agor-live 0.21.2 → 0.23.1

package/dist/daemon/services/knowledge-reindex.js

@@ -1,6 +1,9 @@
 // src/services/knowledge-reindex.ts
 import { loadConfig } from "@agor/core/config";
-import { AppVariableRepository, isPostgresDatabase as isPostgresDatabase2 } from "@agor/core/db";
+import {
+  AppVariableRepository,
+  isPostgresDatabase as isPostgresDatabase2
+} from "@agor/core/db";
 
 // src/knowledge/embeddings.ts
 import { createHash } from "crypto";
@@ -35,6 +38,28 @@ function rowsOf(result) {
 function boolValue(value) {
   return value === true || value === "t" || value === "true" || value === 1 || value === "1";
 }
+async function ensureEmbeddingTenantIsolation(db) {
+  await executeRaw(
+    db,
+    sql`ALTER TABLE kb_unit_embeddings ADD COLUMN IF NOT EXISTS tenant_id text DEFAULT 'default' NOT NULL`
+  );
+  await executeRaw(
+    db,
+    sql`CREATE INDEX IF NOT EXISTS kb_unit_embeddings_tenant_id_idx ON kb_unit_embeddings USING btree (tenant_id)`
+  );
+  await executeRaw(db, sql`ALTER TABLE kb_unit_embeddings ENABLE ROW LEVEL SECURITY`);
+  await executeRaw(db, sql`ALTER TABLE kb_unit_embeddings FORCE ROW LEVEL SECURITY`);
+  await executeRaw(
+    db,
+    sql`DROP POLICY IF EXISTS tenant_isolation_kb_unit_embeddings ON kb_unit_embeddings`
+  );
+  await executeRaw(
+    db,
+    sql`CREATE POLICY tenant_isolation_kb_unit_embeddings ON kb_unit_embeddings
+      USING (tenant_id = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+      WITH CHECK (tenant_id = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))`
+  );
+}
 async function readCapability(db) {
   if (!isPostgresDatabase(db)) {
     return {
@@ -117,6 +142,7 @@ async function ensureKnowledgePgvectorStorage(db) {
       await executeRaw(
         db,
         sql`CREATE TABLE IF NOT EXISTS kb_unit_embeddings (
+          tenant_id text DEFAULT 'default' NOT NULL,
           unit_id varchar(36) NOT NULL REFERENCES public.kb_document_units(unit_id) ON DELETE cascade,
           embedding_space_id varchar(36) NOT NULL REFERENCES public.kb_embedding_spaces(embedding_space_id) ON DELETE cascade,
           content_sha256 text NOT NULL,
@@ -129,6 +155,7 @@ async function ensureKnowledgePgvectorStorage(db) {
       );
       capability.tableReady = true;
     }
+    await ensureEmbeddingTenantIsolation(db);
     if (!capability.spaceIndexReady) {
       await executeRaw(
         db,

package/dist/daemon/services/knowledge-search.d.ts

@@ -1,7 +1,7 @@
 /**
  * Knowledge search service
  */
-import { type Database, type KnowledgeSearchQuery } from '@agor/core/db';
+import { type KnowledgeSearchQuery, type TenantScopeAwareDatabase } from '@agor/core/db';
 import { type AuthenticatedParams, type KnowledgeSearchResult, type QueryParams } from '@agor/core/types';
 export type KnowledgeSearchParams = QueryParams<KnowledgeSearchQuery> & AuthenticatedParams;
 export declare class KnowledgeSearchService {
@@ -11,7 +11,7 @@ export declare class KnowledgeSearchService {
     private namespaces;
     private variables;
     private embeddingProvider;
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
     private canRead;
     private filterReadable;
     private assertSupportedMode;
@@ -24,5 +24,5 @@ export declare class KnowledgeSearchService {
     find(params?: KnowledgeSearchParams): Promise<KnowledgeSearchResult[]>;
     create(data: KnowledgeSearchQuery, params?: KnowledgeSearchParams): Promise<KnowledgeSearchResult[]>;
 }
-export declare function createKnowledgeSearchService(db: Database): KnowledgeSearchService;
+export declare function createKnowledgeSearchService(db: TenantScopeAwareDatabase): KnowledgeSearchService;
 //# sourceMappingURL=knowledge-search.d.ts.map

package/dist/daemon/services/knowledge-search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"knowledge-search.d.ts","sourceRoot":"","sources":["../../src/services/knowledge-search.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAEL,KAAK,QAAQ,EAKb,KAAK,oBAAoB,EAG1B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,KAAK,mBAAmB,EAExB,KAAK,qBAAqB,EAE1B,KAAK,WAAW,EAEjB,MAAM,kBAAkB,CAAC;AAiB1B,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC,oBAAoB,CAAC,GAAG,mBAAmB,CAAC;AAE5F,qBAAa,sBAAsB;IAOrB,OAAO,CAAC,EAAE;IANtB,OAAO,CAAC,IAAI,CAA4B;IACxC,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,iBAAiB,CAAiC;gBAEtC,EAAE,EAAE,QAAQ;YAOlB,OAAO;YAOP,cAAc;IAW5B,OAAO,CAAC,mBAAmB;YAUb,WAAW;IAyBzB,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,kBAAkB;YASZ,uBAAuB;YAcvB,cAAc;IA0N5B,OAAO,CAAC,WAAW;IAqBb,IAAI,CAAC,MAAM,CAAC,EAAE,qBAAqB;IAiBnC,MAAM,CAAC,IAAI,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,qBAAqB;CAgBxE;AAED,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,QAAQ,GAAG,sBAAsB,CAEjF"}
+{"version":3,"file":"knowledge-search.d.ts","sourceRoot":"","sources":["../../src/services/knowledge-search.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAML,KAAK,oBAAoB,EAGzB,KAAK,wBAAwB,EAC9B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,KAAK,mBAAmB,EAExB,KAAK,qBAAqB,EAE1B,KAAK,WAAW,EAEjB,MAAM,kBAAkB,CAAC;AAiB1B,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC,oBAAoB,CAAC,GAAG,mBAAmB,CAAC;AAE5F,qBAAa,sBAAsB;IAOrB,OAAO,CAAC,EAAE;IANtB,OAAO,CAAC,IAAI,CAA4B;IACxC,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,iBAAiB,CAAiC;gBAEtC,EAAE,EAAE,wBAAwB;YAOlC,OAAO;YAOP,cAAc;IAW5B,OAAO,CAAC,mBAAmB;YAUb,WAAW;IAyBzB,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,kBAAkB;YASZ,uBAAuB;YAcvB,cAAc;IA0N5B,OAAO,CAAC,WAAW;IAqBb,IAAI,CAAC,MAAM,CAAC,EAAE,qBAAqB;IAiBnC,MAAM,CAAC,IAAI,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,qBAAqB;CAgBxE;AAED,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,wBAAwB,GAAG,sBAAsB,CAEjG"}

package/dist/daemon/services/knowledge-settings.d.ts

@@ -1,5 +1,5 @@
 import { type AgorKnowledgeSettings } from '@agor/core/config';
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { Application } from '@agor/core/feathers';
 import type { AuthenticatedParams, KnowledgeEmbeddingProvider, KnowledgeSemanticSettingsPublic, Params } from '@agor/core/types';
 type KnowledgeSemanticSearchSettings = NonNullable<AgorKnowledgeSettings['semantic_search']>;
@@ -17,7 +17,7 @@ export declare class KnowledgeSettingsService {
     private db;
     private app?;
     private variables;
-    constructor(db: Database, app?: Application | undefined);
+    constructor(db: TenantScopeAwareDatabase, app?: Application | undefined);
     private publicSettings;
     private validateChunking;
     private markCurrentUnitsForEmbedding;
@@ -26,6 +26,6 @@ export declare class KnowledgeSettingsService {
     patch(_id: null, data: KnowledgeSettingsPatch, params?: KnowledgeSettingsParams): Promise<KnowledgeSemanticSettingsPublic>;
     create(data: KnowledgeSettingsPatch, params?: KnowledgeSettingsParams): Promise<KnowledgeSemanticSettingsPublic>;
 }
-export declare function createKnowledgeSettingsService(db: Database, app?: Application): KnowledgeSettingsService;
+export declare function createKnowledgeSettingsService(db: TenantScopeAwareDatabase, app?: Application): KnowledgeSettingsService;
 export {};
 //# sourceMappingURL=knowledge-settings.d.ts.map

package/dist/daemon/services/knowledge-settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"knowledge-settings.d.ts","sourceRoot":"","sources":["../../src/services/knowledge-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,qBAAqB,EAA0B,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAEL,KAAK,QAAQ,EAMd,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,KAAK,EACV,mBAAmB,EACnB,0BAA0B,EAE1B,+BAA+B,EAC/B,MAAM,EAGP,MAAM,kBAAkB,CAAC;AAoB1B,KAAK,+BAA+B,GAAG,WAAW,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAG7F,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,0BAA0B,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,+BAA+B,CAAC,UAAU,CAAC,CAAC;IACvD,QAAQ,CAAC,EAAE,+BAA+B,CAAC,UAAU,CAAC,CAAC;CACxD;AAED,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,mBAAmB,CAAC;AAEnE,qBAAa,wBAAwB;IAIjC,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,GAAG,CAAC;IAJd,OAAO,CAAC,SAAS,CAAwB;gBAG/B,EAAE,EAAE,QAAQ,EACZ,GAAG,CAAC,EAAE,WAAW,YAAA;YAKb,cAAc;IAkB5B,OAAO,CAAC,gBAAgB;YAwCV,4BAA4B;IA2B1C,OAAO,CAAC,WAAW;IAOb,IAAI,CAAC,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,+BAA+B,CAAC;IAIjF,KAAK,CACT,GAAG,EAAE,IAAI,EACT,IAAI,EAAE,sBAAsB,EAC5B,MAAM,CAAC,EAAE,uBAAuB,GAC/B,OAAO,CAAC,+BAA+B,CAAC;IAyFrC,MAAM,CAAC,IAAI,EAAE,sBAAsB,EAAE,MAAM,CAAC,EAAE,uBAAuB;CAG5E;AAED,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,QAAQ,EACZ,GAAG,CAAC,EAAE,WAAW,GAChB,wBAAwB,CAE1B"}
+{"version":3,"file":"knowledge-settings.d.ts","sourceRoot":"","sources":["../../src/services/knowledge-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,qBAAqB,EAA0B,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAML,KAAK,wBAAwB,EAE9B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,KAAK,EACV,mBAAmB,EACnB,0BAA0B,EAE1B,+BAA+B,EAC/B,MAAM,EAGP,MAAM,kBAAkB,CAAC;AAoB1B,KAAK,+BAA+B,GAAG,WAAW,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAG7F,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,0BAA0B,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,+BAA+B,CAAC,UAAU,CAAC,CAAC;IACvD,QAAQ,CAAC,EAAE,+BAA+B,CAAC,UAAU,CAAC,CAAC;CACxD;AAED,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,mBAAmB,CAAC;AAEnE,qBAAa,wBAAwB;IAIjC,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,GAAG,CAAC;IAJd,OAAO,CAAC,SAAS,CAAwB;gBAG/B,EAAE,EAAE,wBAAwB,EAC5B,GAAG,CAAC,EAAE,WAAW,YAAA;YAKb,cAAc;IAkB5B,OAAO,CAAC,gBAAgB;YAwCV,4BAA4B;IA2B1C,OAAO,CAAC,WAAW;IAOb,IAAI,CAAC,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,+BAA+B,CAAC;IAIjF,KAAK,CACT,GAAG,EAAE,IAAI,EACT,IAAI,EAAE,sBAAsB,EAC5B,MAAM,CAAC,EAAE,uBAAuB,GAC/B,OAAO,CAAC,+BAA+B,CAAC;IAyFrC,MAAM,CAAC,IAAI,EAAE,sBAAsB,EAAE,MAAM,CAAC,EAAE,uBAAuB;CAG5E;AAED,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,wBAAwB,EAC5B,GAAG,CAAC,EAAE,WAAW,GAChB,wBAAwB,CAE1B"}

package/dist/daemon/services/knowledge-settings.js

@@ -52,6 +52,28 @@ function rowsOf(result) {
 function boolValue(value) {
   return value === true || value === "t" || value === "true" || value === 1 || value === "1";
 }
+async function ensureEmbeddingTenantIsolation(db) {
+  await executeRaw(
+    db,
+    sql`ALTER TABLE kb_unit_embeddings ADD COLUMN IF NOT EXISTS tenant_id text DEFAULT 'default' NOT NULL`
+  );
+  await executeRaw(
+    db,
+    sql`CREATE INDEX IF NOT EXISTS kb_unit_embeddings_tenant_id_idx ON kb_unit_embeddings USING btree (tenant_id)`
+  );
+  await executeRaw(db, sql`ALTER TABLE kb_unit_embeddings ENABLE ROW LEVEL SECURITY`);
+  await executeRaw(db, sql`ALTER TABLE kb_unit_embeddings FORCE ROW LEVEL SECURITY`);
+  await executeRaw(
+    db,
+    sql`DROP POLICY IF EXISTS tenant_isolation_kb_unit_embeddings ON kb_unit_embeddings`
+  );
+  await executeRaw(
+    db,
+    sql`CREATE POLICY tenant_isolation_kb_unit_embeddings ON kb_unit_embeddings
+      USING (tenant_id = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+      WITH CHECK (tenant_id = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))`
+  );
+}
 async function readCapability(db) {
   if (!isPostgresDatabase(db)) {
     return {
@@ -137,6 +159,7 @@ async function ensureKnowledgePgvectorStorage(db) {
       await executeRaw(
         db,
         sql`CREATE TABLE IF NOT EXISTS kb_unit_embeddings (
+          tenant_id text DEFAULT 'default' NOT NULL,
           unit_id varchar(36) NOT NULL REFERENCES public.kb_document_units(unit_id) ON DELETE cascade,
           embedding_space_id varchar(36) NOT NULL REFERENCES public.kb_embedding_spaces(embedding_space_id) ON DELETE cascade,
           content_sha256 text NOT NULL,
@@ -149,6 +172,7 @@ async function ensureKnowledgePgvectorStorage(db) {
       );
       capability.tableReady = true;
     }
+    await ensureEmbeddingTenantIsolation(db);
     if (!capability.spaceIndexReady) {
       await executeRaw(
         db,

package/dist/daemon/services/knowledge-versions.d.ts

@@ -1,7 +1,7 @@
 /**
  * Knowledge document versions service
  */
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import { type AuthenticatedParams, type KnowledgeDocumentVersion, type QueryParams } from '@agor/core/types';
 import { DrizzleService } from '../adapters/drizzle';
 export type KnowledgeVersionParams = QueryParams<{
@@ -18,7 +18,7 @@ export declare class KnowledgeVersionsService extends DrizzleService<KnowledgeDo
     private versions;
     private documents;
     private namespaces;
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
     private canRead;
     find(params?: KnowledgeVersionParams): Promise<KnowledgeDocumentVersion[]>;
     get(): Promise<never>;
@@ -27,5 +27,5 @@ export declare class KnowledgeVersionsService extends DrizzleService<KnowledgeDo
     update(): Promise<never>;
     remove(): Promise<never>;
 }
-export declare function createKnowledgeVersionsService(db: Database): KnowledgeVersionsService;
+export declare function createKnowledgeVersionsService(db: TenantScopeAwareDatabase): KnowledgeVersionsService;
 //# sourceMappingURL=knowledge-versions.d.ts.map

package/dist/daemon/services/knowledge-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"knowledge-versions.d.ts","sourceRoot":"","sources":["../../src/services/knowledge-versions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EACL,KAAK,QAAQ,EAId,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,KAAK,mBAAmB,EAExB,KAAK,wBAAwB,EAE7B,KAAK,WAAW,EAEjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGrD,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,GACA,mBAAmB,CAAC;AAEtB,qBAAa,wBAAyB,SAAQ,cAAc,CAC1D,wBAAwB,EACxB,OAAO,CAAC,wBAAwB,CAAC,EACjC,sBAAsB,CACvB;IACC,OAAO,CAAC,QAAQ,CAAqC;IACrD,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,UAAU,CAA+B;gBAErC,EAAE,EAAE,QAAQ;YAeV,OAAO;IAIf,IAAI,CAAC,MAAM,CAAC,EAAE,sBAAsB;IAiCpC,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC;IAIrB,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IAIxB,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAIvB,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IAIxB,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;CAG/B;AAED,wBAAgB,8BAA8B,CAAC,EAAE,EAAE,QAAQ,GAAG,wBAAwB,CAErF"}
+{"version":3,"file":"knowledge-versions.d.ts","sourceRoot":"","sources":["../../src/services/knowledge-versions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,KAAK,mBAAmB,EAExB,KAAK,wBAAwB,EAE7B,KAAK,WAAW,EAEjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGrD,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,GACA,mBAAmB,CAAC;AAEtB,qBAAa,wBAAyB,SAAQ,cAAc,CAC1D,wBAAwB,EACxB,OAAO,CAAC,wBAAwB,CAAC,EACjC,sBAAsB,CACvB;IACC,OAAO,CAAC,QAAQ,CAAqC;IACrD,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,UAAU,CAA+B;gBAErC,EAAE,EAAE,wBAAwB;YAe1B,OAAO;IAIf,IAAI,CAAC,MAAM,CAAC,EAAE,sBAAsB;IAiCpC,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC;IAIrB,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IAIxB,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAIvB,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IAIxB,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;CAG/B;AAED,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,wBAAwB,GAC3B,wBAAwB,CAE1B"}

package/dist/daemon/services/knowledge-versions.js

@@ -27,6 +27,34 @@ var DrizzleService = class {
   // Event emitter for FeathersJS (will be injected by framework)
   // biome-ignore lint/suspicious/noExplicitAny: FeathersJS event system
   emit;
+  /** Extract resolved tenant context from Feathers params. */
+  getTenant(params) {
+    return params?.tenant;
+  }
+  /**
+   * Whether a row belongs to the current tenant. Rows from pre-migration test
+   * fixtures that do not expose tenant_id are treated as visible so existing
+   * single-tenant unit tests keep working; migrated DB rows always carry it.
+   */
+  rowBelongsToTenant(row, tenant) {
+    if (!tenant) return true;
+    const record = row;
+    if (!("tenant_id" in record)) return true;
+    return record.tenant_id === tenant.tenant_id;
+  }
+  /** Stamp tenant_id onto created rows and prevent client-supplied drift. */
+  withTenant(data, params) {
+    const tenant = this.getTenant(params);
+    if (!tenant || !data || typeof data !== "object" || Array.isArray(data)) return data;
+    return { ...data, tenant_id: tenant.tenant_id };
+  }
+  /** Never allow a patch/update to move a row across tenants. */
+  stripTenantMutation(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) return data;
+    const clone = { ...data };
+    delete clone.tenant_id;
+    return clone;
+  }
   /**
    * Extract query parameters from params
    */
@@ -118,12 +146,28 @@ var DrizzleService = class {
       data: paginated
     };
   }
+  /**
+   * Resolve the candidate row set that `find` filters, sorts, and paginates.
+   *
+   * The base implementation reads the whole table and relies on `filterData` to
+   * narrow it in memory. Subclasses may override this to push high-selectivity
+   * predicates into SQL; because `find` always re-applies every query filter via
+   * `filterData`, an override only needs to return a superset of the matching
+   * rows for the result to stay identical.
+   */
+  async fetchData(_query, _params) {
+    return this.repository.findAll();
+  }
   /**
    * Find records
    */
   async find(params) {
     const query = this.getQuery(params);
-    let data = await this.repository.findAll();
+    let data = await this.fetchData(query, params);
+    const tenant = this.getTenant(params);
+    if (tenant) {
+      data = data.filter((row) => this.rowBelongsToTenant(row, tenant));
+    }
     data = this.filterData(data, query);
     const total = data.length;
     data = this.sortData(data, query.$sort);
@@ -135,10 +179,13 @@ var DrizzleService = class {
    */
   async get(id, _params) {
     const prefetched = _params?._agorPrefetchedRecord;
-    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id)) {
+    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id) && this.rowBelongsToTenant(prefetched.record, this.getTenant(_params))) {
       return prefetched.record;
     }
     const result = await this.repository.findById(String(id));
+    if (result && !this.rowBelongsToTenant(result, this.getTenant(_params))) {
+      throw new NotFoundError(this.resourceType, String(id));
+    }
     if (!result) {
       throw new NotFoundError(this.resourceType, String(id));
     }
@@ -150,14 +197,18 @@ var DrizzleService = class {
   async create(data, params) {
     if (Array.isArray(data)) {
       const results = await Promise.all(
-        data.map((item) => this.repository.create(item))
+        data.map(
+          (item) => this.repository.create(this.withTenant(item, params))
+        )
       );
       for (const result2 of results) {
         this.emit?.("created", result2, params);
       }
       return results;
     }
-    const result = await this.repository.create(data);
+    const result = await this.repository.create(
+      this.withTenant(data, params)
+    );
     this.emit?.("created", result, params);
     return result;
   }
@@ -173,7 +224,10 @@ var DrizzleService = class {
    */
   async update(id, data, params) {
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("updated", result, params);
     return result;
   }
@@ -187,12 +241,14 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       const results = await Promise.all(
         records.map(
           (record) => this.repository.update(
             record[this.id],
-            data
+            this.stripTenantMutation(data)
           )
         )
       );
@@ -202,7 +258,10 @@ var DrizzleService = class {
       return results;
     }
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("patched", result, params);
     return result;
   }
@@ -216,6 +275,8 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       await Promise.all(records.map((record) => this.repository.delete(record[this.id])));
       for (const record of records) {

package/dist/daemon/services/leaderboard.d.ts

@@ -5,7 +5,7 @@
  * Allows breakdown by user, branch, repo, model, and agentic tool, with
  * optional time bucketing (hour/day/week/month) and flexible filtering.
  */
-import { type Database, type DateBucket } from '@agor/core/db';
+import { type DateBucket, type TenantScopeAwareDatabase } from '@agor/core/db';
 interface Params {
     query?: Record<string, unknown>;
 }
@@ -14,10 +14,18 @@ interface Params {
  * e.g. `'user,model'` or `'tool,branch,repo'`.
  */
 export type LeaderboardDimension = 'user' | 'branch' | 'repo' | 'model' | 'tool';
+type StringFilterValue = string | string[];
 export interface LeaderboardQuery {
-    userId?: string;
-    branchId?: string;
-    repoId?: string;
+    userId?: StringFilterValue;
+    userIds?: StringFilterValue;
+    branchId?: StringFilterValue;
+    branchIds?: StringFilterValue;
+    repoId?: StringFilterValue;
+    repoIds?: StringFilterValue;
+    model?: StringFilterValue;
+    models?: StringFilterValue;
+    tool?: StringFilterValue;
+    tools?: StringFilterValue;
     startDate?: string;
     endDate?: string;
     groupBy?: string;
@@ -61,7 +69,7 @@ export interface LeaderboardResult {
  */
 export declare class LeaderboardService {
     private db;
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
     /**
      * Find leaderboard entries with filters and sorting
      */
@@ -74,6 +82,6 @@ export declare class LeaderboardService {
 /**
  * Service factory function
  */
-export declare function createLeaderboardService(db: Database): LeaderboardService;
+export declare function createLeaderboardService(db: TenantScopeAwareDatabase): LeaderboardService;
 export {};
 //# sourceMappingURL=leaderboard.d.ts.map

package/dist/daemon/services/leaderboard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"leaderboard.d.ts","sourceRoot":"","sources":["../../src/services/leaderboard.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,UAAU,EAYhB,MAAM,eAAe,CAAC;AAEvB,UAAU,MAAM;IACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAIjF,MAAM,WAAW,gBAAgB;IAE/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAGhB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IAIjB,OAAO,CAAC,EAAE,MAAM,CAAC;IAIjB,MAAM,CAAC,EAAE,UAAU,CAAC;IAIpB,MAAM,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAG3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAE/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IAGd,MAAM,CAAC,EAAE,MAAM,CAAC;IAGhB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAyBD;;;;;GAKG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,EAAE,CAAW;gBAET,EAAE,EAAE,QAAQ;IAIxB;;OAEG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAyRvD;;OAEG;IACG,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGzD;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,QAAQ,GAAG,kBAAkB,CAEzE"}
+{"version":3,"file":"leaderboard.d.ts","sourceRoot":"","sources":["../../src/services/leaderboard.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAIL,KAAK,UAAU,EAWf,KAAK,wBAAwB,EAG9B,MAAM,eAAe,CAAC;AAEvB,UAAU,MAAM;IACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAIjF,KAAK,iBAAiB,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;AAE3C,MAAM,WAAW,gBAAgB;IAE/B,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAG1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IAIjB,OAAO,CAAC,EAAE,MAAM,CAAC;IAIjB,MAAM,CAAC,EAAE,UAAU,CAAC;IAIpB,MAAM,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAG3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAE/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IAGd,MAAM,CAAC,EAAE,MAAM,CAAC;IAGhB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAiED;;;;;GAKG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,EAAE,CAA2B;gBAEzB,EAAE,EAAE,wBAAwB;IAIxC;;OAEG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA6TvD;;OAEG;IACG,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGzD;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,wBAAwB,GAAG,kBAAkB,CAEzF"}

package/dist/daemon/services/leaderboard.js

@@ -7,6 +7,7 @@ import {
   desc,
   eq,
   gte,
+  inArray,
   jsonExtract,
   lte,
   sessions,
@@ -16,6 +17,37 @@ import {
 } from "@agor/core/db";
 var ALL_DIMENSIONS = ["user", "branch", "repo", "model", "tool"];
 var VALID_BUCKETS = /* @__PURE__ */ new Set(["hour", "day", "week", "month"]);
+var MAX_LIMIT = 1e4;
+function parseIntegerParam(value, fallback, { min, max }) {
+  if (value === void 0 || value === null || value === "") return fallback;
+  const parsed = typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(parsed)) return fallback;
+  return Math.min(max, Math.max(min, Math.trunc(parsed)));
+}
+function normalizeStringFilterValues(...values) {
+  const normalized = [];
+  const seen = /* @__PURE__ */ new Set();
+  const visit = (value) => {
+    if (Array.isArray(value)) {
+      for (const item of value) visit(item);
+      return;
+    }
+    if (typeof value !== "string") return;
+    for (const part of value.split(",")) {
+      const trimmed = part.trim();
+      if (!trimmed || seen.has(trimmed)) continue;
+      seen.add(trimmed);
+      normalized.push(trimmed);
+    }
+  };
+  for (const value of values) visit(value);
+  return normalized;
+}
+function stringFilter(column, values) {
+  if (values.length === 0) return void 0;
+  if (values.length === 1) return eq(column, values[0]);
+  return inArray(column, values);
+}
 function parseGroupBy(groupBy) {
   const dims = /* @__PURE__ */ new Set();
   for (const raw of groupBy.split(",")) {
@@ -42,17 +74,24 @@ var LeaderboardService = class {
     const query = params?.query || {};
     const {
       userId,
+      userIds: userIdsQuery,
       branchId,
+      branchIds: branchIdsQuery,
       repoId,
+      repoIds: repoIdsQuery,
+      model,
+      models,
+      tool,
+      tools,
       startDate,
       endDate,
       groupBy = "user,branch,repo",
       bucket,
       sortBy = "cost",
-      sortOrder = "desc",
-      limit = 50,
-      offset = 0
+      sortOrder = "desc"
     } = query;
+    const limit = parseIntegerParam(query.limit, 50, { min: 1, max: MAX_LIMIT });
+    const offset = parseIntegerParam(query.offset, 0, { min: 0, max: Number.MAX_SAFE_INTEGER });
     if (bucket !== void 0 && !VALID_BUCKETS.has(bucket)) {
       throw new Error(`Invalid bucket: "${bucket}". Expected one of: hour, day, week, month.`);
     }
@@ -62,16 +101,29 @@ var LeaderboardService = class {
     const includeRepo = dims.has("repo");
     const includeModel = dims.has("model");
     const includeTool = dims.has("tool");
+    const repoIds = normalizeStringFilterValues(repoId, repoIdsQuery);
+    const needsBranchesJoin = includeBranch || includeRepo || repoIds.length > 0;
+    const modelExpr = jsonExtract(this.db, tasks.data, "model");
     const conditions = [];
-    if (userId) {
-      conditions.push(eq(tasks.created_by, userId));
-    }
-    if (branchId) {
-      conditions.push(eq(sessions.branch_id, branchId));
-    }
-    if (repoId) {
-      conditions.push(eq(branches.repo_id, repoId));
-    }
+    const userFilter = stringFilter(
+      tasks.created_by,
+      normalizeStringFilterValues(userId, userIdsQuery)
+    );
+    if (userFilter) conditions.push(userFilter);
+    const branchFilter = stringFilter(
+      sessions.branch_id,
+      normalizeStringFilterValues(branchId, branchIdsQuery)
+    );
+    if (branchFilter) conditions.push(branchFilter);
+    const repoFilter = stringFilter(branches.repo_id, repoIds);
+    if (repoFilter) conditions.push(repoFilter);
+    const modelFilter = stringFilter(modelExpr, normalizeStringFilterValues(model, models));
+    if (modelFilter) conditions.push(modelFilter);
+    const toolFilter = stringFilter(
+      sessions.agentic_tool,
+      normalizeStringFilterValues(tool, tools)
+    );
+    if (toolFilter) conditions.push(toolFilter);
     if (startDate) {
       const parsed = new Date(startDate);
       if (Number.isNaN(parsed.getTime())) {
@@ -87,7 +139,6 @@ var LeaderboardService = class {
       conditions.push(lte(tasks.created_at, parsed));
     }
     const whereClause = conditions.length > 0 ? and(...conditions) : void 0;
-    const modelExpr = jsonExtract(this.db, tasks.data, "model");
     const inputTokensExpr = jsonExtract(
       this.db,
       tasks.data,
@@ -170,7 +221,10 @@ var LeaderboardService = class {
     const sortField = sortBy === "tokens" ? sql`total_tokens` : sql`total_cost`;
     const metricOrder = sortOrder === "desc" ? desc(sortField) : asc(sortField);
     const orderClauses = bucketExpr ? [asc(sql`bucket`), metricOrder] : [metricOrder];
-    let qb = this.db.select(selectFields).from(tasks).innerJoin(sessions, eq(tasks.session_id, sessions.session_id)).innerJoin(branches, eq(sessions.branch_id, branches.branch_id));
+    let qb = this.db.select(selectFields).from(tasks).innerJoin(sessions, eq(tasks.session_id, sessions.session_id));
+    if (needsBranchesJoin) {
+      qb = qb.innerJoin(branches, eq(sessions.branch_id, branches.branch_id));
+    }
     if (includeUser) {
       qb = qb.leftJoin(users, eq(tasks.created_by, users.user_id));
     }
@@ -178,8 +232,13 @@ var LeaderboardService = class {
     let total;
     if (groupByFields.length === 0) {
       total = results.length;
+    } else if (offset === 0 && results.length < limit) {
+      total = results.length;
     } else {
-      let countInner = this.db.select({ one: sql`1` }).from(tasks).innerJoin(sessions, eq(tasks.session_id, sessions.session_id)).innerJoin(branches, eq(sessions.branch_id, branches.branch_id));
+      let countInner = this.db.select({ one: sql`1` }).from(tasks).innerJoin(sessions, eq(tasks.session_id, sessions.session_id));
+      if (needsBranchesJoin) {
+        countInner = countInner.innerJoin(branches, eq(sessions.branch_id, branches.branch_id));
+      }
       if (includeUser) {
         countInner = countInner.leftJoin(users, eq(tasks.created_by, users.user_id));
       }

package/dist/daemon/services/local-actions.d.ts

@@ -0,0 +1,13 @@
+import { type LocalActionResult } from '@agor/core/local-actions';
+import type { Params } from '@agor/core/types';
+export type LocalActionName = 'unix.group.createBranch' | 'unix.group.deleteBranch' | 'unix.group.addUser' | 'unix.group.removeUser' | 'unix.user.ensure' | 'unix.user.delete' | 'unix.symlink.create' | 'unix.symlink.remove' | 'unix.symlink.cleanupBroken' | 'git.remoteCredentials.scrubManaged';
+export interface LocalActionRequest {
+    action: LocalActionName;
+    params?: Record<string, unknown>;
+    dryRun?: boolean;
+    verbose?: boolean;
+}
+export declare function createLocalActionsService(): {
+    create(data: LocalActionRequest, _params?: Params): Promise<LocalActionResult>;
+};
+//# sourceMappingURL=local-actions.d.ts.map

package/dist/daemon/services/local-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-actions.d.ts","sourceRoot":"","sources":["../../src/services/local-actions.ts"],"names":[],"mappings":"AACA,OAAO,EASL,KAAK,iBAAiB,EAIvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C,MAAM,MAAM,eAAe,GACvB,yBAAyB,GACzB,yBAAyB,GACzB,oBAAoB,GACpB,uBAAuB,GACvB,kBAAkB,GAClB,kBAAkB,GAClB,qBAAqB,GACrB,qBAAqB,GACrB,4BAA4B,GAC5B,oCAAoC,CAAC;AAEzC,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAmBD,wBAAgB,yBAAyB;iBAElB,kBAAkB,YAAY,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;EAqFvF"}