agor-live 0.22.0 → 0.23.2

package/dist/daemon/services/knowledge-documents.js

@@ -34,6 +34,34 @@ var DrizzleService = class {
   // Event emitter for FeathersJS (will be injected by framework)
   // biome-ignore lint/suspicious/noExplicitAny: FeathersJS event system
   emit;
+  /** Extract resolved tenant context from Feathers params. */
+  getTenant(params) {
+    return params?.tenant;
+  }
+  /**
+   * Whether a row belongs to the current tenant. Rows from pre-migration test
+   * fixtures that do not expose tenant_id are treated as visible so existing
+   * single-tenant unit tests keep working; migrated DB rows always carry it.
+   */
+  rowBelongsToTenant(row, tenant) {
+    if (!tenant) return true;
+    const record = row;
+    if (!("tenant_id" in record)) return true;
+    return record.tenant_id === tenant.tenant_id;
+  }
+  /** Stamp tenant_id onto created rows and prevent client-supplied drift. */
+  withTenant(data, params) {
+    const tenant = this.getTenant(params);
+    if (!tenant || !data || typeof data !== "object" || Array.isArray(data)) return data;
+    return { ...data, tenant_id: tenant.tenant_id };
+  }
+  /** Never allow a patch/update to move a row across tenants. */
+  stripTenantMutation(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) return data;
+    const clone = { ...data };
+    delete clone.tenant_id;
+    return clone;
+  }
   /**
    * Extract query parameters from params
    */
@@ -125,12 +153,28 @@ var DrizzleService = class {
       data: paginated
     };
   }
+  /**
+   * Resolve the candidate row set that `find` filters, sorts, and paginates.
+   *
+   * The base implementation reads the whole table and relies on `filterData` to
+   * narrow it in memory. Subclasses may override this to push high-selectivity
+   * predicates into SQL; because `find` always re-applies every query filter via
+   * `filterData`, an override only needs to return a superset of the matching
+   * rows for the result to stay identical.
+   */
+  async fetchData(_query, _params) {
+    return this.repository.findAll();
+  }
   /**
    * Find records
    */
   async find(params) {
     const query = this.getQuery(params);
-    let data = await this.repository.findAll();
+    let data = await this.fetchData(query, params);
+    const tenant = this.getTenant(params);
+    if (tenant) {
+      data = data.filter((row) => this.rowBelongsToTenant(row, tenant));
+    }
     data = this.filterData(data, query);
     const total = data.length;
     data = this.sortData(data, query.$sort);
@@ -142,10 +186,13 @@ var DrizzleService = class {
    */
   async get(id, _params) {
     const prefetched = _params?._agorPrefetchedRecord;
-    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id)) {
+    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id) && this.rowBelongsToTenant(prefetched.record, this.getTenant(_params))) {
       return prefetched.record;
     }
     const result = await this.repository.findById(String(id));
+    if (result && !this.rowBelongsToTenant(result, this.getTenant(_params))) {
+      throw new NotFoundError(this.resourceType, String(id));
+    }
     if (!result) {
       throw new NotFoundError(this.resourceType, String(id));
     }
@@ -157,14 +204,18 @@ var DrizzleService = class {
   async create(data, params) {
     if (Array.isArray(data)) {
       const results = await Promise.all(
-        data.map((item) => this.repository.create(item))
+        data.map(
+          (item) => this.repository.create(this.withTenant(item, params))
+        )
       );
       for (const result2 of results) {
         this.emit?.("created", result2, params);
       }
       return results;
     }
-    const result = await this.repository.create(data);
+    const result = await this.repository.create(
+      this.withTenant(data, params)
+    );
     this.emit?.("created", result, params);
     return result;
   }
@@ -180,7 +231,10 @@ var DrizzleService = class {
    */
   async update(id, data, params) {
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("updated", result, params);
     return result;
   }
@@ -194,12 +248,14 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       const results = await Promise.all(
         records.map(
           (record) => this.repository.update(
             record[this.id],
-            data
+            this.stripTenantMutation(data)
           )
         )
       );
@@ -209,7 +265,10 @@ var DrizzleService = class {
       return results;
     }
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("patched", result, params);
     return result;
   }
@@ -223,6 +282,8 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       await Promise.all(records.map((record) => this.repository.delete(record[this.id])));
       for (const record of records) {
@@ -270,6 +331,28 @@ function rowsOf(result) {
 function boolValue(value) {
   return value === true || value === "t" || value === "true" || value === 1 || value === "1";
 }
+async function ensureEmbeddingTenantIsolation(db) {
+  await executeRaw(
+    db,
+    sql`ALTER TABLE kb_unit_embeddings ADD COLUMN IF NOT EXISTS tenant_id text DEFAULT 'default' NOT NULL`
+  );
+  await executeRaw(
+    db,
+    sql`CREATE INDEX IF NOT EXISTS kb_unit_embeddings_tenant_id_idx ON kb_unit_embeddings USING btree (tenant_id)`
+  );
+  await executeRaw(db, sql`ALTER TABLE kb_unit_embeddings ENABLE ROW LEVEL SECURITY`);
+  await executeRaw(db, sql`ALTER TABLE kb_unit_embeddings FORCE ROW LEVEL SECURITY`);
+  await executeRaw(
+    db,
+    sql`DROP POLICY IF EXISTS tenant_isolation_kb_unit_embeddings ON kb_unit_embeddings`
+  );
+  await executeRaw(
+    db,
+    sql`CREATE POLICY tenant_isolation_kb_unit_embeddings ON kb_unit_embeddings
+      USING (tenant_id = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+      WITH CHECK (tenant_id = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))`
+  );
+}
 async function readCapability(db) {
   if (!isPostgresDatabase(db)) {
     return {
@@ -352,6 +435,7 @@ async function ensureKnowledgePgvectorStorage(db) {
       await executeRaw(
         db,
         sql`CREATE TABLE IF NOT EXISTS kb_unit_embeddings (
+          tenant_id text DEFAULT 'default' NOT NULL,
           unit_id varchar(36) NOT NULL REFERENCES public.kb_document_units(unit_id) ON DELETE cascade,
           embedding_space_id varchar(36) NOT NULL REFERENCES public.kb_embedding_spaces(embedding_space_id) ON DELETE cascade,
           content_sha256 text NOT NULL,
@@ -364,6 +448,7 @@ async function ensureKnowledgePgvectorStorage(db) {
       );
       capability.tableReady = true;
     }
+    await ensureEmbeddingTenantIsolation(db);
     if (!capability.spaceIndexReady) {
       await executeRaw(
         db,

package/dist/daemon/services/knowledge-embedding-indexer.d.ts

@@ -1,4 +1,5 @@
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
+import type { TenantID } from '@agor/core/types';
 export interface EmbeddingReuseIntoNextMetadataUpdate {
     targetVersionId: string;
     embeddingSpaceId: string;
@@ -19,6 +20,7 @@ export interface KnowledgeEmbeddingReuseSqlParams {
 export declare function buildKnowledgeEmbeddingReuseSql(params: KnowledgeEmbeddingReuseSqlParams): import("drizzle-orm").SQL<unknown>;
 export declare class KnowledgeEmbeddingIndexer {
     private db;
+    private options;
     private intervalHandle?;
     private running;
     private wakeScheduled;
@@ -27,7 +29,9 @@ export declare class KnowledgeEmbeddingIndexer {
     private lastError;
     private lastIndexedAt;
     private pgvectorStorageReady;
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase, options?: {
+        tenantId?: TenantID | string;
+    });
     start(): void;
     stop(): void;
     wake(): void;
@@ -51,6 +55,7 @@ export declare class KnowledgeEmbeddingIndexer {
     private reuseExistingEmbeddings;
     private recordEmbeddingReuseIntoNext;
     tick(): Promise<void>;
+    private tickInScope;
     indexBatch(): Promise<number>;
 }
 //# sourceMappingURL=knowledge-embedding-indexer.d.ts.map

package/dist/daemon/services/knowledge-embedding-indexer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"knowledge-embedding-indexer.d.ts","sourceRoot":"","sources":["../../src/services/knowledge-embedding-indexer.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,QAAQ,EAad,MAAM,eAAe,CAAC;AA+BvB,MAAM,WAAW,oCAAoC;IACnD,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAqBD,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EACpD,MAAM,EAAE,oCAAoC,GAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoBzB;AAED,MAAM,WAAW,gCAAgC;IAC/C,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,gCAAgC,sCA0EvF;AAED,qBAAa,yBAAyB;IAUxB,OAAO,CAAC,EAAE;IATtB,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,oBAAoB,CAAS;gBAEjB,EAAE,EAAE,QAAQ;IAIhC,KAAK,IAAI,IAAI;IAUb,IAAI,IAAI,IAAI;IAKZ,IAAI,IAAI,IAAI;IAWZ,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,gBAAgB,IAAI,IAAI,GAAG,IAAI;IAI/B,OAAO,CAAC,IAAI;YAKE,oBAAoB;IAgClC,OAAO,CAAC,OAAO;IAMf;;;;;;;;;;;OAWG;YACW,uBAAuB;YAcvB,4BAA4B;IAwEpC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAcrB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;CAkKpC"}
+{"version":3,"file":"knowledge-embedding-indexer.d.ts","sourceRoot":"","sources":["../../src/services/knowledge-embedding-indexer.ts"],"names":[],"mappings":"AACA,OAAO,EAcL,KAAK,wBAAwB,EAE9B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAA2B,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AA8B1E,MAAM,WAAW,oCAAoC;IACnD,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAqBD,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EACpD,MAAM,EAAE,oCAAoC,GAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoBzB;AAED,MAAM,WAAW,gCAAgC;IAC/C,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,gCAAgC,sCA4EvF;AAED,qBAAa,yBAAyB;IAWlC,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,OAAO;IAXjB,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,oBAAoB,CAAS;gBAG3B,EAAE,EAAE,wBAAwB,EAC5B,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAA;KAAO;IAKxD,KAAK,IAAI,IAAI;IAUb,IAAI,IAAI,IAAI;IAKZ,IAAI,IAAI,IAAI;IAWZ,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,gBAAgB,IAAI,IAAI,GAAG,IAAI;IAI/B,OAAO,CAAC,IAAI;YAKE,oBAAoB;IAgClC,OAAO,CAAC,OAAO;IAMf;;;;;;;;;;;OAWG;YACW,uBAAuB;YAcvB,4BAA4B;IAwEpC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAOb,WAAW;IAcnB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;CAkKpC"}

package/dist/daemon/services/knowledge-embedding-indexer.js

@@ -10,6 +10,7 @@ import {
   kbDocumentUnits,
   kbDocumentVersions,
   kbEmbeddingSpaces,
+  runWithTenantDatabaseScope,
   select,
   shortId,
   sql as sql2,
@@ -82,6 +83,28 @@ function rowsOf(result) {
 function boolValue(value) {
   return value === true || value === "t" || value === "true" || value === 1 || value === "1";
 }
+async function ensureEmbeddingTenantIsolation(db) {
+  await executeRaw(
+    db,
+    sql`ALTER TABLE kb_unit_embeddings ADD COLUMN IF NOT EXISTS tenant_id text DEFAULT 'default' NOT NULL`
+  );
+  await executeRaw(
+    db,
+    sql`CREATE INDEX IF NOT EXISTS kb_unit_embeddings_tenant_id_idx ON kb_unit_embeddings USING btree (tenant_id)`
+  );
+  await executeRaw(db, sql`ALTER TABLE kb_unit_embeddings ENABLE ROW LEVEL SECURITY`);
+  await executeRaw(db, sql`ALTER TABLE kb_unit_embeddings FORCE ROW LEVEL SECURITY`);
+  await executeRaw(
+    db,
+    sql`DROP POLICY IF EXISTS tenant_isolation_kb_unit_embeddings ON kb_unit_embeddings`
+  );
+  await executeRaw(
+    db,
+    sql`CREATE POLICY tenant_isolation_kb_unit_embeddings ON kb_unit_embeddings
+      USING (tenant_id = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+      WITH CHECK (tenant_id = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))`
+  );
+}
 async function readCapability(db) {
   if (!isPostgresDatabase(db)) {
     return {
@@ -164,6 +187,7 @@ async function ensureKnowledgePgvectorStorage(db) {
       await executeRaw(
         db,
         sql`CREATE TABLE IF NOT EXISTS kb_unit_embeddings (
+          tenant_id text DEFAULT 'default' NOT NULL,
           unit_id varchar(36) NOT NULL REFERENCES public.kb_document_units(unit_id) ON DELETE cascade,
           embedding_space_id varchar(36) NOT NULL REFERENCES public.kb_embedding_spaces(embedding_space_id) ON DELETE cascade,
           content_sha256 text NOT NULL,
@@ -176,6 +200,7 @@ async function ensureKnowledgePgvectorStorage(db) {
       );
       capability.tableReady = true;
     }
+    await ensureEmbeddingTenantIsolation(db);
     if (!capability.spaceIndexReady) {
       await executeRaw(
         db,
@@ -274,6 +299,7 @@ function buildKnowledgeEmbeddingReuseSql(params) {
             ORDER BY p.unit_id, old_u.updated_at DESC NULLS LAST, old_u.created_at DESC
           ), upserted AS (
             INSERT INTO kb_unit_embeddings (
+              tenant_id,
               unit_id,
               embedding_space_id,
               content_sha256,
@@ -283,6 +309,7 @@ function buildKnowledgeEmbeddingReuseSql(params) {
               updated_at
             )
             SELECT
+              COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'),
               new_unit_id,
               ${params.embeddingSpaceId},
               content_sha256,
@@ -314,8 +341,9 @@ function buildKnowledgeEmbeddingReuseSql(params) {
             candidates.previous_version_id`;
 }
 var KnowledgeEmbeddingIndexer = class {
-  constructor(db) {
+  constructor(db, options = {}) {
     this.db = db;
+    this.options = options;
     this.variables = new AppVariableRepository(db);
   }
   intervalHandle;
@@ -454,6 +482,12 @@ var KnowledgeEmbeddingIndexer = class {
     }
   }
   async tick() {
+    if (this.options.tenantId) {
+      return runWithTenantDatabaseScope(this.db, this.options.tenantId, () => this.tickInScope());
+    }
+    return this.tickInScope();
+  }
+  async tickInScope() {
     if (this.running) return;
     this.running = true;
     try {
@@ -566,8 +600,8 @@ var KnowledgeEmbeddingIndexer = class {
       const vector = embeddingToPgvector(result.embedding);
       await executeRaw2(
         this.db,
-        sql2`INSERT INTO kb_unit_embeddings (unit_id, embedding_space_id, content_sha256, embedding, token_count, created_at, updated_at)
-            VALUES (${result.id}, ${embeddingSpaceId}, ${sha256Text(content)}, ${vector}::vector, ${result.tokenCount ?? null}, now(), now())
+        sql2`INSERT INTO kb_unit_embeddings (tenant_id, unit_id, embedding_space_id, content_sha256, embedding, token_count, created_at, updated_at)
+            VALUES (COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'), ${result.id}, ${embeddingSpaceId}, ${sha256Text(content)}, ${vector}::vector, ${result.tokenCount ?? null}, now(), now())
             ON CONFLICT (unit_id, embedding_space_id) DO UPDATE SET
               content_sha256 = EXCLUDED.content_sha256,
               embedding = EXCLUDED.embedding,

package/dist/daemon/services/knowledge-graph.d.ts

@@ -1,7 +1,7 @@
 /**
  * Knowledge graph service
  */
-import { type Database, type KnowledgeGraphLinkInput, type KnowledgeGraphNeighborsQuery } from '@agor/core/db';
+import { type KnowledgeGraphLinkInput, type KnowledgeGraphNeighborsQuery, type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { AuthenticatedParams, KnowledgeGraphEdgeType, KnowledgeGraphNode, KnowledgeNamespaceGraph, QueryParams } from '@agor/core/types';
 /** Query for the namespace-wide graph view (whole-namespace document graph). */
 export interface KnowledgeNamespaceGraphRequest {
@@ -18,7 +18,7 @@ export declare class KnowledgeGraphService {
     private graph;
     private documents;
     private namespaces;
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
     create(data: KnowledgeGraphLinkInput, params?: KnowledgeGraphParams): Promise<import("@agor/core").KnowledgeGraphEdge>;
     find(params?: KnowledgeGraphParams): Promise<KnowledgeNamespaceGraph | {
         center: KnowledgeGraphNode;
@@ -54,5 +54,5 @@ export declare class KnowledgeGraphService {
         edges: import("@agor/core").KnowledgeGraphEdge[];
     }>;
 }
-export declare function createKnowledgeGraphService(db: Database): KnowledgeGraphService;
+export declare function createKnowledgeGraphService(db: TenantScopeAwareDatabase): KnowledgeGraphService;
 //# sourceMappingURL=knowledge-graph.d.ts.map

package/dist/daemon/services/knowledge-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"knowledge-graph.d.ts","sourceRoot":"","sources":["../../src/services/knowledge-graph.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,KAAK,QAAQ,EAEb,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EAIlC,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EACV,mBAAmB,EAGnB,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,EACvB,WAAW,EAGZ,MAAM,kBAAkB,CAAC;AAc1B,gFAAgF;AAChF,MAAM,WAAW,8BAA8B;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACtC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAC5C,4BAA4B,GAAG,8BAA8B,CAC9D,GACC,mBAAmB,CAAC;AAEtB,qBAAa,qBAAqB;IAChC,OAAO,CAAC,KAAK,CAA2B;IACxC,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,UAAU,CAA+B;gBAErC,EAAE,EAAE,QAAQ;IAMlB,MAAM,CAAC,IAAI,EAAE,uBAAuB,EAAE,MAAM,CAAC,EAAE,oBAAoB;IAInE,IAAI,CAAC,MAAM,CAAC,EAAE,oBAAoB;;;;;IAUxC;;;;;OAKG;IACG,cAAc,CAClB,OAAO,EAAE,8BAA8B,EACvC,MAAM,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,uBAAuB,CAAC;YAmDrB,mBAAmB;YAInB,OAAO;YAKP,QAAQ;YAKR,cAAc;IAS5B,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,kBAAkB;IAQ1B,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,cAAc;YAWR,cAAc;YAiBd,gBAAgB;YAYhB,eAAe;YAcf,WAAW;IAMzB,OAAO,CAAC,iBAAiB;IAMnB,IAAI,CAAC,IAAI,EAAE,uBAAuB,EAAE,MAAM,CAAC,EAAE,oBAAoB;IAUjE,SAAS,CAAC,IAAI,EAAE,4BAA4B,EAAE,MAAM,CAAC,EAAE,oBAAoB;;;;;CAyBlF;AAED,wBAAgB,2BAA2B,CAAC,EAAE,EAAE,QAAQ,GAAG,qBAAqB,CAE/E"}
+{"version":3,"file":"knowledge-graph.d.ts","sourceRoot":"","sources":["../../src/services/knowledge-graph.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EAIjC,KAAK,wBAAwB,EAC9B,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EACV,mBAAmB,EAGnB,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,EACvB,WAAW,EAGZ,MAAM,kBAAkB,CAAC;AAc1B,gFAAgF;AAChF,MAAM,WAAW,8BAA8B;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACtC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAC5C,4BAA4B,GAAG,8BAA8B,CAC9D,GACC,mBAAmB,CAAC;AAEtB,qBAAa,qBAAqB;IAChC,OAAO,CAAC,KAAK,CAA2B;IACxC,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,UAAU,CAA+B;gBAErC,EAAE,EAAE,wBAAwB;IAMlC,MAAM,CAAC,IAAI,EAAE,uBAAuB,EAAE,MAAM,CAAC,EAAE,oBAAoB;IAInE,IAAI,CAAC,MAAM,CAAC,EAAE,oBAAoB;;;;;IAUxC;;;;;OAKG;IACG,cAAc,CAClB,OAAO,EAAE,8BAA8B,EACvC,MAAM,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,uBAAuB,CAAC;YAmDrB,mBAAmB;YAInB,OAAO;YAKP,QAAQ;YAKR,cAAc;IAS5B,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,kBAAkB;IAQ1B,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,cAAc;YAWR,cAAc;YAiBd,gBAAgB;YAYhB,eAAe;YAcf,WAAW;IAMzB,OAAO,CAAC,iBAAiB;IAMnB,IAAI,CAAC,IAAI,EAAE,uBAAuB,EAAE,MAAM,CAAC,EAAE,oBAAoB;IAUjE,SAAS,CAAC,IAAI,EAAE,4BAA4B,EAAE,MAAM,CAAC,EAAE,oBAAoB;;;;;CAyBlF;AAED,wBAAgB,2BAA2B,CAAC,EAAE,EAAE,wBAAwB,GAAG,qBAAqB,CAE/F"}

package/dist/daemon/services/knowledge-indexing.d.ts

@@ -1,4 +1,4 @@
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { Application } from '@agor/core/feathers';
 import type { AuthenticatedParams, KnowledgeIndexingStatus, Params } from '@agor/core/types';
 export type KnowledgeIndexingParams = Params & AuthenticatedParams;
@@ -6,8 +6,8 @@ export declare class KnowledgeIndexingStatusService {
     private db;
     private app?;
     private variables;
-    constructor(db: Database, app?: Application | undefined);
+    constructor(db: TenantScopeAwareDatabase, app?: Application | undefined);
     find(_params?: KnowledgeIndexingParams): Promise<KnowledgeIndexingStatus>;
 }
-export declare function createKnowledgeIndexingStatusService(db: Database, app?: Application): KnowledgeIndexingStatusService;
+export declare function createKnowledgeIndexingStatusService(db: TenantScopeAwareDatabase, app?: Application): KnowledgeIndexingStatusService;
 //# sourceMappingURL=knowledge-indexing.d.ts.map

package/dist/daemon/services/knowledge-indexing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"knowledge-indexing.d.ts","sourceRoot":"","sources":["../../src/services/knowledge-indexing.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,QAAQ,EAKd,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EACV,mBAAmB,EAEnB,uBAAuB,EACvB,MAAM,EACP,MAAM,kBAAkB,CAAC;AAkB1B,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,mBAAmB,CAAC;AAEnE,qBAAa,8BAA8B;IAIvC,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,GAAG,CAAC;IAJd,OAAO,CAAC,SAAS,CAAwB;gBAG/B,EAAE,EAAE,QAAQ,EACZ,GAAG,CAAC,EAAE,WAAW,YAAA;IAKrB,IAAI,CAAC,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAyDhF;AAED,wBAAgB,oCAAoC,CAClD,EAAE,EAAE,QAAQ,EACZ,GAAG,CAAC,EAAE,WAAW,GAChB,8BAA8B,CAEhC"}
+{"version":3,"file":"knowledge-indexing.d.ts","sourceRoot":"","sources":["../../src/services/knowledge-indexing.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,wBAAwB,EAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EACV,mBAAmB,EAEnB,uBAAuB,EACvB,MAAM,EACP,MAAM,kBAAkB,CAAC;AAkB1B,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,mBAAmB,CAAC;AAEnE,qBAAa,8BAA8B;IAIvC,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,GAAG,CAAC;IAJd,OAAO,CAAC,SAAS,CAAwB;gBAG/B,EAAE,EAAE,wBAAwB,EAC5B,GAAG,CAAC,EAAE,WAAW,YAAA;IAKrB,IAAI,CAAC,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAyDhF;AAED,wBAAgB,oCAAoC,CAClD,EAAE,EAAE,wBAAwB,EAC5B,GAAG,CAAC,EAAE,WAAW,GAChB,8BAA8B,CAEhC"}

package/dist/daemon/services/knowledge-namespaces.d.ts

@@ -1,7 +1,7 @@
 /**
  * Knowledge namespaces service
  */
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { AuthenticatedParams, Id, KnowledgeNamespace, KnowledgeNamespaceAclEntry, KnowledgeNamespacePermission, KnowledgeNamespaceSubjectType, NullableId, QueryParams, UserID } from '@agor/core/types';
 import { DrizzleService } from '../adapters/drizzle';
 export type KnowledgeNamespaceParams = QueryParams<{
@@ -26,7 +26,7 @@ type KnowledgeNamespaceWithAclResult = {
 export declare class KnowledgeNamespacesService extends DrizzleService<KnowledgeNamespace, Partial<KnowledgeNamespace>, KnowledgeNamespaceParams> {
     private repo;
     private groups;
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
     private withEffectivePermission;
     find(params?: KnowledgeNamespaceParams): Promise<KnowledgeNamespace[]>;
     get(id: Id, params?: KnowledgeNamespaceParams): Promise<KnowledgeNamespace>;
@@ -76,6 +76,6 @@ export declare class KnowledgeNamespacesService extends DrizzleService<Knowledge
         subjectId?: string;
     }, params?: KnowledgeNamespaceParams): Promise<KnowledgeNamespaceAclEntry | null>;
 }
-export declare function createKnowledgeNamespacesService(db: Database): KnowledgeNamespacesService;
+export declare function createKnowledgeNamespacesService(db: TenantScopeAwareDatabase): KnowledgeNamespacesService;
 export {};
 //# sourceMappingURL=knowledge-namespaces.d.ts.map

package/dist/daemon/services/knowledge-namespaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"knowledge-namespaces.d.ts","sourceRoot":"","sources":["../../src/services/knowledge-namespaces.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,KAAK,QAAQ,EAAiD,MAAM,eAAe,CAAC;AAE7F,OAAO,KAAK,EACV,mBAAmB,EAEnB,EAAE,EACF,kBAAkB,EAClB,0BAA0B,EAE1B,4BAA4B,EAC5B,6BAA6B,EAC7B,UAAU,EACV,WAAW,EAEX,MAAM,EACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGrD,MAAM,MAAM,wBAAwB,GAAG,WAAW,CAAC;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC,GACA,mBAAmB,CAAC;AAEtB,KAAK,+BAA+B,GAAG;IACrC,YAAY,CAAC,EAAE,6BAA6B,CAAC;IAC7C,WAAW,CAAC,EAAE,6BAA6B,CAAC;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,4BAA4B,CAAC;CAC3C,CAAC;AAEF,KAAK,+BAA+B,GAAG;IACrC,SAAS,EAAE,kBAAkB,CAAC;IAC9B,GAAG,EAAE,0BAA0B,EAAE,CAAC;CACnC,CAAC;AAEF,qBAAa,0BAA2B,SAAQ,cAAc,CAC5D,kBAAkB,EAClB,OAAO,CAAC,kBAAkB,CAAC,EAC3B,wBAAwB,CACzB;IACC,OAAO,CAAC,IAAI,CAA+B;IAC3C,OAAO,CAAC,MAAM,CAAkB;gBAEpB,EAAE,EAAE,QAAQ;IAcxB,OAAO,CAAC,uBAAuB;IAOzB,IAAI,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAiBtE,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAWjF,OAAO,CAAC,OAAO;YAID,mBAAmB;YAcnB,sBAAsB;YAUtB,eAAe;IAU7B,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,mBAAmB;IA8B3B,OAAO,CAAC,kBAAkB;YAuBZ,2BAA2B;YA2B3B,oBAAoB;YAmBpB,yBAAyB;YAYzB,+BAA+B;YAqB/B,qCAAqC;YAcrC,SAAS;IAwBjB,MAAM,CACV,IAAI,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,EAAE,EACjE,MAAM,CAAC,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,EAAE,CAAC;IAO/C,KAAK,CACT,EAAE,EAAE,UAAU,EACd,IAAI,EAAE,OAAO,CAAC,kBAAkB,CAAC,EACjC,MAAM,CAAC,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC;IAkBxB,MAAM,CACV,EAAE,EAAE,EAAE,EACN,IAAI,EAAE,OAAO,CAAC,kBAAkB,CAAC,EACjC,MAAM,CAAC,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC;IAiBxB,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAUtF,WAAW,CACf,IAAI,EAAE;QACJ,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACxC,GAAG,CAAC,EAAE,+BAA+B,EAAE,CAAC;KACzC,EACD,MAAM,CAAC,EAAE,wBAAwB,GAChC,OAAO,CAAC,+BAA+B,CAAC;IAuCrC,OAAO,CACX,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,EAC9D,MAAM,CAAC,EAAE,wBAAwB,GAChC,OAAO,CAAC,0BAA0B,EAAE,CAAC;IASlC,MAAM,CACV,IAAI,EAAE;QACJ,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,6BAA6B,CAAC;QAC7C,WAAW,CAAC,EAAE,6BAA6B,CAAC;QAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,4BAA4B,CAAC;KAC3C,EACD,MAAM,CAAC,EAAE,wBAAwB,GAChC,OAAO,CAAC,0BAA0B,CAAC;IA0BhC,SAAS,CACb,IAAI,EAAE;QACJ,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,6BAA6B,CAAC;QAC7C,WAAW,CAAC,EAAE,6BAA6B,CAAC;QAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,EACD,MAAM,CAAC,EAAE,wBAAwB,GAChC,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;CAa9C;AAED,wBAAgB,gCAAgC,CAAC,EAAE,EAAE,QAAQ,GAAG,0BAA0B,CAEzF"}
+{"version":3,"file":"knowledge-namespaces.d.ts","sourceRoot":"","sources":["../../src/services/knowledge-namespaces.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EACV,mBAAmB,EAEnB,EAAE,EACF,kBAAkB,EAClB,0BAA0B,EAE1B,4BAA4B,EAC5B,6BAA6B,EAC7B,UAAU,EACV,WAAW,EAEX,MAAM,EACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGrD,MAAM,MAAM,wBAAwB,GAAG,WAAW,CAAC;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC,GACA,mBAAmB,CAAC;AAEtB,KAAK,+BAA+B,GAAG;IACrC,YAAY,CAAC,EAAE,6BAA6B,CAAC;IAC7C,WAAW,CAAC,EAAE,6BAA6B,CAAC;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,4BAA4B,CAAC;CAC3C,CAAC;AAEF,KAAK,+BAA+B,GAAG;IACrC,SAAS,EAAE,kBAAkB,CAAC;IAC9B,GAAG,EAAE,0BAA0B,EAAE,CAAC;CACnC,CAAC;AAEF,qBAAa,0BAA2B,SAAQ,cAAc,CAC5D,kBAAkB,EAClB,OAAO,CAAC,kBAAkB,CAAC,EAC3B,wBAAwB,CACzB;IACC,OAAO,CAAC,IAAI,CAA+B;IAC3C,OAAO,CAAC,MAAM,CAAkB;gBAEpB,EAAE,EAAE,wBAAwB;IAcxC,OAAO,CAAC,uBAAuB;IAOzB,IAAI,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAiBtE,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAWjF,OAAO,CAAC,OAAO;YAID,mBAAmB;YAcnB,sBAAsB;YAUtB,eAAe;IAU7B,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,mBAAmB;IA8B3B,OAAO,CAAC,kBAAkB;YAuBZ,2BAA2B;YA2B3B,oBAAoB;YAmBpB,yBAAyB;YAYzB,+BAA+B;YAqB/B,qCAAqC;YAcrC,SAAS;IAwBjB,MAAM,CACV,IAAI,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,EAAE,EACjE,MAAM,CAAC,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,EAAE,CAAC;IAO/C,KAAK,CACT,EAAE,EAAE,UAAU,EACd,IAAI,EAAE,OAAO,CAAC,kBAAkB,CAAC,EACjC,MAAM,CAAC,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC;IAkBxB,MAAM,CACV,EAAE,EAAE,EAAE,EACN,IAAI,EAAE,OAAO,CAAC,kBAAkB,CAAC,EACjC,MAAM,CAAC,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC;IAiBxB,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAUtF,WAAW,CACf,IAAI,EAAE;QACJ,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACxC,GAAG,CAAC,EAAE,+BAA+B,EAAE,CAAC;KACzC,EACD,MAAM,CAAC,EAAE,wBAAwB,GAChC,OAAO,CAAC,+BAA+B,CAAC;IAuCrC,OAAO,CACX,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,EAC9D,MAAM,CAAC,EAAE,wBAAwB,GAChC,OAAO,CAAC,0BAA0B,EAAE,CAAC;IASlC,MAAM,CACV,IAAI,EAAE;QACJ,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,6BAA6B,CAAC;QAC7C,WAAW,CAAC,EAAE,6BAA6B,CAAC;QAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,4BAA4B,CAAC;KAC3C,EACD,MAAM,CAAC,EAAE,wBAAwB,GAChC,OAAO,CAAC,0BAA0B,CAAC;IA0BhC,SAAS,CACb,IAAI,EAAE;QACJ,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,6BAA6B,CAAC;QAC7C,WAAW,CAAC,EAAE,6BAA6B,CAAC;QAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,EACD,MAAM,CAAC,EAAE,wBAAwB,GAChC,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;CAa9C;AAED,wBAAgB,gCAAgC,CAC9C,EAAE,EAAE,wBAAwB,GAC3B,0BAA0B,CAE5B"}

package/dist/daemon/services/knowledge-namespaces.js

@@ -1,6 +1,9 @@
 // src/services/knowledge-namespaces.ts
 import { PAGINATION } from "@agor/core/config";
-import { GroupRepository, KnowledgeNamespaceRepository } from "@agor/core/db";
+import {
+  GroupRepository,
+  KnowledgeNamespaceRepository
+} from "@agor/core/db";
 import { BadRequest, Forbidden, NotFound } from "@agor/core/feathers";
 
 // src/adapters/drizzle.ts
@@ -20,6 +23,34 @@ var DrizzleService = class {
   // Event emitter for FeathersJS (will be injected by framework)
   // biome-ignore lint/suspicious/noExplicitAny: FeathersJS event system
   emit;
+  /** Extract resolved tenant context from Feathers params. */
+  getTenant(params) {
+    return params?.tenant;
+  }
+  /**
+   * Whether a row belongs to the current tenant. Rows from pre-migration test
+   * fixtures that do not expose tenant_id are treated as visible so existing
+   * single-tenant unit tests keep working; migrated DB rows always carry it.
+   */
+  rowBelongsToTenant(row, tenant) {
+    if (!tenant) return true;
+    const record = row;
+    if (!("tenant_id" in record)) return true;
+    return record.tenant_id === tenant.tenant_id;
+  }
+  /** Stamp tenant_id onto created rows and prevent client-supplied drift. */
+  withTenant(data, params) {
+    const tenant = this.getTenant(params);
+    if (!tenant || !data || typeof data !== "object" || Array.isArray(data)) return data;
+    return { ...data, tenant_id: tenant.tenant_id };
+  }
+  /** Never allow a patch/update to move a row across tenants. */
+  stripTenantMutation(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) return data;
+    const clone = { ...data };
+    delete clone.tenant_id;
+    return clone;
+  }
   /**
    * Extract query parameters from params
    */
@@ -111,12 +142,28 @@ var DrizzleService = class {
       data: paginated
     };
   }
+  /**
+   * Resolve the candidate row set that `find` filters, sorts, and paginates.
+   *
+   * The base implementation reads the whole table and relies on `filterData` to
+   * narrow it in memory. Subclasses may override this to push high-selectivity
+   * predicates into SQL; because `find` always re-applies every query filter via
+   * `filterData`, an override only needs to return a superset of the matching
+   * rows for the result to stay identical.
+   */
+  async fetchData(_query, _params) {
+    return this.repository.findAll();
+  }
   /**
    * Find records
    */
   async find(params) {
     const query = this.getQuery(params);
-    let data = await this.repository.findAll();
+    let data = await this.fetchData(query, params);
+    const tenant = this.getTenant(params);
+    if (tenant) {
+      data = data.filter((row) => this.rowBelongsToTenant(row, tenant));
+    }
     data = this.filterData(data, query);
     const total = data.length;
     data = this.sortData(data, query.$sort);
@@ -128,10 +175,13 @@ var DrizzleService = class {
    */
   async get(id, _params) {
     const prefetched = _params?._agorPrefetchedRecord;
-    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id)) {
+    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id) && this.rowBelongsToTenant(prefetched.record, this.getTenant(_params))) {
       return prefetched.record;
     }
     const result = await this.repository.findById(String(id));
+    if (result && !this.rowBelongsToTenant(result, this.getTenant(_params))) {
+      throw new NotFoundError(this.resourceType, String(id));
+    }
     if (!result) {
       throw new NotFoundError(this.resourceType, String(id));
     }
@@ -143,14 +193,18 @@ var DrizzleService = class {
   async create(data, params) {
     if (Array.isArray(data)) {
       const results = await Promise.all(
-        data.map((item) => this.repository.create(item))
+        data.map(
+          (item) => this.repository.create(this.withTenant(item, params))
+        )
       );
       for (const result2 of results) {
         this.emit?.("created", result2, params);
       }
       return results;
     }
-    const result = await this.repository.create(data);
+    const result = await this.repository.create(
+      this.withTenant(data, params)
+    );
     this.emit?.("created", result, params);
     return result;
   }
@@ -166,7 +220,10 @@ var DrizzleService = class {
    */
   async update(id, data, params) {
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("updated", result, params);
     return result;
   }
@@ -180,12 +237,14 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       const results = await Promise.all(
         records.map(
           (record) => this.repository.update(
             record[this.id],
-            data
+            this.stripTenantMutation(data)
           )
         )
       );
@@ -195,7 +254,10 @@ var DrizzleService = class {
       return results;
     }
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("patched", result, params);
     return result;
   }
@@ -209,6 +271,8 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       await Promise.all(records.map((record) => this.repository.delete(record[this.id])));
       for (const record of records) {

package/dist/daemon/services/knowledge-reindex.d.ts

@@ -1,4 +1,4 @@
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { Application } from '@agor/core/feathers';
 import type { AuthenticatedParams, KnowledgeEmbeddingStatus, Params } from '@agor/core/types';
 export interface KnowledgeReindexResult {
@@ -10,8 +10,8 @@ export declare class KnowledgeReindexService {
     private db;
     private app?;
     private variables;
-    constructor(db: Database, app?: Application | undefined);
+    constructor(db: TenantScopeAwareDatabase, app?: Application | undefined);
     create(_data?: unknown, _params?: KnowledgeReindexParams): Promise<KnowledgeReindexResult>;
 }
-export declare function createKnowledgeReindexService(db: Database, app?: Application): KnowledgeReindexService;
+export declare function createKnowledgeReindexService(db: TenantScopeAwareDatabase, app?: Application): KnowledgeReindexService;
 //# sourceMappingURL=knowledge-reindex.d.ts.map

package/dist/daemon/services/knowledge-reindex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"knowledge-reindex.d.ts","sourceRoot":"","sources":["../../src/services/knowledge-reindex.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,KAAK,QAAQ,EAAsB,MAAM,eAAe,CAAC;AACzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAS9F,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,wBAAwB,CAAC;CAClC;AAED,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,mBAAmB,CAAC;AAElE,qBAAa,uBAAuB;IAIhC,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,GAAG,CAAC;IAJd,OAAO,CAAC,SAAS,CAAwB;gBAG/B,EAAE,EAAE,QAAQ,EACZ,GAAG,CAAC,EAAE,WAAW,YAAA;IAKrB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAsBjG;AAED,wBAAgB,6BAA6B,CAC3C,EAAE,EAAE,QAAQ,EACZ,GAAG,CAAC,EAAE,WAAW,GAChB,uBAAuB,CAEzB"}
+{"version":3,"file":"knowledge-reindex.d.ts","sourceRoot":"","sources":["../../src/services/knowledge-reindex.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAS9F,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,wBAAwB,CAAC;CAClC;AAED,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,mBAAmB,CAAC;AAElE,qBAAa,uBAAuB;IAIhC,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,GAAG,CAAC;IAJd,OAAO,CAAC,SAAS,CAAwB;gBAG/B,EAAE,EAAE,wBAAwB,EAC5B,GAAG,CAAC,EAAE,WAAW,YAAA;IAKrB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAsBjG;AAED,wBAAgB,6BAA6B,CAC3C,EAAE,EAAE,wBAAwB,EAC5B,GAAG,CAAC,EAAE,WAAW,GAChB,uBAAuB,CAEzB"}