agor-live 0.22.0 → 0.23.2

package/dist/daemon/utils/realtime-publish.js

@@ -1,5 +1,9 @@
 // src/utils/realtime-publish.ts
-import { shortId as shortId2 } from "@agor/core/db";
+import {
+  resolveTenantContext,
+  TenantResolutionError
+} from "@agor/core/config";
+import { getCurrentTenantId, shortId as shortId2 } from "@agor/core/db";
 import { hasMinimumRole as hasMinimumRole2, ROLES as ROLES2 } from "@agor/core/types";
 
 // src/utils/branch-authorization.ts
@@ -30,6 +34,7 @@ var RealtimeAccessCache = class {
   }
   branchVisibility = /* @__PURE__ */ new Map();
   sessionBranches = /* @__PURE__ */ new Map();
+  sessionOwners = /* @__PURE__ */ new Map();
   branchVisibilityTtlMs;
   sessionBranchTtlMs;
   now;
@@ -46,6 +51,27 @@ var RealtimeAccessCache = class {
     });
     return branchId;
   }
+  /**
+   * Owning user id for a session, cached on the same cadence as the
+   * session→branch map. Used only to offer streaming events to the session
+   * creator's own connections as a fallback when they haven't subscribed to
+   * the per-session stream channel yet.
+   */
+  async getSessionOwnerId(sessionId) {
+    const cached = this.sessionOwners.get(sessionId);
+    const now = this.now();
+    if (cached && cached.expiresAt > now) {
+      return cached.ownerId;
+    }
+    const ownerId = await this.options.sessionsRepository.findCreatedByBySessionId(
+      sessionId
+    ) ?? null;
+    this.sessionOwners.set(sessionId, {
+      ownerId,
+      expiresAt: now + this.sessionBranchTtlMs
+    });
+    return ownerId;
+  }
   async getBranchVisibility(branchId) {
     const cached = this.branchVisibility.get(branchId);
     const now = this.now();
@@ -81,6 +107,7 @@ var RealtimeAccessCache = class {
   }
   invalidateSession(sessionId) {
     this.sessionBranches.delete(sessionId);
+    this.sessionOwners.delete(sessionId);
   }
   clearVisibility() {
     this.branchVisibility.clear();
@@ -88,6 +115,7 @@ var RealtimeAccessCache = class {
   clearAll() {
     this.branchVisibility.clear();
     this.sessionBranches.clear();
+    this.sessionOwners.clear();
   }
   visibilityFromEntry(entry) {
     return entry.mode === "allAuthenticated" ? { mode: "allAuthenticated" } : { mode: "explicitUsers", userIds: entry.userIds };
@@ -95,6 +123,29 @@ var RealtimeAccessCache = class {
 };
 
 // src/utils/realtime-publish.ts
+function tenantChannelName(tenantId) {
+  return `tenant:${tenantId}`;
+}
+var SESSION_STREAM_CHANNEL_PREFIX = "session-stream:";
+function sessionStreamChannelName(sessionId) {
+  return `${SESSION_STREAM_CHANNEL_PREFIX}${sessionId}`;
+}
+function leaveAllSessionStreamChannels(app, connection) {
+  for (const name of app.channels ?? []) {
+    if (name.startsWith(SESSION_STREAM_CHANNEL_PREFIX)) {
+      app.channel(name).leave(connection);
+    }
+  }
+}
+function existingChannel(app, name) {
+  return (app.channels ?? []).includes(name) ? app.channel(name) : null;
+}
+function joinSessionStreamChannel(app, sessionId, connection) {
+  app.channel(sessionStreamChannelName(sessionId)).join(connection);
+}
+function leaveSessionStreamChannel(app, sessionId, connection) {
+  existingChannel(app, sessionStreamChannelName(sessionId))?.leave(connection);
+}
 var DEBUG_REALTIME_PUBLISH = process.env.AGOR_DEBUG_REALTIME_PUBLISH === "1" || process.env.DEBUG?.includes("realtime-publish");
 function realtimePublishDebug(...args) {
   if (DEBUG_REALTIME_PUBLISH) {
@@ -110,8 +161,27 @@ var SESSION_ID_SCOPED_PATHS = /* @__PURE__ */ new Set([
   "session-env-selections"
 ]);
 var OPTIONAL_BRANCH_OR_SESSION_SCOPED_PATHS = /* @__PURE__ */ new Set(["board-objects", "board-comments"]);
+var MESSAGE_STREAMING_EVENTS = /* @__PURE__ */ new Set([
+  "streaming:start",
+  "streaming:chunk",
+  "streaming:end",
+  "streaming:error",
+  "thinking:start",
+  "thinking:chunk",
+  "thinking:end"
+]);
+var TASK_STREAMING_EVENTS = /* @__PURE__ */ new Set(["thinking:chunk", "tool:start", "tool:complete"]);
 function isStreamingEvent(context) {
-  return context.path === "messages/streaming" || context.path === "messages" && context.event?.startsWith("streaming:") === true;
+  if (context.path === "messages/streaming") return true;
+  const event = context.event;
+  if (!event) return false;
+  if (context.path === "messages") {
+    return event.startsWith("streaming:") || MESSAGE_STREAMING_EVENTS.has(event);
+  }
+  if (context.path === "tasks") {
+    return TASK_STREAMING_EVENTS.has(event);
+  }
+  return false;
 }
 function asRecord(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -247,6 +317,47 @@ async function resolvePublishScope(data, context, accessCache) {
 function filterToServiceConnections(authenticated) {
   return authenticated.filter((connection) => isServiceConnection(connection));
 }
+async function resolveStreamingDelivery(app, data, tenantScoped, accessCache, branchRbacEnabled, allowSuperadmin) {
+  const serviceConnections = filterToServiceConnections(tenantScoped);
+  const sessionId = extractSessionId(data);
+  if (!sessionId) return serviceConnections;
+  const tenantConnections = new Set(
+    tenantScoped.connections
+  );
+  const existingRoom = existingChannel(app, sessionStreamChannelName(sessionId));
+  const room = existingRoom ? existingRoom.filter((connection) => tenantConnections.has(connection)) : null;
+  let ownerId = null;
+  try {
+    ownerId = await accessCache.getSessionOwnerId(sessionId);
+  } catch {
+  }
+  const ownerChannel = () => tenantScoped.filter(
+    (connection) => userFromConnection(connection)?.user_id === ownerId
+  );
+  if (!branchRbacEnabled) {
+    const channels2 = [serviceConnections];
+    if (room) channels2.push(room);
+    if (ownerId) channels2.push(ownerChannel());
+    return channels2;
+  }
+  const branchId = await accessCache.getBranchIdForSession(sessionId);
+  const visibility = branchId ? await accessCache.getBranchVisibility(branchId) : null;
+  if (!visibility) return serviceConnections;
+  if (visibility.mode === "allAuthenticated") {
+    const channels2 = [serviceConnections];
+    if (room) channels2.push(room);
+    if (ownerId) channels2.push(ownerChannel());
+    return channels2;
+  }
+  const channels = [serviceConnections];
+  if (room) {
+    channels.push(filterToUserIdsOrSuperadmins(room, visibility.userIds, allowSuperadmin));
+  }
+  if (ownerId && visibility.userIds.has(ownerId)) {
+    channels.push(ownerChannel());
+  }
+  return channels;
+}
 function filterToUserIdsOrAdmins(authenticated, userIds, allowSuperadmin) {
   return authenticated.filter((connection) => {
     if (isServiceConnection(connection) || isAdminConnection(connection, allowSuperadmin)) {
@@ -265,6 +376,22 @@ function filterToUserIdsOrSuperadmins(authenticated, userIds, allowSuperadmin) {
     return typeof userId === "string" && userIds.has(userId);
   });
 }
+function extractConnectionTenantId(context) {
+  const params = context.params;
+  const tenant = params?.connection?.tenant ?? params?.connection?.data?.tenant;
+  return tenant && typeof tenant === "object" && "tenant_id" in tenant ? typeof tenant.tenant_id === "string" ? tenant.tenant_id : void 0 : void 0;
+}
+function resolveRealtimeTenantId(multiTenancy, context) {
+  try {
+    return resolveTenantContext(multiTenancy, { params: context.params }).tenant_id;
+  } catch (error) {
+    const connectionTenantId = extractConnectionTenantId(context);
+    if (error instanceof TenantResolutionError && connectionTenantId) return connectionTenantId;
+    const ambientTenantId = getCurrentTenantId();
+    if (error instanceof TenantResolutionError && ambientTenantId) return ambientTenantId;
+    throw error;
+  }
+}
 function configureRealtimePublish(options) {
   const {
     app,
@@ -275,7 +402,8 @@ function configureRealtimePublish(options) {
       branchRepository,
       sessionsRepository
     }),
-    allowSuperadmin = true
+    allowSuperadmin = true,
+    multiTenancy
   } = options;
   app.publish(async (data, context) => {
     if (context.path && context.method && !isStreamingEvent(context)) {
@@ -286,12 +414,39 @@ function configureRealtimePublish(options) {
       );
     }
     const authenticated = app.channel("authenticated");
-    if (!branchRbacEnabled) return authenticated;
+    let tenantScoped = authenticated;
+    if (multiTenancy) {
+      try {
+        const tenantId = resolveRealtimeTenantId(multiTenancy, context);
+        tenantScoped = app.channel(tenantChannelName(tenantId));
+      } catch (error) {
+        if (error instanceof TenantResolutionError) {
+          console.warn("[realtime] Suppressing event without tenant context", {
+            path: context.path,
+            event: context.event,
+            method: context.method
+          });
+          return filterToServiceConnections(authenticated);
+        }
+        throw error;
+      }
+    }
+    if (isStreamingEvent(context)) {
+      return resolveStreamingDelivery(
+        app,
+        data,
+        tenantScoped,
+        accessCache,
+        branchRbacEnabled,
+        allowSuperadmin
+      );
+    }
+    if (!branchRbacEnabled) return tenantScoped;
     const scope = await resolvePublishScope(data, context, accessCache);
-    if (scope.kind === "global") return authenticated;
-    if (scope.kind === "serviceOnly") return filterToServiceConnections(authenticated);
+    if (scope.kind === "global") return tenantScoped;
+    if (scope.kind === "serviceOnly") return filterToServiceConnections(tenantScoped);
     if (scope.kind === "users") {
-      return filterToUserIdsOrAdmins(authenticated, scope.userIds, allowSuperadmin);
+      return filterToUserIdsOrAdmins(tenantScoped, scope.userIds, allowSuperadmin);
     }
     if (!scope.branchId) {
       console.warn("[realtime] Suppressing scoped event without resolvable branch context", {
@@ -299,7 +454,7 @@ function configureRealtimePublish(options) {
         event: context.event,
         method: context.method
       });
-      return filterToServiceConnections(authenticated);
+      return filterToServiceConnections(tenantScoped);
     }
     const visibility = await accessCache.getBranchVisibility(scope.branchId);
     if (!visibility) {
@@ -308,14 +463,18 @@ function configureRealtimePublish(options) {
         event: context.event,
         method: context.method
       });
-      return filterToServiceConnections(authenticated);
+      return filterToServiceConnections(tenantScoped);
     }
     if (visibility.mode === "allAuthenticated") {
-      return authenticated;
+      return tenantScoped;
     }
-    return filterToUserIdsOrSuperadmins(authenticated, visibility.userIds, allowSuperadmin);
+    return filterToUserIdsOrSuperadmins(tenantScoped, visibility.userIds, allowSuperadmin);
   });
 }
 export {
-  configureRealtimePublish
+  configureRealtimePublish,
+  joinSessionStreamChannel,
+  leaveAllSessionStreamChannels,
+  leaveSessionStreamChannel,
+  sessionStreamChannelName
 };

package/dist/daemon/utils/session-queue-tenant-scope.d.ts

@@ -0,0 +1,24 @@
+import { type AgorConfig } from '@agor/core/config';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
+import type { Params, SessionID, TenantContext } from '@agor/core/types';
+type QueueTenantParams = Params & {
+    tenant?: Pick<TenantContext, 'tenant_id' | 'source'>;
+};
+export interface SessionQueueTenantScopeOptions {
+    db: TenantScopeAwareDatabase;
+    config: AgorConfig;
+    sessionId: SessionID;
+    params?: Params;
+    /**
+     * Trusted tenant id from an already-loaded tenant-owned row (for example a
+     * Postgres sessions/tasks patch result). Do not populate this from request
+     * payloads or request-less tenant discovery reads.
+     */
+    tenantIdHint?: string;
+    label: string;
+}
+export declare function queueTenantParams(params: Params | undefined, tenantId: string, source?: TenantContext['source']): QueueTenantParams;
+export declare function runWithSessionQueueTenantScope<T>(options: SessionQueueTenantScopeOptions, work: (params: QueueTenantParams) => Promise<T>): Promise<T | undefined>;
+export declare function deferWithSessionQueueTenantScope(options: SessionQueueTenantScopeOptions, work: (params: QueueTenantParams) => Promise<void>, onError?: (error: unknown) => void): void;
+export {};
+//# sourceMappingURL=session-queue-tenant-scope.d.ts.map

package/dist/daemon/utils/session-queue-tenant-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-queue-tenant-scope.d.ts","sourceRoot":"","sources":["../../src/utils/session-queue-tenant-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAA6B,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAA8B,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAY,MAAM,kBAAkB,CAAC;AAMnF,KAAK,iBAAiB,GAAG,MAAM,GAAG;IAChC,MAAM,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,GAAG,QAAQ,CAAC,CAAC;CACtD,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC7C,EAAE,EAAE,wBAAwB,CAAC;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAYD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,aAAa,CAAC,QAAQ,CAAc,GAC3C,iBAAiB,CAUnB;AAED,wBAAsB,8BAA8B,CAAC,CAAC,EACpD,OAAO,EAAE,8BAA8B,EACvC,IAAI,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,GAC9C,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAwBxB;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,8BAA8B,EACvC,IAAI,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,EAClD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GACjC,IAAI,CAiCN"}

package/dist/daemon/utils/session-queue-tenant-scope.js

@@ -0,0 +1,133 @@
+// src/utils/session-queue-tenant-scope.ts
+import { resolveMultiTenancyConfig as resolveMultiTenancyConfig2 } from "@agor/core/config";
+import { runWithTenantDatabaseScope as runWithTenantDatabaseScope2 } from "@agor/core/db";
+
+// src/utils/tenant-db-scope.ts
+import {
+  resolveMultiTenancyConfig,
+  resolveTenantContext,
+  TenantResolutionError
+} from "@agor/core/config";
+import {
+  enqueueTenantDatabasePostCommitCallback,
+  getCurrentTenantId,
+  runWithoutTenantDatabaseScope,
+  runWithTenantDatabaseScope
+} from "@agor/core/db";
+import { NotAuthenticated } from "@agor/core/feathers";
+import jwt2 from "jsonwebtoken";
+
+// src/auth/runtime-tokens.ts
+import jwt from "jsonwebtoken";
+
+// src/utils/tenant-db-scope.ts
+function resolveTenantIdForDeferredScope(params) {
+  const scopedParams = params;
+  return scopedParams?.tenant?.tenant_id ?? getCurrentTenantId();
+}
+function deferWithTenantDatabaseScope(db, params, work, onError) {
+  const tenantId = resolveTenantIdForDeferredScope(params);
+  if (!tenantId) {
+    const error = new Error("Missing tenant context for deferred tenant-scoped work");
+    if (onError) {
+      onError(error);
+    } else {
+      console.error("[tenant-db-scope] Deferred tenant-scoped work skipped:", error);
+    }
+    return;
+  }
+  const schedule = () => {
+    runWithoutTenantDatabaseScope(() => {
+      setImmediate(() => {
+        void runWithTenantDatabaseScope(db, tenantId, work).catch((error) => {
+          if (onError) {
+            onError(error);
+            return;
+          }
+          console.error("[tenant-db-scope] Deferred tenant-scoped work failed:", error);
+        });
+      });
+    });
+  };
+  if (enqueueTenantDatabasePostCommitCallback(async () => schedule())) {
+    return;
+  }
+  schedule();
+}
+
+// src/utils/session-queue-tenant-scope.ts
+function staticTenantId(config) {
+  const multiTenancy = resolveMultiTenancyConfig2(config);
+  return multiTenancy.mode === "static" ? multiTenancy.static_tenant_id : void 0;
+}
+function trustedTenantIdHint(options) {
+  const hint = options.tenantIdHint?.trim();
+  return hint || void 0;
+}
+function queueTenantParams(params, tenantId, source = "explicit") {
+  const currentTenant = params?.tenant;
+  return {
+    ...params ?? {},
+    tenant: {
+      ...currentTenant,
+      tenant_id: tenantId,
+      source: currentTenant?.source ?? source
+    }
+  };
+}
+async function runWithSessionQueueTenantScope(options, work) {
+  const capturedTenantId = resolveTenantIdForDeferredScope(options.params);
+  if (capturedTenantId) {
+    const scopedParams2 = queueTenantParams(options.params, capturedTenantId, "explicit");
+    return runWithTenantDatabaseScope2(options.db, capturedTenantId, () => work(scopedParams2));
+  }
+  const tenantIdHint = trustedTenantIdHint(options);
+  if (tenantIdHint) {
+    const scopedParams2 = queueTenantParams(options.params, tenantIdHint, "explicit");
+    return runWithTenantDatabaseScope2(options.db, tenantIdHint, () => work(scopedParams2));
+  }
+  const configuredStaticTenantId = staticTenantId(options.config);
+  if (!configuredStaticTenantId) {
+    console.error(
+      `\u274C [Queue] ${options.label} skipped for session ${options.sessionId}: missing tenant context`
+    );
+    return void 0;
+  }
+  const scopedParams = queueTenantParams(options.params, configuredStaticTenantId, "static");
+  return runWithTenantDatabaseScope2(options.db, configuredStaticTenantId, () => work(scopedParams));
+}
+function deferWithSessionQueueTenantScope(options, work, onError) {
+  const handleError = (error) => {
+    if (onError) {
+      onError(error);
+      return;
+    }
+    console.error(`\u274C [Queue] ${options.label} failed:`, error);
+  };
+  const capturedTenantId = resolveTenantIdForDeferredScope(options.params);
+  if (capturedTenantId) {
+    const scopedParams2 = queueTenantParams(options.params, capturedTenantId, "explicit");
+    deferWithTenantDatabaseScope(options.db, scopedParams2, () => work(scopedParams2), handleError);
+    return;
+  }
+  const tenantIdHint = trustedTenantIdHint(options);
+  if (tenantIdHint) {
+    const scopedParams2 = queueTenantParams(options.params, tenantIdHint, "explicit");
+    deferWithTenantDatabaseScope(options.db, scopedParams2, () => work(scopedParams2), handleError);
+    return;
+  }
+  const configuredStaticTenantId = staticTenantId(options.config);
+  if (!configuredStaticTenantId) {
+    handleError(
+      new Error(`${options.label} skipped for session ${options.sessionId}: missing tenant context`)
+    );
+    return;
+  }
+  const scopedParams = queueTenantParams(options.params, configuredStaticTenantId, "static");
+  deferWithTenantDatabaseScope(options.db, scopedParams, () => work(scopedParams), handleError);
+}
+export {
+  deferWithSessionQueueTenantScope,
+  queueTenantParams,
+  runWithSessionQueueTenantScope
+};

package/dist/daemon/utils/session-state-hooks.d.ts

@@ -8,10 +8,10 @@
  * Lives in the daemon (not core) because these hooks are only invoked from
  * register-services.ts and operate on the daemon's DB + filesystem directly.
  */
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { AgenticToolName } from '@agor/core/types';
 interface PullContext {
-    db: Database;
+    db: TenantScopeAwareDatabase;
     sessionId: string;
     sdkSessionId: string;
     branchPath: string;
@@ -20,7 +20,7 @@ interface PullContext {
     executorHomeDir?: string;
 }
 interface PushContext {
-    db: Database;
+    db: TenantScopeAwareDatabase;
     sessionId: string;
     branchId: string;
     taskId: string;

package/dist/daemon/utils/session-state-hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-state-hooks.d.ts","sourceRoot":"","sources":["../../src/utils/session-state-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,QAAQ,EAAwC,MAAM,eAAe,CAAC;AACpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAYxD,UAAU,WAAW;IACnB,EAAE,EAAE,QAAQ,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,eAAe,CAAC;IACtB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,UAAU,WAAW;IACnB,EAAE,EAAE,QAAQ,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,eAAe,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAqElE;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAKhD"}
+{"version":3,"file":"session-state-hooks.d.ts","sourceRoot":"","sources":["../../src/utils/session-state-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAwC,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACpG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAYxD,UAAU,WAAW;IACnB,EAAE,EAAE,wBAAwB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,eAAe,CAAC;IACtB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,UAAU,WAAW;IACnB,EAAE,EAAE,wBAAwB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,eAAe,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAqElE;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAKhD"}

package/dist/daemon/utils/session-turn-lock.d.ts

@@ -27,6 +27,13 @@ export type SessionTurnLocks = Map<SessionID, Promise<void>>;
  * callers contending for the same session wait their turn (FIFO-ish — set
  * order through the Map). Errors thrown by `fn` propagate to the caller and
  * the lock is released either way.
+ *
+ * Pass `options.waiterTimeoutMs` to limit how long this call waits for the
+ * lock. If the timeout fires before the lock is available, throws an Error.
+ * Use this on HTTP request handlers so a stuck lock holder (broken DB
+ * connection, etc.) does not hang the request indefinitely.
  */
-export declare function withSessionTurnLock<T>(locks: SessionTurnLocks, sessionId: SessionID, fn: () => Promise<T>): Promise<T>;
+export declare function withSessionTurnLock<T>(locks: SessionTurnLocks, sessionId: SessionID, fn: () => Promise<T>, options?: {
+    waiterTimeoutMs?: number;
+}): Promise<T>;
 //# sourceMappingURL=session-turn-lock.d.ts.map

package/dist/daemon/utils/session-turn-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-turn-lock.d.ts","sourceRoot":"","sources":["../../src/utils/session-turn-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,MAAM,gBAAgB,GAAG,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAE7D;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,SAAS,EACpB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAwBZ"}
+{"version":3,"file":"session-turn-lock.d.ts","sourceRoot":"","sources":["../../src/utils/session-turn-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,MAAM,gBAAgB,GAAG,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,SAAS,EACpB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,GACrC,OAAO,CAAC,CAAC,CAAC,CAiDZ"}

package/dist/daemon/utils/session-turn-lock.js

@@ -1,7 +1,30 @@
 // src/utils/session-turn-lock.ts
-async function withSessionTurnLock(locks, sessionId, fn) {
+async function withSessionTurnLock(locks, sessionId, fn, options) {
+  const waiterTimeoutMs = options?.waiterTimeoutMs;
+  const waitStart = waiterTimeoutMs !== void 0 ? Date.now() : 0;
   while (locks.has(sessionId)) {
-    await locks.get(sessionId)?.catch(() => void 0);
+    const existingLock = locks.get(sessionId);
+    if (waiterTimeoutMs !== void 0) {
+      const remaining = waiterTimeoutMs - (Date.now() - waitStart);
+      if (remaining <= 0) {
+        throw new Error(
+          `Session turn lock acquisition timed out after ${waiterTimeoutMs}ms (session ${sessionId})`
+        );
+      }
+      const outcome = await Promise.race([
+        // Swallow the awaited promise's rejection — the original caller already
+        // received the error; waiters only care about lock ordering.
+        existingLock?.catch(() => void 0).then(() => "released"),
+        new Promise((resolve) => setTimeout(() => resolve("timeout"), remaining))
+      ]);
+      if (outcome === "timeout") {
+        throw new Error(
+          `Session turn lock acquisition timed out after ${waiterTimeoutMs}ms (session ${sessionId})`
+        );
+      }
+    } else {
+      await existingLock?.catch(() => void 0);
+    }
   }
   let resolveLock;
   const lockPromise = new Promise((resolve) => {

package/dist/daemon/utils/spawn-executor.d.ts

@@ -22,6 +22,7 @@
  */
 import { type ChildProcess } from 'node:child_process';
 import type { AgorExecutionSettings } from '@agor/core/config';
+import type { AuthenticatedParams } from '@agor/core/types';
 import type { SignOptions } from 'jsonwebtoken';
 /** Set the daemon URL for executor payloads. Call once at daemon startup. */
 export declare function configureDaemonUrl(url: string): void;
@@ -119,6 +120,13 @@ export declare function getDaemonUrl(): string;
  * @returns JWT access token
  */
 export declare function createServiceToken(jwtSecret: string, expiresIn?: SignOptions['expiresIn'], scope?: Record<string, unknown>): string;
+/**
+ * Build extra JWT claims for executor/service tokens from authenticated service
+ * params. In Cloud required-from-auth mode, executor RPCs must carry the same
+ * tenant claim as the request that spawned them; otherwise the daemon handles
+ * them as the static/default tenant.
+ */
+export declare function serviceTokenScopeForParams(params?: Partial<AuthenticatedParams>): Record<string, unknown>;
 /**
  * Generate a session token from the Feathers app
  *
@@ -134,7 +142,21 @@ export declare function generateSessionToken(app: {
             secret?: string;
         };
     };
-}): string;
+}, scope?: Record<string, unknown>): string;
+/**
+ * Generate a tenant-scoped executor service token from Feathers params.
+ *
+ * Prefer this over manually composing `generateSessionToken(app,
+ * serviceTokenScopeForParams(params))` so required-from-auth deployments do not
+ * accidentally drop tenant context on new executor call paths.
+ */
+export declare function generateScopedServiceToken(app: {
+    settings: {
+        authentication?: {
+            secret?: string;
+        };
+    };
+}, params?: Partial<AuthenticatedParams>): string;
 /**
  * Configuration for executor spawning.
  * Loaded from ~/.agor/config.yaml execution section.

package/dist/daemon/utils/spawn-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-executor.d.ts","sourceRoot":"","sources":["../../src/utils/spawn-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAS,MAAM,oBAAoB,CAAC;AAI9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAQ/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAqBhD,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAGpD;AAID,mGAAmG;AACnG,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,GAAG,IAAI,CAgBtE;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wEAAwE;IACxE,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvC,4FAA4F;IAC5F,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,uFAAuF;IACvF,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,yBACf,SAAQ,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,SAAS,CAAC;IACxD,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,yBAAyB,GACnC,MAAM,CAsBR;AAED,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAqBzC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE,oBAAyB,GACjC,IAAI,CA6BN;AA4OD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,qBAAqB,CAAC,CA8BhC;AA4PD,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,EACpC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,MAAM,CAaR;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE;IACxC,QAAQ,EAAE;QAAE,cAAc,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;CACpD,GAAG,MAAM,CAMT;AAMD;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,qBAAqB,EACrB,2BAA2B,GAAG,oBAAoB,CACnD,CAAC;AASF,yGAAyG;AACzG,wBAAgB,uBAAuB,CAAC,eAAe,CAAC,EAAE,cAAc,IAEpE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,UAAS,IAAI,CAAC,oBAAoB,EAAE,yBAAyB,CAAM,KAClE,IAAI,CAaR;AAMD,eAAO,MAAM,0BAA0B,sBAAgB,CAAC"}
+{"version":3,"file":"spawn-executor.d.ts","sourceRoot":"","sources":["../../src/utils/spawn-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAS,MAAM,oBAAoB,CAAC;AAI9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAQ5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAqBhD,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAGpD;AAID,mGAAmG;AACnG,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,GAAG,IAAI,CAgBtE;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wEAAwE;IACxE,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvC,4FAA4F;IAC5F,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,uFAAuF;IACvF,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,yBACf,SAAQ,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,SAAS,CAAC;IACxD,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,yBAAyB,GACnC,MAAM,CAsBR;AAED,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CA6BzC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE,oBAAyB,GACjC,IAAI,CA6BN;AAgQD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,qBAAqB,CAAC,CA8BhC;AA4PD,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,EACpC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,MAAM,CAaR;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GACpC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE;IACH,QAAQ,EAAE;QAAE,cAAc,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;CACpD,EACD,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,MAAM,CAMR;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE;IACH,QAAQ,EAAE;QAAE,cAAc,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;CACpD,EACD,MAAM,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GACpC,MAAM,CAER;AAMD;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,qBAAqB,EACrB,2BAA2B,GAAG,oBAAoB,CACnD,CAAC;AASF,yGAAyG;AACzG,wBAAgB,uBAAuB,CAAC,eAAe,CAAC,EAAE,cAAc,IAEpE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,UAAS,IAAI,CAAC,oBAAoB,EAAE,yBAAyB,CAAM,KAClE,IAAI,CAaR;AAMD,eAAO,MAAM,0BAA0B,sBAAgB,CAAC"}