agor-live 0.22.0 → 0.23.2

package/dist/daemon/utils/append-system-message.d.ts

@@ -9,12 +9,12 @@
  * Returns the created Message. Callers that need to update a task's
  * message_range.end_index (e.g. startup.ts) can read it from message.index.
  */
-import type { Database } from '@agor/core/db';
+import type { TenantScopeAwareDatabase } from '@agor/core/db';
 import type { Application } from '@agor/core/feathers';
 import type { ContentBlock, Message, MessageType, Params } from '@agor/core/types';
 export interface AppendSystemMessageOptions {
     app: Application;
-    db: Database;
+    db: TenantScopeAwareDatabase;
     sessionId: string;
     taskId?: string;
     content: string | ContentBlock[];

package/dist/daemon/utils/append-system-message.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"append-system-message.d.ts","sourceRoot":"","sources":["../../src/utils/append-system-message.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EACV,YAAY,EACZ,OAAO,EAEP,WAAW,EACX,MAAM,EAGP,MAAM,kBAAkB,CAAC;AAG1B,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,WAAW,CAAC;IACjB,EAAE,EAAE,QAAQ,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,GAAG,YAAY,EAAE,CAAC;IACjC,uEAAuE;IACvE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2BAA2B;IAC3B,IAAI,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,QAAQ,GAAG,gBAAgB,GAAG,cAAc,GAAG,gBAAgB,CAAC,CAAC;IAC7F,qCAAqC;IACrC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/B,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,OAAO,CAAC,CAiC5F"}
+{"version":3,"file":"append-system-message.d.ts","sourceRoot":"","sources":["../../src/utils/append-system-message.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EACV,YAAY,EACZ,OAAO,EAEP,WAAW,EACX,MAAM,EAGP,MAAM,kBAAkB,CAAC;AAG1B,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,WAAW,CAAC;IACjB,EAAE,EAAE,wBAAwB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,GAAG,YAAY,EAAE,CAAC;IACjC,uEAAuE;IACvE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2BAA2B;IAC3B,IAAI,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,QAAQ,GAAG,gBAAgB,GAAG,cAAc,GAAG,gBAAgB,CAAC,CAAC;IAC7F,qCAAqC;IACrC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/B,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,OAAO,CAAC,CAiC5F"}

package/dist/daemon/utils/apply-session-config-defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply-session-config-defaults.d.ts","sourceRoot":"","sources":["../../src/utils/apply-session-config-defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,KAAK,EAAmB,WAAW,EAAiB,MAAM,kBAAkB,CAAC;AAMpF;;;;;GAKG;AACH,MAAM,WAAW,8BAA8B;IAC7C,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED,wBAAgB,0BAA0B,CAAC,IAAI,GAAE,8BAAmC,IAGpE,SAAS,WAAW,KAAG,OAAO,CAAC,WAAW,CAAC,CA4D1D"}
+{"version":3,"file":"apply-session-config-defaults.d.ts","sourceRoot":"","sources":["../../src/utils/apply-session-config-defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAQH,OAAO,KAAK,EAAmB,WAAW,EAAiB,MAAM,kBAAkB,CAAC;AAMpF;;;;;GAKG;AACH,MAAM,WAAW,8BAA8B;IAC7C,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED,wBAAgB,0BAA0B,CAAC,IAAI,GAAE,8BAAmC,IAGpE,SAAS,WAAW,KAAG,OAAO,CAAC,WAAW,CAAC,CA4E1D"}

package/dist/daemon/utils/apply-session-config-defaults.js

@@ -1,4 +1,9 @@
 // src/utils/apply-session-config-defaults.ts
+import { BadRequest } from "@agor/core/feathers";
+import {
+  formatUnsupportedAgorCodexModelMessage,
+  isUnsupportedAgorCodexModel
+} from "@agor/core/models";
 import { resolveSessionDefaults } from "@agor/core/sessions";
 function applySessionConfigDefaults(opts = {}) {
   const { warnOnExternalDefaultFill = true } = opts;
@@ -10,9 +15,12 @@ function applySessionConfigDefaults(opts = {}) {
     if (!data) return context;
     const hasPermission = data.permission_config != null;
     const hasModel = !!data.model_config?.model;
-    if (hasPermission && hasModel) return context;
     const agenticTool = data.agentic_tool;
     if (!agenticTool) return context;
+    if (agenticTool === "codex" && data.model_config?.model && isUnsupportedAgorCodexModel(data.model_config.model)) {
+      throw new BadRequest(formatUnsupportedAgorCodexModelMessage(data.model_config.model));
+    }
+    if (hasPermission && hasModel) return context;
     const userId = data.created_by;
     if (!userId) return context;
     let user;
@@ -31,6 +39,9 @@ function applySessionConfigDefaults(opts = {}) {
       user,
       overrides: { modelConfig: data.model_config ?? void 0 }
     });
+    if (resolved.model_config?.model && agenticTool === "codex" && isUnsupportedAgorCodexModel(resolved.model_config.model)) {
+      throw new BadRequest(formatUnsupportedAgorCodexModelMessage(resolved.model_config.model));
+    }
     if (!hasPermission) {
       data.permission_config = resolved.permission_config;
       if (warnOnExternalDefaultFill && context.params.provider) {

package/dist/daemon/utils/authorization.d.ts

@@ -65,5 +65,7 @@ export declare function requireAdminForEnvConfig(): (context: HookContext) => Ho
 export declare function registerAuthenticatedRoute(app: any, path: string, service: any, authConfig: Record<string, {
     role: Role;
     action: string;
-}>, requireAuth: any): void;
+}>, requireAuth: any, options?: {
+    around?: Array<(context: HookContext, next: () => Promise<void>) => Promise<void>>;
+}): void;
 //# sourceMappingURL=authorization.d.ts.map

package/dist/daemon/utils/authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/utils/authorization.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAInF,MAAM,MAAM,IAAI,GAAG,QAAQ,CAAC;AAE5B;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,mBAAmB,GAAG,SAAS,EACvC,WAAW,EAAE,IAAI,EACjB,MAAM,GAAE,MAA8B,GACrC,IAAI,CAmBN;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,IAC3D,SAAS,WAAW,0BAI7B;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,sBAAsB,GAAG,SAAS,EAC/C,MAAM,EAAE,mBAAmB,GAAG,SAAS,EACvC,MAAM,EAAE,MAAM,GACb,IAAI,CAYN;AAuBD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,KAC9B,SAAS,WAAW,0BAsB7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,0BAA0B,CAExC,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,MAAM,EAEZ,OAAO,EAAE,GAAG,EACZ,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EAE1D,WAAW,EAAE,GAAG,GACf,IAAI,CAsBN"}
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/utils/authorization.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAInF,MAAM,MAAM,IAAI,GAAG,QAAQ,CAAC;AAE5B;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,mBAAmB,GAAG,SAAS,EACvC,WAAW,EAAE,IAAI,EACjB,MAAM,GAAE,MAA8B,GACrC,IAAI,CAmBN;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,IAC3D,SAAS,WAAW,0BAI7B;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,sBAAsB,GAAG,SAAS,EAC/C,MAAM,EAAE,mBAAmB,GAAG,SAAS,EACvC,MAAM,EAAE,MAAM,GACb,IAAI,CAYN;AAuBD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,KAC9B,SAAS,WAAW,0BAsB7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,0BAA0B,CAExC,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,MAAM,EAEZ,OAAO,EAAE,GAAG,EACZ,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EAE1D,WAAW,EAAE,GAAG,EAChB,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CAC/E,GACL,IAAI,CAuBN"}

package/dist/daemon/utils/authorization.js

@@ -4,13 +4,41 @@ import { hasMinimumRole, ROLES } from "@agor/core/types";
 
 // src/auth/executor-runtime-scope.ts
 import { Forbidden } from "@agor/core/feathers";
+
+// src/auth/executor-session-token.ts
+var EXECUTOR_SESSION_TOKEN_TYPE = "executor-session";
+var EXECUTOR_SESSION_TOKEN_PURPOSE = "executor-task";
+function isExecutorSessionTokenPayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+  const record = payload;
+  return record.type === EXECUTOR_SESSION_TOKEN_TYPE && record.purpose === EXECUTOR_SESSION_TOKEN_PURPOSE;
+}
+function getExecutorSessionTokenSessionId(payload) {
+  return payload.session_id ?? payload.sessionId;
+}
+
+// src/auth/executor-runtime-scope.ts
 function scopedPayload(context) {
-  const payload = context.params.authentication?.payload;
-  if (payload?.type !== "executor-session") return null;
-  if (payload.purpose !== "executor-task") {
-    throw new Forbidden("Executor token is not valid for this request");
+  const params = context.params;
+  const payload = params.authentication?.payload;
+  if (payload?.type === EXECUTOR_SESSION_TOKEN_TYPE) {
+    if (!isExecutorSessionTokenPayload(payload)) {
+      throw new Forbidden("Executor token is not valid for this request");
+    }
+    return payload;
+  }
+  if (params.authentication?.strategy === "jwt" && params.task_id) {
+    return {
+      type: EXECUTOR_SESSION_TOKEN_TYPE,
+      purpose: EXECUTOR_SESSION_TOKEN_PURPOSE,
+      task_id: params.task_id,
+      session_id: params.session_id,
+      sessionId: params.sessionId,
+      branch_id: params.branch_id
+    };
   }
-  return payload;
+  if (payload?.type !== void 0) return null;
+  return null;
 }
 function expectClaim(claim, label) {
   if (!claim) {
@@ -112,7 +140,7 @@ function executorRuntimeScopeGuard() {
     const payload = scopedPayload(context);
     if (!payload) return context;
     const scope = {
-      sessionId: payload.session_id ?? payload.sessionId,
+      sessionId: getExecutorSessionTokenSessionId(payload),
       taskId: payload.task_id,
       branchId: payload.branch_id
     };
@@ -310,7 +338,7 @@ function requireAdminForEnvConfig() {
     return context;
   };
 }
-function registerAuthenticatedRoute(app, path, service, authConfig, requireAuth) {
+function registerAuthenticatedRoute(app, path, service, authConfig, requireAuth, options = {}) {
   app.use(path, service);
   const hooks = {};
   for (const [method, config] of Object.entries(authConfig)) {
@@ -321,6 +349,7 @@ function registerAuthenticatedRoute(app, path, service, authConfig, requireAuth)
     ];
   }
   app.service(path).hooks({
+    ...options.around ? { around: { all: options.around } } : {},
     before: hooks
   });
 }

package/dist/daemon/utils/branch-authorization.d.ts

@@ -401,6 +401,17 @@ export declare function ensureCanView(options?: {
 export declare function scopeFindToAccessibleBranches(branchRepo: BranchRepository, options?: {
     allowSuperadmin?: boolean;
 }): (context: HookContext) => Promise<HookContext<unknown>>;
+/**
+ * Mark a branch-scoped find() request for repository-level SQL RBAC pushdown.
+ *
+ * This is the single-query alternative to {@link scopeFindToAccessibleBranches}:
+ * instead of preloading every accessible branch id and injecting a large
+ * `branch_id IN (...)` filter, services that understand this marker compose the
+ * shared branch visibility predicate directly into their repository query.
+ */
+export declare function scopeFindToAccessibleBranchesSql(options?: {
+    allowSuperadmin?: boolean;
+}): (context: HookContext) => Promise<HookContext<unknown>>;
 /**
  * Scope find() queries on session-scoped resources to the set of sessions
  * the caller can access (via their accessible branches).
@@ -425,6 +436,17 @@ export declare function scopeFindToAccessibleBranches(branchRepo: BranchReposito
 export declare function scopeFindToAccessibleSessions(sessionRepo: SessionRepository, options?: {
     allowSuperadmin?: boolean;
 }): (context: HookContext) => Promise<HookContext<unknown>>;
+/**
+ * Mark a session-scoped find() request for repository-level SQL RBAC pushdown.
+ *
+ * This is the single-query alternative to {@link scopeFindToAccessibleSessions}:
+ * instead of preloading every accessible session id and injecting a large
+ * `session_id IN (...)` filter, services that understand this marker compose
+ * the shared branch visibility predicate through the session's branch.
+ */
+export declare function scopeFindToAccessibleSessionsSql(options?: {
+    allowSuperadmin?: boolean;
+}): (context: HookContext) => Promise<HookContext<unknown>>;
 /**
  * Scope find() queries on the boards service to the set of boards the caller
  * can see.
@@ -446,6 +468,14 @@ export declare function scopeFindToAccessibleSessions(sessionRepo: SessionReposi
 export declare function scopeFindToAccessibleBoards(boardRepo: BoardRepository, options?: {
     allowSuperadmin?: boolean;
 }): (context: HookContext) => Promise<HookContext<unknown>>;
+/**
+ * Mark a boards.find() request for repository-level SQL board-visibility
+ * pushdown. Avoids resolving visible board ids into a large `board_id IN (...)`
+ * list before the service query runs.
+ */
+export declare function scopeFindToAccessibleBoardsSql(options?: {
+    allowSuperadmin?: boolean;
+}): (context: HookContext) => Promise<HookContext<unknown>>;
 /**
  * Core check: is the caller the session's creator OR a global admin/superadmin?
  *

package/dist/daemon/utils/branch-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"branch-authorization.d.ts","sourceRoot":"","sources":["../../src/utils/branch-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EACV,mBAAmB,EACnB,MAAM,EACN,QAAQ,EACR,qBAAqB,EACrB,WAAW,EACX,OAAO,EACP,IAAI,EACL,MAAM,kBAAkB,CAAC;AAG1B;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,eAAe,UAAO,GAAG,OAAO,CAGtF;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAExB,CAAC;AAuH3C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,IAAI,EACZ,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,qBAAqB,EACpC,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,UAAO,EACtB,mBAAmB,CAAC,EAAE,qBAAqB,GAC1C,OAAO,CAiBT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,IAAI,EACZ,OAAO,EAAE,OAAO,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,UAAO,EACtB,mBAAmB,CAAC,EAAE,qBAAqB,GAC1C,qBAAqB,CASvB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,mBAAmB,EAC3B,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CACrD,UAAU,EAAE,gBAAgB,EAC5B,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,mBAAmB,GAAG,SAAS,EACvC,MAAM,GAAE,MAA0C,GACjD,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,gBAAgB,EAAE,aAAa,SAAc,IACpE,SAAS,WAAW,mCAgDnC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,qBAAqB,EACpC,MAAM,GAAE,MAA8B,EACtC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IAE/B,SAAS,WAAW,0BAsD7B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,gBAAgB,EAC5B,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IAEzB,SAAS,WAAW,mCAuDnC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,IAAI,EAAE,CAAC,EAAE,EACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,cAAc,GAAE,WAAW,CAAC,MAAM,CAAa,GAC9C;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,CAAC,EAAE,CAAA;CAAE,CAuC3D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,iBAAiB,EAC9B,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IAEzB,SAAS,WAAW,mCA+CnC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,gBAAgB,IACvD,SAAS,WAAW,mCAuDnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAE/B,cAAc,EAAE,GAAG,EAAE,uCAAuC;AAC5D,UAAU,EAAE,gBAAgB,IAEd,SAAS,WAAW,mCAoEnC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,KACrB,SAAS,WAAW,mCAiEnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAEzB,cAAc,EAAE,GAAG,IAEL,SAAS,WAAW,mCAsBnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,gBAAgB,IAClD,SAAS,WAAW,mCAwBnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,KAC/B,SAAS,WAAW,0BAyB7B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,CACtC,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC7C,kBAAkB,EAAE,MAAM,GAAG,IAAI,EACjC,iBAAiB,EAAE,OAAO,GACzB,MAAM,GAAG,IAAI,CAKf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,uBAAuB,CAE3C,QAAQ,EAAE,GAAG,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAEpC,QAAQ,EAAE,GAAG,IAEC,SAAS,WAAW,mCAyBnC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CAEzC,QAAQ,EAAE,GAAG,IAEC,SAAS,WAAW,mCAyCnC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,4BAA4B,CAChD,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EAEd,GAAG,EAAE;IAAE,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,EACnC,UAAU,EAAE,gBAAgB,GAC3B,OAAO,CAAC,OAAO,CAAC,CA+ClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,aAz1B3D,WAAW,0BA21B7B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,aAp2BpD,WAAW,0BAs2B7B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IACtE,SAAS,WAAW,0BAoE7B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,aAr8BlD,WAAW,0BAu8B7B;AAgGD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,gBAAgB,EAC5B,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IAEzB,SAAS,WAAW,mCASnC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,iBAAiB,EAC9B,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IAEzB,SAAS,WAAW,mCASnC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,eAAe,EAC1B,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IAEzB,SAAS,WAAW,mCAQnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAE,EACtE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EACpC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACtC,IAAI,CAmBN;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IACvE,SAAS,WAAW,0BAkB7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,EAC9B,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAE,EACxE,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,iCAAiC,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,EACtF,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACtC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAA;CAAE,CAiDpD;AAQD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,kBAAkB,EAChC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IAEzB,SAAS,WAAW,mCA2CnC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,kBAAkB,EAChC,UAAU,EAAE,gBAAgB,IAEd,SAAS,WAAW,mCAqBnC;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IACrE,SAAS,WAAW,0BAsC7B"}
+{"version":3,"file":"branch-authorization.d.ts","sourceRoot":"","sources":["../../src/utils/branch-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EACV,mBAAmB,EACnB,MAAM,EACN,QAAQ,EACR,qBAAqB,EACrB,WAAW,EACX,OAAO,EACP,IAAI,EACL,MAAM,kBAAkB,CAAC;AAG1B;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,eAAe,UAAO,GAAG,OAAO,CAGtF;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAExB,CAAC;AAuH3C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,IAAI,EACZ,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,qBAAqB,EACpC,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,UAAO,EACtB,mBAAmB,CAAC,EAAE,qBAAqB,GAC1C,OAAO,CAiBT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,IAAI,EACZ,OAAO,EAAE,OAAO,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,UAAO,EACtB,mBAAmB,CAAC,EAAE,qBAAqB,GAC1C,qBAAqB,CASvB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,mBAAmB,EAC3B,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CACrD,UAAU,EAAE,gBAAgB,EAC5B,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,mBAAmB,GAAG,SAAS,EACvC,MAAM,GAAE,MAA0C,GACjD,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,gBAAgB,EAAE,aAAa,SAAc,IACpE,SAAS,WAAW,mCAgDnC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,qBAAqB,EACpC,MAAM,GAAE,MAA8B,EACtC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IAE/B,SAAS,WAAW,0BAsD7B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,gBAAgB,EAC5B,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IAEzB,SAAS,WAAW,mCAuDnC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,IAAI,EAAE,CAAC,EAAE,EACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,cAAc,GAAE,WAAW,CAAC,MAAM,CAAa,GAC9C;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,CAAC,EAAE,CAAA;CAAE,CAuC3D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,iBAAiB,EAC9B,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IAEzB,SAAS,WAAW,mCAoFnC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,gBAAgB,IACvD,SAAS,WAAW,mCAuDnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAE/B,cAAc,EAAE,GAAG,EAAE,uCAAuC;AAC5D,UAAU,EAAE,gBAAgB,IAEd,SAAS,WAAW,mCAoEnC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,KACrB,SAAS,WAAW,mCAiEnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAEzB,cAAc,EAAE,GAAG,IAEL,SAAS,WAAW,mCAsBnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,gBAAgB,IAClD,SAAS,WAAW,mCAwBnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,KAC/B,SAAS,WAAW,0BAyB7B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,CACtC,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC7C,kBAAkB,EAAE,MAAM,GAAG,IAAI,EACjC,iBAAiB,EAAE,OAAO,GACzB,MAAM,GAAG,IAAI,CAKf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,uBAAuB,CAE3C,QAAQ,EAAE,GAAG,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAEpC,QAAQ,EAAE,GAAG,IAEC,SAAS,WAAW,mCAyBnC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CAEzC,QAAQ,EAAE,GAAG,IAEC,SAAS,WAAW,mCAyCnC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,4BAA4B,CAChD,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EAEd,GAAG,EAAE;IAAE,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,EACnC,UAAU,EAAE,gBAAgB,GAC3B,OAAO,CAAC,OAAO,CAAC,CA+ClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,aA93B3D,WAAW,0BAg4B7B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,aAz4BpD,WAAW,0BA24B7B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IACtE,SAAS,WAAW,0BAoE7B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,aA1+BlD,WAAW,0BA4+B7B;AA0HD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,gBAAgB,EAC5B,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IAEzB,SAAS,WAAW,mCASnC;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IACxE,SAAS,WAAW,mCAQnC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,iBAAiB,EAC9B,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IAEzB,SAAS,WAAW,mCASnC;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IACxE,SAAS,WAAW,mCAQnC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,eAAe,EAC1B,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IAEzB,SAAS,WAAW,mCAQnC;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IACtE,SAAS,WAAW,mCAQnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAE,EACtE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EACpC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACtC,IAAI,CAmBN;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IACvE,SAAS,WAAW,0BAkB7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,EAC9B,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAE,EACxE,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,iCAAiC,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,EACtF,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACtC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAA;CAAE,CAiDpD;AAQD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,kBAAkB,EAChC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IAEzB,SAAS,WAAW,mCA2CnC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,kBAAkB,EAChC,UAAU,EAAE,gBAAgB,IAEd,SAAS,WAAW,mCAqBnC;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,IACrE,SAAS,WAAW,0BAsC7B"}

package/dist/daemon/utils/branch-authorization.js

@@ -318,11 +318,28 @@ function scopeSessionQuery(sessionRepo, options) {
     }
     const userRole = context.params.user?.role;
     const allowSuperadmin = options?.allowSuperadmin ?? true;
-    const accessibleSessions = isSuperAdmin(userRole, allowSuperadmin) ? await sessionRepo.findAll() : await sessionRepo.findAccessibleSessions(userId);
-    context.result = paginateClientSide(
-      accessibleSessions,
-      context.params.query
-    );
+    const query = context.params.query;
+    const boardId = query?.board_id;
+    const accessibleSessions = isSuperAdmin(userRole, allowSuperadmin) ? boardId ? await sessionRepo.findByBoard(boardId) : await sessionRepo.findAll() : await sessionRepo.findAccessibleSessions(userId, boardId);
+    const sortSpec = query?.$sort;
+    const sortKeys = sortSpec ? Object.keys(sortSpec) : [];
+    const isUpdatedAtSort = sortKeys.length === 1 && sortKeys[0] === "updated_at";
+    if (isUpdatedAtSort) {
+      const dir = sortSpec.updated_at;
+      accessibleSessions.sort((a, b) => {
+        const av = a.last_updated ?? "";
+        const bv = b.last_updated ?? "";
+        if (av < bv) return dir === -1 ? 1 : -1;
+        if (av > bv) return dir === -1 ? -1 : 1;
+        return 0;
+      });
+    }
+    let paginateQuery = query ?? {};
+    if (isUpdatedAtSort) {
+      const { $sort: _ignoredUpdatedAtSort, ...rest } = paginateQuery;
+      paginateQuery = rest;
+    }
+    context.result = paginateClientSide(accessibleSessions, paginateQuery, /* @__PURE__ */ new Set(["board_id"]));
     return context;
   };
 }
@@ -686,6 +703,20 @@ async function resolveFindScopeAccess(context, options, loadAccessibleIds) {
   const ids = await loadAccessibleIds(userId);
   return { kind: "filter", accessibleIds: new Set(ids) };
 }
+async function resolveFindSqlScopeAccess(context, options) {
+  if (context.method !== "find") return { kind: "passThrough" };
+  if (!context.params.provider) return { kind: "passThrough" };
+  if (context.params.user?._isServiceAccount) return { kind: "passThrough" };
+  const userId = context.params.user?.user_id;
+  if (!userId) {
+    emptyFindResult(context);
+    return { kind: "handled" };
+  }
+  const userRole = context.params.user?.role;
+  const allowSuperadmin = options?.allowSuperadmin ?? true;
+  if (isSuperAdmin(userRole, allowSuperadmin)) return { kind: "passThrough" };
+  return { kind: "filter", userId };
+}
 function intersectFindQuery(context, field, accessibleIds) {
   const query = context.params.query ?? {};
   const existing = query[field];
@@ -715,6 +746,14 @@ function scopeFindToAccessibleBranches(branchRepo, options) {
     return intersectFindQuery(context, "branch_id", decision.accessibleIds);
   };
 }
+function scopeFindToAccessibleBranchesSql(options) {
+  return async (context) => {
+    const decision = await resolveFindSqlScopeAccess(context, options);
+    if (decision.kind !== "filter") return context;
+    context.params._agorSqlBranchAccessUserId = decision.userId;
+    return context;
+  };
+}
 function scopeFindToAccessibleSessions(sessionRepo, options) {
   return async (context) => {
     const decision = await resolveFindScopeAccess(context, options, async (uid) => {
@@ -725,6 +764,14 @@ function scopeFindToAccessibleSessions(sessionRepo, options) {
     return intersectFindQuery(context, "session_id", decision.accessibleIds);
   };
 }
+function scopeFindToAccessibleSessionsSql(options) {
+  return async (context) => {
+    const decision = await resolveFindSqlScopeAccess(context, options);
+    if (decision.kind !== "filter") return context;
+    context.params._agorSqlSessionAccessUserId = decision.userId;
+    return context;
+  };
+}
 function scopeFindToAccessibleBoards(boardRepo, options) {
   return async (context) => {
     const decision = await resolveFindScopeAccess(
@@ -736,6 +783,14 @@ function scopeFindToAccessibleBoards(boardRepo, options) {
     return intersectFindQuery(context, "board_id", decision.accessibleIds);
   };
 }
+function scopeFindToAccessibleBoardsSql(options) {
+  return async (context) => {
+    const decision = await resolveFindSqlScopeAccess(context, options);
+    if (decision.kind !== "filter") return context;
+    context.params._agorSqlBoardAccessUserId = decision.userId;
+    return context;
+  };
+}
 function checkSessionOwnerOrAdmin(user, session, options) {
   if (user._isServiceAccount) return;
   const allowSuperadmin = options?.allowSuperadmin ?? true;
@@ -901,8 +956,11 @@ export {
   resolveSessionContext,
   scopeBranchQuery,
   scopeFindToAccessibleBoards,
+  scopeFindToAccessibleBoardsSql,
   scopeFindToAccessibleBranches,
+  scopeFindToAccessibleBranchesSql,
   scopeFindToAccessibleSessions,
+  scopeFindToAccessibleSessionsSql,
   scopeScheduleQuery,
   scopeSessionQuery,
   setSessionUnixUsername,

package/dist/daemon/utils/branch-inspect.d.ts

@@ -7,5 +7,6 @@ export interface BranchInspectResult {
 export declare function inspectBranchViaExecutor(app: Application, branchId: BranchID, options?: {
     asUser?: string | null;
     logPrefix?: string;
+    serviceTokenScope?: Record<string, unknown>;
 }): Promise<BranchInspectResult>;
 //# sourceMappingURL=branch-inspect.d.ts.map

package/dist/daemon/utils/branch-inspect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"branch-inspect.d.ts","sourceRoot":"","sources":["../../src/utils/branch-inspect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAWD,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,WAAW,EAChB,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3D,OAAO,CAAC,mBAAmB,CAAC,CA2B9B"}
+{"version":3,"file":"branch-inspect.d.ts","sourceRoot":"","sources":["../../src/utils/branch-inspect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAWD,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,WAAW,EAChB,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC,GACL,OAAO,CAAC,mBAAmB,CAAC,CA4B9B"}

package/dist/daemon/utils/branch-inspect.js

@@ -108,6 +108,13 @@ function generateTaskId() {
   return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 function findExecutorPath() {
+  const configuredPath = process.env.AGOR_EXECUTOR_PATH;
+  if (configuredPath) {
+    if (!existsSync(configuredPath)) {
+      throw new Error(`Configured AGOR_EXECUTOR_PATH does not exist: ${configuredPath}`);
+    }
+    return configuredPath;
+  }
   const dirname = typeof __dirname !== "undefined" ? __dirname : path.dirname(fileURLToPath(import.meta.url));
   const possiblePaths = [
     path.join(dirname, "../executor/cli.js"),
@@ -407,12 +414,12 @@ function createServiceToken(jwtSecret, expiresIn, scope = {}) {
     expiresIn || "5m"
   );
 }
-function generateSessionToken(app) {
+function generateSessionToken(app, scope = {}) {
   const jwtSecret = app.settings.authentication?.secret;
   if (!jwtSecret) {
     throw new Error("JWT secret not configured in app settings");
   }
-  return createServiceToken(jwtSecret);
+  return createServiceToken(jwtSecret, void 0, scope);
 }
 
 // src/utils/branch-inspect.ts
@@ -421,7 +428,8 @@ function isBranchInspectResult(value) {
 }
 async function inspectBranchViaExecutor(app, branchId, options = {}) {
   const sessionToken = generateSessionToken(
-    app
+    app,
+    options.serviceTokenScope
   );
   const result = await runExecutorCommand(
     {

package/dist/daemon/utils/emit-service-event.d.ts

@@ -0,0 +1,56 @@
+import type { Application } from '@agor/core/feathers';
+import type { HookContext } from '@agor/core/types';
+export type ManualServiceEvent = {
+    /**
+     * Service path the event belongs to (e.g. `'branches'`). Load-bearing: the
+     * realtime publish handler keys tenant + branch/session RBAC scoping off
+     * `context.path`.
+     */
+    path: string;
+    /**
+     * Service event name. Typically one of `created` | `updated` | `patched` |
+     * `removed` (the method is inferred from these), but any custom event string
+     * is supported — pass `method` to set the inferred CRUD method for those.
+     */
+    event: string;
+    /** Record to broadcast (becomes both the event payload and `hook.result`). */
+    data: unknown;
+    /**
+     * Request params carrying tenant/connection context. Load-bearing: without a
+     * resolvable tenant here (or an ambient tenant DB scope), multi-tenant
+     * publishing suppresses the event to service-only sockets.
+     */
+    params?: HookContext['params'];
+    /** Optional record id (publisher uses it as a branch-id fallback and for logging). */
+    id?: HookContext['id'];
+    /** Overrides the CRUD method inferred from `event`. */
+    method?: string;
+};
+/**
+ * Manually emit a Feathers service event with a correctly-shaped publish
+ * context.
+ *
+ * Some services persist through a raw adapter path (e.g. an overridden
+ * `patch()` that calls `super.patch()`), which bypasses Feathers' automatic
+ * event dispatch — so those call sites must emit the service event by hand.
+ *
+ * The shape of the emit matters. Feathers' transport-commons publish listener
+ * passes the THIRD `emit` argument through UNCHANGED as the publish `hook`, and
+ * only synthesizes a fake `{ path, service, app, result }` when that argument
+ * is absent (`@feathersjs/transport-commons` `channels/index.ts`). Automatic
+ * events, by contrast, emit the full HookContext (`@feathersjs/feathers`
+ * `events.ts`). So both malformed shapes lose something the global publish
+ * handler (`configureRealtimePublish`) needs:
+ *   - passing NO third arg gets a synthesized `path`, but no `context.params`
+ *     (no tenant/connection context), and
+ *   - passing raw params as the third arg carries `context.params`-looking data
+ *     at the wrong nesting AND loses `path` (Feathers won't synthesize it once a
+ *     third arg is present).
+ * Either way the handler can't resolve the tenant channel (multi-tenancy)
+ * and/or the branch/session RBAC scope, so it degrades to global-scope
+ * broadcast or service-only suppression.
+ *
+ * Build the hook shape once, here, so call sites can't drift on it.
+ */
+export declare function emitServiceEvent(app: Application, event: ManualServiceEvent): void;
+//# sourceMappingURL=emit-service-event.d.ts.map

package/dist/daemon/utils/emit-service-event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit-service-event.d.ts","sourceRoot":"","sources":["../../src/utils/emit-service-event.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AASpD,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,IAAI,EAAE,OAAO,CAAC;IACd;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/B,sFAAsF;IACtF,EAAE,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IACvB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAclF"}

package/dist/daemon/utils/emit-service-event.js

@@ -0,0 +1,23 @@
+// src/utils/emit-service-event.ts
+var DEFAULT_EVENT_METHOD = {
+  created: "create",
+  updated: "update",
+  patched: "patch",
+  removed: "remove"
+};
+function emitServiceEvent(app, event) {
+  const service = app.service(event.path);
+  service.emit?.(event.event, event.data, {
+    app,
+    service,
+    path: event.path,
+    method: event.method ?? DEFAULT_EVENT_METHOD[event.event] ?? "patch",
+    event: event.event,
+    id: event.id,
+    result: event.data,
+    params: event.params ?? {}
+  });
+}
+export {
+  emitServiceEvent
+};

package/dist/daemon/utils/executor-read-impersonation.d.ts

@@ -1,4 +1,4 @@
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { User, UserID } from '@agor/core/types';
 /**
  * Resolve the optional `asUser` for short-lived executor read/probe commands.
@@ -9,5 +9,5 @@ import type { User, UserID } from '@agor/core/types';
  * caller's Unix identity so reads happen with the same OS-level access as the
  * requesting user.
  */
-export declare function resolveExecutorReadAsUser(db: Database, userOrId: User | UserID | undefined | null): Promise<string | undefined>;
+export declare function resolveExecutorReadAsUser(db: TenantScopeAwareDatabase, userOrId: User | UserID | undefined | null): Promise<string | undefined>;
 //# sourceMappingURL=executor-read-impersonation.d.ts.map

package/dist/daemon/utils/executor-read-impersonation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor-read-impersonation.d.ts","sourceRoot":"","sources":["../../src/utils/executor-read-impersonation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,QAAQ,EAAmB,MAAM,eAAe,CAAC;AAC/D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,GACzC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAsB7B"}
+{"version":3,"file":"executor-read-impersonation.d.ts","sourceRoot":"","sources":["../../src/utils/executor-read-impersonation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,wBAAwB,EAAmB,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,wBAAwB,EAC5B,QAAQ,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,GACzC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAsB7B"}

package/dist/daemon/utils/git-impersonation.d.ts

@@ -6,10 +6,10 @@
  * via `initgroups()` so the daemon can see `agor_wt_*` groups added at
  * runtime — but only when supplemental groups actually exist.
  *
- * In the open-access default (`branch_rbac: false`, `unix_user_mode:
- * simple`) no supplemental groups are ever created, so wrapping in sudo is
- * pure overhead AND breaks for users who never configured passwordless
- * sudoers (#1140). Return undefined in that case so callers spawn directly.
+ * In simple Unix mode no supplemental branch groups are created, even when
+ * app-level `branch_rbac` is enabled, so wrapping in sudo is pure overhead
+ * AND breaks for users who never configured passwordless sudoers (#1140).
+ * Return undefined in that case so callers spawn directly.
  *
  * The gate lives HERE on purpose: every caller that resolves impersonation
  * needs the same check, and dropping it at a call site is exactly how the
@@ -18,7 +18,7 @@
  * caller paths. Callers can spawn directly with the result; no extra gating
  * required.
  */
-import type { Database } from '@agor/core/db';
+import type { TenantScopeAwareDatabase } from '@agor/core/db';
 import type { Branch, UserID } from '@agor/core/types';
 /**
  * Resolve the configured daemon user for `sudo -u` group-refresh wrapping,
@@ -44,9 +44,9 @@ export declare function resolveDaemonUserForGroupRefresh(): Promise<string | und
  * Resolve Unix user for git operations.
  *
  * Returns the daemon user when group refresh via `sudo -u` is needed
- * (RBAC enabled or non-simple unix_user_mode — see
- * `isUnixGroupRefreshNeeded`). Returns `undefined` in the open-access
- * default so callers spawn directly without sudo wrap (#1140).
+ * (non-simple unix_user_mode — see `isUnixGroupRefreshNeeded`). Returns
+ * `undefined` in simple mode so callers spawn directly without sudo wrap
+ * (#1140), regardless of app-level branch RBAC.
  *
  * @param db - Database instance (unused today, kept on the signature for
  *             the planned per-user resolution refactor)
@@ -57,11 +57,11 @@ export declare function resolveDaemonUserForGroupRefresh(): Promise<string | und
  *                 through to the daemon-user / undefined branches.
  * @returns Daemon username when sudo wrap is needed, otherwise undefined
  */
-export declare function resolveGitImpersonationForUser(_db: Database, _userId: UserID | undefined): Promise<string | undefined>;
+export declare function resolveGitImpersonationForUser(_db: TenantScopeAwareDatabase, _userId: UserID | undefined): Promise<string | undefined>;
 /**
  * Resolve Unix user for git operations on a branch.
  *
  * @see resolveGitImpersonationForUser
  */
-export declare function resolveGitImpersonationForBranch(db: Database, branch: Branch): Promise<string | undefined>;
+export declare function resolveGitImpersonationForBranch(db: TenantScopeAwareDatabase, branch: Branch): Promise<string | undefined>;
 //# sourceMappingURL=git-impersonation.d.ts.map

package/dist/daemon/utils/git-impersonation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-impersonation.d.ts","sourceRoot":"","sources":["../../src/utils/git-impersonation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEvD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAUpF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7B;AAED;;;;GAIG;AACH,wBAAsB,gCAAgC,CACpD,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7B"}
+{"version":3,"file":"git-impersonation.d.ts","sourceRoot":"","sources":["../../src/utils/git-impersonation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEvD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAUpF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,wBAAwB,EAC7B,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7B;AAED;;;;GAIG;AACH,wBAAsB,gCAAgC,CACpD,EAAE,EAAE,wBAAwB,EAC5B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7B"}

package/dist/daemon/utils/git-remote-credential-scan.d.ts

@@ -1,4 +1,4 @@
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 /**
  * Best-effort startup repair for credential-bearing git remote URLs.
  *
@@ -9,7 +9,7 @@ import { type Database } from '@agor/core/db';
  * pre-existing repository outside `~/.agor`, and mutating those configs during
  * daemon boot would be surprising. Local repos still get opportunistically
  * scrubbed at Agor git-operation boundaries and can be repaired explicitly via
- * `agor admin scrub-git-remotes --write`.
+ * `agor local scrub-git-remotes --write`.
  */
-export declare function scrubManagedGitRemoteCredentials(db: Database): Promise<void>;
+export declare function scrubManagedGitRemoteCredentials(db: TenantScopeAwareDatabase): Promise<void>;
 //# sourceMappingURL=git-remote-credential-scan.d.ts.map

package/dist/daemon/utils/git-remote-credential-scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-remote-credential-scan.d.ts","sourceRoot":"","sources":["../../src/utils/git-remote-credential-scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,QAAQ,EAA2B,MAAM,eAAe,CAAC;AAGzF;;;;;;;;;;;GAWG;AACH,wBAAsB,gCAAgC,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAiFlF"}
+{"version":3,"file":"git-remote-credential-scan.d.ts","sourceRoot":"","sources":["../../src/utils/git-remote-credential-scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,eAAe,CAAC;AAGvB;;;;;;;;;;;GAWG;AACH,wBAAsB,gCAAgC,CACpD,EAAE,EAAE,wBAAwB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAiFf"}

package/dist/daemon/utils/git-remote-credential-scan.js

@@ -1,6 +1,10 @@
 // src/utils/git-remote-credential-scan.ts
-import { BranchRepository, RepoRepository, shortId } from "@agor/core/db";
-import { scrubGitConfigRemoteCredentials } from "@agor/core/git";
+import {
+  BranchRepository,
+  RepoRepository,
+  shortId
+} from "@agor/core/db";
+import { scrubGitConfigRemoteCredentials } from "@agor/core/git/exec";
 async function scrubManagedGitRemoteCredentials(db) {
   const repoRepo = new RepoRepository(db);
   const branchRepo = new BranchRepository(db);

package/dist/daemon/utils/mcp-header-secrets.d.ts

@@ -1,12 +1,10 @@
 import type { MCPServer, Params } from '@agor/core/types';
+import { type ExecutorSessionTokenPayload } from '../auth/executor-session-token.js';
 export type MCPSecretParams = Params & {
     authentication?: {
         strategy?: string;
-        payload?: {
-            type?: string;
-            session_id?: string;
-            sessionId?: string;
-        };
+        accessToken?: string;
+        payload?: ExecutorSessionTokenPayload;
     };
     user?: {
         role?: string;

package/dist/daemon/utils/mcp-header-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-header-secrets.d.ts","sourceRoot":"","sources":["../../src/utils/mcp-header-secrets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG;IACrC,cAAc,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE;YACR,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,UAAU,CAAC,EAAE,MAAM,CAAC;YACpB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;KACH,CAAC;IACF,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,2CAA2C,CACzD,MAAM,CAAC,EAAE,eAAe,EACxB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,OAAO,CAST;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,CAAC,EAAE,eAAe,EACxB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAaT;AAGD,eAAO,MAAM,4BAA4B,qCAA+B,CAAC;AAEzE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAWnE;AAGD,eAAO,MAAM,4BAA4B,+BAAyB,CAAC"}
+{"version":3,"file":"mcp-header-secrets.d.ts","sourceRoot":"","sources":["../../src/utils/mcp-header-secrets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EACL,KAAK,2BAA2B,EAGjC,MAAM,mCAAmC,CAAC;AAE3C,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG;IACrC,cAAc,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,2BAA2B,CAAC;KACvC,CAAC;IACF,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,2CAA2C,CACzD,MAAM,CAAC,EAAE,eAAe,EACxB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,OAAO,CAST;AAuBD,wBAAgB,4BAA4B,CAC1C,MAAM,CAAC,EAAE,eAAe,EACxB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAaT;AAGD,eAAO,MAAM,4BAA4B,qCAA+B,CAAC;AAEzE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAWnE;AAGD,eAAO,MAAM,4BAA4B,+BAAyB,CAAC"}