agor-live 0.22.0 → 0.23.2

package/dist/daemon/services/schedules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schedules.d.ts","sourceRoot":"","sources":["../../src/services/schedules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,KAAK,QAAQ,EAAsB,MAAM,eAAe,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC;IACvC,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB,CAAC,GACA,mBAAmB,CAAC;AAEtB,qBAAa,gBAAiB,SAAQ,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;gBACnF,EAAE,EAAE,QAAQ;CAWzB;AAED,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,QAAQ,GAAG,gBAAgB,CAErE"}
+{"version":3,"file":"schedules.d.ts","sourceRoot":"","sources":["../../src/services/schedules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAsB,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAClF,OAAO,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC;IACvC,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB,CAAC,GACA,mBAAmB,CAAC;AAEtB,qBAAa,gBAAiB,SAAQ,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;gBACnF,EAAE,EAAE,wBAAwB;CAWzC;AAED,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,wBAAwB,GAAG,gBAAgB,CAErF"}

package/dist/daemon/services/schedules.js

@@ -19,6 +19,34 @@ var DrizzleService = class {
   // Event emitter for FeathersJS (will be injected by framework)
   // biome-ignore lint/suspicious/noExplicitAny: FeathersJS event system
   emit;
+  /** Extract resolved tenant context from Feathers params. */
+  getTenant(params) {
+    return params?.tenant;
+  }
+  /**
+   * Whether a row belongs to the current tenant. Rows from pre-migration test
+   * fixtures that do not expose tenant_id are treated as visible so existing
+   * single-tenant unit tests keep working; migrated DB rows always carry it.
+   */
+  rowBelongsToTenant(row, tenant) {
+    if (!tenant) return true;
+    const record = row;
+    if (!("tenant_id" in record)) return true;
+    return record.tenant_id === tenant.tenant_id;
+  }
+  /** Stamp tenant_id onto created rows and prevent client-supplied drift. */
+  withTenant(data, params) {
+    const tenant = this.getTenant(params);
+    if (!tenant || !data || typeof data !== "object" || Array.isArray(data)) return data;
+    return { ...data, tenant_id: tenant.tenant_id };
+  }
+  /** Never allow a patch/update to move a row across tenants. */
+  stripTenantMutation(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) return data;
+    const clone = { ...data };
+    delete clone.tenant_id;
+    return clone;
+  }
   /**
    * Extract query parameters from params
    */
@@ -110,12 +138,28 @@ var DrizzleService = class {
       data: paginated
     };
   }
+  /**
+   * Resolve the candidate row set that `find` filters, sorts, and paginates.
+   *
+   * The base implementation reads the whole table and relies on `filterData` to
+   * narrow it in memory. Subclasses may override this to push high-selectivity
+   * predicates into SQL; because `find` always re-applies every query filter via
+   * `filterData`, an override only needs to return a superset of the matching
+   * rows for the result to stay identical.
+   */
+  async fetchData(_query, _params) {
+    return this.repository.findAll();
+  }
   /**
    * Find records
    */
   async find(params) {
     const query = this.getQuery(params);
-    let data = await this.repository.findAll();
+    let data = await this.fetchData(query, params);
+    const tenant = this.getTenant(params);
+    if (tenant) {
+      data = data.filter((row) => this.rowBelongsToTenant(row, tenant));
+    }
     data = this.filterData(data, query);
     const total = data.length;
     data = this.sortData(data, query.$sort);
@@ -127,10 +171,13 @@ var DrizzleService = class {
    */
   async get(id, _params) {
     const prefetched = _params?._agorPrefetchedRecord;
-    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id)) {
+    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id) && this.rowBelongsToTenant(prefetched.record, this.getTenant(_params))) {
       return prefetched.record;
     }
     const result = await this.repository.findById(String(id));
+    if (result && !this.rowBelongsToTenant(result, this.getTenant(_params))) {
+      throw new NotFoundError(this.resourceType, String(id));
+    }
     if (!result) {
       throw new NotFoundError(this.resourceType, String(id));
     }
@@ -142,14 +189,18 @@ var DrizzleService = class {
   async create(data, params) {
     if (Array.isArray(data)) {
       const results = await Promise.all(
-        data.map((item) => this.repository.create(item))
+        data.map(
+          (item) => this.repository.create(this.withTenant(item, params))
+        )
       );
       for (const result2 of results) {
         this.emit?.("created", result2, params);
       }
       return results;
     }
-    const result = await this.repository.create(data);
+    const result = await this.repository.create(
+      this.withTenant(data, params)
+    );
     this.emit?.("created", result, params);
     return result;
   }
@@ -165,7 +216,10 @@ var DrizzleService = class {
    */
   async update(id, data, params) {
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("updated", result, params);
     return result;
   }
@@ -179,12 +233,14 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       const results = await Promise.all(
         records.map(
           (record) => this.repository.update(
             record[this.id],
-            data
+            this.stripTenantMutation(data)
           )
         )
       );
@@ -194,7 +250,10 @@ var DrizzleService = class {
       return results;
     }
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("patched", result, params);
     return result;
   }
@@ -208,6 +267,8 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       await Promise.all(records.map((record) => this.repository.delete(record[this.id])));
       for (const record of records) {

package/dist/daemon/services/session-env-selections.d.ts

@@ -14,7 +14,7 @@
  * granted access — session env selections expose the creator's private
  * credentials.
  */
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { QueryParams, SessionEnvSelection, SessionID } from '@agor/core/types';
 /**
  * Session-env-selection params
@@ -28,7 +28,7 @@ export type SessionEnvSelectionParams = QueryParams<{
  */
 export declare class SessionEnvSelectionsService {
     private repo;
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
     /**
      * List all selections for a session.
      */
@@ -49,5 +49,5 @@ export declare class SessionEnvSelectionsService {
 /**
  * Service factory
  */
-export declare function createSessionEnvSelectionsService(db: Database): SessionEnvSelectionsService;
+export declare function createSessionEnvSelectionsService(db: TenantScopeAwareDatabase): SessionEnvSelectionsService;
 //# sourceMappingURL=session-env-selections.d.ts.map

package/dist/daemon/services/session-env-selections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-env-selections.d.ts","sourceRoot":"","sources":["../../src/services/session-env-selections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,KAAK,QAAQ,EAAiC,MAAM,eAAe,CAAC;AAC7E,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEpF;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC;IAClD,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,CAAC;AAEH;;GAEG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,IAAI,CAAgC;gBAEhC,EAAE,EAAE,QAAQ;IAIxB;;OAEG;IACG,IAAI,CACR,SAAS,EAAE,SAAS,EACpB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAIjC;;OAEG;IACG,GAAG,CACP,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,MAAM,CACV,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,MAAM,CACV,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,IAAI,CAAC;CAGjB;AAED;;GAEG;AACH,wBAAgB,iCAAiC,CAAC,EAAE,EAAE,QAAQ,GAAG,2BAA2B,CAE3F"}
+{"version":3,"file":"session-env-selections.d.ts","sourceRoot":"","sources":["../../src/services/session-env-selections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAiC,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC7F,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEpF;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC;IAClD,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,CAAC;AAEH;;GAEG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,IAAI,CAAgC;gBAEhC,EAAE,EAAE,wBAAwB;IAIxC;;OAEG;IACG,IAAI,CACR,SAAS,EAAE,SAAS,EACpB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAIjC;;OAEG;IACG,GAAG,CACP,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,MAAM,CACV,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,MAAM,CACV,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,IAAI,CAAC;CAGjB;AAED;;GAEG;AACH,wBAAgB,iCAAiC,CAC/C,EAAE,EAAE,wBAAwB,GAC3B,2BAA2B,CAE7B"}

package/dist/daemon/services/session-mcp-servers.d.ts

@@ -4,7 +4,7 @@
  * Manages the many-to-many relationship between sessions and MCP servers.
  * Provides API for adding/removing/toggling MCP servers for sessions.
  */
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { MCPServer, MCPServerID, QueryParams, SessionID } from '@agor/core/types';
 /**
  * Session-MCP service params
@@ -20,7 +20,7 @@ export type SessionMCPParams = QueryParams<{
  */
 export declare class SessionMCPServersService {
     private sessionMCPRepo;
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
     /**
      * Add MCP server to session
      */
@@ -49,5 +49,5 @@ export declare class SessionMCPServersService {
 /**
  * Service factory function
  */
-export declare function createSessionMCPServersService(db: Database): SessionMCPServersService;
+export declare function createSessionMCPServersService(db: TenantScopeAwareDatabase): SessionMCPServersService;
 //# sourceMappingURL=session-mcp-servers.d.ts.map

package/dist/daemon/services/session-mcp-servers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-mcp-servers.d.ts","sourceRoot":"","sources":["../../src/services/session-mcp-servers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,QAAQ,EAA8B,MAAM,eAAe,CAAC;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEvF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC;IACzC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC,CAAC;AAEH;;GAEG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,cAAc,CAA6B;gBAEvC,EAAE,EAAE,QAAQ;IAIxB;;OAEG;IACG,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,WAAW,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,YAAY,CAChB,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,WAAW,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,YAAY,CAChB,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,WAAW,CACf,SAAS,EAAE,SAAS,EACpB,WAAW,UAAQ,EACnB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,EAAE,CAAC;IAIvB;;OAEG;IACG,UAAU,CACd,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,WAAW,EAAE,EACxB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,KAAK,CACT,SAAS,EAAE,SAAS,EACpB,WAAW,UAAQ,EACnB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,CAAC;CAGnB;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,EAAE,EAAE,QAAQ,GAAG,wBAAwB,CAErF"}
+{"version":3,"file":"session-mcp-servers.d.ts","sourceRoot":"","sources":["../../src/services/session-mcp-servers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAA8B,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEvF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC;IACzC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC,CAAC;AAEH;;GAEG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,cAAc,CAA6B;gBAEvC,EAAE,EAAE,wBAAwB;IAIxC;;OAEG;IACG,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,WAAW,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,YAAY,CAChB,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,WAAW,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,YAAY,CAChB,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,WAAW,CACf,SAAS,EAAE,SAAS,EACpB,WAAW,UAAQ,EACnB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,EAAE,CAAC;IAIvB;;OAEG;IACG,UAAU,CACd,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,WAAW,EAAE,EACxB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,KAAK,CACT,SAAS,EAAE,SAAS,EACpB,WAAW,UAAQ,EACnB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,CAAC;CAGnB;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,wBAAwB,GAC3B,wBAAwB,CAE1B"}

package/dist/daemon/services/session-streams.d.ts

@@ -0,0 +1,29 @@
+import type { Application } from '@agor/core/feathers';
+import type { Params } from '@agor/core/types';
+/**
+ * `session-streams` — a realtime control-plane service that lets a browser
+ * declare interest in a session's streaming events. Subscribing joins the
+ * calling CONNECTION to the per-session stream channel so the daemon can route
+ * high-frequency streaming chunks to only the tabs viewing that session,
+ * instead of broadcasting them to the whole tenant.
+ *
+ * Access is gated by a tenant-scoped `sessions.get`, which runs the same auth /
+ * tenant / branch-view checks a normal session read does — no weaker path to a
+ * session's live text than to its stored messages. Feathers drops connections
+ * from channels automatically on disconnect, so unsubscribe on refresh /
+ * navigation is best-effort; the socket teardown is the real cleanup.
+ */
+export interface SessionStreamSubscription {
+    session_id: string;
+    subscribed: boolean;
+}
+interface SubscribeData {
+    session_id?: string;
+    sessionId?: string;
+}
+export declare function createSessionStreamsService(app: Application): {
+    create(data: SubscribeData, params: Params): Promise<SessionStreamSubscription>;
+    remove(id: string, params: Params): Promise<SessionStreamSubscription>;
+};
+export {};
+//# sourceMappingURL=session-streams.d.ts.map

package/dist/daemon/services/session-streams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-streams.d.ts","sourceRoot":"","sources":["../../src/services/session-streams.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,UAAU,aAAa;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AASD,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,WAAW;iBAqBrC,aAAa,UAAU,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;eAgBpE,MAAM,UAAU,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;EAwB/E"}

package/dist/daemon/services/session-streams.js

@@ -0,0 +1,84 @@
+// src/services/session-streams.ts
+import { BadRequest } from "@agor/core/feathers";
+
+// src/utils/realtime-publish.ts
+import {
+  resolveTenantContext,
+  TenantResolutionError
+} from "@agor/core/config";
+import { getCurrentTenantId, shortId as shortId2 } from "@agor/core/db";
+import { hasMinimumRole as hasMinimumRole2, ROLES as ROLES2 } from "@agor/core/types";
+
+// src/utils/branch-authorization.ts
+import { shortId } from "@agor/core/db";
+import { Forbidden, NotAuthenticated, NotFound } from "@agor/core/feathers";
+import { BRANCH_PERMISSION_LEVELS, hasMinimumRole, ROLES } from "@agor/core/types";
+var PERMISSION_RANK = Object.fromEntries(
+  BRANCH_PERMISSION_LEVELS.map((level, i) => [level, i - 1])
+);
+
+// src/utils/realtime-access-cache.ts
+var DEFAULT_BRANCH_VISIBILITY_TTL_MS = 5 * 6e4;
+var DEFAULT_SESSION_BRANCH_TTL_MS = 60 * 6e4;
+
+// src/utils/realtime-publish.ts
+var SESSION_STREAM_CHANNEL_PREFIX = "session-stream:";
+function sessionStreamChannelName(sessionId) {
+  return `${SESSION_STREAM_CHANNEL_PREFIX}${sessionId}`;
+}
+function existingChannel(app, name) {
+  return (app.channels ?? []).includes(name) ? app.channel(name) : null;
+}
+function joinSessionStreamChannel(app, sessionId, connection) {
+  app.channel(sessionStreamChannelName(sessionId)).join(connection);
+}
+function leaveSessionStreamChannel(app, sessionId, connection) {
+  existingChannel(app, sessionStreamChannelName(sessionId))?.leave(connection);
+}
+var DEBUG_REALTIME_PUBLISH = process.env.AGOR_DEBUG_REALTIME_PUBLISH === "1" || process.env.DEBUG?.includes("realtime-publish");
+
+// src/services/session-streams.ts
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isCanonicalSessionId(id) {
+  return UUID_RE.test(id);
+}
+function createSessionStreamsService(app) {
+  const resolveAccessibleSessionId = async (sessionId, params) => {
+    const session = await app.service("sessions").get(sessionId, { ...params ?? {}, query: {} });
+    return session?.session_id ?? null;
+  };
+  return {
+    async create(data, params) {
+      const connection = params?.connection;
+      if (!connection) {
+        throw new BadRequest("session stream subscription requires a realtime connection");
+      }
+      const sessionId = data?.session_id ?? data?.sessionId;
+      if (!sessionId || typeof sessionId !== "string") {
+        throw new BadRequest("session_id is required");
+      }
+      const canonicalId = await resolveAccessibleSessionId(sessionId, params) ?? sessionId;
+      joinSessionStreamChannel(app, canonicalId, connection);
+      return { session_id: canonicalId, subscribed: true };
+    },
+    async remove(id, params) {
+      const connection = params?.connection;
+      const sessionId = typeof id === "string" ? id : "";
+      if (!connection || !sessionId) {
+        return { session_id: sessionId, subscribed: false };
+      }
+      let canonicalId = sessionId;
+      if (!isCanonicalSessionId(sessionId)) {
+        try {
+          canonicalId = await resolveAccessibleSessionId(sessionId, params) ?? sessionId;
+        } catch {
+        }
+      }
+      leaveSessionStreamChannel(app, canonicalId, connection);
+      return { session_id: canonicalId, subscribed: false };
+    }
+  };
+}
+export {
+  createSessionStreamsService
+};

package/dist/daemon/services/session-token-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-token-service.d.ts","sourceRoot":"","sources":["../../src/services/session-token-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwBH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,mBAAmB;IAK5B,OAAO,CAAC,MAAM;IAJhB,OAAO,CAAC,MAAM,CAAuC;IACrD,OAAO,CAAC,SAAS,CAAuB;gBAG9B,MAAM,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;KAClB;IAMH;;;OAGG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAIlC;;;OAGG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACnE,OAAO,CAAC,MAAM,CAAC;IAkDlB;;;;;;OAMG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACpE,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAqD9B;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAMhC;;OAEG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAe5C;;OAEG;IACH,mBAAmB,IAAI,MAAM;IAI7B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAgB5B;;OAEG;IACH,OAAO,CAAC,iBAAiB;CAU1B"}
+{"version":3,"file":"session-token-service.d.ts","sourceRoot":"","sources":["../../src/services/session-token-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA6BH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,mBAAmB;IAK5B,OAAO,CAAC,MAAM;IAJhB,OAAO,CAAC,MAAM,CAAuC;IACrD,OAAO,CAAC,SAAS,CAAuB;gBAG9B,MAAM,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;KAClB;IAMH;;;OAGG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAIlC;;;OAGG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACnE,OAAO,CAAC,MAAM,CAAC;IAmDlB;;;;;;OAMG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACpE,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAqD9B;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAMhC;;OAEG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAe5C;;OAEG;IACH,mBAAmB,IAAI,MAAM;IAI7B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAgB5B;;OAEG;IACH,OAAO,CAAC,iBAAiB;CAU1B"}

package/dist/daemon/services/session-token-service.js

@@ -1,5 +1,12 @@
 // src/services/session-token-service.ts
+import { getCurrentTenantId } from "@agor/core/db";
 import jwt from "jsonwebtoken";
+
+// src/auth/executor-session-token.ts
+var EXECUTOR_SESSION_TOKEN_TYPE = "executor-session";
+var EXECUTOR_SESSION_TOKEN_PURPOSE = "executor-task";
+
+// src/services/session-token-service.ts
 var DEBUG_SESSION_TOKENS = process.env.AGOR_DEBUG_SESSION_TOKENS === "1" || process.env.DEBUG?.includes("session-token");
 function sessionTokenDebug(...args) {
   if (DEBUG_SESSION_TOKENS) {
@@ -30,16 +37,16 @@ var SessionTokenService = class {
     }
     const now = /* @__PURE__ */ new Date();
     const expiresAt = new Date(now.getTime() + this.config.expiration_ms);
+    const tenantId = getCurrentTenantId();
     const payload = {
       sub: userId,
       // Standard JWT subject claim (used by Feathers for user lookup)
-      type: "executor-session",
-      purpose: "executor-task",
-      sessionId,
-      // Custom claim for session tracking
+      type: EXECUTOR_SESSION_TOKEN_TYPE,
+      purpose: EXECUTOR_SESSION_TOKEN_PURPOSE,
       session_id: sessionId,
       task_id: scope.taskId,
       branch_id: scope.branchId,
+      ...tenantId ? { tenant_id: tenantId } : {},
       iat: Math.floor(now.getTime() / 1e3),
       // Issued at
       exp: Math.floor(expiresAt.getTime() / 1e3),

package/dist/daemon/services/sessions.d.ts

@@ -4,10 +4,10 @@
  * Provides REST + WebSocket API for session management.
  * Uses DrizzleService adapter with SessionRepository.
  */
-import { type Database, type SessionWithLastMessage } from '@agor/core/db';
+import { type SessionWithLastMessage, type TenantScopeAwareDatabase } from '@agor/core/db';
 import { type Application } from '@agor/core/feathers';
-import type { AuthenticatedParams, Paginated, QueryParams, Session, SessionID } from '@agor/core/types';
-import { DrizzleService } from '../adapters/drizzle';
+import type { AuthenticatedParams, Paginated, QueryParams, Session, SessionID, UUID } from '@agor/core/types';
+import { DrizzleService, type Query } from '../adapters/drizzle';
 /**
  * Internal service params shared between services that support last-message enrichment.
  * Bypasses Feathers query filtering for internal service-to-service calls.
@@ -28,6 +28,8 @@ export type SessionParams = QueryParams<{
 }> & AuthenticatedParams & InternalEnrichmentParams & {
     /** Root-level include_last_message flag (bypasses Feathers query filtering, used by internal service calls) */
     _include_last_message?: boolean | 'true' | 'false';
+    /** Internal RBAC SQL pushdown marker set by register-hooks for external regular users. */
+    _agorSqlSessionAccessUserId?: UUID;
 };
 export declare function markRemoteRelationshipsEnrichedResult<T extends object>(result: T): T;
 export declare function isRemoteRelationshipsEnrichedResult(result: unknown): boolean;
@@ -53,7 +55,9 @@ export declare class SessionsService extends DrizzleService<Session, Partial<Ses
     private sessionEnvSelectionRepo;
     private usersRepo;
     private branchRepo;
-    constructor(db: Database, app: Application);
+    private assertSupportedModelConfig;
+    constructor(db: TenantScopeAwareDatabase, app: Application);
+    protected fetchData(_query: Query, params?: SessionParams): Promise<Session[]>;
     enrichRemoteRelationships(sessionList: Session[]): Promise<Session[]>;
     /**
      * Attach explicit MCP server IDs to a session.
@@ -200,5 +204,5 @@ export declare class SessionsService extends DrizzleService<Session, Partial<Ses
 /**
  * Service factory function
  */
-export declare function createSessionsService(db: Database, app: Application): SessionsService;
+export declare function createSessionsService(db: TenantScopeAwareDatabase, app: Application): SessionsService;
 //# sourceMappingURL=sessions.d.ts.map

package/dist/daemon/services/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/services/sessions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAEL,KAAK,QAAQ,EAKb,KAAK,sBAAsB,EAE5B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,WAAW,EAAa,MAAM,qBAAqB,CAAC;AAGlE,OAAO,KAAK,EACV,mBAAmB,EAGnB,SAAS,EACT,WAAW,EACX,OAAO,EACP,SAAS,EAGV,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAgCrD;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,uGAAuG;IACvG,+BAA+B,CAAC,EAAE,MAAM,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;IAClD,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACzC,CAAC,GACA,mBAAmB,GACnB,wBAAwB,GAAG;IACzB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;CACpD,CAAC;AAIJ,wBAAgB,qCAAqC,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAGpF;AAED,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAI5E;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,kBAAkB,EAAE,cAAc,CAAC;IAC3D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,kBAAkB,EAAE,aAAa,CAAC;CAC1D,CAAC;AAEF;;GAEG;AACH,qBAAa,eAAgB,SAAQ,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IAC3F,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,GAAG,CAAc;IACzB,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,uBAAuB,CAAgC;IAC/D,OAAO,CAAC,uBAAuB,CAAgC;IAC/D,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,UAAU,CAAmB;gBAEzB,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW;IAwBpC,yBAAyB,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IA8B3E;;;OAGG;IACG,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB5F;;;OAGG;YACW,cAAc;IA0B5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;YACW,oBAAoB;IAoElC;;;;OAIG;IACG,IAAI,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAC1C,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,CAAC;IA2EnB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,KAAK,CACT,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,OAAO,kBAAkB,EAAE,WAAW,CAAC,EACrD,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,CAAC;IA4JnB;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc,CAAC,CASpB;IAEH,iBAAiB,CACf,OAAO,EAAE,CACP,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,aAAa,KACnB,OAAO,CAAC;QACX,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC,GACD,IAAI;IAID,WAAW,CACf,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC;IAOF;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc,CAAC,CAA+D;IAEtF,iBAAiB,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAI1F,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/E;;;;OAIG;IACG,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,OAAO,EAAE,CAAC;QACrB,QAAQ,EAAE,OAAO,EAAE,CAAC;KACrB,CAAC;IAgBF;;OAEG;IACG,MAAM,CACV,EAAE,EAAE,OAAO,kBAAkB,EAAE,UAAU,EACzC,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,GAAG,OAAO,EAAE,CAAC;IAsC/B;;;OAGG;IACG,KAAK,CACT,EAAE,EAAE,OAAO,kBAAkB,EAAE,UAAU,EACzC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EACtB,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,GAAG,OAAO,EAAE,CAAC;IAqB/B;;;;OAIG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA2B9E;;;OAGG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;CAc5E;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,GAAG,eAAe,CAErF"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/services/sessions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAML,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAE9B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,WAAW,EAAyB,MAAM,qBAAqB,CAAC;AAQ9E,OAAO,KAAK,EACV,mBAAmB,EAGnB,SAAS,EACT,WAAW,EACX,OAAO,EACP,SAAS,EAET,IAAI,EACL,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,KAAK,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAgCjE;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,uGAAuG;IACvG,+BAA+B,CAAC,EAAE,MAAM,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;IAClD,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACzC,CAAC,GACA,mBAAmB,GACnB,wBAAwB,GAAG;IACzB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;IACnD,0FAA0F;IAC1F,2BAA2B,CAAC,EAAE,IAAI,CAAC;CACpC,CAAC;AAmCJ,wBAAgB,qCAAqC,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAGpF;AAED,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAI5E;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,kBAAkB,EAAE,cAAc,CAAC;IAC3D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,kBAAkB,EAAE,aAAa,CAAC;CAC1D,CAAC;AAEF;;GAEG;AACH,qBAAa,eAAgB,SAAQ,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IAC3F,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,GAAG,CAAc;IACzB,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,uBAAuB,CAAgC;IAC/D,OAAO,CAAC,uBAAuB,CAAgC;IAC/D,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,UAAU,CAAmB;IAErC,OAAO,CAAC,0BAA0B;gBAatB,EAAE,EAAE,wBAAwB,EAAE,GAAG,EAAE,WAAW;cAwB1C,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAM9E,yBAAyB,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IA8B3E;;;OAGG;IACG,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB5F;;;OAGG;YACW,cAAc;IA0B5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;YACW,oBAAoB;IAoElC;;;;OAIG;IACG,IAAI,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAC1C,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,CAAC;IA6EnB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,KAAK,CACT,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,OAAO,kBAAkB,EAAE,WAAW,CAAC,EACrD,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,CAAC;IA8JnB;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc,CAAC,CASpB;IAEH,iBAAiB,CACf,OAAO,EAAE,CACP,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,aAAa,KACnB,OAAO,CAAC;QACX,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC,GACD,IAAI;IAID,WAAW,CACf,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC;IAOF;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc,CAAC,CAA+D;IAEtF,iBAAiB,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAI1F,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/E;;;;OAIG;IACG,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,OAAO,EAAE,CAAC;QACrB,QAAQ,EAAE,OAAO,EAAE,CAAC;KACrB,CAAC;IAgBF;;OAEG;IACG,MAAM,CACV,EAAE,EAAE,OAAO,kBAAkB,EAAE,UAAU,EACzC,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,GAAG,OAAO,EAAE,CAAC;IAsC/B;;;OAGG;IACG,KAAK,CACT,EAAE,EAAE,OAAO,kBAAkB,EAAE,UAAU,EACzC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EACtB,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,GAAG,OAAO,EAAE,CAAC;IAqB/B;;;;OAIG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA2B9E;;;OAGG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;CAwE5E;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,wBAAwB,EAC5B,GAAG,EAAE,WAAW,GACf,eAAe,CAEjB"}