@cleocode/core 2026.6.12 → 2026.6.14

package/dist/store/service-trust-gate.d.ts

@@ -0,0 +1,164 @@
+/**
+ * Service-vault trust gate — **policy-before-decrypt** per-agent access control.
+ *
+ * EP-UNIVERSAL-SERVICE-VAULT (epic T11765 · saga SG-VAULT-CORE T10409 · M2 W1a ·
+ * task T11937 · AC4). Ports onecli `connect.rs` selective-mode: an agent may use a
+ * service connection ONLY when (a) a row exists in `agent_service_grants` linking
+ * the agent to the connection, AND (b) the grant's `session_policy` evaluates to
+ * an allow. This module evaluates that decision from already-loaded grant data —
+ * it performs ZERO crypto. The store
+ * ({@link import('./service-connections-accessor.js')}) calls `decryptGlobal`
+ * ONLY after this gate returns `allowed: true`, so a denied/blocked agent NEVER
+ * triggers a decrypt (the policy-before-decrypt invariant, proven by unit test).
+ *
+ * ## Why the gate is decrypt-free
+ *
+ * The gate takes the grant rows as INPUT and returns a pure decision. It cannot
+ * decrypt even if it wanted to — it imports no crypto. The decryption chokepoint
+ * lives one layer up (the accessor), guarded by this decision. That separation is
+ * exactly what makes "a denied agent never decrypts" structurally true and
+ * spy-assertable: the spy is placed on `decryptGlobal`, and a deny path returns
+ * before the accessor reaches the decrypt call.
+ *
+ * ## Policy shape ({@link SessionPolicy})
+ *
+ * Mirrors onecli's `PolicyAction` (block / rate-limit / manual-approval) collapsed
+ * to a per-grant JSON:
+ *
+ *   - `mode: 'allow' | 'block'` — `block` is a hard deny (no decrypt).
+ *   - `rateLimit?` — advisory rate cap; the gate surfaces it but does not itself
+ *     count requests (the caller enforces). Presence alone does not deny.
+ *   - `manualApproval?: true` — the connection requires an out-of-band human
+ *     approval that has not been granted for this session → deny (no decrypt)
+ *     until the caller supplies `approved: true` in the evaluation context.
+ *
+ * A bare grant (`{"mode":"allow"}`, the column default) allows.
+ *
+ * @module store/service-trust-gate
+ * @task T11937
+ * @epic T11765
+ * @saga T10409
+ * @see ./service-connections-accessor.ts — the accessor that decrypts ONLY on allow
+ * @see ../../../onecli — `apps/gateway/src/connect.rs` selective-mode (the ported model)
+ */
+/**
+ * Advisory rate-limit clause on a {@link SessionPolicy}.
+ *
+ * The gate reports it on an allow decision; it does NOT itself maintain a counter
+ * (the consumer enforces the cap). Presence never denies access — it shapes how
+ * the caller throttles an already-permitted credential use.
+ *
+ * @task T11937
+ */
+export interface SessionRateLimit {
+    /** Maximum requests permitted within `window`. */
+    readonly maxRequests: number;
+    /** Rolling window the cap applies over. */
+    readonly window: 'minute' | 'hour' | 'day';
+}
+/**
+ * Per-grant session policy evaluated by the trust gate BEFORE any decrypt.
+ *
+ * Serialized as the `agent_service_grants.session_policy` JSON column. The column
+ * default `{"mode":"allow"}` makes a bare grant permissive.
+ *
+ * @task T11937
+ */
+export interface SessionPolicy {
+    /** `block` is a hard deny (no decrypt); `allow` permits (subject to other clauses). */
+    readonly mode: 'allow' | 'block';
+    /** Advisory rate cap surfaced on an allow decision (never itself denies). */
+    readonly rateLimit?: SessionRateLimit;
+    /**
+     * When `true`, the connection requires an out-of-band human approval. The gate
+     * DENIES unless the evaluation context carries `approved: true` for this
+     * session.
+     */
+    readonly manualApproval?: boolean;
+}
+/**
+ * Minimal grant projection the gate evaluates — exactly the
+ * `agent_service_grants` columns the decision needs, no token material.
+ *
+ * @task T11937
+ */
+export interface ServiceGrant {
+    /** The granted agent. */
+    readonly agentId: string;
+    /** The connection this grant authorizes. */
+    readonly serviceConnectionId: number;
+    /** The parsed {@link SessionPolicy} (already JSON-decoded from the column). */
+    readonly sessionPolicy: SessionPolicy;
+}
+/**
+ * Context for a single access evaluation.
+ *
+ * @task T11937
+ */
+export interface TrustEvalContext {
+    /** The agent requesting access. */
+    readonly agentId: string;
+    /** The connection the agent wants to use. */
+    readonly serviceConnectionId: number;
+    /**
+     * Whether an out-of-band manual approval has been granted for this session.
+     * Required to pass a `manualApproval: true` policy. Defaults to `false`.
+     */
+    readonly approved?: boolean;
+}
+/**
+ * Reason an access evaluation was DENIED — stable codes for diagnostics/audit.
+ *
+ * @task T11937
+ */
+export type TrustDenyReason = 'no-grant' | 'policy-block' | 'manual-approval-required';
+/**
+ * The pure decision returned by {@link evaluateServiceAccess}.
+ *
+ * On `allowed: false` the accessor MUST NOT decrypt. On `allowed: true` the
+ * accessor may decrypt and (optionally) honor `rateLimit`.
+ *
+ * @task T11937
+ */
+export type TrustDecision = {
+    readonly allowed: true;
+    readonly rateLimit?: SessionRateLimit;
+} | {
+    readonly allowed: false;
+    readonly reason: TrustDenyReason;
+};
+/**
+ * Parse a raw `session_policy` JSON string into a {@link SessionPolicy}, failing
+ * CLOSED (to `block`) on any malformed input.
+ *
+ * SECURITY: a corrupt/unparseable policy must NEVER silently widen access — it
+ * resolves to `{ mode: 'block' }` so the gate denies and no decrypt occurs.
+ *
+ * @param raw - The `agent_service_grants.session_policy` column value.
+ * @returns A well-formed {@link SessionPolicy}; `block` on parse failure.
+ * @task T11937
+ */
+export declare function parseSessionPolicy(raw: string): SessionPolicy;
+/**
+ * Evaluate whether an agent may access a service connection — the **policy-
+ * before-decrypt** chokepoint.
+ *
+ * Pure: takes the agent's grants (already loaded) + the evaluation context and
+ * returns a {@link TrustDecision} WITHOUT touching crypto. The store calls
+ * `decryptGlobal` ONLY when the returned `allowed` is `true`. Deny order:
+ *
+ *  1. no matching grant → `no-grant` (denied).
+ *  2. grant policy `mode: 'block'` → `policy-block` (denied).
+ *  3. policy `manualApproval` set but context not `approved` →
+ *     `manual-approval-required` (denied).
+ *  4. otherwise → allowed (carrying any advisory `rateLimit`).
+ *
+ * @param grants - The agent's grant rows (the accessor loads these from
+ *   `agent_service_grants`). Only grants for `ctx.agentId` /
+ *   `ctx.serviceConnectionId` are considered.
+ * @param ctx - The evaluation context (agent, connection, approval flag).
+ * @returns The access decision. NEVER decrypts.
+ * @task T11937
+ */
+export declare function evaluateServiceAccess(grants: readonly ServiceGrant[], ctx: TrustEvalContext): TrustDecision;
+//# sourceMappingURL=service-trust-gate.d.ts.map

package/dist/store/service-trust-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-trust-gate.d.ts","sourceRoot":"","sources":["../../src/store/service-trust-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,yBAAyB;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4CAA4C;IAC5C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;CACvC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mCAAmC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,cAAc,GAAG,0BAA0B,CAAC;AAEvF;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC;AAElE;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAkC7D;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,GAAG,EAAE,gBAAgB,GACpB,aAAa,CAiBf"}

package/dist/store/service-trust-gate.js

@@ -0,0 +1,122 @@
+/**
+ * Service-vault trust gate — **policy-before-decrypt** per-agent access control.
+ *
+ * EP-UNIVERSAL-SERVICE-VAULT (epic T11765 · saga SG-VAULT-CORE T10409 · M2 W1a ·
+ * task T11937 · AC4). Ports onecli `connect.rs` selective-mode: an agent may use a
+ * service connection ONLY when (a) a row exists in `agent_service_grants` linking
+ * the agent to the connection, AND (b) the grant's `session_policy` evaluates to
+ * an allow. This module evaluates that decision from already-loaded grant data —
+ * it performs ZERO crypto. The store
+ * ({@link import('./service-connections-accessor.js')}) calls `decryptGlobal`
+ * ONLY after this gate returns `allowed: true`, so a denied/blocked agent NEVER
+ * triggers a decrypt (the policy-before-decrypt invariant, proven by unit test).
+ *
+ * ## Why the gate is decrypt-free
+ *
+ * The gate takes the grant rows as INPUT and returns a pure decision. It cannot
+ * decrypt even if it wanted to — it imports no crypto. The decryption chokepoint
+ * lives one layer up (the accessor), guarded by this decision. That separation is
+ * exactly what makes "a denied agent never decrypts" structurally true and
+ * spy-assertable: the spy is placed on `decryptGlobal`, and a deny path returns
+ * before the accessor reaches the decrypt call.
+ *
+ * ## Policy shape ({@link SessionPolicy})
+ *
+ * Mirrors onecli's `PolicyAction` (block / rate-limit / manual-approval) collapsed
+ * to a per-grant JSON:
+ *
+ *   - `mode: 'allow' | 'block'` — `block` is a hard deny (no decrypt).
+ *   - `rateLimit?` — advisory rate cap; the gate surfaces it but does not itself
+ *     count requests (the caller enforces). Presence alone does not deny.
+ *   - `manualApproval?: true` — the connection requires an out-of-band human
+ *     approval that has not been granted for this session → deny (no decrypt)
+ *     until the caller supplies `approved: true` in the evaluation context.
+ *
+ * A bare grant (`{"mode":"allow"}`, the column default) allows.
+ *
+ * @module store/service-trust-gate
+ * @task T11937
+ * @epic T11765
+ * @saga T10409
+ * @see ./service-connections-accessor.ts — the accessor that decrypts ONLY on allow
+ * @see ../../../onecli — `apps/gateway/src/connect.rs` selective-mode (the ported model)
+ */
+/**
+ * Parse a raw `session_policy` JSON string into a {@link SessionPolicy}, failing
+ * CLOSED (to `block`) on any malformed input.
+ *
+ * SECURITY: a corrupt/unparseable policy must NEVER silently widen access — it
+ * resolves to `{ mode: 'block' }` so the gate denies and no decrypt occurs.
+ *
+ * @param raw - The `agent_service_grants.session_policy` column value.
+ * @returns A well-formed {@link SessionPolicy}; `block` on parse failure.
+ * @task T11937
+ */
+export function parseSessionPolicy(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { mode: 'block' };
+    }
+    if (typeof parsed !== 'object' || parsed === null) {
+        return { mode: 'block' };
+    }
+    const obj = parsed;
+    const mode = obj['mode'] === 'block' ? 'block' : obj['mode'] === 'allow' ? 'allow' : 'block';
+    const policy = { mode };
+    if (obj['manualApproval'] === true) {
+        policy.manualApproval = true;
+    }
+    const rl = obj['rateLimit'];
+    if (typeof rl === 'object' && rl !== null) {
+        const rlObj = rl;
+        const maxRequests = rlObj['maxRequests'];
+        const window = rlObj['window'];
+        if (typeof maxRequests === 'number' &&
+            maxRequests > 0 &&
+            (window === 'minute' || window === 'hour' || window === 'day')) {
+            policy.rateLimit = { maxRequests, window };
+        }
+    }
+    return policy;
+}
+/**
+ * Evaluate whether an agent may access a service connection — the **policy-
+ * before-decrypt** chokepoint.
+ *
+ * Pure: takes the agent's grants (already loaded) + the evaluation context and
+ * returns a {@link TrustDecision} WITHOUT touching crypto. The store calls
+ * `decryptGlobal` ONLY when the returned `allowed` is `true`. Deny order:
+ *
+ *  1. no matching grant → `no-grant` (denied).
+ *  2. grant policy `mode: 'block'` → `policy-block` (denied).
+ *  3. policy `manualApproval` set but context not `approved` →
+ *     `manual-approval-required` (denied).
+ *  4. otherwise → allowed (carrying any advisory `rateLimit`).
+ *
+ * @param grants - The agent's grant rows (the accessor loads these from
+ *   `agent_service_grants`). Only grants for `ctx.agentId` /
+ *   `ctx.serviceConnectionId` are considered.
+ * @param ctx - The evaluation context (agent, connection, approval flag).
+ * @returns The access decision. NEVER decrypts.
+ * @task T11937
+ */
+export function evaluateServiceAccess(grants, ctx) {
+    const grant = grants.find((g) => g.agentId === ctx.agentId && g.serviceConnectionId === ctx.serviceConnectionId);
+    if (grant === undefined) {
+        return { allowed: false, reason: 'no-grant' };
+    }
+    const policy = grant.sessionPolicy;
+    if (policy.mode === 'block') {
+        return { allowed: false, reason: 'policy-block' };
+    }
+    if (policy.manualApproval === true && ctx.approved !== true) {
+        return { allowed: false, reason: 'manual-approval-required' };
+    }
+    return policy.rateLimit !== undefined
+        ? { allowed: true, rateLimit: policy.rateLimit }
+        : { allowed: true };
+}
+//# sourceMappingURL=service-trust-gate.js.map

package/dist/store/service-trust-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-trust-gate.js","sourceRoot":"","sources":["../../src/store/service-trust-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AA0FH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7F,MAAM,MAAM,GAIR,EAAE,IAAI,EAAE,CAAC;IACb,IAAI,GAAG,CAAC,gBAAgB,CAAC,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IAC/B,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,EAA6B,CAAC;QAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,IACE,OAAO,WAAW,KAAK,QAAQ;YAC/B,WAAW,GAAG,CAAC;YACf,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,EAC9D,CAAC;YACD,MAAM,CAAC,SAAS,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA+B,EAC/B,GAAqB;IAErB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,mBAAmB,KAAK,GAAG,CAAC,mBAAmB,CACtF,CAAC;IACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC;IACnC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,KAAK,SAAS;QACnC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;QAChD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC"}

package/dist/store/session-store.d.ts

@@ -57,42 +57,81 @@ export declare function workHistory(sessionId: string, limit?: number, cwd?: str
 }>>;
 /** Garbage collect old sessions (mark ended sessions as orphaned after threshold). */
 export declare function gcSessions(maxAgeDays?: number, cwd?: string): Promise<number>;
-/** Get the currently active session (if any). */
+/**
+ * Get the currently active session — the most-recent `status='active'` row.
+ *
+ * @internal LEGACY single-process TTY fallback ONLY (T11640 · Epic T11638).
+ *
+ * This resolves "whoever wrote an active session to the DB most recently",
+ * which is the WRONG identity in any multi-tenant context: under the warm
+ * daemon (many concurrent connections) and under multi-agent spawn isolation
+ * (many worktrees writing the same DB) it collapses every caller's identity
+ * onto the last writer, causing session-bleed and memory scope-leakage.
+ *
+ * Identity-meaning callers — anything that means "the session of whoever is
+ * calling THIS request" — MUST use {@link resolveCurrentSession} /
+ * {@link resolveCurrentSessionId}, which resolve, in order:
+ *   1. the daemon connection handle ({@link getCurrentConnectionSessionId}),
+ *   2. the env-named session (`CLEO_SESSION_ID`, via
+ *      {@link resolveSessionIdFromEnv}),
+ *   3. and only THEN fall back to this most-recent-active row.
+ *
+ * `getActiveSession` survives as that final tier-3 fallback and for genuine
+ * SCAN-meaning callers (e.g. "is there any active session at all?",
+ * `gcSessions`, the data-accessor pass-throughs). The
+ * `lint-no-bare-get-active-session.mjs` gate bans NEW bare callsites so the
+ * identity-vs-scan split cannot silently regress — annotate a justified scan
+ * callsite with a trailing `// get-active-session-allowed: <reason>`.
+ *
+ * @param cwd - Working directory for DB resolution.
+ * @returns The most-recent active session, or `null`.
+ */
 export declare function getActiveSession(cwd?: string): Promise<Session | null>;
 /**
- * Resolve the CALLER's current session, env-first (T11344 · Epic T11284).
+ * Resolve the CALLER's current session (T11344/T11640 · Epics T11284, T11638).
  *
- * THE canonical identity-resolution helper. Replaces bare `getActiveSession()`
- * for any consumer that means "the session of whoever is calling THIS process":
+ * THE canonical identity-resolution helper. Replaces bare {@link getActiveSession}
+ * for any consumer that means "the session of whoever is calling THIS request".
+ * Resolution precedence (first hit wins):
  *
- * 1. If `resolveSessionIdFromEnv()` returns an id AND a session row with that
- *    id exists, return it — this is the spawned agent's OWN session
- *    (`CLEO_SESSION_ID` injected by spawn isolation, T11343).
- * 2. Otherwise fall back to `getActiveSession()` (most-recent active row).
+ * 1. **Daemon connection handle** ({@link getCurrentConnectionSessionId}) — when
+ *    dispatching a request frame on a warm-daemon connection, the connection's
+ *    accept-time-bound session is authoritative. A row with that id is honoured
+ *    when present; when the bound id has no row yet, resolution proceeds (the
+ *    connection asserted an identity that the env/active tiers may still
+ *    satisfy). This is the seam that gives the multi-connection daemon a stable
+ *    per-connection identity (T11640).
+ * 2. **Env-named session** — `resolveSessionIdFromEnv()` (`CLEO_SESSION_ID`
+ *    injected by spawn isolation, T11343); the spawned agent's OWN session.
+ * 3. **Most-recent active row** — {@link getActiveSession}, the legacy
+ *    single-process fallback.
  *
  * Making most-recent-active the FALLBACK rather than the default identity is
  * what dissolves multi-agent session-bleed AND memory scope-leakage: a
  * short-lived `cleo` call in agent A's worktree no longer resolves agent B's
  * session just because B wrote to the DB more recently.
  *
- * The env-named session is honoured even when its status is not `active`
- * (the caller explicitly set `CLEO_SESSION_ID`), so callers that need an
- * active-only guarantee should check `.status` on the result.
+ * The connection-handle and env-named sessions are honoured even when their
+ * status is not `active` (the caller explicitly asserted that id), so callers
+ * that need an active-only guarantee should check `.status` on the result.
  *
  * @param cwd - Working directory for DB resolution.
  * @returns The resolved session, or `null` when none can be resolved.
  * @task T11344
+ * @task T11640
  */
 export declare function resolveCurrentSession(cwd?: string): Promise<Session | null>;
 /**
- * Resolve the CALLER's current session id, env-first (T11344).
+ * Resolve the CALLER's current session id (T11344/T11640).
  *
- * Thin id-only convenience over {@link resolveCurrentSession}. Prefer this over
+ * Thin id-only convenience over {@link resolveCurrentSession} sharing its
+ * connection-handle → env → most-recent-active precedence. Prefer this over
  * `(await getActiveSession())?.id` in identity-resolution hot paths.
  *
  * @param cwd - Working directory for DB resolution.
  * @returns The resolved session id, or `null`.
  * @task T11344
+ * @task T11640
  */
 export declare function resolveCurrentSessionId(cwd?: string): Promise<string | null>;
 //# sourceMappingURL=session-store.d.ts.map

package/dist/store/session-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../src/store/session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AASnD,4BAA4B;AAC5B,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBpF;AAED,2BAA2B;AAC3B,wBAAsB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAUzF;AAED,wBAAwB;AACxB,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAgCzB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,2CAA2C;AAC3C,wBAAsB,YAAY,CAChC,OAAO,CAAC,EAAE;IACR,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,EACD,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,EAAE,CAAC,CAgBpB;AAED,qBAAqB;AACrB,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAgBzB;AAID,gDAAgD;AAChD,wBAAsB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB9F;AAED,sCAAsC;AACtC,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAa1D;AAED,sDAAsD;AACtD,wBAAsB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB7E;AAED,sCAAsC;AACtC,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,MAAW,EAClB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC,CAe7E;AAID,sFAAsF;AACtF,wBAAsB,UAAU,CAAC,UAAU,GAAE,MAAW,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBvF;AAED,iDAAiD;AACjD,wBAAsB,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAY5E;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAQjF;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQlF"}
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../src/store/session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAUnD,4BAA4B;AAC5B,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAuBpF;AAED,2BAA2B;AAC3B,wBAAsB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAUzF;AAED,wBAAwB;AACxB,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAkCzB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,2CAA2C;AAC3C,wBAAsB,YAAY,CAChC,OAAO,CAAC,EAAE;IACR,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,EACD,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,EAAE,CAAC,CAgBpB;AAED,qBAAqB;AACrB,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAgBzB;AAID,gDAAgD;AAChD,wBAAsB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB9F;AAED,sCAAsC;AACtC,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAa1D;AAED,sDAAsD;AACtD,wBAAsB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB7E;AAED,sCAAsC;AACtC,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,MAAW,EAClB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC,CAe7E;AAID,sFAAsF;AACtF,wBAAsB,UAAU,CAAC,UAAU,GAAE,MAAW,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBvF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAY5E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAcjF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAalF"}

package/dist/store/session-store.js

@@ -8,6 +8,7 @@
  * @task T1609 insertHandoffEntry — write-once INSERT path for handoff data
  */
 import { and, desc, eq, isNull } from 'drizzle-orm';
+import { getCurrentConnectionSessionId } from '../sessions/connection-session-handle.js';
 import { resolveSessionIdFromEnv } from '../sessions/session-id.js';
 import { rowToSession } from './converters.js';
 import { getDb } from './sqlite.js';
@@ -31,6 +32,8 @@ export async function createSession(session, cwd) {
         tasksCreatedJson: session.tasksCreated ? JSON.stringify(session.tasksCreated) : '[]',
         startedAt: session.startedAt,
         endedAt: session.endedAt,
+        // Fork-tree parent edge (T11639) — sourced from CLEO_PARENT_SESSION_ID at start.
+        parentSessionId: session.parentSessionId ?? null,
     })
         .run();
     return session;
@@ -75,6 +78,9 @@ export async function updateSession(sessionId, updates, cwd) {
         updateRow.previousSessionId = updates.previousSessionId;
     if (updates.nextSessionId !== undefined)
         updateRow.nextSessionId = updates.nextSessionId;
+    // Fork-tree parent edge (T11639)
+    if (updates.parentSessionId !== undefined)
+        updateRow.parentSessionId = updates.parentSessionId;
     if (updates.agentIdentifier !== undefined)
         updateRow.agentIdentifier = updates.agentIdentifier;
     if (updates.handoffConsumedAt !== undefined)
@@ -226,7 +232,35 @@ export async function gcSessions(maxAgeDays = 30, cwd) {
     }
     return toUpdate.length;
 }
-/** Get the currently active session (if any). */
+/**
+ * Get the currently active session — the most-recent `status='active'` row.
+ *
+ * @internal LEGACY single-process TTY fallback ONLY (T11640 · Epic T11638).
+ *
+ * This resolves "whoever wrote an active session to the DB most recently",
+ * which is the WRONG identity in any multi-tenant context: under the warm
+ * daemon (many concurrent connections) and under multi-agent spawn isolation
+ * (many worktrees writing the same DB) it collapses every caller's identity
+ * onto the last writer, causing session-bleed and memory scope-leakage.
+ *
+ * Identity-meaning callers — anything that means "the session of whoever is
+ * calling THIS request" — MUST use {@link resolveCurrentSession} /
+ * {@link resolveCurrentSessionId}, which resolve, in order:
+ *   1. the daemon connection handle ({@link getCurrentConnectionSessionId}),
+ *   2. the env-named session (`CLEO_SESSION_ID`, via
+ *      {@link resolveSessionIdFromEnv}),
+ *   3. and only THEN fall back to this most-recent-active row.
+ *
+ * `getActiveSession` survives as that final tier-3 fallback and for genuine
+ * SCAN-meaning callers (e.g. "is there any active session at all?",
+ * `gcSessions`, the data-accessor pass-throughs). The
+ * `lint-no-bare-get-active-session.mjs` gate bans NEW bare callsites so the
+ * identity-vs-scan split cannot silently regress — annotate a justified scan
+ * callsite with a trailing `// get-active-session-allowed: <reason>`.
+ *
+ * @param cwd - Working directory for DB resolution.
+ * @returns The most-recent active session, or `null`.
+ */
 export async function getActiveSession(cwd) {
     const db = await getDb(cwd);
     const rows = await db
@@ -241,30 +275,46 @@ export async function getActiveSession(cwd) {
     return rowToSession(rows[0]);
 }
 /**
- * Resolve the CALLER's current session, env-first (T11344 · Epic T11284).
+ * Resolve the CALLER's current session (T11344/T11640 · Epics T11284, T11638).
  *
- * THE canonical identity-resolution helper. Replaces bare `getActiveSession()`
- * for any consumer that means "the session of whoever is calling THIS process":
+ * THE canonical identity-resolution helper. Replaces bare {@link getActiveSession}
+ * for any consumer that means "the session of whoever is calling THIS request".
+ * Resolution precedence (first hit wins):
  *
- * 1. If `resolveSessionIdFromEnv()` returns an id AND a session row with that
- *    id exists, return it — this is the spawned agent's OWN session
- *    (`CLEO_SESSION_ID` injected by spawn isolation, T11343).
- * 2. Otherwise fall back to `getActiveSession()` (most-recent active row).
+ * 1. **Daemon connection handle** ({@link getCurrentConnectionSessionId}) — when
+ *    dispatching a request frame on a warm-daemon connection, the connection's
+ *    accept-time-bound session is authoritative. A row with that id is honoured
+ *    when present; when the bound id has no row yet, resolution proceeds (the
+ *    connection asserted an identity that the env/active tiers may still
+ *    satisfy). This is the seam that gives the multi-connection daemon a stable
+ *    per-connection identity (T11640).
+ * 2. **Env-named session** — `resolveSessionIdFromEnv()` (`CLEO_SESSION_ID`
+ *    injected by spawn isolation, T11343); the spawned agent's OWN session.
+ * 3. **Most-recent active row** — {@link getActiveSession}, the legacy
+ *    single-process fallback.
  *
  * Making most-recent-active the FALLBACK rather than the default identity is
  * what dissolves multi-agent session-bleed AND memory scope-leakage: a
  * short-lived `cleo` call in agent A's worktree no longer resolves agent B's
  * session just because B wrote to the DB more recently.
  *
- * The env-named session is honoured even when its status is not `active`
- * (the caller explicitly set `CLEO_SESSION_ID`), so callers that need an
- * active-only guarantee should check `.status` on the result.
+ * The connection-handle and env-named sessions are honoured even when their
+ * status is not `active` (the caller explicitly asserted that id), so callers
+ * that need an active-only guarantee should check `.status` on the result.
  *
  * @param cwd - Working directory for DB resolution.
  * @returns The resolved session, or `null` when none can be resolved.
  * @task T11344
+ * @task T11640
  */
 export async function resolveCurrentSession(cwd) {
+    const connId = getCurrentConnectionSessionId();
+    if (connId) {
+        const byConn = await getSession(connId, cwd);
+        if (byConn)
+            return byConn;
+        // connection named a session with no row yet — fall through to env/active.
+    }
     const envId = resolveSessionIdFromEnv();
     if (envId) {
         const byEnv = await getSession(envId, cwd);
@@ -275,16 +325,24 @@ export async function resolveCurrentSession(cwd) {
     return getActiveSession(cwd);
 }
 /**
- * Resolve the CALLER's current session id, env-first (T11344).
+ * Resolve the CALLER's current session id (T11344/T11640).
  *
- * Thin id-only convenience over {@link resolveCurrentSession}. Prefer this over
+ * Thin id-only convenience over {@link resolveCurrentSession} sharing its
+ * connection-handle → env → most-recent-active precedence. Prefer this over
  * `(await getActiveSession())?.id` in identity-resolution hot paths.
  *
  * @param cwd - Working directory for DB resolution.
  * @returns The resolved session id, or `null`.
  * @task T11344
+ * @task T11640
  */
 export async function resolveCurrentSessionId(cwd) {
+    const connId = getCurrentConnectionSessionId();
+    if (connId) {
+        const byConn = await getSession(connId, cwd);
+        if (byConn)
+            return byConn.id;
+    }
     const envId = resolveSessionIdFromEnv();
     if (envId) {
         const byEnv = await getSession(envId, cwd);

package/dist/store/session-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.js","sourceRoot":"","sources":["../../src/store/session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAE5C,0BAA0B;AAE1B,4BAA4B;AAC5B,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,GAAY;IAChE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC5B,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;SACvB,MAAM,CAAC;QACN,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,WAAW,EAAE,EAAE,EAAE,MAAM;QACvB,aAAa,EAAE,EAAE,EAAE,KAAK;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/D,kBAAkB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1F,gBAAgB,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;QACpF,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;SACD,GAAG,EAAE,CAAC;IAET,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2BAA2B;AAC3B,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB,EAAE,GAAY;IAC9D,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;SACxC,GAAG,EAAE,CAAC;IAET,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;AAChC,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB,EACjB,OAAyB,EACzB,GAAY;IAEZ,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,SAAS,GAA4B,EAAE,CAAC;IAE9C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,SAAS,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IACpE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACvE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,SAAS,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IACjE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS;QACtC,SAAS,CAAC,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QACpC,SAAS,CAAC,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACpE,+BAA+B;IAC/B,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS;QACzC,SAAS,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAC1D,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;QAAE,SAAS,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IACzF,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;QAAE,SAAS,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAC/F,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS;QACzC,SAAS,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAC1D,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS;QACzC,SAAS,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAC1D,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,SAAS,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACnF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,SAAS,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAEnF,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAEzF,OAAO,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB,EACjB,WAAmB,EACnB,GAAY;IAEZ,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;AACnF,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAGC,EACD,GAAY;IAEZ,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAE5B,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,KAAK,GAAG,EAAE;SACb,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;SACrB,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;SAC7D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAE5C,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;IACzF,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAChC,CAAC;AAED,qBAAqB;AACrB,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,IAAa,EACb,GAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,OAAO,GAAqB;QAChC,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC;IAEF,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;IACxB,CAAC;IAED,OAAO,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,+BAA+B;AAE/B,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAY;IAC7E,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,oDAAoD;IACpD,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;SAC9B,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,EAC/C,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CACzC,CACF;SACA,GAAG,EAAE,CAAC;IAET,kCAAkC;IAClC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAElF,gCAAgC;IAChC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;SACvB,GAAG,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;SAChD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;SACxC,GAAG,EAAE,CAAC;AACX,CAAC;AAED,sCAAsC;AACtC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,GAAY;IAEZ,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC;QACN,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW;QACxC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa;KAC7C,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;SACxC,GAAG,EAAE,CAAC;IAET,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC5D,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,aAAa,EAAE,CAAC;AACzE,CAAC;AAED,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,SAAiB,EAAE,GAAY;IAC5D,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,mCAAmC;IACnC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;SAC9B,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,EAC/C,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CACzC,CACF;SACA,GAAG,EAAE,CAAC;IAET,+BAA+B;IAC/B,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;SACvB,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC/C,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;SACxC,GAAG,EAAE,CAAC;AACX,CAAC;AAED,sCAAsC;AACtC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,QAAgB,EAAE,EAClB,GAAY;IAEZ,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;SAC5B,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;SACtD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;SAC5E,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,EAAE,CAAC;IAET,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,4BAA4B;AAE5B,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,aAAqB,EAAE,EAAE,GAAY;IACpE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC;IAEpD,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;SAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;SAC/C,GAAG,EAAE,CAAC;IAET,MAAM,QAAQ,GAAG,MAAM,CAAC;IAExB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;aACvB,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;aAC3B,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;aAC1C,GAAG,EAAE,CAAC;IACX,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AAED,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAY;IACjD,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;SAC3C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;SACxC,KAAK,CAAC,CAAC,CAAC;SACR,GAAG,EAAE,CAAC;IAET,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAY;IACtD,MAAM,KAAK,GAAG,uBAAuB,EAAE,CAAC;IACxC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,uEAAuE;IACzE,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAAY;IACxD,MAAM,KAAK,GAAG,uBAAuB,EAAE,CAAC;IACxC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,EAAE,CAAC;IAC7B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,MAAM,EAAE,EAAE,IAAI,IAAI,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"session-store.js","sourceRoot":"","sources":["../../src/store/session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAE5C,0BAA0B;AAE1B,4BAA4B;AAC5B,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,GAAY;IAChE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC5B,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;SACvB,MAAM,CAAC;QACN,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,WAAW,EAAE,EAAE,EAAE,MAAM;QACvB,aAAa,EAAE,EAAE,EAAE,KAAK;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/D,kBAAkB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1F,gBAAgB,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;QACpF,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iFAAiF;QACjF,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;KACjD,CAAC;SACD,GAAG,EAAE,CAAC;IAET,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2BAA2B;AAC3B,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB,EAAE,GAAY;IAC9D,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;SACxC,GAAG,EAAE,CAAC;IAET,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;AAChC,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB,EACjB,OAAyB,EACzB,GAAY;IAEZ,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,SAAS,GAA4B,EAAE,CAAC;IAE9C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,SAAS,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IACpE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACvE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,SAAS,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IACjE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS;QACtC,SAAS,CAAC,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QACpC,SAAS,CAAC,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACpE,+BAA+B;IAC/B,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS;QACzC,SAAS,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAC1D,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;QAAE,SAAS,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IACzF,iCAAiC;IACjC,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;QAAE,SAAS,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAC/F,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;QAAE,SAAS,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAC/F,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS;QACzC,SAAS,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAC1D,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS;QACzC,SAAS,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAC1D,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,SAAS,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACnF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,SAAS,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAEnF,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAEzF,OAAO,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB,EACjB,WAAmB,EACnB,GAAY;IAEZ,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;AACnF,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAGC,EACD,GAAY;IAEZ,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAE5B,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,KAAK,GAAG,EAAE;SACb,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;SACrB,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;SAC7D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAE5C,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;IACzF,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAChC,CAAC;AAED,qBAAqB;AACrB,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,IAAa,EACb,GAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,OAAO,GAAqB;QAChC,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC;IAEF,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;IACxB,CAAC;IAED,OAAO,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,+BAA+B;AAE/B,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAY;IAC7E,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,oDAAoD;IACpD,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;SAC9B,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,EAC/C,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CACzC,CACF;SACA,GAAG,EAAE,CAAC;IAET,kCAAkC;IAClC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAElF,gCAAgC;IAChC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;SACvB,GAAG,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;SAChD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;SACxC,GAAG,EAAE,CAAC;AACX,CAAC;AAED,sCAAsC;AACtC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,GAAY;IAEZ,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC;QACN,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW;QACxC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa;KAC7C,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;SACxC,GAAG,EAAE,CAAC;IAET,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC5D,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,aAAa,EAAE,CAAC;AACzE,CAAC;AAED,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,SAAiB,EAAE,GAAY;IAC5D,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,mCAAmC;IACnC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;SAC9B,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,EAC/C,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CACzC,CACF;SACA,GAAG,EAAE,CAAC;IAET,+BAA+B;IAC/B,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;SACvB,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC/C,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;SACxC,GAAG,EAAE,CAAC;AACX,CAAC;AAED,sCAAsC;AACtC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,QAAgB,EAAE,EAClB,GAAY;IAEZ,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;SAC5B,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;SACtD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;SAC5E,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,EAAE,CAAC;IAET,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,4BAA4B;AAE5B,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,aAAqB,EAAE,EAAE,GAAY;IACpE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC;IAEpD,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;SAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;SAC/C,GAAG,EAAE,CAAC;IAET,MAAM,QAAQ,GAAG,MAAM,CAAC;IAExB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;aACvB,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;aAC3B,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;aAC1C,GAAG,EAAE,CAAC;IACX,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAY;IACjD,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;SAC3C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;SACxC,KAAK,CAAC,CAAC,CAAC;SACR,GAAG,EAAE,CAAC;IAET,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAY;IACtD,MAAM,MAAM,GAAG,6BAA6B,EAAE,CAAC;IAC/C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,2EAA2E;IAC7E,CAAC;IACD,MAAM,KAAK,GAAG,uBAAuB,EAAE,CAAC;IACxC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,uEAAuE;IACzE,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAAY;IACxD,MAAM,MAAM,GAAG,6BAA6B,EAAE,CAAC;IAC/C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,KAAK,GAAG,uBAAuB,EAAE,CAAC;IACxC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,EAAE,CAAC;IAC7B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,MAAM,EAAE,EAAE,IAAI,IAAI,CAAC;AAC5B,CAAC"}

package/dist/store/sqlite-data-accessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite-data-accessor.d.ts","sourceRoot":"","sources":["../../src/store/sqlite-data-accessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH,OAAO,KAAK,EAEV,YAAY,EAOb,MAAM,oBAAoB,CAAC;AAwG5B,yDAAyD;AACzD,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC,CAWf;AAID;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAotClF"}
+{"version":3,"file":"sqlite-data-accessor.d.ts","sourceRoot":"","sources":["../../src/store/sqlite-data-accessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH,OAAO,KAAK,EAEV,YAAY,EAOb,MAAM,oBAAoB,CAAC;AAyG5B,yDAAyD;AACzD,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC,CAWf;AAID;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA2tClF"}

package/dist/store/sqlite-data-accessor.js

@@ -15,6 +15,7 @@ import { and, eq, inArray, isNull, like, ne, notInArray, or, sql } from 'drizzle
 import { archivedTaskToRow, rowToSession, rowToTask, taskToRow } from './converters.js';
 import { cleanupBrainRefsOnSessionDelete } from './cross-db-cleanup.js';
 import { batchUpdateDependencies, loadDependenciesForTasks, loadRelationsForTasks, updateDependencies, upsertSession, upsertTask, } from './db-helpers.js';
+import { resolveCurrentSession } from './session-store.js';
 import { closeDb, getDb, getNativeTasksDb } from './sqlite.js';
 import { TERMINAL_TASK_STATUSES } from './status-registry.js';
 import * as schema from './tasks-schema.js';
@@ -501,6 +502,12 @@ export async function createSqliteDataAccessor(cwd) {
                 return null;
             return rowToSession(rows[0]);
         },
+        async resolveCurrentSession() {
+            // T11640 — identity-meaning resolution (connection-handle → env → active).
+            // Delegates to the canonical resolver so accessor-based callers share the
+            // same precedence as bare `resolveCurrentSession()` consumers.
+            return resolveCurrentSession(cwd);
+        },
         async upsertSingleSession(session) {
             const db = await getDb(cwd);
             await upsertSession(db, session);