Merge remote-tracking branch 'origin/master' into release-8.7.0

# Conflicts:
#	apps/meteor/CHANGELOG.md
#	apps/meteor/app/utils/rocketchat.info
#	apps/meteor/package.json
#	apps/meteor/server/api/v1/channels.ts
#	apps/meteor/server/api/v1/teams.ts
#	apps/meteor/server/lib/saml/lib/parsers/Response.ts
#	apps/meteor/server/models.ts
#	apps/meteor/tests/unit/server/lib/saml/server.tests.ts
#	package.json
#	packages/apps-engine/CHANGELOG.md
#	packages/apps-engine/package.json
#	packages/core-typings/CHANGELOG.md
#	packages/core-typings/package.json
#	packages/core-typings/src/index.ts
#	packages/model-typings/CHANGELOG.md
#	packages/model-typings/package.json
#	packages/model-typings/src/index.ts
#	packages/models/CHANGELOG.md
#	packages/models/package.json
#	packages/models/src/index.ts
#	packages/rest-typings/CHANGELOG.md
#	packages/rest-typings/package.json

Author: ggazzo

.serena/.gitignore

@@ -0,0 +1,2 @@
+/cache
+/project.local.yml

.serena/project.yml

@@ -0,0 +1,167 @@
+# the name by which the project can be referenced within Serena/when chatting with the LLM.
+project_name: "Rocket.Chat"
+
+# the encoding used by text files in the project
+# For a list of possible encodings, see https://docs.python.org/3.11/library/codecs.html#standard-encodings
+encoding: "utf-8"
+
+# optional shell command to run before the language backend (LSP or JetBrains) is initialised.
+# the command runs in the project root directory and is only executed if the project is trusted
+# (see trusted_project_path_patterns in the global configuration).
+# serena waits for the command to exit: a non-zero exit code is logged as an error but does not
+# abort activation. a per-project timeout (activation_command_timeout, default 180s) is the safety
+# backstop for non-terminating commands; on expiry the process is killed and activation continues.
+# example: activation_command: "npx nx run-many -t build"
+activation_command:
+
+# maximum time in seconds to wait for activation_command to complete before killing it (default 180s).
+# must be a positive number.
+activation_command_timeout: 180.0
+
+# line ending convention to use when writing source files.
+# Possible values: unset (use global setting), "lf", "crlf", or "native" (platform default)
+# This does not affect Serena's own files (e.g. memories and configuration files), which always use native line endings.
+line_ending:
+
+# The language backend to use for this project.
+# If not set, the global setting from serena_config.yml is used.
+# Valid values: LSP, JetBrains
+# Note: the backend is fixed at startup. If a project with a different backend
+# is activated post-init, an error will be returned.
+language_backend:
+
+# whether to use project's .gitignore files to ignore files
+ignore_all_files_in_gitignore: true
+
+# advanced configuration option allowing to configure language server-specific options.
+# Maps the language key to the options.
+# The settings are considered only if the project is trusted (see global configuration to define trusted projects).
+# See https://oraios.github.io/serena/02-usage/050_configuration.html#language-server-specific-settings
+ls_specific_settings: {}
+
+# list of workspace folder paths (LSP backend only).
+# These folders will be used to build up Serena's symbol index.
+# Paths must be within the project root and should thus be relative to the project root.
+# Furthermore, the paths should not be filtered by ignore settings.
+# Default setting: The entire project root folder (".") is considered.
+# In (large) monorepos, this can be used to index only subfolders of the project root, e.g.
+#   ls_workspace_folders:
+#     - "./subproject1"
+#     - "./subproject2"
+ls_workspace_folders:
+- "."
+
+# list of additional workspace folder paths for cross-package reference support.
+# Paths can be absolute or relative to the project root.
+# Each folder is registered as an LSP workspace folder, enabling language servers to discover
+# symbols and references across package boundaries, but these folders are not indexed by Serena,
+# i.e. the respective symbols will not be found using Serena's symbol search tools.
+# Example:
+#   additional_workspace_folders:
+#     - ../sibling-package
+#     - ../shared-lib
+ls_additional_workspace_folders: []
+
+# list of additional paths to ignore in this project.
+# Same syntax as gitignore, so you can use * and **.
+# Important: quote patterns that start with `*`, otherwise YAML treats them as aliases.
+# Example:
+#   ignored_paths:
+#     - "examples/**"
+#     - ".worktrees/**"
+#     - "**/bin/**"
+#     - "**/obj/**"
+# Note: global ignored_paths from serena_config.yml are also applied additively.
+ignored_paths: []
+
+# whether the project is in read-only mode
+# If set to true, all editing tools will be disabled and attempts to use them will result in an error
+# Added on 2025-04-18
+read_only: false
+
+# list of tool names to exclude.
+# This extends the existing exclusions (e.g. from the global configuration)
+# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
+excluded_tools: []
+
+# list of tools to include that would otherwise be disabled (particularly optional tools that are disabled by default).
+# This extends the existing inclusions (e.g. from the global configuration).
+# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
+included_optional_tools: []
+
+# fixed set of tools to use as the base tool set (if non-empty), replacing Serena's default set of tools.
+# This cannot be combined with non-empty excluded_tools or included_optional_tools.
+# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
+fixed_tools: []
+
+# list of mode names that are to be activated by default, overriding the setting in the global configuration.
+# The full set of modes to be activated is base_modes (from global config) + default_modes + added_modes.
+# If the setting is undefined/empty, the default_modes from the global configuration (serena_config.yml) apply.
+# Otherwise, this overrides the setting from the global configuration (serena_config.yml).
+# Therefore, you can set this to [] if you do not want the default modes defined in the global config to apply
+# for this project.
+# This setting can, in turn, be overridden by CLI parameters (--mode).
+# See https://oraios.github.io/serena/02-usage/050_configuration.html#modes
+default_modes:
+
+# list of mode names to be activated additionally for this project, e.g. ["query-projects"]
+# The full set of modes to be activated is base_modes (from global config) + default_modes + added_modes.
+# See https://oraios.github.io/serena/02-usage/050_configuration.html#modes
+added_modes:
+
+# initial prompt for the project. It will always be given to the LLM upon activating the project
+# (contrary to the memories, which are loaded on demand).
+initial_prompt: ""
+
+# time budget (seconds) per tool call for the retrieval of additional symbol information
+# such as docstrings or parameter information.
+# This overrides the corresponding setting in the global configuration; see the documentation there.
+# If null or missing, use the setting from the global configuration.
+symbol_info_budget:
+
+# list of regex patterns which, when matched, mark a memory entry as read‑only.
+# Extends the list from the global configuration, merging the two lists.
+read_only_memory_patterns: []
+
+# list of regex patterns for memories to completely ignore.
+# Matching memories will not appear in list_memories or activate_project output
+# and cannot be accessed via read_memory or write_memory.
+# To access ignored memory files, use the read_file tool on the raw file path.
+# Extends the list from the global configuration, merging the two lists.
+# Example: ["_archive/.*", "_episodes/.*"]
+ignored_memory_patterns: []
+
+# list of language servers to start when using the LSP backend; choose from:
+#   ada                 al                  angular             ansible             bash
+#   bsl                 clojure             cpp                 cpp_ccls            crystal
+#   csharp              csharp_omnisharp    cue                 dart                elixir
+#   elm                 erlang              fortran             fsharp              gdscript
+#   go                  groovy              haskell             haxe                hlsl
+#   html                java                json                julia               kotlin
+#   latex               lean4               lua                 luau                markdown
+#   matlab              msl                 nix                 ocaml               pascal
+#   perl                php                 php_phpactor        php_phpantom        powershell
+#   python              python_jedi         python_pyrefly      python_ty           r
+#   rego                ruby                ruby_solargraph     rust                scala
+#   scss                solidity            svelte              swift               systemverilog
+#   terraform           toml                typescript          typescript_vts      vue
+#   yaml                zig
+#   (This list may be outdated; generated with scripts/print_language_list.py;
+#   For the current list, see values of Language enum here:
+#   https://github.com/oraios/serena/blob/main/src/solidlsp/ls_config.py)
+# For some languages, there are several alternative language servers, e.g. csharp_omnisharp, ruby_solargraph.)
+# Note:
+#   - For C, use cpp
+#   - For JavaScript, use typescript
+#   - For Angular projects, use angular (subsumes typescript+html; requires `npm install` in the project root)
+#   - For Svelte projects, use svelte (subsumes typescript/javascript for .svelte projects; requires npm)
+#   - For SCSS / Sass / plain CSS, use scss (some-sass-language-server handles all three)
+#   - For Free Pascal/Lazarus, use pascal
+# Special requirements:
+#   Some language servers require additional setup/installations.
+#   See here for details: https://oraios.github.io/serena/01-about/020_programming-languages.html#language-servers
+# When using multiple language servers, the first language server that supports a given file will be used for that file.
+# The first language server is the default language and the respective language server will be used as a fallback.
+# Note that when using the JetBrains backend, language servers are not used and this list is correspondingly ignored.
+language_servers:
+- typescript

apps/meteor/.babel/box-atomic/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "babel-plugin-box-atomic",
+  "version": "0.0.0",
+  "main": "plugin.cjs",
+  "private": true
+}

apps/meteor/.babel/box-atomic/plugin.cjs

@@ -0,0 +1,192 @@
+/**
+ * PoC Babel plugin: build-time atomic extraction for <Box>.
+ *
+ * For every <Box> whose styling props are static literals, resolve them to
+ * atomic class names at build time, strip the props, and add a plain
+ * `className`. Non-literal props (expressions) are left untouched and handled
+ * by the runtime atomic path.
+ *
+ * The resolved CSS rules are surfaced two ways:
+ *   options.sheet  : Map<className, css>  — collected out-of-band (tests/demo)
+ *   options.inject : boolean              — when true, each file gets a top-of-
+ *                    module `attachRules("<its rules>")` call, so the CSS lands
+ *                    in the page at module load with no external asset. Sharing
+ *                    across files is deduped/ref-counted by attachRules.
+ *
+ * Resolution defaults to the bundled snapshot of Fuselage's real runtime
+ * resolver (resolver.generated.cjs) so the plugin is drop-in: a consumer adds
+ * just this plugin, no wiring. Both can be overridden via options for tests:
+ *   options.styleProps : string[]  — recognised styling prop names
+ *   options.resolve    : (props) => { className, css }[]
+ */
+// Lazily loaded so requiring the plugin never fails if the snapshot is absent
+// (e.g. before the first esbuild bundle); only needed when resolve is omitted.
+let bundled;
+const getBundled = () => {
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  if (!bundled) bundled = require('./resolver.generated.cjs');
+  return bundled;
+};
+
+// CANARY (temporary): fires when Meteor merely REQUIRES this module (before any
+// transform), proving resolution independent of the babel cache.
+try {
+  require('fs').appendFileSync(
+    '/tmp/box-atomic-canary.log',
+    `[${process.pid}] module required ${new Date().toISOString()}\n`,
+  );
+} catch (_) {}
+
+module.exports = function boxAtomicPlugin({ types: t }) {
+  // CANARY (temporary): proves Meteor loads this plugin, and counts compiled
+  // <Box> across the build. Remove after verifying.
+  if (!global.__RCX_BOX_PLUGIN) {
+    global.__RCX_BOX_PLUGIN = { loaded: true, boxes: 0 };
+    try {
+      require('fs').appendFileSync(
+        '/tmp/box-atomic-canary.log',
+        `[${process.pid}] plugin loaded ${new Date().toISOString()}\n`,
+      );
+    } catch (_) {}
+    console.error('[box-atomic] plugin loaded by babel');
+  }
+
+  const staticValue = (node) => {
+    if (node === null) return true; // boolean shorthand: <Box invisible />
+    if (t.isStringLiteral(node)) return node.value;
+    if (t.isJSXExpressionContainer(node)) {
+      const { expression: e } = node;
+      if (
+        t.isStringLiteral(e) ||
+        t.isNumericLiteral(e) ||
+        t.isBooleanLiteral(e)
+      )
+        return e.value;
+    }
+    return undefined; // dynamic — leave for runtime
+  };
+
+  return {
+    name: 'fuselage-box-atomic',
+    pre() {
+      this.rules = new Map(); // className -> css, for this file
+    },
+    visitor: {
+      JSXOpeningElement(path, state) {
+        const { sheet } = state.opts;
+        // Safe default: keep props on the element (runtime skips them via the
+        // marker, so the render-CPU win is preserved) because whether a prop is
+        // introspected elsewhere (cloneElement, child.props.x, spread) can't be
+        // proven statically. Full stripping is opt-in via keepProps:false.
+        const keepProps = state.opts.keepProps !== false;
+        const resolve = state.opts.resolve || getBundled().resolve;
+        const styleProps = state.opts.styleProps || getBundled().styleProps;
+        const propSet = new Set(styleProps);
+
+        if (!t.isJSXIdentifier(path.node.name, { name: 'Box' })) return;
+
+        const collected = {};
+        const toRemove = [];
+
+        for (const attr of path.node.attributes) {
+          if (!t.isJSXAttribute(attr) || !t.isJSXIdentifier(attr.name))
+            continue;
+          if (!propSet.has(attr.name.name)) continue;
+
+          const value = staticValue(attr.value);
+          if (value === undefined) continue; // dynamic prop stays
+
+          collected[attr.name.name] = value;
+          toRemove.push(attr);
+        }
+
+        if (toRemove.length === 0) return;
+
+        let resolved;
+        try {
+          resolved = resolve(collected);
+        } catch (_) {
+          return; // resolver failure → leave this Box to the runtime
+        }
+        if (!resolved || resolved.length === 0) return;
+
+        global.__RCX_BOX_PLUGIN.boxes++; // CANARY
+
+        const classNames = resolved.map((r) => r.className);
+        for (const { className, css } of resolved) {
+          if (sheet && !sheet.has(className)) sheet.set(className, css);
+          if (!this.rules.has(className)) this.rules.set(className, css);
+        }
+
+        if (keepProps) {
+          // Keep the props on the element so runtime introspection (e.g.
+          // `child.props.bg`, spreads) still works; mark which props are
+          // already compiled so the runtime skips restyling them.
+          path.node.attributes.push(
+            t.jsxAttribute(
+              t.jsxIdentifier('data-rcx-atomic'),
+              t.stringLiteral(Object.keys(collected).join(' ')),
+            ),
+          );
+        } else {
+          path.node.attributes = path.node.attributes.filter(
+            (a) => !toRemove.includes(a),
+          );
+        }
+
+        const classString = classNames.join(' ');
+        const existing = path.node.attributes.find(
+          (a) =>
+            t.isJSXAttribute(a) &&
+            t.isJSXIdentifier(a.name, { name: 'className' }),
+        );
+
+        if (!existing) {
+          path.node.attributes.push(
+            t.jsxAttribute(
+              t.jsxIdentifier('className'),
+              t.stringLiteral(classString),
+            ),
+          );
+          return;
+        }
+
+        if (t.isStringLiteral(existing.value)) {
+          existing.value = t.stringLiteral(
+            `${classString} ${existing.value.value}`,
+          );
+          return;
+        }
+
+        // className is an expression: prepend our static classes
+        if (t.isJSXExpressionContainer(existing.value)) {
+          existing.value = t.jsxExpressionContainer(
+            t.binaryExpression(
+              '+',
+              t.stringLiteral(`${classString} `),
+              existing.value.expression,
+            ),
+          );
+        }
+      },
+      Program: {
+        exit(path, state) {
+          if (!state.opts.inject || this.rules.size === 0) return;
+
+          const css = [...this.rules.values()].join('\n');
+          const attach = path.scope.generateUidIdentifier('rcxAttach');
+
+          path.unshiftContainer('body', [
+            t.importDeclaration(
+              [t.importSpecifier(attach, t.identifier('attachRules'))],
+              t.stringLiteral('@rocket.chat/css-in-js'),
+            ),
+            t.expressionStatement(
+              t.callExpression(attach, [t.stringLiteral(css)]),
+            ),
+          ]);
+        },
+      },
+    },
+  };
+};