agor-live 0.22.0 → 0.23.2

package/dist/core/utils/emoji-shortcodes.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Normalize exact emoji shortcodes to Unicode while preserving arbitrary text.
+ *
+ * This intentionally only rewrites whole-field shortcodes such as `:compass:`.
+ * It does not parse Markdown/content or replace shortcodes embedded in text.
+ */
+export declare function normalizeExactEmojiShortcode(value: undefined): undefined;
+export declare function normalizeExactEmojiShortcode(value: null): null;
+export declare function normalizeExactEmojiShortcode(value: string): string;
+export declare function normalizeExactEmojiShortcode(value: string | undefined): string | undefined;
+export declare function normalizeExactEmojiShortcode(value: string | null): string | null;
+export declare function normalizeExactEmojiShortcode(value: string | null | undefined): string | null | undefined;
+//# sourceMappingURL=emoji-shortcodes.d.ts.map

package/dist/core/utils/emoji-shortcodes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emoji-shortcodes.d.ts","sourceRoot":"","sources":["../../src/utils/emoji-shortcodes.ts"],"names":[],"mappings":"AAiCA;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;AAC1E,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAAC;AAChE,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;AACpE,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAC5F,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;AAClF,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC"}

package/dist/core/yaml/index.cjs

@@ -30,17 +30,17 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/yaml/index.ts
 var yaml_exports = {};
 __export(yaml_exports, {
-  YAMLException: () => YAMLException,
+  YAMLException: () => YAMLException2,
   default: () => yaml_default,
-  dump: () => dump,
-  load: () => load
+  dump: () => dump2,
+  load: () => load2
 });
 module.exports = __toCommonJS(yaml_exports);
-var import_js_yaml = __toESM(require("js-yaml"), 1);
-var load = import_js_yaml.default.load;
-var dump = import_js_yaml.default.dump;
-var YAMLException = import_js_yaml.default.YAMLException;
-var yaml_default = import_js_yaml.default;
+var yaml = __toESM(require("js-yaml"), 1);
+var load2 = yaml.load;
+var dump2 = yaml.dump;
+var YAMLException2 = yaml.YAMLException;
+var yaml_default = yaml;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   YAMLException,

package/dist/core/yaml/index.d.ts

@@ -8,7 +8,7 @@
  * `js-yaml` itself has no Node-only imports, so this module is safe to use
  * from the browser.
  */
-import yaml from 'js-yaml';
+import * as yaml from 'js-yaml';
 export declare const load: typeof yaml.load;
 export declare const dump: typeof yaml.dump;
 export declare const YAMLException: typeof yaml.YAMLException;

package/dist/core/yaml/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/yaml/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,IAAI,MAAM,SAAS,CAAC;AAE3B,eAAO,MAAM,IAAI,kBAAY,CAAC;AAC9B,eAAO,MAAM,IAAI,kBAAY,CAAC;AAC9B,eAAO,MAAM,aAAa,2BAAqB,CAAC;AAEhD,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAExD,eAAe,IAAI,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/yaml/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,IAAI,MAAM,SAAS,CAAC;AAEhC,eAAO,MAAM,IAAI,kBAAY,CAAC;AAC9B,eAAO,MAAM,IAAI,kBAAY,CAAC;AAC9B,eAAO,MAAM,aAAa,2BAAqB,CAAC;AAEhD,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAExD,eAAe,IAAI,CAAC"}

package/dist/core/yaml/index.js

@@ -1,12 +1,12 @@
 // src/yaml/index.ts
-import yaml from "js-yaml";
-var load = yaml.load;
-var dump = yaml.dump;
-var YAMLException = yaml.YAMLException;
+import * as yaml from "js-yaml";
+var load2 = yaml.load;
+var dump2 = yaml.dump;
+var YAMLException2 = yaml.YAMLException;
 var yaml_default = yaml;
 export {
-  YAMLException,
+  YAMLException2 as YAMLException,
   yaml_default as default,
-  dump,
-  load
+  dump2 as dump,
+  load2 as load
 };

package/dist/daemon/adapters/drizzle.d.ts

@@ -67,6 +67,18 @@ export declare class DrizzleService<T = any, D = Partial<T>, P extends Params =
     multi: boolean | string[];
     resourceType: string;
     emit?: (event: string, ...args: any[]) => boolean;
+    /** Extract resolved tenant context from Feathers params. */
+    private getTenant;
+    /**
+     * Whether a row belongs to the current tenant. Rows from pre-migration test
+     * fixtures that do not expose tenant_id are treated as visible so existing
+     * single-tenant unit tests keep working; migrated DB rows always carry it.
+     */
+    private rowBelongsToTenant;
+    /** Stamp tenant_id onto created rows and prevent client-supplied drift. */
+    private withTenant;
+    /** Never allow a patch/update to move a row across tenants. */
+    private stripTenantMutation;
     constructor(repository: Repository<T>, options?: DrizzleAdapterOptions);
     /**
      * Extract query parameters from params
@@ -75,19 +87,29 @@ export declare class DrizzleService<T = any, D = Partial<T>, P extends Params =
     /**
      * Apply filters to data array (client-side filtering)
      */
-    private filterData;
+    protected filterData(data: T[], query: Query): T[];
     /**
      * Sort data array
      */
-    private sortData;
+    protected sortData(data: T[], sortSpec?: Record<string, 1 | -1>): T[];
     /**
      * Select specific fields from data
      */
-    private selectFields;
+    protected selectFields(data: T[], fields?: string[]): Partial<T>[];
     /**
      * Apply pagination to data
      */
-    private paginateData;
+    protected paginateData(data: T[], query: Query, total: number): Paginated<T> | T[];
+    /**
+     * Resolve the candidate row set that `find` filters, sorts, and paginates.
+     *
+     * The base implementation reads the whole table and relies on `filterData` to
+     * narrow it in memory. Subclasses may override this to push high-selectivity
+     * predicates into SQL; because `find` always re-applies every query filter via
+     * `filterData`, an override only needs to return a superset of the matching
+     * rows for the result to stay identical.
+     */
+    protected fetchData(_query: Query, _params?: P): Promise<T[]>;
     /**
      * Find records
      */

package/dist/daemon/adapters/drizzle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"drizzle.d.ts","sourceRoot":"","sources":["../../src/adapters/drizzle.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG1E;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAE7B;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAE3B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACxB,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3B;AAED;;;;;GAKG;AAEH,qBAAa,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM;IAW1E,OAAO,CAAC,UAAU;IAVpB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IAIrB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;gBAGxC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EACjC,OAAO,GAAE,qBAA0B;IAQrC;;OAEG;IACH,OAAO,CAAC,QAAQ;IAIhB;;OAEG;IACH,OAAO,CAAC,UAAU;IA0ClB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAqBhB;;OAEG;IACH,OAAO,CAAC,YAAY;IAgBpB;;OAEG;IACH,OAAO,CAAC,YAAY;IAwBpB;;OAEG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAsBnD;;OAEG;IACG,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAmC1C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAkBzD;;;;;;;;;OASG;IACG,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IASrD;;OAEG;IACG,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAsClE;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CA+B3D"}
+{"version":3,"file":"drizzle.d.ts","sourceRoot":"","sources":["../../src/adapters/drizzle.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAiB,MAAM,kBAAkB,CAAC;AAGzF;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAE7B;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAE3B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACxB,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3B;AAED;;;;;GAKG;AAEH,qBAAa,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM;IA2C1E,OAAO,CAAC,UAAU;IA1CpB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IAIrB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;IAElD,4DAA4D;IAC5D,OAAO,CAAC,SAAS;IAIjB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAO1B,2EAA2E;IAC3E,OAAO,CAAC,UAAU;IAMlB,+DAA+D;IAC/D,OAAO,CAAC,mBAAmB;gBAQjB,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EACjC,OAAO,GAAE,qBAA0B;IAQrC;;OAEG;IACH,OAAO,CAAC,QAAQ;IAIhB;;OAEG;IACH,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE;IA0ClD;;OAEG;IACH,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;IAqBrE;;OAEG;IACH,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE;IAgBlE;;OAEG;IACH,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;IAwBlF;;;;;;;;OAQG;cACa,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAInE;;OAEG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IA4BnD;;OAEG;IACG,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAwC1C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAsBzD;;;;;;;;;OASG;IACG,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAYrD;;OAEG;IACG,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IA2ClE;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAiC3D"}

package/dist/daemon/adapters/drizzle.js

@@ -15,6 +15,34 @@ var DrizzleService = class {
   // Event emitter for FeathersJS (will be injected by framework)
   // biome-ignore lint/suspicious/noExplicitAny: FeathersJS event system
   emit;
+  /** Extract resolved tenant context from Feathers params. */
+  getTenant(params) {
+    return params?.tenant;
+  }
+  /**
+   * Whether a row belongs to the current tenant. Rows from pre-migration test
+   * fixtures that do not expose tenant_id are treated as visible so existing
+   * single-tenant unit tests keep working; migrated DB rows always carry it.
+   */
+  rowBelongsToTenant(row, tenant) {
+    if (!tenant) return true;
+    const record = row;
+    if (!("tenant_id" in record)) return true;
+    return record.tenant_id === tenant.tenant_id;
+  }
+  /** Stamp tenant_id onto created rows and prevent client-supplied drift. */
+  withTenant(data, params) {
+    const tenant = this.getTenant(params);
+    if (!tenant || !data || typeof data !== "object" || Array.isArray(data)) return data;
+    return { ...data, tenant_id: tenant.tenant_id };
+  }
+  /** Never allow a patch/update to move a row across tenants. */
+  stripTenantMutation(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) return data;
+    const clone = { ...data };
+    delete clone.tenant_id;
+    return clone;
+  }
   /**
    * Extract query parameters from params
    */
@@ -106,12 +134,28 @@ var DrizzleService = class {
       data: paginated
     };
   }
+  /**
+   * Resolve the candidate row set that `find` filters, sorts, and paginates.
+   *
+   * The base implementation reads the whole table and relies on `filterData` to
+   * narrow it in memory. Subclasses may override this to push high-selectivity
+   * predicates into SQL; because `find` always re-applies every query filter via
+   * `filterData`, an override only needs to return a superset of the matching
+   * rows for the result to stay identical.
+   */
+  async fetchData(_query, _params) {
+    return this.repository.findAll();
+  }
   /**
    * Find records
    */
   async find(params) {
     const query = this.getQuery(params);
-    let data = await this.repository.findAll();
+    let data = await this.fetchData(query, params);
+    const tenant = this.getTenant(params);
+    if (tenant) {
+      data = data.filter((row) => this.rowBelongsToTenant(row, tenant));
+    }
     data = this.filterData(data, query);
     const total = data.length;
     data = this.sortData(data, query.$sort);
@@ -123,10 +167,13 @@ var DrizzleService = class {
    */
   async get(id, _params) {
     const prefetched = _params?._agorPrefetchedRecord;
-    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id)) {
+    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id) && this.rowBelongsToTenant(prefetched.record, this.getTenant(_params))) {
       return prefetched.record;
     }
     const result = await this.repository.findById(String(id));
+    if (result && !this.rowBelongsToTenant(result, this.getTenant(_params))) {
+      throw new NotFoundError(this.resourceType, String(id));
+    }
     if (!result) {
       throw new NotFoundError(this.resourceType, String(id));
     }
@@ -138,14 +185,18 @@ var DrizzleService = class {
   async create(data, params) {
     if (Array.isArray(data)) {
       const results = await Promise.all(
-        data.map((item) => this.repository.create(item))
+        data.map(
+          (item) => this.repository.create(this.withTenant(item, params))
+        )
       );
       for (const result2 of results) {
         this.emit?.("created", result2, params);
       }
       return results;
     }
-    const result = await this.repository.create(data);
+    const result = await this.repository.create(
+      this.withTenant(data, params)
+    );
     this.emit?.("created", result, params);
     return result;
   }
@@ -161,7 +212,10 @@ var DrizzleService = class {
    */
   async update(id, data, params) {
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("updated", result, params);
     return result;
   }
@@ -175,12 +229,14 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       const results = await Promise.all(
         records.map(
           (record) => this.repository.update(
             record[this.id],
-            data
+            this.stripTenantMutation(data)
           )
         )
       );
@@ -190,7 +246,10 @@ var DrizzleService = class {
       return results;
     }
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("patched", result, params);
     return result;
   }
@@ -204,6 +263,8 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       await Promise.all(records.map((record) => this.repository.delete(record[this.id])));
       for (const record of records) {

package/dist/daemon/auth/api-key-strategy.js

@@ -25,7 +25,7 @@ var ApiKeyStrategy = class extends AuthenticationBaseStrategy {
     this.apiKeysRepo.updateLastUsed(keyRow.id).catch((err) => {
       console.warn("Failed to update API key last_used_at:", err);
     });
-    const user = await this.usersService.get(keyRow.user_id);
+    const user = await this.usersService.get(keyRow.user_id, params);
     if (!user) {
       throw new NotAuthenticated("User not found for API key");
     }

package/dist/daemon/auth/executor-runtime-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor-runtime-scope.d.ts","sourceRoot":"","sources":["../../src/auth/executor-runtime-scope.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAuB,WAAW,EAAU,MAAM,kBAAkB,CAAC;AAqJjF,KAAK,QAAQ,GAAG,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;AAE/D,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,KACzB,SAAS,WAAW,KAAG,OAAO,CAAC,WAAW,CAAC,CAkJ1D"}
+{"version":3,"file":"executor-runtime-scope.d.ts","sourceRoot":"","sources":["../../src/auth/executor-runtime-scope.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAuB,WAAW,EAAU,MAAM,kBAAkB,CAAC;AAqKjF,KAAK,QAAQ,GAAG,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;AAE/D,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,KACzB,SAAS,WAAW,KAAG,OAAO,CAAC,WAAW,CAAC,CAkJ1D"}

package/dist/daemon/auth/executor-runtime-scope.js

@@ -1,12 +1,40 @@
 // src/auth/executor-runtime-scope.ts
 import { Forbidden } from "@agor/core/feathers";
+
+// src/auth/executor-session-token.ts
+var EXECUTOR_SESSION_TOKEN_TYPE = "executor-session";
+var EXECUTOR_SESSION_TOKEN_PURPOSE = "executor-task";
+function isExecutorSessionTokenPayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+  const record = payload;
+  return record.type === EXECUTOR_SESSION_TOKEN_TYPE && record.purpose === EXECUTOR_SESSION_TOKEN_PURPOSE;
+}
+function getExecutorSessionTokenSessionId(payload) {
+  return payload.session_id ?? payload.sessionId;
+}
+
+// src/auth/executor-runtime-scope.ts
 function scopedPayload(context) {
-  const payload = context.params.authentication?.payload;
-  if (payload?.type !== "executor-session") return null;
-  if (payload.purpose !== "executor-task") {
-    throw new Forbidden("Executor token is not valid for this request");
+  const params = context.params;
+  const payload = params.authentication?.payload;
+  if (payload?.type === EXECUTOR_SESSION_TOKEN_TYPE) {
+    if (!isExecutorSessionTokenPayload(payload)) {
+      throw new Forbidden("Executor token is not valid for this request");
+    }
+    return payload;
+  }
+  if (params.authentication?.strategy === "jwt" && params.task_id) {
+    return {
+      type: EXECUTOR_SESSION_TOKEN_TYPE,
+      purpose: EXECUTOR_SESSION_TOKEN_PURPOSE,
+      task_id: params.task_id,
+      session_id: params.session_id,
+      sessionId: params.sessionId,
+      branch_id: params.branch_id
+    };
   }
-  return payload;
+  if (payload?.type !== void 0) return null;
+  return null;
 }
 function expectClaim(claim, label) {
   if (!claim) {
@@ -114,7 +142,7 @@ function executorRuntimeScopeGuard() {
     const payload = scopedPayload(context);
     if (!payload) return context;
     const scope = {
-      sessionId: payload.session_id ?? payload.sessionId,
+      sessionId: getExecutorSessionTokenSessionId(payload),
       taskId: payload.task_id,
       branchId: payload.branch_id
     };

package/dist/daemon/auth/executor-session-token.d.ts

@@ -0,0 +1,15 @@
+import type { JwtPayload } from 'jsonwebtoken';
+export declare const EXECUTOR_SESSION_TOKEN_TYPE = "executor-session";
+export declare const EXECUTOR_SESSION_TOKEN_PURPOSE = "executor-task";
+export type ExecutorSessionTokenPayload = JwtPayload & {
+    type?: string;
+    purpose?: string;
+    session_id?: string;
+    /** @deprecated Legacy alias kept only for tokens minted before session_id became canonical. */
+    sessionId?: string;
+    task_id?: string;
+    branch_id?: string;
+};
+export declare function isExecutorSessionTokenPayload(payload: unknown): payload is ExecutorSessionTokenPayload;
+export declare function getExecutorSessionTokenSessionId(payload: ExecutorSessionTokenPayload): string | undefined;
+//# sourceMappingURL=executor-session-token.d.ts.map

package/dist/daemon/auth/executor-session-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor-session-token.d.ts","sourceRoot":"","sources":["../../src/auth/executor-session-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,eAAO,MAAM,2BAA2B,qBAAqB,CAAC;AAC9D,eAAO,MAAM,8BAA8B,kBAAkB,CAAC;AAE9D,MAAM,MAAM,2BAA2B,GAAG,UAAU,GAAG;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,OAAO,GACf,OAAO,IAAI,2BAA2B,CAMxC;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,2BAA2B,GACnC,MAAM,GAAG,SAAS,CAEpB"}

package/dist/daemon/auth/executor-session-token.js

@@ -0,0 +1,17 @@
+// src/auth/executor-session-token.ts
+var EXECUTOR_SESSION_TOKEN_TYPE = "executor-session";
+var EXECUTOR_SESSION_TOKEN_PURPOSE = "executor-task";
+function isExecutorSessionTokenPayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+  const record = payload;
+  return record.type === EXECUTOR_SESSION_TOKEN_TYPE && record.purpose === EXECUTOR_SESSION_TOKEN_PURPOSE;
+}
+function getExecutorSessionTokenSessionId(payload) {
+  return payload.session_id ?? payload.sessionId;
+}
+export {
+  EXECUTOR_SESSION_TOKEN_PURPOSE,
+  EXECUTOR_SESSION_TOKEN_TYPE,
+  getExecutorSessionTokenSessionId,
+  isExecutorSessionTokenPayload
+};

package/dist/daemon/auth/issue-browser-tokens-hook.d.ts

@@ -0,0 +1,24 @@
+import type { SignOptions } from 'jsonwebtoken';
+export interface IssueBrowserTokensHookOptions {
+    jwtSecret: string;
+    accessTokenTtl: SignOptions['expiresIn'];
+    refreshTokenTtl: SignOptions['expiresIn'];
+    tenantClaim: string;
+    debug?: (...args: unknown[]) => void;
+}
+/**
+ * After-create hook for the authentication service: replace the strategy's
+ * access token with a browser access token and attach a refresh token.
+ *
+ * Machine-token logins (executor-session / service JWTs) are exempt from the
+ * swap. Feathers stores the login result's accessToken on the socket
+ * connection and re-verifies it on every subsequent service call, so swapping
+ * a machine credential for a short-TTL browser token would kill any
+ * long-running executor connection the moment the browser TTL elapses — even
+ * though the machine token itself is still valid. Machine logins also must
+ * not receive long-lived refresh tokens meant for interactive clients.
+ *
+ * User redaction applies on every path that returns a user.
+ */
+export declare function createIssueBrowserTokensHook(options: IssueBrowserTokensHookOptions): (context: any) => Promise<any>;
+//# sourceMappingURL=issue-browser-tokens-hook.d.ts.map

package/dist/daemon/auth/issue-browser-tokens-hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue-browser-tokens-hook.d.ts","sourceRoot":"","sources":["../../src/auth/issue-browser-tokens-hook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAWhD,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IACzC,eAAe,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACtC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,6BAA6B,IAInE,SAAS,GAAG,kBAoC3B"}

package/dist/daemon/auth/issue-browser-tokens-hook.js

@@ -0,0 +1,95 @@
+// src/auth/runtime-tokens.ts
+import jwt from "jsonwebtoken";
+var RUNTIME_JWT_ISSUER = "agor";
+var RUNTIME_JWT_AUDIENCE = "https://agor.dev";
+function runtimeTenantClaims(tenantId, claimName = "tenant_id") {
+  if (!tenantId) return {};
+  if (claimName === "tenant_id") return { tenant_id: tenantId };
+  return { tenant_id: tenantId, [claimName]: tenantId };
+}
+function issueRuntimeToken(payload, jwtSecret, expiresIn, options = {}) {
+  return jwt.sign(payload, jwtSecret, {
+    expiresIn,
+    issuer: RUNTIME_JWT_ISSUER,
+    audience: options.audience ?? RUNTIME_JWT_AUDIENCE
+  });
+}
+function issueRuntimeTokenPair(user, jwtSecret, accessTokenTtl, refreshTokenTtl, extraClaims = {}) {
+  return {
+    accessToken: issueRuntimeToken(
+      { sub: user.user_id, type: "access", ...extraClaims },
+      jwtSecret,
+      accessTokenTtl
+    ),
+    refreshToken: issueRuntimeToken(
+      { sub: user.user_id, type: "refresh", ...extraClaims },
+      jwtSecret,
+      refreshTokenTtl
+    )
+  };
+}
+
+// src/auth/token-invalidation.ts
+import { NotAuthenticated } from "@agor/core/feathers";
+var AUTH_TOKEN_ISSUED_AT_MS_CLAIM = "auth_time_ms";
+function dateToMillis(value) {
+  if (value === void 0) return null;
+  const millis = value instanceof Date ? value.getTime() : new Date(value).getTime();
+  return Number.isFinite(millis) ? millis : null;
+}
+function authTokenIssuedAtClaim(now = Date.now(), user) {
+  const validAfterMs = dateToMillis(user?.tokens_valid_after);
+  const issuedAtMs = validAfterMs !== null && now <= validAfterMs ? validAfterMs + 1 : now;
+  return { [AUTH_TOKEN_ISSUED_AT_MS_CLAIM]: issuedAtMs };
+}
+
+// src/auth/user-redaction.ts
+function redactUserAuthMetadata(user) {
+  const {
+    tokens_valid_after: _tokensValidAfter,
+    password: _password,
+    tenant_id: _tenantId,
+    ...publicUser
+  } = user;
+  return publicUser;
+}
+
+// src/auth/issue-browser-tokens-hook.ts
+var MACHINE_TOKEN_TYPES = /* @__PURE__ */ new Set(["executor-session", "service"]);
+function createIssueBrowserTokensHook(options) {
+  const { jwtSecret, accessTokenTtl, refreshTokenTtl, tenantClaim, debug } = options;
+  return async (context) => {
+    debug?.("\u2705 Authentication succeeded:", {
+      strategy: context.result?.authentication?.strategy,
+      hasUser: !!context.result?.user,
+      user_id: context.result?.user?.user_id,
+      hasAccessToken: !!context.result?.accessToken
+    });
+    if (!context.result?.user) {
+      return context;
+    }
+    const payloadType = context.result.authentication?.payload?.type;
+    if (typeof payloadType === "string" && MACHINE_TOKEN_TYPES.has(payloadType)) {
+      context.result.user = redactUserAuthMetadata(context.result.user);
+      return context;
+    }
+    const tenantId = context.params?.tenant?.tenant_id ?? context.result.user.tenant_id;
+    const tokens = issueRuntimeTokenPair(
+      context.result.user,
+      jwtSecret,
+      accessTokenTtl,
+      refreshTokenTtl,
+      {
+        ...authTokenIssuedAtClaim(Date.now(), context.result.user),
+        ...runtimeTenantClaims(tenantId, tenantClaim)
+      }
+    );
+    context.result.accessToken = tokens.accessToken;
+    context.result.refreshToken = tokens.refreshToken;
+    context.result.user = redactUserAuthMetadata(context.result.user);
+    return context;
+  };
+}
+export {
+  createIssueBrowserTokensHook
+};

package/dist/daemon/auth/launch-auth.d.ts

@@ -1,5 +1,5 @@
-import type { AgorConfig } from '@agor/core/config';
-import { type Database } from '@agor/core/db';
+import { type AgorConfig } from '@agor/core/config';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { Params, User, UserID } from '@agor/core/types';
 import { type SignOptions } from 'jsonwebtoken';
 interface ResolvedLaunchSettings {
@@ -14,6 +14,7 @@ interface ResolvedLaunchSettings {
     devSharedSecret?: string;
     serviceCredential?: string;
     allowAdminRoles: boolean;
+    trustVerifiedEmailForLinking: boolean;
     requestTimeoutMs: number;
     algorithms?: string[];
 }
@@ -30,7 +31,7 @@ export interface LaunchAuthResult {
     user: User;
 }
 export interface LaunchAuthServiceOptions {
-    db: Database;
+    db: TenantScopeAwareDatabase;
     config: AgorConfig;
     jwtSecret: string;
     accessTokenTtl: SignOptions['expiresIn'];
@@ -45,7 +46,7 @@ export declare function createLaunchAuthService(options: LaunchAuthServiceOption
     create(data: {
         launchCode?: string;
         launch_code?: string;
-    }, _params?: Params): Promise<LaunchAuthResult>;
+    }, params?: Params): Promise<LaunchAuthResult>;
 };
 export {};
 //# sourceMappingURL=launch-auth.d.ts.map

package/dist/daemon/auth/launch-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"launch-auth.d.ts","sourceRoot":"","sources":["../../src/auth/launch-auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,KAAK,QAAQ,EAAuD,MAAM,eAAe,CAAC;AAEnG,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAwB,MAAM,EAAY,MAAM,kBAAkB,CAAC;AAE7F,OAAY,EAAmC,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAWtF,UAAU,sBAAsB;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AA+BD,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,CAAC;IACvC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,QAAQ,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IACzC,eAAe,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IAC1C,YAAY,EAAE;QAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;CACnE;AAOD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,sBAAsB,CAoBhF;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,UAAU,GAAG,wBAAwB,CAQ5F;AA6UD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB;iBAElD;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,YAAY,MAAM;EAsCrF"}
+{"version":3,"file":"launch-auth.d.ts","sourceRoot":"","sources":["../../src/auth/launch-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,UAAU,EAIhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAQL,KAAK,wBAAwB,EAG9B,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EACV,MAAM,EAEN,IAAI,EAEJ,MAAM,EAEP,MAAM,kBAAkB,CAAC;AAE1B,OAAY,EAAmC,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAatF,UAAU,sBAAsB;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;IACzB,4BAA4B,EAAE,OAAO,CAAC;IACtC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAgCD,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,CAAC;IACvC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,wBAAwB,CAAC;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IACzC,eAAe,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IAC1C,YAAY,EAAE;QAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;CACnE;AAOD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,sBAAsB,CAqBhF;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,UAAU,GAAG,wBAAwB,CAQ5F;AAuXD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB;iBAIlD;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,WAAW,MAAM;EAkDpF"}