agor-live 0.22.0 → 0.23.2

package/dist/daemon/services/artifacts.d.ts

@@ -11,10 +11,10 @@
  * sidecar format — `detectLegacyFormat` flags old artifacts so the UI can
  * surface a self-service upgrade prompt.
  */
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { Application } from '@agor/core/feathers';
-import type { AgorGrants, AgorRuntimeConfig, Artifact, ArtifactBuildStatus, ArtifactConsoleEntry, ArtifactPayload, ArtifactStatus, ArtifactTrustScopeType, BoardID, BranchID, QueryParams, SandpackConfig, SandpackError, SandpackTemplate, SessionID, UserID, UserRole } from '@agor/core/types';
-import { DrizzleService } from '../adapters/drizzle.js';
+import type { AgorGrants, AgorRuntimeConfig, Artifact, ArtifactBuildStatus, ArtifactConsoleEntry, ArtifactPayload, ArtifactStatus, ArtifactTrustScopeType, BoardID, BranchID, QueryParams, SandpackConfig, SandpackError, SandpackTemplate, SessionID, UserID, UserRole, UUID } from '@agor/core/types';
+import { DrizzleService, type Query } from '../adapters/drizzle.js';
 interface ArtifactValidationDiagnostic {
     code: string;
     severity: 'error' | 'warning';
@@ -32,7 +32,10 @@ export type ArtifactParams = QueryParams<{
     board_id?: BoardID;
     branch_id?: BranchID;
     archived?: boolean;
-}>;
+}> & {
+    /** Internal RBAC SQL pushdown marker set by register-hooks for external regular users. */
+    _agorSqlBranchAccessUserId?: UUID;
+};
 export declare class ArtifactsService extends DrizzleService<Artifact, Partial<Artifact>, ArtifactParams> {
     private artifactRepo;
     private trustRepo;
@@ -84,7 +87,32 @@ export declare class ArtifactsService extends DrizzleService<Artifact, Partial<A
     private pendingRuntimeQueries;
     private ensureBranchFilesystemAccess;
     private resolveArtifactSource;
-    constructor(db: Database, app: Application);
+    constructor(db: TenantScopeAwareDatabase, app: Application);
+    /**
+     * Push the list read's high-selectivity predicates into SQL.
+     *
+     * The generic adapter would read the entire artifacts table and filter in
+     * memory. Artifacts are fetched on initial app load, so we narrow the read to
+     * the board, archived state, explicit branch ids, and any RBAC SQL branch
+     * visibility marker before rows leave the database.
+     * The per-row `rowToArtifact` / `getBaseUrl` enrichment runs inside
+     * `artifactRepo.findAll` on the reduced set, and `find` still re-applies every
+     * query filter in memory, so this only ever returns a superset of the matching
+     * rows.
+     *
+     * Artifacts are not query-validated, so values arrive uncoerced: only push
+     * when the value already has the column's type (string `board_id`, boolean
+     * `archived`, string / all-string `{ $in }` `branch_id`). Anything else falls
+     * through to the unchanged in-memory filter, preserving current behavior
+     * exactly.
+     *
+     * `artifacts.branch_id` is nullable, so a `{ $in }` that contains a non-string
+     * element (e.g. `null`) is deliberately NOT pushed: `filterData` matches null
+     * branch_ids against such a set via JS `includes`, but SQL `IN (NULL)` never
+     * does — pushing it would return a SUBSET and break the superset contract.
+     * board_id / archived may still be pushed in that case.
+     */
+    protected fetchData(query: Query, params?: ArtifactParams): Promise<Artifact[]>;
     create(_data: Partial<Artifact>, _params?: unknown): Promise<Artifact>;
     /**
      * Direct REST/service updates are metadata-only and must not rewrite
@@ -391,6 +419,6 @@ export declare function sanitizeAgorGrants(input: unknown): AgorGrants;
 export declare function pickConsentRelevantGrants(grants: AgorGrants): AgorGrants;
 /** Inverse of `pickConsentRelevantGrants`: only the no-consent metadata keys. */
 export declare function pickNoConsentGrants(grants: AgorGrants): AgorGrants;
-export declare function createArtifactsService(db: Database, app: Application): ArtifactsService;
+export declare function createArtifactsService(db: TenantScopeAwareDatabase, app: Application): ArtifactsService;
 export {};
 //# sourceMappingURL=artifacts.d.ts.map

package/dist/daemon/services/artifacts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.d.ts","sourceRoot":"","sources":["../../src/services/artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAcH,OAAO,EAKL,KAAK,QAAQ,EAEd,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,OAAO,EACP,QAAQ,EACR,WAAW,EACX,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,MAAM,EACN,QAAQ,EACT,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AA2FxD,UAAU,4BAA4B;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,UAAU,wBAAwB;IAChC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,4BAA4B,EAAE,CAAC;CAC7C;AAsCD,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC;IACvC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC,CAAC;AAOH,qBAAa,gBAAiB,SAAQ,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC/F,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,SAAS,CAA+B;IAChD,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,GAAG,CAAc;IACzB,0EAA0E;IAC1E,OAAO,CAAC,KAAK,CAAW;IAExB;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW,CAAkD;IAErE,0EAA0E;IAC1E,OAAO,CAAC,cAAc,CAAgD;IAEtE,qEAAqE;IACrE,OAAO,CAAC,gBAAgB,CAAkC;IAE1D,8EAA8E;IAC9E,OAAO,CAAC,iBAAiB,CAAkC;IAE3D;;;;OAIG;IACH,OAAO,CAAC,oBAAoB,CAA2C;IAEvE;;;OAGG;IACH,OAAO,CAAC,aAAa,CAAwE;IAE7F;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,qBAAqB,CAQf;YAEA,4BAA4B;YAY5B,qBAAqB;gBAyCvB,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW;IAoBpC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAM5E;;;;;OAKG;IACH,OAAO,CAAC,+BAA+B;IAKjC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAQ/F;;;;;OAKG;IACG,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IA2C9F;;;OAGG;IACH,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,YAAY,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO;IAMlF,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAkBtE;;;;;;;;;;;;OAYG;IACG,eAAe,CACnB,IAAI,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iBAAiB,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;QACrC,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;QAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,eAAe,CAAC,EAAE,cAAc,CAAC;QACjC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,WAAW,CAAC,EAAE,UAAU,CAAC;QACzB,YAAY,CAAC,EAAE,iBAAiB,CAAC;QACjC,CAAC,CAAC,EAAE,MAAM,CAAC;QACX,CAAC,CAAC,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EACD,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,QAAQ,CAAC;IA2KpB;;;OAGG;IACG,cAAc,CAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;QACP,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,CAAC,CAAC,EAAE,MAAM,CAAC;QACX,CAAC,CAAC,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,WAAW,CAAC,EAAE,UAAU,CAAC;QACzB,YAAY,CAAC,EAAE,iBAAiB,CAAC;QACjC,eAAe,CAAC,EAAE,cAAc,CAAC;KAClC,EACD,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,QAAQ,CAAC;IAqIpB;;;;;;;;;;;;OAYG;IACG,IAAI,CACR,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAClD,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IA8FhF;;;;;;OAMG;IACG,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAmH/E;;;;;;;;OAQG;YACW,YAAY;IAiE1B;;;;;;;;;;;;;OAaG;YACW,iBAAiB;IAmE/B;;;OAGG;YACW,kBAAkB;YAiDlB,aAAa;YA0Bb,mBAAmB;IAwBjC;;;;;;;;;;;OAWG;IACG,UAAU,CAAC,KAAK,EAAE;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,sBAAsB,CAAC;KACnC,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,sBAAsB,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IAkE5D,eAAe,CAAC,MAAM,EAAE,MAAM;IAI9B,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtE;;;;;;;;;;;;;;OAcG;IACG,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAkIhF;;;;;;;;;;;;;;;;;OAiBG;IACG,oBAAoB,CAAC,KAAK,EAAE;QAChC,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,WAAW,GAAG,eAAe,CAAC;QACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,OAAO,CAAC;IA8CpB;;;;;;;;;OASG;IACH,mBAAmB,CAAC,KAAK,EAAE;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,CAAC;QACxB,EAAE,EAAE,OAAO,CAAC;QACZ,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI;IAeF,oBAAoB,CACxB,KAAK,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EACpE,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,wBAAwB,CAAC;IAwB9B,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAC5C,MAAM,EAAE,mBAAmB,CAAC;QAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IAeF,8EAA8E;IAC9E,OAAO,CAAC,SAAS;IAIjB,6EAA6E;IAC7E,OAAO,CAAC,wBAAwB;IAmB1B,iBAAiB,CACrB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,oBAAoB,EAAE,EAC/B,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAcV,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,aAAa,GAAG,IAAI,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;YAWF,0BAA0B;IAUxC,OAAO,CAAC,wBAAwB;IA8BhC,OAAO,CAAC,0BAA0B;IAMlC;;;;OAIG;IACG,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAmC7E,qBAAqB,CAAC,MAAM,EAAE,cAAc,GAAG;QAC7C,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,IAAI;IAmDR;;;;;;;;;;;;OAYG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO,GACtD,OAAO,CACR,cAAc,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CACvF;IAwID;;;;;;OAMG;IACG,cAAc,CAClB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,QAAQ,CAAC;IA2Bd,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAIrE,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAMrF;;;;;;OAMG;YACW,mBAAmB;IA0BjC,OAAO,CAAC,qBAAqB;IAmI7B,OAAO,CAAC,OAAO;IAKf,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,+BAA+B;IAevC,OAAO,CAAC,qBAAqB;IAwB7B,OAAO,CAAC,kCAAkC;IAe1C,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,WAAW;IAwBnB,OAAO,CAAC,kBAAkB;CAoB3B;AAQD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAS5D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAe7D;AAED,0DAA0D;AAC1D,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAMxE;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAMlE;AAkDD,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,GAAG,gBAAgB,CAEvF"}
+{"version":3,"file":"artifacts.d.ts","sourceRoot":"","sources":["../../src/services/artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAeH,OAAO,EAML,KAAK,wBAAwB,EAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,OAAO,EACP,QAAQ,EACR,WAAW,EACX,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,MAAM,EACN,QAAQ,EACR,IAAI,EACL,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EAAE,cAAc,EAAE,KAAK,KAAK,EAAE,MAAM,wBAAwB,CAAC;AA2FpE,UAAU,4BAA4B;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,UAAU,wBAAwB;IAChC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,4BAA4B,EAAE,CAAC;CAC7C;AAsCD,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC;IACvC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC,GAAG;IACH,0FAA0F;IAC1F,0BAA0B,CAAC,EAAE,IAAI,CAAC;CACnC,CAAC;AAOF,qBAAa,gBAAiB,SAAQ,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC/F,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,SAAS,CAA+B;IAChD,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,GAAG,CAAc;IACzB,0EAA0E;IAC1E,OAAO,CAAC,KAAK,CAA2B;IAExC;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW,CAAkD;IAErE,0EAA0E;IAC1E,OAAO,CAAC,cAAc,CAAgD;IAEtE,qEAAqE;IACrE,OAAO,CAAC,gBAAgB,CAAkC;IAE1D,8EAA8E;IAC9E,OAAO,CAAC,iBAAiB,CAAkC;IAE3D;;;;OAIG;IACH,OAAO,CAAC,oBAAoB,CAA2C;IAEvE;;;OAGG;IACH,OAAO,CAAC,aAAa,CAAwE;IAE7F;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,qBAAqB,CAQf;YAEA,4BAA4B;YAY5B,qBAAqB;gBAyCvB,EAAE,EAAE,wBAAwB,EAAE,GAAG,EAAE,WAAW;IAkB1D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;cACa,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IA+B/E,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAM5E;;;;;OAKG;IACH,OAAO,CAAC,+BAA+B;IAKjC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAQ/F;;;;;OAKG;IACG,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IA2C9F;;;OAGG;IACH,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,YAAY,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO;IAMlF,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAkBtE;;;;;;;;;;;;OAYG;IACG,eAAe,CACnB,IAAI,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iBAAiB,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;QACrC,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;QAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,eAAe,CAAC,EAAE,cAAc,CAAC;QACjC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,WAAW,CAAC,EAAE,UAAU,CAAC;QACzB,YAAY,CAAC,EAAE,iBAAiB,CAAC;QACjC,CAAC,CAAC,EAAE,MAAM,CAAC;QACX,CAAC,CAAC,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EACD,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,QAAQ,CAAC;IA2KpB;;;OAGG;IACG,cAAc,CAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;QACP,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,CAAC,CAAC,EAAE,MAAM,CAAC;QACX,CAAC,CAAC,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,WAAW,CAAC,EAAE,UAAU,CAAC;QACzB,YAAY,CAAC,EAAE,iBAAiB,CAAC;QACjC,eAAe,CAAC,EAAE,cAAc,CAAC;KAClC,EACD,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,QAAQ,CAAC;IAqIpB;;;;;;;;;;;;OAYG;IACG,IAAI,CACR,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAClD,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IA8FhF;;;;;;OAMG;IACG,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAmH/E;;;;;;;;OAQG;YACW,YAAY;IAiE1B;;;;;;;;;;;;;OAaG;YACW,iBAAiB;IAmE/B;;;OAGG;YACW,kBAAkB;YAiDlB,aAAa;YA0Bb,mBAAmB;IAwBjC;;;;;;;;;;;OAWG;IACG,UAAU,CAAC,KAAK,EAAE;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,sBAAsB,CAAC;KACnC,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,sBAAsB,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IAkE5D,eAAe,CAAC,MAAM,EAAE,MAAM;IAI9B,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtE;;;;;;;;;;;;;;OAcG;IACG,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAkIhF;;;;;;;;;;;;;;;;;OAiBG;IACG,oBAAoB,CAAC,KAAK,EAAE;QAChC,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,WAAW,GAAG,eAAe,CAAC;QACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,OAAO,CAAC;IA8CpB;;;;;;;;;OASG;IACH,mBAAmB,CAAC,KAAK,EAAE;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,CAAC;QACxB,EAAE,EAAE,OAAO,CAAC;QACZ,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI;IAeF,oBAAoB,CACxB,KAAK,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EACpE,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,wBAAwB,CAAC;IAwB9B,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAC5C,MAAM,EAAE,mBAAmB,CAAC;QAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IAeF,8EAA8E;IAC9E,OAAO,CAAC,SAAS;IAIjB,6EAA6E;IAC7E,OAAO,CAAC,wBAAwB;IAmB1B,iBAAiB,CACrB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,oBAAoB,EAAE,EAC/B,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAcV,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,aAAa,GAAG,IAAI,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;YAWF,0BAA0B;IAUxC,OAAO,CAAC,wBAAwB;IA8BhC,OAAO,CAAC,0BAA0B;IAMlC;;;;OAIG;IACG,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAmC7E,qBAAqB,CAAC,MAAM,EAAE,cAAc,GAAG;QAC7C,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,IAAI;IAmDR;;;;;;;;;;;;OAYG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO,GACtD,OAAO,CACR,cAAc,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CACvF;IAwID;;;;;;OAMG;IACG,cAAc,CAClB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,QAAQ,CAAC;IA2Bd,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAIrE,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAMrF;;;;;;OAMG;YACW,mBAAmB;IA0BjC,OAAO,CAAC,qBAAqB;IAmI7B,OAAO,CAAC,OAAO;IAKf,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,+BAA+B;IAevC,OAAO,CAAC,qBAAqB;IAwB7B,OAAO,CAAC,kCAAkC;IAe1C,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,WAAW;IAwBnB,OAAO,CAAC,kBAAkB;CAoB3B;AAQD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAS5D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAe7D;AAED,0DAA0D;AAC1D,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAMxE;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAMlE;AAkDD,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,wBAAwB,EAC5B,GAAG,EAAE,WAAW,GACf,gBAAgB,CAElB"}

package/dist/daemon/services/artifacts.js

@@ -2,6 +2,7 @@
 import { createHash } from "crypto";
 import * as fs2 from "fs";
 import { mkdir, realpath as realpath2, rm, writeFile } from "fs/promises";
+import { tmpdir } from "os";
 import * as path2 from "path";
 import { generateId } from "@agor/core";
 import {
@@ -44,6 +45,34 @@ var DrizzleService = class {
   // Event emitter for FeathersJS (will be injected by framework)
   // biome-ignore lint/suspicious/noExplicitAny: FeathersJS event system
   emit;
+  /** Extract resolved tenant context from Feathers params. */
+  getTenant(params) {
+    return params?.tenant;
+  }
+  /**
+   * Whether a row belongs to the current tenant. Rows from pre-migration test
+   * fixtures that do not expose tenant_id are treated as visible so existing
+   * single-tenant unit tests keep working; migrated DB rows always carry it.
+   */
+  rowBelongsToTenant(row, tenant) {
+    if (!tenant) return true;
+    const record = row;
+    if (!("tenant_id" in record)) return true;
+    return record.tenant_id === tenant.tenant_id;
+  }
+  /** Stamp tenant_id onto created rows and prevent client-supplied drift. */
+  withTenant(data, params) {
+    const tenant = this.getTenant(params);
+    if (!tenant || !data || typeof data !== "object" || Array.isArray(data)) return data;
+    return { ...data, tenant_id: tenant.tenant_id };
+  }
+  /** Never allow a patch/update to move a row across tenants. */
+  stripTenantMutation(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) return data;
+    const clone = { ...data };
+    delete clone.tenant_id;
+    return clone;
+  }
   /**
    * Extract query parameters from params
    */
@@ -135,12 +164,28 @@ var DrizzleService = class {
       data: paginated
     };
   }
+  /**
+   * Resolve the candidate row set that `find` filters, sorts, and paginates.
+   *
+   * The base implementation reads the whole table and relies on `filterData` to
+   * narrow it in memory. Subclasses may override this to push high-selectivity
+   * predicates into SQL; because `find` always re-applies every query filter via
+   * `filterData`, an override only needs to return a superset of the matching
+   * rows for the result to stay identical.
+   */
+  async fetchData(_query, _params) {
+    return this.repository.findAll();
+  }
   /**
    * Find records
    */
   async find(params) {
     const query = this.getQuery(params);
-    let data = await this.repository.findAll();
+    let data = await this.fetchData(query, params);
+    const tenant = this.getTenant(params);
+    if (tenant) {
+      data = data.filter((row) => this.rowBelongsToTenant(row, tenant));
+    }
     data = this.filterData(data, query);
     const total = data.length;
     data = this.sortData(data, query.$sort);
@@ -152,10 +197,13 @@ var DrizzleService = class {
    */
   async get(id, _params) {
     const prefetched = _params?._agorPrefetchedRecord;
-    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id)) {
+    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id) && this.rowBelongsToTenant(prefetched.record, this.getTenant(_params))) {
       return prefetched.record;
     }
     const result = await this.repository.findById(String(id));
+    if (result && !this.rowBelongsToTenant(result, this.getTenant(_params))) {
+      throw new NotFoundError(this.resourceType, String(id));
+    }
     if (!result) {
       throw new NotFoundError(this.resourceType, String(id));
     }
@@ -167,14 +215,18 @@ var DrizzleService = class {
   async create(data, params) {
     if (Array.isArray(data)) {
       const results = await Promise.all(
-        data.map((item) => this.repository.create(item))
+        data.map(
+          (item) => this.repository.create(this.withTenant(item, params))
+        )
       );
       for (const result2 of results) {
         this.emit?.("created", result2, params);
       }
       return results;
     }
-    const result = await this.repository.create(data);
+    const result = await this.repository.create(
+      this.withTenant(data, params)
+    );
     this.emit?.("created", result, params);
     return result;
   }
@@ -190,7 +242,10 @@ var DrizzleService = class {
    */
   async update(id, data, params) {
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("updated", result, params);
     return result;
   }
@@ -204,12 +259,14 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       const results = await Promise.all(
         records.map(
           (record) => this.repository.update(
             record[this.id],
-            data
+            this.stripTenantMutation(data)
           )
         )
       );
@@ -219,7 +276,10 @@ var DrizzleService = class {
       return results;
     }
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("patched", result, params);
     return result;
   }
@@ -233,6 +293,8 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       await Promise.all(records.map((record) => this.repository.delete(record[this.id])));
       for (const record of records) {
@@ -876,6 +938,45 @@ var ArtifactsService = class extends DrizzleService {
     this.app = app;
     this.dbRef = db;
   }
+  /**
+   * Push the list read's high-selectivity predicates into SQL.
+   *
+   * The generic adapter would read the entire artifacts table and filter in
+   * memory. Artifacts are fetched on initial app load, so we narrow the read to
+   * the board, archived state, explicit branch ids, and any RBAC SQL branch
+   * visibility marker before rows leave the database.
+   * The per-row `rowToArtifact` / `getBaseUrl` enrichment runs inside
+   * `artifactRepo.findAll` on the reduced set, and `find` still re-applies every
+   * query filter in memory, so this only ever returns a superset of the matching
+   * rows.
+   *
+   * Artifacts are not query-validated, so values arrive uncoerced: only push
+   * when the value already has the column's type (string `board_id`, boolean
+   * `archived`, string / all-string `{ $in }` `branch_id`). Anything else falls
+   * through to the unchanged in-memory filter, preserving current behavior
+   * exactly.
+   *
+   * `artifacts.branch_id` is nullable, so a `{ $in }` that contains a non-string
+   * element (e.g. `null`) is deliberately NOT pushed: `filterData` matches null
+   * branch_ids against such a set via JS `includes`, but SQL `IN (NULL)` never
+   * does — pushing it would return a SUBSET and break the superset contract.
+   * board_id / archived may still be pushed in that case.
+   */
+  async fetchData(query, params) {
+    const filter = {};
+    if (typeof query.board_id === "string") filter.board_id = query.board_id;
+    if (typeof query.archived === "boolean") filter.archived = query.archived;
+    if (params?._agorSqlBranchAccessUserId) {
+      filter.visibleToUserId = params._agorSqlBranchAccessUserId;
+    }
+    const branchId = query.branch_id;
+    if (typeof branchId === "string") {
+      filter.branchIds = [branchId];
+    } else if (branchId && typeof branchId === "object" && Array.isArray(branchId.$in) && branchId.$in.every((el) => typeof el === "string")) {
+      filter.branchIds = branchId.$in;
+    }
+    return this.artifactRepo.findAll(filter);
+  }
   // Direct Feathers create is intentionally rejected — artifacts require
   // the publishArtifact() lifecycle (folder → DB).
   async create(_data, _params) {
@@ -2214,7 +2315,7 @@ var ArtifactsService = class extends DrizzleService {
       return { folderPath: matchedBranch.canonicalFolderPath, branchId: matchedBranch.branchId };
     }
     const canonical = await canonicalizeExistingPrefix(resolved);
-    const allowedTempRoots = ["/tmp", "/var/tmp"];
+    const allowedTempRoots = ["/tmp", "/var/tmp", tmpdir()];
     for (const root of allowedTempRoots) {
       const rootReal = await canonicalizeExistingPrefix(root);
       if (canonical.startsWith(rootReal + path2.sep) || canonical === rootReal) {

package/dist/daemon/services/assistant-knowledge.d.ts

@@ -1,8 +1,8 @@
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { Branch, BranchID, KnowledgeNamespace, UserID } from '@agor/core/types';
 export declare const ASSISTANT_MEMORY_PATH_TEMPLATE: "memory/{{YYYY-MM-DD}}.md";
 export declare const ASSISTANT_NAMESPACE_MISSING_MESSAGE = "namespace for this agent is not set up";
-export declare function ensureAssistantKnowledgeNamespace(db: Database, branchId: BranchID, userId?: UserID | null): Promise<{
+export declare function ensureAssistantKnowledgeNamespace(db: TenantScopeAwareDatabase, branchId: BranchID, userId?: UserID | null): Promise<{
     namespace: KnowledgeNamespace;
     branch: Branch;
 }>;

package/dist/daemon/services/assistant-knowledge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assistant-knowledge.d.ts","sourceRoot":"","sources":["../../src/services/assistant-knowledge.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,QAAQ,EAGd,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAEV,MAAM,EACN,QAAQ,EACR,kBAAkB,EAClB,MAAM,EACP,MAAM,kBAAkB,CAAC;AAG1B,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAClF,eAAO,MAAM,mCAAmC,2CAA2C,CAAC;AA+C5F,wBAAsB,iCAAiC,CACrD,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,QAAQ,EAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,OAAO,CAAC;IAAE,SAAS,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgE5D"}
+{"version":3,"file":"assistant-knowledge.d.ts","sourceRoot":"","sources":["../../src/services/assistant-knowledge.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAEV,MAAM,EACN,QAAQ,EACR,kBAAkB,EAClB,MAAM,EACP,MAAM,kBAAkB,CAAC;AAG1B,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAClF,eAAO,MAAM,mCAAmC,2CAA2C,CAAC;AA+C5F,wBAAsB,iCAAiC,CACrD,EAAE,EAAE,wBAAwB,EAC5B,QAAQ,EAAE,QAAQ,EAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,OAAO,CAAC;IAAE,SAAS,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgE5D"}

package/dist/daemon/services/board-comments.d.ts

@@ -10,8 +10,8 @@
  * - Spatial positioning: absolute/relative (Phase 3)
  * - Mentions and notifications (Phase 4)
  */
-import { type Database } from '@agor/core/db';
-import type { BoardComment, QueryParams } from '@agor/core/types';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
+import type { BoardComment, QueryParams, UUID } from '@agor/core/types';
 import { DrizzleService } from '../adapters/drizzle';
 /**
  * Board comments service params
@@ -24,13 +24,16 @@ export type BoardCommentsParams = QueryParams<{
     branch_id?: string;
     resolved?: boolean;
     created_by?: string;
-}>;
+}> & {
+    /** Internal RBAC SQL pushdown marker set by register-hooks for external regular users. */
+    _agorSqlBoardAccessUserId?: UUID;
+};
 /**
  * Extended board comments service with custom methods
  */
 export declare class BoardCommentsService extends DrizzleService<BoardComment, Partial<BoardComment>, BoardCommentsParams> {
     private commentsRepo;
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
     /**
      * Override find to support filtering by board, session, etc.
      * Returns paginated results for FeathersJS compatibility.
@@ -90,5 +93,5 @@ export declare class BoardCommentsService extends DrizzleService<BoardComment, P
 /**
  * Service factory function
  */
-export declare function createBoardCommentsService(db: Database): BoardCommentsService;
+export declare function createBoardCommentsService(db: TenantScopeAwareDatabase): BoardCommentsService;
 //# sourceMappingURL=board-comments.d.ts.map

package/dist/daemon/services/board-comments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"board-comments.d.ts","sourceRoot":"","sources":["../../src/services/board-comments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,CAAC;AAEH;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,cAAc,CACtD,YAAY,EACZ,OAAO,CAAC,YAAY,CAAC,EACrB,mBAAmB,CACpB;IACC,OAAO,CAAC,YAAY,CAA0B;gBAElC,EAAE,EAAE,QAAQ;IAcxB;;;OAGG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,mBAAmB;;;;;;IA4BvC;;OAEG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC;IAI/E;;OAEG;IACG,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC;IAIjF;;OAEG;IACG,WAAW,CACf,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,EACD,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,YAAY,EAAE,CAAC;IAI1B;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI9F;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAIxF;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,YAAY,EAAE,CAAC;IAI1B;;OAEG;IACG,UAAU,CACd,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,EACjC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,YAAY,EAAE,CAAC;IAQ1B;;;OAGG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EACxC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,YAAY,CAAC;IAIxB;;;OAGG;IACG,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,EAC3B,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,YAAY,CAAC;CAGzB;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,QAAQ,GAAG,oBAAoB,CAE7E"}
+{"version":3,"file":"board-comments.d.ts","sourceRoot":"","sources":["../../src/services/board-comments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAA2B,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,GAAG;IACH,0FAA0F;IAC1F,yBAAyB,CAAC,EAAE,IAAI,CAAC;CAClC,CAAC;AAEF;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,cAAc,CACtD,YAAY,EACZ,OAAO,CAAC,YAAY,CAAC,EACrB,mBAAmB,CACpB;IACC,OAAO,CAAC,YAAY,CAA0B;gBAElC,EAAE,EAAE,wBAAwB;IAcxC;;;OAGG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,mBAAmB;;;;;;IA6BvC;;OAEG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC;IAI/E;;OAEG;IACG,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC;IAIjF;;OAEG;IACG,WAAW,CACf,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,EACD,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,YAAY,EAAE,CAAC;IAI1B;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI9F;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAIxF;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,YAAY,EAAE,CAAC;IAI1B;;OAEG;IACG,UAAU,CACd,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,EACjC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,YAAY,EAAE,CAAC;IAQ1B;;;OAGG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EACxC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,YAAY,CAAC;IAIxB;;;OAGG;IACG,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,EAC3B,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,YAAY,CAAC;CAGzB;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,wBAAwB,GAAG,oBAAoB,CAE7F"}

package/dist/daemon/services/board-comments.js

@@ -19,6 +19,34 @@ var DrizzleService = class {
   // Event emitter for FeathersJS (will be injected by framework)
   // biome-ignore lint/suspicious/noExplicitAny: FeathersJS event system
   emit;
+  /** Extract resolved tenant context from Feathers params. */
+  getTenant(params) {
+    return params?.tenant;
+  }
+  /**
+   * Whether a row belongs to the current tenant. Rows from pre-migration test
+   * fixtures that do not expose tenant_id are treated as visible so existing
+   * single-tenant unit tests keep working; migrated DB rows always carry it.
+   */
+  rowBelongsToTenant(row, tenant) {
+    if (!tenant) return true;
+    const record = row;
+    if (!("tenant_id" in record)) return true;
+    return record.tenant_id === tenant.tenant_id;
+  }
+  /** Stamp tenant_id onto created rows and prevent client-supplied drift. */
+  withTenant(data, params) {
+    const tenant = this.getTenant(params);
+    if (!tenant || !data || typeof data !== "object" || Array.isArray(data)) return data;
+    return { ...data, tenant_id: tenant.tenant_id };
+  }
+  /** Never allow a patch/update to move a row across tenants. */
+  stripTenantMutation(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) return data;
+    const clone = { ...data };
+    delete clone.tenant_id;
+    return clone;
+  }
   /**
    * Extract query parameters from params
    */
@@ -110,12 +138,28 @@ var DrizzleService = class {
       data: paginated
     };
   }
+  /**
+   * Resolve the candidate row set that `find` filters, sorts, and paginates.
+   *
+   * The base implementation reads the whole table and relies on `filterData` to
+   * narrow it in memory. Subclasses may override this to push high-selectivity
+   * predicates into SQL; because `find` always re-applies every query filter via
+   * `filterData`, an override only needs to return a superset of the matching
+   * rows for the result to stay identical.
+   */
+  async fetchData(_query, _params) {
+    return this.repository.findAll();
+  }
   /**
    * Find records
    */
   async find(params) {
     const query = this.getQuery(params);
-    let data = await this.repository.findAll();
+    let data = await this.fetchData(query, params);
+    const tenant = this.getTenant(params);
+    if (tenant) {
+      data = data.filter((row) => this.rowBelongsToTenant(row, tenant));
+    }
     data = this.filterData(data, query);
     const total = data.length;
     data = this.sortData(data, query.$sort);
@@ -127,10 +171,13 @@ var DrizzleService = class {
    */
   async get(id, _params) {
     const prefetched = _params?._agorPrefetchedRecord;
-    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id)) {
+    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id) && this.rowBelongsToTenant(prefetched.record, this.getTenant(_params))) {
       return prefetched.record;
     }
     const result = await this.repository.findById(String(id));
+    if (result && !this.rowBelongsToTenant(result, this.getTenant(_params))) {
+      throw new NotFoundError(this.resourceType, String(id));
+    }
     if (!result) {
       throw new NotFoundError(this.resourceType, String(id));
     }
@@ -142,14 +189,18 @@ var DrizzleService = class {
   async create(data, params) {
     if (Array.isArray(data)) {
       const results = await Promise.all(
-        data.map((item) => this.repository.create(item))
+        data.map(
+          (item) => this.repository.create(this.withTenant(item, params))
+        )
       );
       for (const result2 of results) {
         this.emit?.("created", result2, params);
       }
       return results;
     }
-    const result = await this.repository.create(data);
+    const result = await this.repository.create(
+      this.withTenant(data, params)
+    );
     this.emit?.("created", result, params);
     return result;
   }
@@ -165,7 +216,10 @@ var DrizzleService = class {
    */
   async update(id, data, params) {
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("updated", result, params);
     return result;
   }
@@ -179,12 +233,14 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       const results = await Promise.all(
         records.map(
           (record) => this.repository.update(
             record[this.id],
-            data
+            this.stripTenantMutation(data)
           )
         )
       );
@@ -194,7 +250,10 @@ var DrizzleService = class {
       return results;
     }
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("patched", result, params);
     return result;
   }
@@ -208,6 +267,8 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       await Promise.all(records.map((record) => this.repository.delete(record[this.id])));
       for (const record of records) {
@@ -243,23 +304,27 @@ var BoardCommentsService = class extends DrizzleService {
    */
   async find(params) {
     const filters = params?.query || {};
-    const allComments = await this.commentsRepo.findAll({
+    const queryFilters = {
       board_id: filters.board_id,
       session_id: filters.session_id,
       task_id: filters.task_id,
       message_id: filters.message_id,
       branch_id: filters.branch_id,
       resolved: filters.resolved,
-      created_by: filters.created_by
-    });
+      created_by: filters.created_by,
+      visibleToUserId: params?._agorSqlBoardAccessUserId
+    };
     const $limit = filters.$limit ?? PAGINATION.DEFAULT_LIMIT;
     const $skip = filters.$skip ?? 0;
-    const paginated = allComments.slice($skip, $skip + $limit);
+    const [total, data] = await Promise.all([
+      this.commentsRepo.count(queryFilters),
+      this.commentsRepo.findAll(queryFilters, { limit: $limit, offset: $skip })
+    ]);
     return {
-      total: allComments.length,
+      total,
       limit: $limit,
       skip: $skip,
-      data: paginated
+      data
     };
   }
   /**

package/dist/daemon/services/board-objects.d.ts

@@ -4,8 +4,8 @@
  * Provides REST + WebSocket API for managing positioned entities on boards.
  * Supports both session cards and branch cards (Phase 1: Hybrid support).
  */
-import { type BoardObjectFindFilters, type BoardObjectFindOptions, type Database } from '@agor/core/db';
-import type { BoardEntityObject, BoardEntityType, BoardID, BranchID, CardID, QueryParams } from '@agor/core/types';
+import { type BoardObjectFindFilters, type BoardObjectFindOptions, type TenantScopeAwareDatabase } from '@agor/core/db';
+import type { BoardEntityObject, BoardEntityType, BoardID, BranchID, CardID, QueryParams, UUID } from '@agor/core/types';
 export type BoardObjectPatchedEventPayload = Omit<BoardEntityObject, 'zone_id'> & {
     zone_id?: string | null;
 };
@@ -19,7 +19,10 @@ export type BoardObjectParams = QueryParams<{
     card_id?: CardID;
     zone_id?: string;
     entity_type?: BoardEntityType;
-}>;
+}> & {
+    /** Internal RBAC SQL pushdown marker set by register-hooks for external regular users. */
+    _agorSqlBoardAccessUserId?: UUID;
+};
 export interface NormalizedBoardObjectFindQuery {
     filters: BoardObjectFindFilters;
     pagination: BoardObjectFindOptions;
@@ -33,7 +36,7 @@ export declare function normalizeBoardObjectFindQuery(query?: BoardObjectParams[
 export declare class BoardObjectsService {
     private boardObjectRepo;
     emit?: (event: string, data: BoardEntityObject, params?: BoardObjectParams) => void;
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
     /**
      * Create board object (add branch to board)
      */
@@ -85,5 +88,5 @@ export declare class BoardObjectsService {
 /**
  * Service factory function
  */
-export declare function createBoardObjectsService(db: Database): BoardObjectsService;
+export declare function createBoardObjectsService(db: TenantScopeAwareDatabase): BoardObjectsService;
 //# sourceMappingURL=board-objects.d.ts.map

package/dist/daemon/services/board-objects.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"board-objects.d.ts","sourceRoot":"","sources":["../../src/services/board-objects.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAE3B,KAAK,QAAQ,EACd,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,iBAAiB,EACjB,eAAe,EACf,OAAO,EACP,QAAQ,EACR,MAAM,EACN,WAAW,EACZ,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,8BAA8B,GAAG,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,GAAG;IAChF,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,iBAAiB,GAC7B,8BAA8B,CAKhC;AAED;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC1C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,sBAAsB,CAAC;IAChC,UAAU,EAAE,sBAAsB,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,GAAE,iBAAiB,CAAC,OAAO,CAAM,GACrC,8BAA8B,CAmBhC;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe,CAAwB;IACxC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;gBAE/E,EAAE,EAAE,QAAQ;IAIxB;;OAEG;IACG,MAAM,CACV,IAAI,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAChC,MAAM,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,iBAAiB,CAAC;IA8B7B;;OAEG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,iBAAiB;;;;;;IAerC;;OAEG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAQ9E;;OAEG;IACG,KAAK,CACT,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAChC,MAAM,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,iBAAiB,CAAC;IA6B7B;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAUhF;;OAEG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,EAClC,MAAM,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,iBAAiB,CAAC;IAS7B;;OAEG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,MAAM,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,iBAAiB,CAAC;IAa7B;;OAEG;IACG,mBAAmB,CACvB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,EACvC,MAAM,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAc/B;;OAEG;IACG,cAAc,CAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;CAGrC;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,QAAQ,GAAG,mBAAmB,CAE3E"}
+{"version":3,"file":"board-objects.d.ts","sourceRoot":"","sources":["../../src/services/board-objects.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAE3B,KAAK,wBAAwB,EAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,iBAAiB,EACjB,eAAe,EACf,OAAO,EACP,QAAQ,EACR,MAAM,EACN,WAAW,EACX,IAAI,EACL,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,8BAA8B,GAAG,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,GAAG;IAChF,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,iBAAiB,GAC7B,8BAA8B,CAKhC;AAED;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC1C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B,CAAC,GAAG;IACH,0FAA0F;IAC1F,yBAAyB,CAAC,EAAE,IAAI,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,sBAAsB,CAAC;IAChC,UAAU,EAAE,sBAAsB,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,GAAE,iBAAiB,CAAC,OAAO,CAAM,GACrC,8BAA8B,CAmBhC;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe,CAAwB;IACxC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;gBAE/E,EAAE,EAAE,wBAAwB;IAIxC;;OAEG;IACG,MAAM,CACV,IAAI,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAChC,MAAM,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,iBAAiB,CAAC;IA8B7B;;OAEG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,iBAAiB;;;;;;IA2BrC;;OAEG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAQ9E;;OAEG;IACG,KAAK,CACT,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAChC,MAAM,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,iBAAiB,CAAC;IA6B7B;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAUhF;;OAEG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,EAClC,MAAM,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,iBAAiB,CAAC;IAS7B;;OAEG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,MAAM,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,iBAAiB,CAAC;IAa7B;;OAEG;IACG,mBAAmB,CACvB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,EACvC,MAAM,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAc/B;;OAEG;IACG,cAAc,CAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;CAGrC;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,wBAAwB,GAAG,mBAAmB,CAE3F"}

package/dist/daemon/services/board-objects.js

@@ -57,10 +57,20 @@ var BoardObjectsService = class {
    */
   async find(params) {
     const normalized = normalizeBoardObjectFindQuery(params?.query);
-    const [total, data] = await Promise.all([
-      this.boardObjectRepo.count(normalized.filters),
-      this.boardObjectRepo.findAll(normalized.filters, normalized.pagination)
-    ]);
+    const visibleToUserId = params?._agorSqlBoardAccessUserId;
+    const [total, data] = await Promise.all(
+      visibleToUserId ? [
+        this.boardObjectRepo.countVisibleToUser(visibleToUserId, normalized.filters),
+        this.boardObjectRepo.findVisibleToUser(
+          visibleToUserId,
+          normalized.filters,
+          normalized.pagination
+        )
+      ] : [
+        this.boardObjectRepo.count(normalized.filters),
+        this.boardObjectRepo.findAll(normalized.filters, normalized.pagination)
+      ]
+    );
     return {
       total,
       limit: normalized.limit,