 		if (realFailures.length === 0) return;
 		const details = realFailures.map(({ loader, error }) => {
 			return `  [${loader}] ${error instanceof Error ? error.message : String(error)}`;
@@ -8266,11 +8870,6 @@ async function createStartupAttachmentBackend({ db, env = process.env, s3Depende
 }
 //#endregion
 //#region src/services/attachment-access.service.ts
-/** The scope an attachment's bytes belong to: the document's own domain state. */
-const ATTACHMENT_SCOPE = "global";
-/** The branch an attachment reference is resolved against. */
-const ATTACHMENT_BRANCH = "main";
-const HASH_PATTERN = /^[a-f0-9]{64}$/;
 /**
 * Composes document authorization with the projected document/ref
 * relationship. Order is fixed: validate ref, resolve the canonical document
@@ -8327,29 +8926,10 @@ var AttachmentAccessService = class {
 			return { kind: "denied" };
 		}
 		if (!await this.canReadDocument(documentId, request)) return { kind: "denied" };
-		const subject = {
+		if (!await readGateAllowsAttachmentRead(this.readGate, this.references, documentId, ref, {
 			address: request.userAddress,
 			key: request.appKey
-		};
-		let served;
-		try {
-			served = await this.readGate.isServed(documentId, { subject });
-		} catch {
-			return { kind: "denied" };
-		}
-		if (!served) return { kind: "denied" };
-		const scopes = await this.references.referencingScopes(documentId, ref);
-		if (scopes.length === 0) return { kind: "denied" };
-		let held;
-		try {
-			held = (await this.readGate.get(documentId, {
-				subject,
-				scopes
-			})).state;
-		} catch {
-			return { kind: "denied" };
-		}
-		if (!scopes.some((scope) => scope in held)) return { kind: "denied" };
+		})) return { kind: "denied" };
 		return {
 			kind: "allowed",
 			documentId,
@@ -8366,10 +8946,10 @@ var AttachmentAccessService = class {
 	*/
 	async canReadDocument(documentId, request) {
 		if (!this.scopeGate) return this.authorization.canRead(documentId, request.userAddress);
-		return (await this.scopeGate.scopePredicateById(documentId, {
+		return scopeGateAllowsAttachmentRead(this.scopeGate, documentId, {
 			address: request.userAddress,
 			key: request.appKey
-		}, ATTACHMENT_BRANCH))(ATTACHMENT_SCOPE);
+		});
 	}
 };
 /**
@@ -8387,7 +8967,7 @@ function normalizeAttachmentRef(value) {
 	} catch {
 		return null;
 	}
-	if (version !== 1 || !HASH_PATTERN.test(hash)) return null;
+	if (version !== 1 || !isAttachmentHash(hash)) return null;
 	return createRef(hash, version);
 }
 //#endregion
@@ -9568,6 +10148,25 @@ function createReadinessGate() {
 function getExplorerPrefix(basePath) {
 	return path.posix.join(basePath, "explorer");
 }
+function attachmentInspectionStore(attachments) {
+	return { getAttachmentInfo: async () => ({
+		present: true,
+		storeKind: "kysely",
+		hasReplicator: false,
+		replicatorRunning: false,
+		backlogScanned: false,
+		refsSeen: 0,
+		held: 0,
+		bytesHeld: await attachments.store.storageUsed(),
+		queued: 0,
+		fetching: 0,
+		pendingFetches: 0,
+		waiting: 0,
+		notFound: 0,
+		failed: 0,
+		lastError: void 0
+	}) };
+}
 function resolveAttachmentStoragePath(options) {
 	if (options.attachmentStoragePath) return options.attachmentStoragePath;
 	if (options.dbPath && !options.dbPath.startsWith("postgres")) return path.resolve(options.dbPath, "..", "attachments");
@@ -9628,7 +10227,7 @@ function resolveGatewayAdapterType(logger) {
 /**
 * Sets up the subgraph manager and registers subgraphs
 */
-async function setupGraphQLManager({ httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate, httpRoutes, attachments }) {
+async function setupGraphQLManager({ httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, authService, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient, syncServingGate, httpRoutes, attachments, inspection, driveStore }) {
 	const graphqlManager = new GraphQLManager({
 		path: config.basePath,
 		httpServer,
@@ -9648,7 +10247,9 @@ async function setupGraphQLManager({ httpAdapter, authFetchMiddleware, requireAu
 		reactorDriveClient,
 		syncServingGate,
 		httpRoutes,
-		attachments
+		attachments,
+		inspection,
+		driveStore
 	});
 	await graphqlManager.init(subgraphs.core, authFetchMiddleware, requireAuthFetchMiddleware);
 	for (const [packageName, collection] of subgraphs.extended.entries()) for (const subgraph of collection) await graphqlManager.registerSubgraph(subgraph, "graphql", false, packageName);
@@ -9947,7 +10548,7 @@ async function _setupCommonInfrastructure(options) {
 /**
 * Private helper function containing common setup logic for API initialization
 */
-async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authEnabled, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient, syncServingGate, httpRoutes, attachmentReadsFollowDocumentPolicy = false) {
+async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authEnabled, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, readModels, attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers = [], reactorDriveClient, syncServingGate, httpRoutes, attachmentReadsFollowDocumentPolicy = false, inspection, driveStore) {
 	const hostModuleBase = {
 		...createReactorHostModuleBase({
 			client: reactorClient,
@@ -9998,6 +10599,7 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	const attachmentClientProvider = new AttachmentClientProvider(attachments.service, attachmentAccess, logger);
 	const coreSubgraphs = DefaultCoreSubgraphs.slice();
 	coreSubgraphs.push(ReactorSubgraph);
+	if (inspection) coreSubgraphs.push(InspectionSubgraph);
 	if (documentPermissionService) {
 		coreSubgraphs.push(AuthSubgraph);
 		logger.info("Auth subgraph registered (document permissions enabled)");
@@ -10025,7 +10627,9 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 		reactorDriveClient,
 		syncServingGate,
 		httpRoutes,
-		attachments: attachmentClientProvider
+		attachments: attachmentClientProvider,
+		inspection,
+		driveStore
 	});
 	setupEventListeners(packages, graphqlManager, reactorProcessorManager, moduleFor, documentModelRegistry);
 	if (mcpServerEnabled) {
@@ -10057,6 +10661,7 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 		requireAuthenticatedCaller: floor,
 		authorizationService,
 		relationalDb,
+		inspection,
 		dispose
 	};
 }
@@ -10120,7 +10725,10 @@ async function initializeAndStartAPI(clientInitializer, options, processorApp) {
 	const documentModelRegistry = reactorClientModule.reactorModule?.documentModelRegistry;
 	if (!documentModelRegistry) throw new Error("DocumentModelRegistry not available from InProcessReactorClientModule");
 	return {
-		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authEnabled, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient, buildSyncServingGate(reactorClientModule.reactorModule, authorizationConfig, options.logger ?? defaultLogger), httpRoutes, attachmentReadsFollowDocumentPolicy),
+		...await _setupAPI(reactorClient, syncManager, reactorProcessorManager, httpAdapter, authFetchMiddleware, requireAuthFetchMiddleware, authEnabled, authService, port, packages, relationalDb, analyticsStore, documentPermissionService, processors, subgraphs, options, processorApp, (reactorClientModule.reactorModule?.readModelCoordinator)?.readModels ?? [], attachments, attachmentReferenceIndex, attachmentReferenceProjection, authorizationConfig, documentModelRegistry, dbClosers, reactorDriveClient, buildSyncServingGate(reactorClientModule.reactorModule, authorizationConfig, options.logger ?? defaultLogger), httpRoutes, attachmentReadsFollowDocumentPolicy, reactorClientModule.reactorModule ? createReactorInspectionSource(reactorClientModule.reactorModule, {
+			...options.inspection,
+			attachmentStore: attachmentInspectionStore(attachments)
+		}) : void 0, reactorClientModule.reactorModule?.reactor),
 		client: reactorClient,
 		syncManager,
 		documentModelRegistry,
@@ -10303,7 +10911,7 @@ var PackageManagementService = class {
 	}
 };
 //#endregion
-export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessFailed, AttachmentAccessService, AttachmentAccessUnavailable, AttachmentClientProvider, AuthDecision, AuthDecisionSchema, AuthEvaluationUnsupportedError, AuthService, AuthSubgraph, AuthenticationRequiredError, AuthorizationPolicy, AuthorizedAttachmentService, AuthorizedDocumentHandle, BaseSubgraph, CORE_PACKAGE_NAME, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, DocumentRelationshipFieldsFragmentDoc, EvaluateActionsDocument, ExecuteBatchDocument, ExecutionJobInputSchema, FindDocumentsDocument, ForbiddenError, GetDocumentDocument, GetDocumentIncomingRelationshipEdgesDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipEdgesDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, HttpRouteService, ImportPackageLoader, InMemoryPackageStorage, InvalidNamespaceError, JobChangesDocument, JobInfoFieldsFragmentDoc, MalformedStoredOperationError, MemoryWebhookStore, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PACKAGE_ROUTE_SEGMENT, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PrivacyPermissionAdapter, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RefusalNotRecordedError, RelationalWebhookStore, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SyncRefusalInputSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, UpdateRelationshipDocument, ViewFilterInputSchema, WEBHOOK_SEGMENT, WS_AUTH_CLOSE_REASONS, WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE_REASON_BEARER_REJECTED, WebhookService, assertAttachmentPolicyReadsAllowed, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertHostMountPath, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, callerSubject, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createRenownCredentialVerifier, createSchema, createWsAuthHandlers, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphs, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isPostgresConnectionString, isSubgraphClass, namespacePath, namespaceSegments, newWebhookToken, parseDriveUrl, parseWebhookBody, piecesBaseUrl, redactHeaders, renderGraphqlPlayground, resolvePackageName, resolveRenownConfig, verifyWebhook };
+export { ADMIN_USERS, ActionCandidateInputSchema, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AttachmentAccessFailed, AttachmentAccessService, AttachmentAccessUnavailable, AttachmentClientProvider, AuthDecision, AuthDecisionSchema, AuthEvaluationUnsupportedError, AuthService, AuthSubgraph, AuthenticationRequiredError, AuthorizationPolicy, AuthorizedAttachmentService, AuthorizedDocumentHandle, BaseSubgraph, CORE_PACKAGE_NAME, CanonicalDocumentIdResolutionError, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, DocumentRelationshipFieldsFragmentDoc, EvaluateActionsDocument, ExecuteBatchDocument, ExecutionJobInputSchema, FindDocumentsDocument, ForbiddenError, GetCreateDefaultsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipEdgesDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipEdgesDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentServedDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, HttpRouteService, ImportPackageLoader, InMemoryPackageStorage, InspectionSubgraph, InvalidNamespaceError, JobChangesDocument, JobInfoFieldsFragmentDoc, MalformedStoredOperationError, MemoryWebhookStore, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PACKAGE_ROUTE_SEGMENT, PGLITE_UTC_PARSERS, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PrivacyPermissionAdapter, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RefusalNotRecordedError, RelationalWebhookStore, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SyncRefusalInputSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, UpdateRelationshipDocument, ViewFilterInputSchema, WEBHOOK_SEGMENT, WS_AUTH_CLOSE_REASONS, WS_CLOSE_REASON_AUTHENTICATION_REQUIRED, WS_CLOSE_REASON_BEARER_REJECTED, WebhookService, assertAttachmentPolicyReadsAllowed, assertAuthRequiredForDocumentPermissions, assertCredentialVerifierForSource, assertHostMountPath, assertRequireAuthenticatedCallerAllowed, assertSkipCredentialVerificationAllowed, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, callerSubject, createAuthFetchMiddleware, createCanonicalDocumentIdResolver, createGatewayAdapter, createHttpAdapter, createInspectionResolvers, createMergedSchema, createReactorGraphQLClient, createReactorInspectionSource, createRenownCredentialVerifier, createSchema, createWsAuthHandlers, decodeExplorerUrlState, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphs, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getExplorerPrefix, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getUniqueUpgradeManifests, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, inspectionTypeDefs, isDefinedNonNullAny, isExpectedLoaderMiss, isListedAdmin, isPostgresConnectionString, isSubgraphClass, namespacePath, namespaceSegments, newWebhookToken, parseDriveUrl, parseWebhookBody, piecesBaseUrl, redactHeaders, renderGraphqlPlayground, resolvePackageName, resolveRenownConfig, verifyWebhook };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=dc27a51b-c565-5dcc-a85a-eac64c78db3e
+//# debugId=980be7cc-16d9-5965-b60e-0c7ca7a4e3c8