@jungjaehoon/mama-os 0.70.0 → 0.71.0

package/CHANGELOG.md

@@ -5,6 +5,39 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.71.0] - 2026-10-09
+
+### Added
+
+- `member_root` and a session per principal: each active member gets its own intake, session key,
+  agent id, workspace, downloads, Claude config directory and Codex home under `member_root`, on
+  the one shared serial chain; boot serves active members; a member session starts from its own
+  chat and holds no owner policy; Codex tool calls use the turn's access (#455).
+- The member native boundary: Claude Read and Edit rules and the Bash sandbox, and the member's
+  Codex permission profile, deny the owner's home, owner data paths and other members' directories;
+  each member gets a short Claude temp root of its own. Members sign in with the owner's logins in
+  their own homes (#456).
+- `deliver.telegram.file` in the member role: the file comes from the caller's own
+  `workspace/files` and goes only to the one Telegram DM the registry resolves for it; a hard link
+  or a path through a symlink is refused (#458).
+- Each Claude member session binds its own deny-all proxy; a member's refused connection is stored
+  and alerted as principal, host and time only, grouped per member and host, and the security
+  viewer shows it as `member_connect` (#461).
+
+### Changed
+
+- Owner rules are recognised by the writing principal, not by a messenger chat ref (#454).
+- In a member turn, `memory.save` with `replaces` and `memory.retire` refuse a target not bound to
+  the member's personal scope alone (#457).
+- The owner's chat reads use its own channels (stored chat channels with rows bound to the owner)
+  instead of a connector-wide read; the stored-source reader, `source.recent` and
+  `schedule.upcoming` use one access rule instead of owner exceptions; the owner's checkpoint list,
+  session-start source inventory and viewer memory stats run under its access (#459).
+- The owner's native session denies the product database (with `-wal` and `-shm`), the raw
+  stores, `member_root` and the member temp root, logical and physical paths, on both backends;
+  boot refuses `agent.codex_cwd` inside the connectors directory (#460).
+- A member's shell starts stay in `tool_traces`; they no longer reach the owner's alerts (#461).
+
 ## [0.70.0] - 2026-10-08
 
 ### Added

package/README.md

@@ -4,7 +4,7 @@ One owner agent on Claude or Codex watches connected work, keeps task revisions
 answers on Telegram, publishes reports and a board, and recalls corrections.
 [mama-core](../mama-core/README.md) supplies the shared engine.
 
-Current manifest: **0.70.0**. Install with `npm install -g @jungjaehoon/mama-os` (Node.js 22.13+)
+Current manifest: **0.71.0**. Install with `npm install -g @jungjaehoon/mama-os` (Node.js 22.13+)
 and follow [owner setup](../../docs/start/owner-setup.md).
 
 ## Start and operate

package/dist/agent/claude-native-tool-policy.d.ts

@@ -8,6 +8,8 @@
 export declare function claudeOwnerAllowedTools(workspaceDir: string): string[];
 /** CLI deny rules also govern native children; project permission rules are ignored in -p. */
 export declare function claudeOwnerDisallowedTools(paths: readonly string[], workspaceDir: string): string[];
+/** Member boundary also covers NotebookEdit through Edit; retain owner rules unchanged. */
+export declare function claudeMemberDisallowedTools(paths: readonly string[], workspaceDir: string): string[];
 export interface ClaudeToolRole {
     allowedTools?: readonly string[];
     blockedTools?: readonly string[];

package/dist/agent/claude-native-tool-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude-native-tool-policy.d.ts","sourceRoot":"","sources":["../../src/agent/claude-native-tool-policy.ts"],"names":[],"mappings":"AA+BA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAYtE;AAED,8FAA8F;AAC9F,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,GACnB,MAAM,EAAE,CAQV;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AASD,2EAA2E;AAC3E,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAe7F"}
+{"version":3,"file":"claude-native-tool-policy.d.ts","sourceRoot":"","sources":["../../src/agent/claude-native-tool-policy.ts"],"names":[],"mappings":"AA+BA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAYtE;AAED,8FAA8F;AAC9F,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,GACnB,MAAM,EAAE,CAQV;AAED,2FAA2F;AAC3F,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,GACnB,MAAM,EAAE,CAKV;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AASD,2EAA2E;AAC3E,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAe7F"}

package/dist/agent/claude-native-tool-policy.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.claudeOwnerAllowedTools = claudeOwnerAllowedTools;
 exports.claudeOwnerDisallowedTools = claudeOwnerDisallowedTools;
+exports.claudeMemberDisallowedTools = claudeMemberDisallowedTools;
 exports.projectClaudeNativeTools = projectClaudeNativeTools;
 /**
  * Role tool names that resolve to Claude CLI builtin tools. Catalog/MCP actions
@@ -62,6 +63,13 @@ function claudeOwnerDisallowedTools(paths, workspaceDir) {
         ]),
     ];
 }
+/** Member boundary also covers NotebookEdit through Edit; retain owner rules unchanged. */
+function claudeMemberDisallowedTools(paths, workspaceDir) {
+    return [
+        ...claudeOwnerDisallowedTools(paths, workspaceDir),
+        ...paths.flatMap((path) => [`Edit(/${path})`, `Edit(/${path}/**)`]),
+    ];
+}
 function isBlocked(cliName, blocked) {
     if (blocked.has(cliName))
         return true;

package/dist/agent/claude-native-tool-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-native-tool-policy.js","sourceRoot":"","sources":["../../src/agent/claude-native-tool-policy.ts"],"names":[],"mappings":";;AAsCA,0DAYC;AAGD,gEAWC;AAeD,4DAeC;AA9FD;;;;GAIG;AACH,MAAM,sBAAsB,GAAqC;IAC/D,eAAe,EAAE,OAAO;IACxB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,YAAY,EAAE,cAAc;IAC5B,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACvB,CAAC;AAEF,MAAM,oBAAoB,GAAsB;IAC9C,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,cAAc;IACd,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;IACV,WAAW;CACZ,CAAC;AAEF;;;;;;GAMG;AACH,SAAgB,uBAAuB,CAAC,YAAoB;IAC1D,OAAO;QACL,MAAM;QACN,MAAM;QACN,MAAM;QACN,SAAS,YAAY,MAAM;QAC3B,MAAM;QACN,UAAU;QACV,WAAW;QACX,cAAc;QACd,OAAO;KACR,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAgB,0BAA0B,CACxC,KAAwB,EACxB,YAAoB;IAEpB,OAAO;QACL,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,GAAG,EAAE,SAAS,IAAI,MAAM,CAAC,CAAC;QACnE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrD,GAAG,IAAI,KAAK,YAAY,WAAW;YACnC,GAAG,IAAI,KAAK,YAAY,cAAc;SACvC,CAAC;KACH,CAAC;AACJ,CAAC;AAOD,SAAS,SAAS,CAAC,OAAe,EAAE,OAA4B;IAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAChD,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CACpE,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAgB,wBAAwB,CAAC,IAAgC;IACvE,MAAM,OAAO,GAAG,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACjF,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACzE,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAClF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC"}
+{"version":3,"file":"claude-native-tool-policy.js","sourceRoot":"","sources":["../../src/agent/claude-native-tool-policy.ts"],"names":[],"mappings":";;AAsCA,0DAYC;AAGD,gEAWC;AAGD,kEAQC;AAeD,4DAeC;AAzGD;;;;GAIG;AACH,MAAM,sBAAsB,GAAqC;IAC/D,eAAe,EAAE,OAAO;IACxB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,YAAY,EAAE,cAAc;IAC5B,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACvB,CAAC;AAEF,MAAM,oBAAoB,GAAsB;IAC9C,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,cAAc;IACd,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;IACV,WAAW;CACZ,CAAC;AAEF;;;;;;GAMG;AACH,SAAgB,uBAAuB,CAAC,YAAoB;IAC1D,OAAO;QACL,MAAM;QACN,MAAM;QACN,MAAM;QACN,SAAS,YAAY,MAAM;QAC3B,MAAM;QACN,UAAU;QACV,WAAW;QACX,cAAc;QACd,OAAO;KACR,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAgB,0BAA0B,CACxC,KAAwB,EACxB,YAAoB;IAEpB,OAAO;QACL,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,GAAG,EAAE,SAAS,IAAI,MAAM,CAAC,CAAC;QACnE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrD,GAAG,IAAI,KAAK,YAAY,WAAW;YACnC,GAAG,IAAI,KAAK,YAAY,cAAc;SACvC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAgB,2BAA2B,CACzC,KAAwB,EACxB,YAAoB;IAEpB,OAAO;QACL,GAAG,0BAA0B,CAAC,KAAK,EAAE,YAAY,CAAC;QAClD,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,GAAG,EAAE,SAAS,IAAI,MAAM,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAOD,SAAS,SAAS,CAAC,OAAe,EAAE,OAA4B;IAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAChD,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CACpE,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAgB,wBAAwB,CAAC,IAAgC;IACvE,MAAM,OAAO,GAAG,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACjF,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACzE,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAClF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC"}

package/dist/api/attachment-actions.d.ts

@@ -7,10 +7,14 @@ export interface AttachmentActionPorts {
     connectors?: () => ConnectorRegistry | null;
     workspaceDir?: string;
     downloadsDir?: string;
+    principalPaths?: (principalId: string) => {
+        workspaceDir: string;
+        downloadsDir: string;
+    };
     telegram?: () => OwnerFileSender | null;
     discord?: () => OwnerFileSender | null;
     slack?: () => OwnerFileSender | null;
 }
 export declare function safeFileName(name: string): string;
-export declare function createAttachmentActionRegistrations(ports?: AttachmentActionPorts): ActionRegistration[];
+export declare function createAttachmentActionRegistrations(ports: AttachmentActionPorts, ownerPrincipalId: string): ActionRegistration[];
 //# sourceMappingURL=attachment-actions.d.ts.map

package/dist/api/attachment-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attachment-actions.d.ts","sourceRoot":"","sources":["../../src/api/attachment-actions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAEV,kBAAkB,EAGnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+CAA+C,CAAC;AAQvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAC;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;IACxC,OAAO,CAAC,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;CACtC;AAqKD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAYjD;AAyBD,wBAAgB,mCAAmC,CACjD,KAAK,GAAE,qBAA0B,GAChC,kBAAkB,EAAE,CAmHtB"}
+{"version":3,"file":"attachment-actions.d.ts","sourceRoot":"","sources":["../../src/api/attachment-actions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAEV,kBAAkB,EAGnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+CAA+C,CAAC;AAQvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAC;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACzF,QAAQ,CAAC,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;IACxC,OAAO,CAAC,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;CACtC;AAqKD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAYjD;AAyBD,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,qBAAqB,EAC5B,gBAAgB,EAAE,MAAM,GACvB,kBAAkB,EAAE,CAqItB"}

package/dist/api/attachment-actions.js

@@ -174,7 +174,7 @@ function workspaceFilesRoot(ports) {
         throw new Error('Attachment workspace directory is not configured');
     return (0, node_path_1.join)(ports.workspaceDir, 'files');
 }
-function createAttachmentActionRegistrations(ports = {}) {
+function createAttachmentActionRegistrations(ports, ownerPrincipalId) {
     return [
         {
             contract: {
@@ -226,9 +226,10 @@ function createAttachmentActionRegistrations(ports = {}) {
                 if (!descriptor) {
                     throw new Error(`File ${fileId} does not belong to observation ${observation.observationRef} room ${roomId}`);
                 }
-                if (!ports.downloadsDir?.trim())
+                const downloadsDir = ports.principalPaths?.(context.access.principalId).downloadsDir ?? ports.downloadsDir;
+                if (!downloadsDir?.trim())
                     throw new Error('Attachment downloads directory is not configured');
-                const targetDir = (0, node_path_1.join)(ports.downloadsDir, observation.source, safeFileName(roomId));
+                const targetDir = (0, node_path_1.join)(downloadsDir, observation.source, safeFileName(roomId));
                 (0, node_fs_1.mkdirSync)(targetDir, { recursive: true, mode: 0o700 });
                 const targetPath = (0, node_path_1.join)(targetDir, `${safeFileName(fileId)}_${safeFileName(descriptor.name)}`);
                 const downloaded = await provider.downloadAttachment({
@@ -256,7 +257,7 @@ function createAttachmentActionRegistrations(ports = {}) {
             .map((messenger) => ({
             contract: {
                 name: `deliver.${messenger}.file`,
-                summary: `Send one regular file under the owner workspace files directory through ${messenger}; images and documents use the messenger upload API.`,
+                summary: `Send one regular file under the caller's workspace files directory through ${messenger}; images and documents use the messenger upload API.`,
                 inputSchema: ownerFileSchema,
                 examples: [
                     { title: 'Send a workspace result', input: { path: '/workspace/files/result.xlsx' } },
@@ -273,9 +274,21 @@ function createAttachmentActionRegistrations(ports = {}) {
                 const sender = ports[messenger]?.();
                 if (!sender)
                     throw new Error(`${messenger} file delivery port is not configured`);
-                const validated = (0, file_delivery_js_1.validateWorkspaceFile)(workspaceFilesRoot(ports), path, file_delivery_js_1.OWNER_FILE_MAX_UPLOAD_BYTES);
+                const isMember = context.access.principalId !== ownerPrincipalId;
+                // A member without its own paths must never inherit the owner's file authority.
+                if (isMember && !ports.principalPaths)
+                    throw new Error('Member file delivery requires principal paths');
+                const filesRoot = workspaceFilesRoot(ports.principalPaths
+                    ? { workspaceDir: ports.principalPaths(context.access.principalId).workspaceDir }
+                    : ports);
+                const validated = (0, file_delivery_js_1.validateWorkspaceFile)(filesRoot, path, file_delivery_js_1.OWNER_FILE_MAX_UPLOAD_BYTES, isMember);
                 const caption = values.caption === undefined ? undefined : String(values.caption);
-                const result = await sender.sendFile(validated.path, caption, context.operationId);
+                const result = isMember && messenger === 'telegram'
+                    ? await sender.sendFile(validated.path, caption, context.operationId, {
+                        access: context.access,
+                        filesRoot,
+                    })
+                    : await sender.sendFile(validated.path, caption, context.operationId);
                 return { path: validated.path, ...result };
             },
         })),

package/dist/api/attachment-actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"attachment-actions.js","sourceRoot":"","sources":["../../src/api/attachment-actions.ts"],"names":[],"mappings":";;AAoMA,oCAYC;AAyBD,kFAqHC;AA9VD,qCAA8C;AAC9C,yCAAiC;AAQjC,2EAIgD;AAChD,8DAAyE;AACzE,2DAAmE;AAEnE,yDAI4B;AAY5B,MAAM,mBAAmB,GAAuB;IAC9C,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,gBAAgB,CAAC;IAC5B,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,cAAc,EAAE;YACd,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,6EAA6E;SAC3F;KACF;CACF,CAAC;AAEF,MAAM,wBAAwB,GAAuB;IACnD,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,gBAAgB,EAAE,QAAQ,CAAC;IACtC,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,cAAc,EAAE;YACd,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,kEAAkE;SAChF;QACD,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,sDAAsD;SACpE;KACF;CACF,CAAC;AAEF,MAAM,eAAe,GAAuB;IAC1C,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,MAAM,CAAC;IAClB,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,oDAAoD;SAClE;QACD,OAAO,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,KAAK;YAChB,WAAW,EAAE,wBAAwB;SACtC;KACF;CACF,CAAC;AAYF,SAAS,oBAAoB,CAAC,KAA4B;IACxD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACzF,KAAK,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC7C,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,SAAS,eAAe,CACtB,OAAsB;IAEtB,OAAO,OAAO,CAAC,aAAa,EAAE,WAAW,KAAK,SAAS;QACrD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAA4B,EAC5B,KAA8B,EAC9B,OAAsB;IAEtB,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC,eAAe,CAC9D,cAAc,EACd,OAAO,CAAC,MAAM,EACd,eAAe,CAAC,OAAO,CAAC,CACzB,CAAC;IACF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,sBAAsB,cAAc,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,WAAW,GAAG,MAAgD,CAAC;IACrE,IAAI,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,sBAAsB,cAAc,0BAA0B,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,WAAW,CAClB,KAA4B,EAC5B,MAAc;IAEd,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,aAAa,MAAM,8EAA8E,CAClG,CAAC;QACF,KAAK,CAAC,IAAI,GAAG,eAAe,CAAC;QAC7B,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,cAAc,CAAC,CAAC;IAChG,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,gCAAgC,CAAC,CAAC;IACrF,OAAO,IAAA,oCAAmB,EAAC,SAAS,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,MAAM,CAAC,QAA6C,EAAE,GAAW;IACxE,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACzF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAAC,WAAwC;IACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,SAAS,CAAC;IAChF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACtF,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IACjD,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9E,OAAO,eAAe,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,SAAS,GAAG,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,IAAI,MAAM,KAAK,EAAE;gBAAE,OAAO,MAAM,CAAC;QACnC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,eAAe,WAAW,CAAC,cAAc,WAAW,WAAW,CAAC,MAAM,UAAU,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,MAAM,CAAC,WAAwC;IAItD,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;IACtC,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAChD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,IAAA,iCAAsB,EAAC,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACnE,MAAM,UAAU,GAAG,IAAA,8BAAmB,EAAC,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAClE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC5F,CAAC;AAED,SAAgB,YAAY,CAAC,IAAY;IACvC,yFAAyF;IACzF,uCAAuC;IACvC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;SACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC;QACnF,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,IAAI,CACT;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAwC;IACjE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAChD,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC;QAC9B,UAAU,EAAE,WAAW,CAAC,QAAQ,IAAI,IAAI;QACxC,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,KAAK,SAAS;YAC/C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,KAAK,SAAS;YAC/C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC7C,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA4B;IACtD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;QAC7B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,OAAO,IAAA,gBAAI,EAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAgB,mCAAmC,CACjD,QAA+B,EAAE;IAEjC,OAAO;QACL;YACE,QAAQ,EAAE;gBACR,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EACL,4RAA4R;gBAC9R,WAAW,EAAE,mBAAmB;gBAChC,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,CAAC;aACzF;YACD,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAgC,EAAE,OAAO,CAAC,CAAC;gBAC5F,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBACxD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC7E,OAAO;oBACL,cAAc,EAAE,WAAW,CAAC,cAAc;oBAC1C,SAAS,EAAE,WAAW,CAAC,MAAM;oBAC7B,KAAK;iBACN,CAAC;YACJ,CAAC;SACF;QACD;YACE,QAAQ,EAAE;gBACR,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EACL,wKAAwK;gBAC1K,WAAW,EAAE,wBAAwB;gBACrC,QAAQ,EAAE;oBACR;wBACE,KAAK,EAAE,6BAA6B;wBACpC,KAAK,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE;qBAC3D;iBACF;aACF;YACD,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,MAAM,GAAG,KAAgC,CAAC;gBAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;oBACpD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBACxC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAClE,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBACxD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;gBACtC,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACrF,MAAM,MAAM,GAAG,SAAS;oBACtB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,MAAM,QAAQ,CAAC,eAAe,CAAC;wBAC7B,GAAG,OAAO;wBACV,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;qBAChE,CAAC,CAAC;gBACP,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;gBACjE,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,KAAK,CACb,QAAQ,MAAM,mCAAmC,WAAW,CAAC,cAAc,SAAS,MAAM,EAAE,CAC7F,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;oBAC7B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,KAAK,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;gBACrF,IAAA,mBAAS,EAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvD,MAAM,UAAU,GAAG,IAAA,gBAAI,EACrB,SAAS,EACT,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAC3D,CAAC;gBACF,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC;oBACnD,MAAM;oBACN,MAAM;oBACN,UAAU;iBACX,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,UAAU,CAAC,CAAC,IAAI,CAAC;gBACvC,IAAI,IAAI,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,4BAA4B,CAAC,CAAC;gBACzE,CAAC;gBACD,OAAO;oBACL,cAAc,EAAE,WAAW,CAAC,cAAc;oBAC1C,SAAS,EAAE,WAAW,CAAC,MAAM;oBAC7B,MAAM;oBACN,IAAI,EAAE,UAAU;oBAChB,IAAI;iBACL,CAAC;YACJ,CAAC;SACF;QACD,uFAAuF;QACvF,+FAA+F;QAC/F,GAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAW;aAC3C,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC;aACrD,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACnB,QAAQ,EAAE;gBACR,IAAI,EAAE,WAAW,SAAS,OAAO;gBACjC,OAAO,EAAE,2EAA2E,SAAS,sDAAsD;gBACnJ,WAAW,EAAE,eAAe;gBAC5B,QAAQ,EAAE;oBACR,EAAE,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,8BAA8B,EAAE,EAAE;iBACtF;aACF;YACD,IAAI,EAAE,KAAK,EAAE,KAAc,EAAE,OAAsB,EAAE,EAAE;gBACrD,MAAM,MAAM,GAAG,KAAgC,CAAC;gBAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACxF,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACjF,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,gCAAgC,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,uCAAuC,CAAC,CAAC;gBAClF,MAAM,SAAS,GAAG,IAAA,wCAAqB,EACrC,kBAAkB,CAAC,KAAK,CAAC,EACzB,IAAI,EACJ,8CAA2B,CAC5B,CAAC;gBACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;gBACnF,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;YAC7C,CAAC;SACF,CAAC,CAAC;KACN,CAAC;AACJ,CAAC"}
+{"version":3,"file":"attachment-actions.js","sourceRoot":"","sources":["../../src/api/attachment-actions.ts"],"names":[],"mappings":";;AAqMA,oCAYC;AAyBD,kFAwIC;AAlXD,qCAA8C;AAC9C,yCAAiC;AAQjC,2EAIgD;AAChD,8DAAyE;AACzE,2DAAmE;AAEnE,yDAI4B;AAa5B,MAAM,mBAAmB,GAAuB;IAC9C,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,gBAAgB,CAAC;IAC5B,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,cAAc,EAAE;YACd,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,6EAA6E;SAC3F;KACF;CACF,CAAC;AAEF,MAAM,wBAAwB,GAAuB;IACnD,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,gBAAgB,EAAE,QAAQ,CAAC;IACtC,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,cAAc,EAAE;YACd,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,kEAAkE;SAChF;QACD,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,sDAAsD;SACpE;KACF;CACF,CAAC;AAEF,MAAM,eAAe,GAAuB;IAC1C,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,MAAM,CAAC;IAClB,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,oDAAoD;SAClE;QACD,OAAO,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,KAAK;YAChB,WAAW,EAAE,wBAAwB;SACtC;KACF;CACF,CAAC;AAYF,SAAS,oBAAoB,CAAC,KAA4B;IACxD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACzF,KAAK,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC7C,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,SAAS,eAAe,CACtB,OAAsB;IAEtB,OAAO,OAAO,CAAC,aAAa,EAAE,WAAW,KAAK,SAAS;QACrD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAA4B,EAC5B,KAA8B,EAC9B,OAAsB;IAEtB,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC,eAAe,CAC9D,cAAc,EACd,OAAO,CAAC,MAAM,EACd,eAAe,CAAC,OAAO,CAAC,CACzB,CAAC;IACF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,sBAAsB,cAAc,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,WAAW,GAAG,MAAgD,CAAC;IACrE,IAAI,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,sBAAsB,cAAc,0BAA0B,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,WAAW,CAClB,KAA4B,EAC5B,MAAc;IAEd,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,aAAa,MAAM,8EAA8E,CAClG,CAAC;QACF,KAAK,CAAC,IAAI,GAAG,eAAe,CAAC;QAC7B,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,cAAc,CAAC,CAAC;IAChG,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,gCAAgC,CAAC,CAAC;IACrF,OAAO,IAAA,oCAAmB,EAAC,SAAS,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,MAAM,CAAC,QAA6C,EAAE,GAAW;IACxE,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACzF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAAC,WAAwC;IACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,SAAS,CAAC;IAChF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACtF,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IACjD,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9E,OAAO,eAAe,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,SAAS,GAAG,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,IAAI,MAAM,KAAK,EAAE;gBAAE,OAAO,MAAM,CAAC;QACnC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,eAAe,WAAW,CAAC,cAAc,WAAW,WAAW,CAAC,MAAM,UAAU,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,MAAM,CAAC,WAAwC;IAItD,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;IACtC,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAChD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,IAAA,iCAAsB,EAAC,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACnE,MAAM,UAAU,GAAG,IAAA,8BAAmB,EAAC,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAClE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC5F,CAAC;AAED,SAAgB,YAAY,CAAC,IAAY;IACvC,yFAAyF;IACzF,uCAAuC;IACvC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;SACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC;QACnF,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,IAAI,CACT;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAwC;IACjE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAChD,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC;QAC9B,UAAU,EAAE,WAAW,CAAC,QAAQ,IAAI,IAAI;QACxC,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,KAAK,SAAS;YAC/C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,KAAK,SAAS;YAC/C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC7C,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA4B;IACtD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;QAC7B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,OAAO,IAAA,gBAAI,EAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAgB,mCAAmC,CACjD,KAA4B,EAC5B,gBAAwB;IAExB,OAAO;QACL;YACE,QAAQ,EAAE;gBACR,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EACL,4RAA4R;gBAC9R,WAAW,EAAE,mBAAmB;gBAChC,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,CAAC;aACzF;YACD,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAgC,EAAE,OAAO,CAAC,CAAC;gBAC5F,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBACxD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC7E,OAAO;oBACL,cAAc,EAAE,WAAW,CAAC,cAAc;oBAC1C,SAAS,EAAE,WAAW,CAAC,MAAM;oBAC7B,KAAK;iBACN,CAAC;YACJ,CAAC;SACF;QACD;YACE,QAAQ,EAAE;gBACR,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EACL,wKAAwK;gBAC1K,WAAW,EAAE,wBAAwB;gBACrC,QAAQ,EAAE;oBACR;wBACE,KAAK,EAAE,6BAA6B;wBACpC,KAAK,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE;qBAC3D;iBACF;aACF;YACD,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,MAAM,GAAG,KAAgC,CAAC;gBAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;oBACpD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBACxC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAClE,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBACxD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;gBACtC,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACrF,MAAM,MAAM,GAAG,SAAS;oBACtB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,MAAM,QAAQ,CAAC,eAAe,CAAC;wBAC7B,GAAG,OAAO;wBACV,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;qBAChE,CAAC,CAAC;gBACP,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;gBACjE,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,KAAK,CACb,QAAQ,MAAM,mCAAmC,WAAW,CAAC,cAAc,SAAS,MAAM,EAAE,CAC7F,CAAC;gBACJ,CAAC;gBACD,MAAM,YAAY,GAChB,KAAK,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC;gBACxF,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC/E,IAAA,mBAAS,EAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvD,MAAM,UAAU,GAAG,IAAA,gBAAI,EACrB,SAAS,EACT,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAC3D,CAAC;gBACF,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC;oBACnD,MAAM;oBACN,MAAM;oBACN,UAAU;iBACX,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,UAAU,CAAC,CAAC,IAAI,CAAC;gBACvC,IAAI,IAAI,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,4BAA4B,CAAC,CAAC;gBACzE,CAAC;gBACD,OAAO;oBACL,cAAc,EAAE,WAAW,CAAC,cAAc;oBAC1C,SAAS,EAAE,WAAW,CAAC,MAAM;oBAC7B,MAAM;oBACN,IAAI,EAAE,UAAU;oBAChB,IAAI;iBACL,CAAC;YACJ,CAAC;SACF;QACD,uFAAuF;QACvF,+FAA+F;QAC/F,GAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAW;aAC3C,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC;aACrD,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACnB,QAAQ,EAAE;gBACR,IAAI,EAAE,WAAW,SAAS,OAAO;gBACjC,OAAO,EAAE,8EAA8E,SAAS,sDAAsD;gBACtJ,WAAW,EAAE,eAAe;gBAC5B,QAAQ,EAAE;oBACR,EAAE,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,8BAA8B,EAAE,EAAE;iBACtF;aACF;YACD,IAAI,EAAE,KAAK,EAAE,KAAc,EAAE,OAAsB,EAAE,EAAE;gBACrD,MAAM,MAAM,GAAG,KAAgC,CAAC;gBAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACxF,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACjF,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,gCAAgC,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,uCAAuC,CAAC,CAAC;gBAClF,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,KAAK,gBAAgB,CAAC;gBACjE,gFAAgF;gBAChF,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC,cAAc;oBACnC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBACnE,MAAM,SAAS,GAAG,kBAAkB,CAClC,KAAK,CAAC,cAAc;oBAClB,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE;oBACjF,CAAC,CAAC,KAAK,CACV,CAAC;gBACF,MAAM,SAAS,GAAG,IAAA,wCAAqB,EACrC,SAAS,EACT,IAAI,EACJ,8CAA2B,EAC3B,QAAQ,CACT,CAAC;gBACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClF,MAAM,MAAM,GACV,QAAQ,IAAI,SAAS,KAAK,UAAU;oBAClC,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE;wBAClE,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,SAAS;qBACV,CAAC;oBACJ,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;gBAC1E,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;YAC7C,CAAC;SACF,CAAC,CAAC;KACN,CAAC;AACJ,CAAC"}

package/dist/api/file-delivery.d.ts

@@ -1,3 +1,4 @@
+import type { JudgmentAccess } from '@jungjaehoon/mama-core';
 export declare const OWNER_FILE_MAX_UPLOAD_BYTES: number;
 export declare const TELEGRAM_MAX_UPLOAD_BYTES: number;
 export declare const TELEGRAM_MAX_PHOTO_BYTES: number;
@@ -9,7 +10,12 @@ export interface OwnerFileDeliveryResult {
     idempotent?: boolean;
 }
 export interface OwnerFileSender {
-    sendFile(path: string, caption: string | undefined, operationId: string): Promise<TelegramFileDeliveryResult>;
+    sendFile(path: string, caption: string | undefined, operationId: string, member?: MemberFileDeliveryContext): Promise<TelegramFileDeliveryResult>;
+}
+/** Telegram-only host authority, resolved per call; never part of action input. */
+export interface MemberFileDeliveryContext {
+    access: JudgmentAccess;
+    filesRoot: string;
 }
 export type TelegramFileDeliveryResult = OwnerFileDeliveryResult;
 export type TelegramFileSender = OwnerFileSender;
@@ -18,9 +24,13 @@ export interface ValidatedWorkspaceFile {
     size: number;
     sentAs: 'photo' | 'document';
 }
-export declare function validateWorkspaceFile(filesRoot: string, inputPath: string, maxBytes: number): ValidatedWorkspaceFile;
-/** Keep this descriptor open through upload so a later path replacement cannot change its bytes. */
-export declare function openWorkspaceFile(filesRoot: string, inputPath: string, maxBytes: number): ValidatedWorkspaceFile & {
+export declare function openMemberWorkspaceFile(real: string): number;
+export declare function validateWorkspaceFile(filesRoot: string, inputPath: string, maxBytes: number, member?: boolean): ValidatedWorkspaceFile;
+/**
+ * Keep this descriptor open through upload so a later path replacement cannot change its bytes.
+ * member: reject symlink components and hard links before uploading with the daemon's authority.
+ */
+export declare function openWorkspaceFile(filesRoot: string, inputPath: string, maxBytes: number, member?: boolean): ValidatedWorkspaceFile & {
     fd: number;
 };
 /** Read the validated descriptor without reopening its mutable pathname. The caller closes it. */

package/dist/api/file-delivery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-delivery.d.ts","sourceRoot":"","sources":["../../src/api/file-delivery.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,2BAA2B,QAAmB,CAAC;AAC5D,eAAO,MAAM,yBAAyB,QAA8B,CAAC;AACrE,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AACzD,eAAO,MAAM,yBAAyB,aAAsD,CAAC;AAE7F,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACxC;AAED,MAAM,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AACjE,MAAM,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAEjD,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;CAC9B;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,sBAAsB,CAIxB;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,sBAAsB,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAyCzC;AAED,kGAAkG;AAClG,wBAAuB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAW3E;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAY1E"}
+{"version":3,"file":"file-delivery.d.ts","sourceRoot":"","sources":["../../src/api/file-delivery.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAM7D,eAAO,MAAM,2BAA2B,QAAmB,CAAC;AAC5D,eAAO,MAAM,yBAAyB,QAA8B,CAAC;AACrE,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AACzD,eAAO,MAAM,yBAAyB,aAAsD,CAAC;AAE7F,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,yBAAyB,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACxC;AAED,mFAAmF;AACnF,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AACjE,MAAM,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAEjD,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;CAC9B;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA0B5D;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,UAAQ,GACb,sBAAsB,CAIxB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,UAAQ,GACb,sBAAsB,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CA2CzC;AAED,kGAAkG;AAClG,wBAAuB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAW3E;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAY1E"}

package/dist/api/file-delivery.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TELEGRAM_IMAGE_EXTENSIONS = exports.TELEGRAM_MAX_PHOTO_BYTES = exports.TELEGRAM_MAX_UPLOAD_BYTES = exports.OWNER_FILE_MAX_UPLOAD_BYTES = void 0;
+exports.openMemberWorkspaceFile = openMemberWorkspaceFile;
 exports.validateWorkspaceFile = validateWorkspaceFile;
 exports.openWorkspaceFile = openWorkspaceFile;
 exports.readWorkspaceFile = readWorkspaceFile;
@@ -8,17 +9,55 @@ exports.workspaceFileIdentity = workspaceFileIdentity;
 const node_fs_1 = require("node:fs");
 const node_crypto_1 = require("node:crypto");
 const node_path_1 = require("node:path");
+// macOS <sys/fcntl.h>: reject symlinks in every path component, the last included. Combined with
+// O_NOFOLLOW, open fails with EINVAL.
+const O_NOFOLLOW_ANY = 0x20000000;
 exports.OWNER_FILE_MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
 exports.TELEGRAM_MAX_UPLOAD_BYTES = exports.OWNER_FILE_MAX_UPLOAD_BYTES;
 exports.TELEGRAM_MAX_PHOTO_BYTES = 10 * 1024 * 1024;
 exports.TELEGRAM_IMAGE_EXTENSIONS = new Set(['.png', '.jpg', '.jpeg', '.webp', '.gif']);
-function validateWorkspaceFile(filesRoot, inputPath, maxBytes) {
-    const { fd, ...validated } = openWorkspaceFile(filesRoot, inputPath, maxBytes);
+function openMemberWorkspaceFile(real) {
+    let fd;
+    if (process.platform === 'darwin') {
+        try {
+            fd = (0, node_fs_1.openSync)(real, node_fs_1.constants.O_RDONLY | O_NOFOLLOW_ANY);
+        }
+        catch (error) {
+            if (error.code === 'ELOOP') {
+                throw new Error('path must not pass through a symlink');
+            }
+            throw error;
+        }
+    }
+    else if (process.platform === 'linux') {
+        fd = (0, node_fs_1.openSync)(real, node_fs_1.constants.O_RDONLY | node_fs_1.constants.O_NOFOLLOW);
+    }
+    else {
+        throw new Error('member file delivery is not supported on this platform');
+    }
+    try {
+        if (process.platform === 'linux' && (0, node_fs_1.readlinkSync)(`/proc/self/fd/${fd}`) !== real) {
+            throw new Error('path must not pass through a symlink');
+        }
+        if ((0, node_fs_1.fstatSync)(fd).nlink !== 1)
+            throw new Error('path must not be a hard link');
+        return fd;
+    }
+    catch (error) {
+        (0, node_fs_1.closeSync)(fd);
+        throw error;
+    }
+}
+function validateWorkspaceFile(filesRoot, inputPath, maxBytes, member = false) {
+    const { fd, ...validated } = openWorkspaceFile(filesRoot, inputPath, maxBytes, member);
     (0, node_fs_1.closeSync)(fd);
     return validated;
 }
-/** Keep this descriptor open through upload so a later path replacement cannot change its bytes. */
-function openWorkspaceFile(filesRoot, inputPath, maxBytes) {
+/**
+ * Keep this descriptor open through upload so a later path replacement cannot change its bytes.
+ * member: reject symlink components and hard links before uploading with the daemon's authority.
+ */
+function openWorkspaceFile(filesRoot, inputPath, maxBytes, member = false) {
     const rootPath = (0, node_path_1.resolve)(filesRoot);
     const rootMetadata = (0, node_fs_1.lstatSync)(rootPath);
     if (!rootMetadata.isDirectory() || rootMetadata.isSymbolicLink()) {
@@ -37,7 +76,9 @@ function openWorkspaceFile(filesRoot, inputPath, maxBytes) {
     if (real === root || !real.startsWith(`${root}${node_path_1.sep}`)) {
         throw new Error('path must stay under the workspace files directory');
     }
-    const fd = (0, node_fs_1.openSync)(real, node_fs_1.constants.O_RDONLY | node_fs_1.constants.O_NOFOLLOW);
+    const fd = member
+        ? openMemberWorkspaceFile(real)
+        : (0, node_fs_1.openSync)(real, node_fs_1.constants.O_RDONLY | node_fs_1.constants.O_NOFOLLOW);
     try {
         const opened = (0, node_fs_1.fstatSync)(fd);
         if (!opened.isFile())

package/dist/api/file-delivery.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-delivery.js","sourceRoot":"","sources":["../../src/api/file-delivery.ts"],"names":[],"mappings":";;;AA0CA,sDAQC;AAGD,8CA6CC;AAGD,8CAWC;AAED,sDAYC;AA9HD,qCASiB;AACjB,6CAAyC;AACzC,yCAA2E;AAE9D,QAAA,2BAA2B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,QAAA,yBAAyB,GAAG,mCAA2B,CAAC;AACxD,QAAA,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5C,QAAA,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AA0B7F,SAAgB,qBAAqB,CACnC,SAAiB,EACjB,SAAiB,EACjB,QAAgB;IAEhB,MAAM,EAAE,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC/E,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;IACd,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oGAAoG;AACpG,SAAgB,iBAAiB,CAC/B,SAAiB,EACjB,SAAiB,EACjB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,IAAA,mBAAO,EAAC,SAAS,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,IAAA,mBAAS,EAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,sBAAY,EAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,IAAA,gBAAI,EAAC,IAAA,sBAAY,EAAC,IAAA,mBAAO,EAAC,QAAQ,CAAC,CAAC,EAAE,IAAA,oBAAQ,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,mBAAO,EAAC,SAAS,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAA,mBAAS,EAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,sBAAY,EAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,eAAG,EAAE,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,GAAG,IAAA,kBAAQ,EAAC,IAAI,EAAE,mBAAS,CAAC,QAAQ,GAAG,mBAAS,CAAC,UAAU,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,QAAQ,CAAC,CAAC;QACxE,CAAC;QACD,OAAO;YACL,EAAE;YACF,IAAI,EAAE,IAAI;YACV,IAAI;YACJ,MAAM,EACJ,IAAI,IAAI,gCAAwB;gBAChC,iCAAyB,CAAC,GAAG,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBACxD,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,UAAU;SACjB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,kGAAkG;AAC3F,KAAK,SAAS,CAAC,CAAC,iBAAiB,CAAC,EAAU;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9D,IAAA,cAAI,EAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACvD,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CACtC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,SAAS,KAAK,CAAC;YAAE,OAAO;QAC5B,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CAAC,EAAU,EAAE,OAAgB;IAChE,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,OAAO,IAAI,EAAE,IAAI,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC,IAAI,CAAC;IACpC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,OAAO,QAAQ,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7F,IAAI,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACzF,QAAQ,IAAI,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"file-delivery.js","sourceRoot":"","sources":["../../src/api/file-delivery.ts"],"names":[],"mappings":";;;AAuDA,0DA0BC;AAED,sDASC;AAMD,8CAgDC;AAGD,8CAWC;AAED,sDAYC;AA9KD,qCAUiB;AACjB,6CAAyC;AACzC,yCAA2E;AAG3E,iGAAiG;AACjG,sCAAsC;AACtC,MAAM,cAAc,GAAG,UAAU,CAAC;AAErB,QAAA,2BAA2B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,QAAA,yBAAyB,GAAG,mCAA2B,CAAC;AACxD,QAAA,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5C,QAAA,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAiC7F,SAAgB,uBAAuB,CAAC,IAAY;IAClD,IAAI,EAAU,CAAC;IACf,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,EAAE,GAAG,IAAA,kBAAQ,EAAC,IAAI,EAAE,mBAAS,CAAC,QAAQ,GAAG,cAAc,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACxC,EAAE,GAAG,IAAA,kBAAQ,EAAC,IAAI,EAAE,mBAAS,CAAC,QAAQ,GAAG,mBAAS,CAAC,UAAU,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAA,sBAAY,EAAC,iBAAiB,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CACnC,SAAiB,EACjB,SAAiB,EACjB,QAAgB,EAChB,MAAM,GAAG,KAAK;IAEd,MAAM,EAAE,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvF,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;IACd,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAC/B,SAAiB,EACjB,SAAiB,EACjB,QAAgB,EAChB,MAAM,GAAG,KAAK;IAEd,MAAM,QAAQ,GAAG,IAAA,mBAAO,EAAC,SAAS,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,IAAA,mBAAS,EAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,sBAAY,EAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,IAAA,gBAAI,EAAC,IAAA,sBAAY,EAAC,IAAA,mBAAO,EAAC,QAAQ,CAAC,CAAC,EAAE,IAAA,oBAAQ,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,mBAAO,EAAC,SAAS,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAA,mBAAS,EAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,sBAAY,EAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,eAAG,EAAE,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,GAAG,MAAM;QACf,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC;QAC/B,CAAC,CAAC,IAAA,kBAAQ,EAAC,IAAI,EAAE,mBAAS,CAAC,QAAQ,GAAG,mBAAS,CAAC,UAAU,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,QAAQ,CAAC,CAAC;QACxE,CAAC;QACD,OAAO;YACL,EAAE;YACF,IAAI,EAAE,IAAI;YACV,IAAI;YACJ,MAAM,EACJ,IAAI,IAAI,gCAAwB;gBAChC,iCAAyB,CAAC,GAAG,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBACxD,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,UAAU;SACjB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,kGAAkG;AAC3F,KAAK,SAAS,CAAC,CAAC,iBAAiB,CAAC,EAAU;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9D,IAAA,cAAI,EAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACvD,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CACtC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,SAAS,KAAK,CAAC;YAAE,OAAO;QAC5B,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CAAC,EAAU,EAAE,OAAgB;IAChE,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,OAAO,IAAI,EAAE,IAAI,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC,IAAI,CAAC;IACpC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,OAAO,QAAQ,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7F,IAAI,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACzF,QAAQ,IAAI,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/dist/api/member-share-actions.d.ts

@@ -4,6 +4,13 @@ interface MemberSharePorts {
     ownerPrincipalId: string;
     ownerDefaultScopes: readonly MemoryScopeRef[];
 }
+/**
+ * A member changes shared records only in a group room, where the team sees it (owner decision
+ * 2026-10-09). Until group-room turns exist (P10), a member turn replaces or retires only records
+ * bound to its own personal scope alone; sharing one stays allowed. A record with no binding is
+ * not the member's either. The owner is unchanged; a missing record is left to core.
+ */
+export declare function guardMemberSharedRecords(registration: ActionRegistration, adapter: DatabaseInstance, ownerPrincipalId: string): ActionRegistration;
 export declare function memberShareActionRegistrations(ports: MemberSharePorts): ActionRegistration[];
 export {};
 //# sourceMappingURL=member-share-actions.d.ts.map

package/dist/api/member-share-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"member-share-actions.d.ts","sourceRoot":"","sources":["../../src/api/member-share-actions.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EAGrB,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAIhC,UAAU,gBAAgB;IACxB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,SAAS,cAAc,EAAE,CAAC;CAC/C;AAoBD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,gBAAgB,GAAG,kBAAkB,EAAE,CAiM5F"}
+{"version":3,"file":"member-share-actions.d.ts","sourceRoot":"","sources":["../../src/api/member-share-actions.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EAGrB,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAIhC,UAAU,gBAAgB;IACxB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,SAAS,cAAc,EAAE,CAAC;CAC/C;AAQD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,kBAAkB,EAChC,OAAO,EAAE,gBAAgB,EACzB,gBAAgB,EAAE,MAAM,GACvB,kBAAkB,CA+BpB;AAcD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,gBAAgB,GAAG,kBAAkB,EAAE,CAiM5F"}

package/dist/api/member-share-actions.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.guardMemberSharedRecords = guardMemberSharedRecords;
 exports.memberShareActionRegistrations = memberShareActionRegistrations;
 const mama_core_1 = require("@jungjaehoon/mama-core");
 const owner_authority_js_1 = require("../runtime/owner-authority.js");
@@ -9,6 +10,36 @@ function denied(message) {
     error.name = 'denied';
     return error;
 }
+/**
+ * A member changes shared records only in a group room, where the team sees it (owner decision
+ * 2026-10-09). Until group-room turns exist (P10), a member turn replaces or retires only records
+ * bound to its own personal scope alone; sharing one stays allowed. A record with no binding is
+ * not the member's either. The owner is unchanged; a missing record is left to core.
+ */
+function guardMemberSharedRecords(registration, adapter, ownerPrincipalId) {
+    const action = registration.contract.name;
+    return {
+        ...registration,
+        exec: async (input, context) => {
+            const principalId = context.access.principalId;
+            if (principalId !== ownerPrincipalId) {
+                for (const id of (0, owner_authority_js_1.amendedRecordIds)(action, input)) {
+                    const bindings = adapter
+                        .prepare(`SELECT s.kind, s.external_id FROM decisions d
+               LEFT JOIN memory_scope_bindings b ON b.memory_id = d.id
+               LEFT JOIN memory_scopes s ON s.id = b.scope_id
+               WHERE d.id = ?`)
+                        .all(id);
+                    if (bindings.length > 0 &&
+                        !bindings.every((binding) => binding.kind === 'user' && binding.external_id === principalId))
+                        throw denied(`${id} is not only yours: shared records change in the group room, not in this ` +
+                            'chat. Save your own note instead, or raise it in the group room.');
+                }
+            }
+            return await registration.exec(input, context);
+        },
+    };
+}
 function revisionText(record) {
     return {
         id: record.id,

package/dist/api/member-share-actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"member-share-actions.js","sourceRoot":"","sources":["../../src/api/member-share-actions.ts"],"names":[],"mappings":";;AAqCA,wEAiMC;AAtOD,sDASgC;AAChC,sEAA8D;AAC9D,gEAAyD;AAQzD,SAAS,MAAM,CAAC,OAAe;IAC7B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC;IACtB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB;IACxC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;QAClF,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;KAC5F,CAAC;AACJ,CAAC;AAED,SAAgB,8BAA8B,CAAC,KAAuB;IACpE,OAAO;QACL;YACE,QAAQ,EAAE;gBACR,IAAI,EAAE,cAAc;gBACpB,eAAe,EAAE,IAAI;gBACrB,OAAO,EACL,gQAAgQ;gBAClQ,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,oBAAoB,EAAE,KAAK;oBAC3B,QAAQ,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC;oBACjD,UAAU,EAAE;wBACV,SAAS,EAAE;4BACT,IAAI,EAAE,QAAQ;4BACd,OAAO,EAAE,KAAK;4BACd,WAAW,EAAE,gDAAgD;yBAC9D;wBACD,YAAY,EAAE;4BACZ,IAAI,EAAE,QAAQ;4BACd,OAAO,EAAE,KAAK;4BACd,WAAW,EAAE,2DAA2D;yBACzE;wBACD,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,OAAO,EAAE,KAAK;4BACd,WAAW,EAAE,yDAAyD;yBACvE;qBACF;iBACF;gBACD,QAAQ,EAAE;oBACR;wBACE,KAAK,EAAE,iCAAiC;wBACxC,KAAK,EAAE;4BACL,SAAS,EAAE,gBAAgB;4BAC3B,YAAY,EAAE,mBAAmB;4BACjC,MAAM,EAAE,4CAA4C;yBACrD;qBACF;iBACF;aACF;YACD,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,EACJ,SAAS,EAAE,QAAQ,EACnB,YAAY,EAAE,WAAW,EACzB,MAAM,GACP,GAAG,KAIH,CAAC;gBACF,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE;oBAAE,MAAM,IAAA,+BAAY,EAAC,mCAAmC,CAAC,CAAC;gBAC1F,MAAM,UAAU,GAAG,IAAA,qCAAyB,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAClE,IACE,SAAS,EAAE,IAAI,KAAK,QAAQ;oBAC5B,SAAS,CAAC,MAAM,KAAK,QAAQ;oBAC7B,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,gBAAgB;oBAEhD,MAAM,MAAM,CAAC,0EAA0E,CAAC,CAAC;gBAC3F,0FAA0F;gBAC1F,IAAI,CAAC,IAAA,kCAAa,EAAC,OAAO,EAAE,SAAS,CAAC,WAAW,CAAC;oBAChD,MAAM,MAAM,CAAC,+DAA+D,CAAC,CAAC;gBAChF,IACE,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,WAAW,CAChE;oBAED,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;gBAC1D,IACE,CAAC,UAAU;qBACR,gBAAgB,CAAC,SAAS,CAAC,WAAW,CAAC;qBACvC,IAAI,CACH,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,IAAI,KAAK,QAAQ;oBACvB,KAAK,CAAC,SAAS,KAAK,SAAS;oBAC7B,KAAK,CAAC,OAAO,KAAK,WAAW,CAChC;oBAEH,MAAM,MAAM,CAAC,4DAA4D,CAAC,CAAC;gBAE7E,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClF,MAAM,MAAM,GAAG,MAAM,IAAA,gCAAoB,EAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC7E,IACE,CAAC,MAAM;oBACP,OAAO,IAAI,MAAM;oBACjB,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;oBAC1B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,MAAM;oBACjC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE,KAAK,SAAS,CAAC,WAAW;oBAE9C,MAAM,MAAM,CAAC,iEAAiE,CAAC,CAAC;gBAClF,+EAA+E;gBAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;gBACtC,4FAA4F;gBAC5F,uFAAuF;gBACvF,MAAM,QAAQ,GACZ,KAAK,CAAC,OAAO;qBACV,OAAO,CAAC,qDAAqD,CAAC;qBAC9D,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC;gBAClC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;oBACzC,MAAM,IAAA,+BAAY,EAChB,uEAAuE,CACxE,CAAC;gBACJ,sFAAsF;gBACtF,6FAA6F;gBAC7F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO;qBAC1B,OAAO,CACN;;;;;;;;;iDASqC,CACtC;qBACA,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAA0B,CAAC;gBACtD,2FAA2F;gBAC3F,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE;oBAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO;yBACvB,OAAO,CACN;;;;;;;oBAOM,CACP;yBACA,GAAG,CAAC,EAAE,EAAE,EAAE,CAAiD,CAAC;oBAC/D,oFAAoF;oBACpF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;oBAC9C,KAAK,MAAM,GAAG,IAAI,IAAI;wBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;oBACzE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACjF,CAAC,CAAC;gBACF,MAAM,SAAS,GAAG,EAAE,CAAC;gBACrB,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC;oBAC7B,MAAM,QAAQ,GAAG,MAAM,IAAA,gCAAoB,EAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;oBACzE,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,QAAQ;wBAClC,MAAM,MAAM,CACV,0EAA0E,CAC3E,CAAC;oBACJ,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACjF,CAAC;gBACD,iFAAiF;gBACjF,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,EAAE,CACtC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACxD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC5F,MAAM,MAAM,GAAqB;oBAC/B,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,WAAW,EAAE;oBAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE;iBACrC,CAAC;gBACF,4FAA4F;gBAC5F,MAAM,WAAW,GAAmB;oBAClC,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;oBAC/B,MAAM;oBACN,aAAa,EAAE,MAAM;oBACrB,OAAO,EAAE,CAAC,cAAc,CAAC;iBAC1B,CAAC;gBACF,OAAO,IAAA,8BAAkB,EACvB,KAAK,CAAC,OAAO,EACb;oBACE,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;wBACtB,QAAQ,EAAE,MAAM,CAAC,EAAE;wBACnB,WAAW;wBACX,MAAM;wBACN,OAAO,EAAE,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;wBACnE,SAAS;qBACV,CAAC;oBACF,MAAM;oBACN,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE;oBAC3D,KAAK,EAAE;wBACL;4BACE,QAAQ,EAAE,UAAU;4BACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;4BACzC,KAAK,EAAE,EAAE,MAAM,EAAE;yBAClB;qBACF;iBACF,EACD,WAAW,EACX,SAAS,EACT,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CACjD,CAAC;YACJ,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"member-share-actions.js","sourceRoot":"","sources":["../../src/api/member-share-actions.ts"],"names":[],"mappings":";;AA+BA,4DAmCC;AAcD,wEAiMC;AAjRD,sDASgC;AAChC,sEAAgF;AAChF,gEAAyD;AAQzD,SAAS,MAAM,CAAC,OAAe;IAC7B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC;IACtB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB,CACtC,YAAgC,EAChC,OAAyB,EACzB,gBAAwB;IAExB,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC1C,OAAO;QACL,GAAG,YAAY;QACf,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YAC/C,IAAI,WAAW,KAAK,gBAAgB,EAAE,CAAC;gBACrC,KAAK,MAAM,EAAE,IAAI,IAAA,qCAAgB,EAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;oBACjD,MAAM,QAAQ,GAAG,OAAO;yBACrB,OAAO,CACN;;;8BAGgB,CACjB;yBACA,GAAG,CAAC,EAAE,CAA+D,CAAC;oBACzE,IACE,QAAQ,CAAC,MAAM,GAAG,CAAC;wBACnB,CAAC,QAAQ,CAAC,KAAK,CACb,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW,CAC5E;wBAED,MAAM,MAAM,CACV,GAAG,EAAE,2EAA2E;4BAC9E,kEAAkE,CACrE,CAAC;gBACN,CAAC;YACH,CAAC;YACD,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB;IACxC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;QAClF,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;KAC5F,CAAC;AACJ,CAAC;AAED,SAAgB,8BAA8B,CAAC,KAAuB;IACpE,OAAO;QACL;YACE,QAAQ,EAAE;gBACR,IAAI,EAAE,cAAc;gBACpB,eAAe,EAAE,IAAI;gBACrB,OAAO,EACL,gQAAgQ;gBAClQ,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,oBAAoB,EAAE,KAAK;oBAC3B,QAAQ,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC;oBACjD,UAAU,EAAE;wBACV,SAAS,EAAE;4BACT,IAAI,EAAE,QAAQ;4BACd,OAAO,EAAE,KAAK;4BACd,WAAW,EAAE,gDAAgD;yBAC9D;wBACD,YAAY,EAAE;4BACZ,IAAI,EAAE,QAAQ;4BACd,OAAO,EAAE,KAAK;4BACd,WAAW,EAAE,2DAA2D;yBACzE;wBACD,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,OAAO,EAAE,KAAK;4BACd,WAAW,EAAE,yDAAyD;yBACvE;qBACF;iBACF;gBACD,QAAQ,EAAE;oBACR;wBACE,KAAK,EAAE,iCAAiC;wBACxC,KAAK,EAAE;4BACL,SAAS,EAAE,gBAAgB;4BAC3B,YAAY,EAAE,mBAAmB;4BACjC,MAAM,EAAE,4CAA4C;yBACrD;qBACF;iBACF;aACF;YACD,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,EACJ,SAAS,EAAE,QAAQ,EACnB,YAAY,EAAE,WAAW,EACzB,MAAM,GACP,GAAG,KAIH,CAAC;gBACF,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE;oBAAE,MAAM,IAAA,+BAAY,EAAC,mCAAmC,CAAC,CAAC;gBAC1F,MAAM,UAAU,GAAG,IAAA,qCAAyB,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAClE,IACE,SAAS,EAAE,IAAI,KAAK,QAAQ;oBAC5B,SAAS,CAAC,MAAM,KAAK,QAAQ;oBAC7B,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,gBAAgB;oBAEhD,MAAM,MAAM,CAAC,0EAA0E,CAAC,CAAC;gBAC3F,0FAA0F;gBAC1F,IAAI,CAAC,IAAA,kCAAa,EAAC,OAAO,EAAE,SAAS,CAAC,WAAW,CAAC;oBAChD,MAAM,MAAM,CAAC,+DAA+D,CAAC,CAAC;gBAChF,IACE,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,WAAW,CAChE;oBAED,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;gBAC1D,IACE,CAAC,UAAU;qBACR,gBAAgB,CAAC,SAAS,CAAC,WAAW,CAAC;qBACvC,IAAI,CACH,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,IAAI,KAAK,QAAQ;oBACvB,KAAK,CAAC,SAAS,KAAK,SAAS;oBAC7B,KAAK,CAAC,OAAO,KAAK,WAAW,CAChC;oBAEH,MAAM,MAAM,CAAC,4DAA4D,CAAC,CAAC;gBAE7E,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClF,MAAM,MAAM,GAAG,MAAM,IAAA,gCAAoB,EAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC7E,IACE,CAAC,MAAM;oBACP,OAAO,IAAI,MAAM;oBACjB,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;oBAC1B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,MAAM;oBACjC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE,KAAK,SAAS,CAAC,WAAW;oBAE9C,MAAM,MAAM,CAAC,iEAAiE,CAAC,CAAC;gBAClF,+EAA+E;gBAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;gBACtC,4FAA4F;gBAC5F,uFAAuF;gBACvF,MAAM,QAAQ,GACZ,KAAK,CAAC,OAAO;qBACV,OAAO,CAAC,qDAAqD,CAAC;qBAC9D,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC;gBAClC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;oBACzC,MAAM,IAAA,+BAAY,EAChB,uEAAuE,CACxE,CAAC;gBACJ,sFAAsF;gBACtF,6FAA6F;gBAC7F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO;qBAC1B,OAAO,CACN;;;;;;;;;iDASqC,CACtC;qBACA,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAA0B,CAAC;gBACtD,2FAA2F;gBAC3F,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE;oBAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO;yBACvB,OAAO,CACN;;;;;;;oBAOM,CACP;yBACA,GAAG,CAAC,EAAE,EAAE,EAAE,CAAiD,CAAC;oBAC/D,oFAAoF;oBACpF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;oBAC9C,KAAK,MAAM,GAAG,IAAI,IAAI;wBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;oBACzE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACjF,CAAC,CAAC;gBACF,MAAM,SAAS,GAAG,EAAE,CAAC;gBACrB,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC;oBAC7B,MAAM,QAAQ,GAAG,MAAM,IAAA,gCAAoB,EAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;oBACzE,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,QAAQ;wBAClC,MAAM,MAAM,CACV,0EAA0E,CAC3E,CAAC;oBACJ,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACjF,CAAC;gBACD,iFAAiF;gBACjF,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,EAAE,CACtC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACxD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC5F,MAAM,MAAM,GAAqB;oBAC/B,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,WAAW,EAAE;oBAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE;iBACrC,CAAC;gBACF,4FAA4F;gBAC5F,MAAM,WAAW,GAAmB;oBAClC,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;oBAC/B,MAAM;oBACN,aAAa,EAAE,MAAM;oBACrB,OAAO,EAAE,CAAC,cAAc,CAAC;iBAC1B,CAAC;gBACF,OAAO,IAAA,8BAAkB,EACvB,KAAK,CAAC,OAAO,EACb;oBACE,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;wBACtB,QAAQ,EAAE,MAAM,CAAC,EAAE;wBACnB,WAAW;wBACX,MAAM;wBACN,OAAO,EAAE,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;wBACnE,SAAS;qBACV,CAAC;oBACF,MAAM;oBACN,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE;oBAC3D,KAAK,EAAE;wBACL;4BACE,QAAQ,EAAE,UAAU;4BACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;4BACzC,KAAK,EAAE,EAAE,MAAM,EAAE;yBAClB;qBACF;iBACF,EACD,WAAW,EACX,SAAS,EACT,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CACjD,CAAC;YACJ,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/api/report-source-actions.d.ts

@@ -3,7 +3,6 @@ import type { DatabaseAdapter } from '@jungjaehoon/mama-core/db-manager';
 import type { TimeZoneSetting } from '../runtime/timezone.js';
 type ReportReadPorts = {
     adapter: Pick<DatabaseAdapter, 'prepare'>;
-    ownerPrincipalId: string;
     timeZone: TimeZoneSetting;
 };
 export declare function reportSourceActionRegistrations(ports: ReportReadPorts): ActionRegistration[];

package/dist/api/report-source-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report-source-actions.d.ts","sourceRoot":"","sources":["../../src/api/report-source-actions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAK9D,KAAK,eAAe,GAAG;IACrB,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAC1C,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,eAAe,CAAC;CAC3B,CAAC;AAyaF,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,EAAE,CAE5F"}
+{"version":3,"file":"report-source-actions.d.ts","sourceRoot":"","sources":["../../src/api/report-source-actions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAM9D,KAAK,eAAe,GAAG;IACrB,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAC1C,QAAQ,EAAE,eAAe,CAAC;CAC3B,CAAC;AA0YF,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,EAAE,CAE5F"}

package/dist/api/report-source-actions.js

@@ -3,46 +3,24 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.reportSourceActionRegistrations = reportSourceActionRegistrations;
 const invalid_input_js_1 = require("../utils/invalid-input.js");
 const timezone_js_1 = require("../runtime/timezone.js");
-function grantChannels(access, connector, ownerPrincipalId) {
+const stored_index_read_js_1 = require("../connectors/framework/stored-index-read.js");
+function grantChannels(access, connector, channels = access.channels) {
     if (!access.connectors?.includes(connector))
         return [];
-    if (access.principalId === ownerPrincipalId)
+    if (access.connectorWideRead?.includes(connector))
         return null;
-    return [
-        ...new Set((access.channels?.[connector] ?? []).filter((channel) => channel.trim() !== '')),
-    ];
+    return [...new Set((channels?.[connector] ?? []).filter((channel) => channel.trim() !== ''))];
 }
-function allowedRows(rows, access, ownerPrincipalId) {
+function allowedRows(rows, access) {
+    const grantedChannels = access.channels;
     return rows.filter((row) => {
         const connector = String(row.source_connector);
-        const channels = grantChannels(access, connector, ownerPrincipalId);
+        const channels = grantChannels(access, connector, grantedChannels);
         return channels !== null && channels.length === 0
             ? false
             : channels === null || channels.includes(String(row.channel ?? ''));
     });
 }
-function visibleConnectorFilter(connectors, access, ownerPrincipalId) {
-    const clauses = [];
-    const params = [];
-    for (const connector of connectors) {
-        const wide = access.principalId === ownerPrincipalId;
-        if (wide) {
-            clauses.push('source_connector = ?');
-            params.push(connector);
-            continue;
-        }
-        const granted = access.channels?.[connector] ?? [];
-        const readGranted = granted;
-        if (readGranted.length === 0)
-            continue;
-        clauses.push(`(source_connector = ? AND channel IN (${readGranted.map(() => '?').join(',')}))`);
-        params.push(connector, ...readGranted);
-    }
-    return {
-        sql: clauses.length ? clauses.map((clause) => `(${clause})`).join(' OR ') : '0',
-        params,
-    };
-}
 function sinceTime(value, now) {
     if (value === undefined)
         return now - 24 * 60 * 60 * 1_000;
@@ -128,7 +106,7 @@ function recentAction(ports) {
             const connectors = context.access.connectors ?? [];
             if (connectors.length === 0)
                 throw new Error('source.recent requires at least one granted connector');
-            const visibility = visibleConnectorFilter(connectors, context.access, ports.ownerPrincipalId);
+            const visibility = (0, stored_index_read_js_1.storedSourceAccessFilter)(context.access, connectors);
             const sourceCeiling = context.readAllowance?.maxSourceMs;
             const rows = ports.adapter
                 .prepare(`SELECT source_connector, source_id, source_entity_id, channel, author, content, source_timestamp_ms,
@@ -140,7 +118,7 @@ function recentAction(ports) {
                 .all(...visibility.params, since, ...chatChannels, ...(sourceCeiling === undefined || sourceCeiling === null ? [] : [sourceCeiling]), RECENT_SCAN_LIMIT + 1);
             if (rows.length > RECENT_SCAN_LIMIT)
                 throw (0, invalid_input_js_1.invalidInput)(`source.recent found more than ${RECENT_SCAN_LIMIT} changes; narrow since or cap`);
-            const visible = allowedRows(rows, context.access, ports.ownerPrincipalId);
+            const visible = allowedRows(rows, context.access);
             const groups = new Map();
             for (const row of visible) {
                 const metadata = decodeMetadata(row.metadata_json);
@@ -198,7 +176,7 @@ function recentAction(ports) {
                 .all(...connectors);
             const failedConnectors = failures
                 .filter((row) => {
-                const grant = grantChannels(context.access, String(row.connector_name), ports.ownerPrincipalId);
+                const grant = grantChannels(context.access, String(row.connector_name));
                 return grant === null || grant.length > 0;
             })
                 .map((row) => {
@@ -208,7 +186,7 @@ function recentAction(ports) {
                FROM connector_event_index WHERE source_connector = ? GROUP BY source_connector, channel`)
                     .all(connector);
                 const failedChannels = [
-                    ...new Map(allowedRows(knownChannels, context.access, ports.ownerPrincipalId)
+                    ...new Map(allowedRows(knownChannels, context.access)
                         .filter((event) => event.source_connector === connector)
                         .map((event) => {
                         const key = String(event.channel ?? '');
@@ -294,7 +272,7 @@ function upcomingAction(ports) {
             const connectors = ['calendar', 'ical'].filter((name) => context.access.connectors?.includes(name));
             if (!connectors.length)
                 throw new Error('schedule.upcoming requires a granted calendar or ical connector');
-            const visibility = visibleConnectorFilter(connectors, context.access, ports.ownerPrincipalId);
+            const visibility = (0, stored_index_read_js_1.storedSourceAccessFilter)(context.access, connectors);
             const raw = ports.adapter
                 .prepare(`SELECT source_connector, source_id, source_entity_id, channel, source_timestamp_ms,
                 metadata_json, current_observation_id
@@ -305,7 +283,7 @@ function upcomingAction(ports) {
          WHERE (${visibility.sql}))
          WHERE revision_order=1 ORDER BY source_timestamp_ms DESC`)
                 .all(...visibility.params);
-            const visible = allowedRows(raw, context.access, ports.ownerPrincipalId);
+            const visible = allowedRows(raw, context.access);
             const now = Date.now();
             const until = now + Number(days) * 86_400_000;
             const events = visible.flatMap((row) => {