177 files changed

Libra does not show diffs here. View the full diff on GitHub.

• modified.dependency-cruiser.cjs+79-0
• modifiedapps/mail/app/(routes)/agents/playbook/page.tsx+11-5
• modifiedapps/mail/app/(routes)/brain/playbooks/chat-agent/page.tsx+5-1
• modifiedapps/mail/app/(routes)/brain/playbooks/page.tsx+55-8
• modifiedapps/mail/app/(routes)/brain/playbooks/routing/page.tsx+26-4
• modifiedapps/mail/app/(routes)/playground/components/PlaybookEditor.tsx+6-0
• modifiedapps/mail/app/(routes)/settings/appearance/page.tsx+25-4
• modifiedapps/mail/app/(routes)/settings/danger-zone/page.tsx+13-0
• modifiedapps/mail/app/(routes)/settings/general/page.tsx+75-32
• modifiedapps/mail/app/(routes)/settings/notifications/page.tsx+74-13
• modifiedapps/mail/app/(routes)/settings/security/page.tsx+33-8
• modifiedapps/mail/app/(routes)/settings/signature/page.tsx+18-5
• modifiedapps/mail/messages/en.json+80-16
• addedapps/mail/modules/administeredUser/components/AdminNotice.tsx+51-0
• addedapps/mail/modules/administeredUser/components/AdministeredUserBanner.tsx+46-0
• addedapps/mail/modules/administeredUser/components/AdministeredUserBar.tsx+45-0
• addedapps/mail/modules/administeredUser/components/AdministeredUserPicker.tsx+179-0
• addedapps/mail/modules/administeredUser/components/DocumentOwnerBanner.tsx+109-0
• addedapps/mail/modules/administeredUser/components/ScopeNotHonouredNotice.tsx+66-0
• addedapps/mail/modules/administeredUser/context.tsx+220-0
• addedapps/mail/modules/administeredUser/contract.ts+188-0
• addedapps/mail/modules/administeredUser/hooks/use-org-admin-access.ts+43-0
• addedapps/mail/modules/administeredUser/index.ts+19-0
• addedapps/mail/modules/administeredUser/permission-error.ts+24-0
• modifiedapps/mail/modules/aop/components/ActionQueueView.tsx+12-4
• modifiedapps/mail/modules/aop/components/AgentDocHeader.tsx+22-3
• modifiedapps/mail/modules/aop/components/AgentFieldsCallout.tsx+13-3
• modifiedapps/mail/modules/aop/components/CrmAgentConfigPanel.tsx+17-3
• modifiedapps/mail/modules/aop/components/PlaybookSettingsPanel.tsx+19-7
• modifiedapps/mail/modules/aop/components/StrategicOverviewConfigPanel.tsx+13-3
• modifiedapps/mail/modules/aop/hooks/use-aops.ts+7-2
• modifiedapps/mail/modules/brain/components/AopManageDialogs.tsx+11-6
• modifiedapps/mail/modules/brain/components/PlaybookAopSection.tsx+17-3
• modifiedapps/mail/modules/brain/components/PlaybookFileTree.tsx+11-1
• modifiedapps/mail/modules/cedar-os/__tests__/__mocks__/auth-client.ts+11-4
• modifiedapps/mail/modules/company/components/CompanyExplorer.tsx+40-7
• modifiedapps/mail/modules/documents/playbook/CompositePlaybookDocument.tsx+23-9
• modifiedapps/mail/modules/documents/playbook/PlaybookDocument.tsx+45-4
• modifiedapps/mail/modules/documents/playbook/PlaybookDocumentCreateDialog.tsx+8-0
• modifiedapps/mail/modules/documents/playbook/PlaybookStageNode.tsx+5-3
• modifiedapps/mail/modules/documents/playbook/PlaybookTriggerNode.tsx+5-3
• modifiedapps/mail/modules/documents/playbook/SubagentCreateDialog.tsx+7-1
• modifiedapps/mail/modules/documents/playbook/TriggerNode.tsx+6-3
• modifiedapps/mail/modules/documents/playbook/WebhookTriggerPanel.tsx+14-4
• modifiedapps/mail/modules/documents/playbook/playbookExtensions.ts+14-5
• modifiedapps/mail/modules/documents/playbook/structure/index.tsx+6-4
• modifiedapps/mail/modules/documents/playbook/useDocumentCreation.tsx+4-0
• modifiedapps/mail/modules/documents/playbook/usePlaybookAop.ts+13-2
• modifiedapps/mail/modules/documents/playbook/useSubagentCreation.tsx+10-1
• modifiedapps/mail/modules/home/components/DisplayArtifactPanel.tsx+11-1
• modifiedapps/mail/modules/userSettings/hooks/use-settings.ts+30-0
• modifiedapps/mail/providers/client-providers.tsx+22-19
• addedapps/mail/tests/modules/administeredUser/contract-coverage.test.ts+174-0
• addedapps/mail/tests/modules/administeredUser/permission-error.test.ts+48-0
• addedapps/mail/tests/modules/administeredUser/scope-not-honoured-notice.test.tsx+62-0
• addedapps/mail/tests/modules/playbook/playbook-document-owner.test.tsx+103-0
• addedapps/server/src/mastra/mcp/external/__tests__/mutating-actions-are-administrable.test.ts+257-0
• addedapps/server/src/mastra/mcp/external/__tests__/no-bare-user-id-inputs.test.ts+248-0
• modifiedapps/server/src/mastra/mcp/external/__tests__/scope-map.test.ts+47-0
• modifiedapps/server/src/mastra/mcp/external/scope-map.ts+72-21
• modifiedapps/server/src/mastra/mcp/external/server.ts+6-0
• modifiedapps/server/src/mastra/skills/account-config/tools/__tests__/apply-systems-change.test.ts+54-23
• modifiedapps/server/src/mastra/skills/account-config/tools/__tests__/applyConfigChangeTool.test.ts+113-4
• addedapps/server/src/mastra/skills/account-config/tools/__tests__/get-sent-emails-authorization.test.ts+247-0
• addedapps/server/src/mastra/skills/account-config/tools/__tests__/read-connection-settings-authorization.test.ts+322-0
• modifiedapps/server/src/mastra/skills/account-config/tools/apply-systems-change.ts+41-17
• modifiedapps/server/src/mastra/skills/account-config/tools/applyConfigChangeTool.ts+152-43
• modifiedapps/server/src/mastra/skills/account-config/tools/getSentEmailsTool.ts+73-8
• modifiedapps/server/src/mastra/skills/account-config/tools/readConnectionSettingsTool.ts+41-5
• modifiedapps/server/src/mastra/tools/config/__tests__/configTool.test.ts+213-38
• addedapps/server/src/mastra/tools/config/__tests__/configureStrategistTool.test.ts+120-0
• addedapps/server/src/mastra/tools/config/__tests__/listOrgMembers.test.ts+270-0
• modifiedapps/server/src/mastra/tools/config/__tests__/workspaceWriteTool.test.ts+68-11
• modifiedapps/server/src/mastra/tools/config/config-read-tool.ts+98-9
• modifiedapps/server/src/mastra/tools/config/config-tool-shared.ts+9-0
• modifiedapps/server/src/mastra/tools/config/config-write-tool.ts+160-89
• modifiedapps/server/src/mastra/tools/config/configTool.ts+64-25
• modifiedapps/server/src/mastra/tools/config/configureStrategistTool.ts+36-3
• addedapps/server/src/mastra/tools/config/connection-write-tool.ts+102-0
• modifiedapps/server/src/mastra/tools/config/systems-write-tool.ts+9-3
• modifiedapps/server/src/mastra/tools/config/workspace-write-tool.ts+26-12
• addedapps/server/src/mastra/tools/document/__tests__/document-redirect-authorization.test.ts+474-0
• modifiedapps/server/src/mastra/tools/document/__tests__/documentTool.test.ts+150-0
• modifiedapps/server/src/mastra/tools/document/__tests__/readDocumentTool.by-id.test.ts+3-2
• modifiedapps/server/src/mastra/tools/document/__tests__/writeDocumentTool.test.ts+6-3
• modifiedapps/server/src/mastra/tools/document/displayDocumentTool.ts+13-2
• modifiedapps/server/src/mastra/tools/document/documentTool.ts+163-22
• modifiedapps/server/src/mastra/tools/document/listDocumentsTool.ts+19-7
• modifiedapps/server/src/mastra/tools/document/readDocumentTool.ts+16-2
• modifiedapps/server/src/mastra/tools/document/writeDocumentTool.ts+24-31
• modifiedapps/server/src/mastra/tools/family-tool-names.ts+21-1
• modifiedapps/server/src/mastra/tools/mail/__tests__/mailTool.live-actions.test.ts+5-0
• modifiedapps/server/src/mastra/tools/mail/__tests__/mailTool.test.ts+6-0
• modifiedapps/server/src/mastra/tools/mail/mailTool.ts+16-6
• modifiedapps/server/src/mastra/tools/task/listTasksTool.ts+49-28
• modifiedapps/server/src/mastra/tools/ui-config/__tests__/uiConfigTool.test.ts+96-5
• modifiedapps/server/src/mastra/tools/ui-config/uiConfigTool.ts+19-1
• modifiedapps/server/src/mastra/utils/__tests__/target-user-scope.test.ts+80-24
• modifiedapps/server/src/mastra/utils/approval-policy.ts+6-1
• modifiedapps/server/src/mastra/utils/target-user-scope.ts+72-26
• addedapps/server/src/services/agent-action-queue/__tests__/execution-read-scope.test.ts+278-0
• modifiedapps/server/src/services/agent-action-queue/queries.ts+85-6
• addedapps/server/src/services/aop/__tests__/custom-field-management-ownership.test.ts+242-0
• modifiedapps/server/src/services/aop/__tests__/custom-field-management.test.ts+5-110
• modifiedapps/server/src/services/aop/custom-field-management.ts+48-32
• addedapps/server/src/services/auth/__tests__/authorize.test.ts+1047-0
• removedapps/server/src/services/auth/__tests__/org-access.test.ts+0-75
• addedapps/server/src/services/auth/__tests__/role-reads-confined-to-authority.test.ts+406-0
• addedapps/server/src/services/auth/__tests__/target-user-id-reaches-the-authority.test.ts+372-0
• addedapps/server/src/services/auth/authorize.ts+526-0
• removedapps/server/src/services/auth/org-access.ts+0-53
• addedapps/server/src/services/crm/__tests__/company-merge-authorization.test.ts+224-0
• modifiedapps/server/src/services/crm/__tests__/conversation-members.test.ts+143-32
• addedapps/server/src/services/crm/__tests__/strategic-catalog-authorization.test.ts+278-0
• modifiedapps/server/src/services/crm/company-merge.ts+37-25
• modifiedapps/server/src/services/crm/conversation-members.ts+56-15
• modifiedapps/server/src/services/crm/overview-instance.ts+183-1
• modifiedapps/server/src/services/documents/__tests__/playbook-doctype.test.ts+21-1
• modifiedapps/server/src/services/documents/convention-paths.ts+29-0
• modifiedapps/server/src/services/documents/triggers/board-webhooks.ts+12-3
• modifiedapps/server/src/services/organizations/__tests__/org-admin.test.ts+12-62
• addedapps/server/src/services/organizations/members.ts+64-0
• modifiedapps/server/src/services/organizations/org-admin.ts+13-65
• modifiedapps/server/src/services/playbook/__tests__/playbook-webhook-registration.test.ts+9-6
• addedapps/server/src/services/playbook/playbook-path-access.ts+154-0
• modifiedapps/server/src/services/playbook/playbook-webhook-registration.ts+76-14
• modifiedapps/server/src/services/users/__tests__/categorized-key-access.test.ts+27-1
• addedapps/server/src/services/users/__tests__/staff-only-agent-execution.test.ts+278-0
• modifiedapps/server/src/services/users/__tests__/user-settings-merge.test.ts+6-3
• modifiedapps/server/src/services/users/__tests__/user-settings.test.ts+6-2
• addedapps/server/src/services/users/staff-only-settings.ts+135-0
• modifiedapps/server/src/services/users/user-settings.ts+22-0
• addedapps/server/src/trpc/assert-actor.ts+87-0
• addedapps/server/src/trpc/routes/__tests__/admin-agent-toggles-staff-gate.test.ts+239-0
• addedapps/server/src/trpc/routes/__tests__/admin-crm-sync-staff-gate.test.ts+353-0
• addedapps/server/src/trpc/routes/__tests__/admin-data-subrouter-target-gate.test.ts+244-0
• addedapps/server/src/trpc/routes/__tests__/admin-integrity-account-health-staff-gate.test.ts+332-0
• addedapps/server/src/trpc/routes/__tests__/admin-router-target-gate.test.ts+160-0
• addedapps/server/src/trpc/routes/__tests__/admin-subrouter-target-gate.test.ts+245-0
• addedapps/server/src/trpc/routes/__tests__/agent-action-queue-execution-scope.test.ts+708-0
• modifiedapps/server/src/trpc/routes/__tests__/analytics-guard.test.ts+50-17
• addedapps/server/src/trpc/routes/__tests__/aop-agents-list-scope.test.ts+288-0
• modifiedapps/server/src/trpc/routes/__tests__/aop-agents-router.test.ts+14-5
• addedapps/server/src/trpc/routes/__tests__/aop-create-playbook-document-owner.test.ts+243-0
• addedapps/server/src/trpc/routes/__tests__/aop-list-scope.test.ts+236-0
• addedapps/server/src/trpc/routes/__tests__/aop-sent-email-scope.test.ts+295-0
• addedapps/server/src/trpc/routes/__tests__/aop-staff-delegation.test.ts+207-0
• modifiedapps/server/src/trpc/routes/__tests__/credential-vault-org-admin.test.ts+20-4
• addedapps/server/src/trpc/routes/__tests__/crm-owner-reassignment-authority.test.ts+231-0
• modifiedapps/server/src/trpc/routes/__tests__/files-restore-node.test.ts+26-2
• modifiedapps/server/src/trpc/routes/__tests__/files-router-auth.test.ts+184-4
• addedapps/server/src/trpc/routes/__tests__/files-router-permission-request.test.ts+293-0
• modifiedapps/server/src/trpc/routes/__tests__/integrations-mcp-delete.test.ts+18-3
• modifiedapps/server/src/trpc/routes/__tests__/integrations-mcp-org-scope.test.ts+7-2
• modifiedapps/server/src/trpc/routes/__tests__/settings-router.test.ts+238-23
• modifiedapps/server/src/trpc/routes/__tests__/user-tasks-conversation-scope.test.ts+12-1
• modifiedapps/server/src/trpc/routes/admin-account-health.ts+48-6
• modifiedapps/server/src/trpc/routes/admin-boards.ts+5-1
• modifiedapps/server/src/trpc/routes/admin-crm-sync.ts+94-8
• modifiedapps/server/src/trpc/routes/admin-email-analysis.ts+25-0
• modifiedapps/server/src/trpc/routes/admin-integrity.ts+76-14
• modifiedapps/server/src/trpc/routes/admin.ts+207-59
• modifiedapps/server/src/trpc/routes/agent-action-queue.ts+214-30
• modifiedapps/server/src/trpc/routes/analytics-access.ts+26-11
• modifiedapps/server/src/trpc/routes/analytics.ts+4-4
• modifiedapps/server/src/trpc/routes/aop-agents.ts+117-18
• modifiedapps/server/src/trpc/routes/aop.ts+520-234
• modifiedapps/server/src/trpc/routes/cedar-admin.ts+6-1
• modifiedapps/server/src/trpc/routes/crm.ts+22-19
• modifiedapps/server/src/trpc/routes/documents.ts+63-13
• modifiedapps/server/src/trpc/routes/files.ts+164-57
• modifiedapps/server/src/trpc/routes/integrations.ts+21-53
• modifiedapps/server/src/trpc/routes/org-admin.ts+46-6
• modifiedapps/server/src/trpc/routes/organisation.ts+11-24
• modifiedapps/server/src/trpc/routes/settings.ts+184-102
• modifiedapps/server/src/trpc/routes/statistics.ts+44-45
• addeddocs/design/admin-config-permissions-revamp.md+1027-0