resolveQueryScope (v3/queryScope.ts)

Determines allowed query scope for a token, enforcing environment limits.

// Source: https://github.com/triggerdotdev/trigger.dev | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
// Provided via justclaw.it.com; keep this notice with the code.
import type { ApiAuthenticationResultSuccess } from "~/services/apiAuth.server";
import type { QueryScope } from "~/v3/querySchemas";

/**
 * The widest scope a credential may query at.
 *
 * `executeQuery` always isolates by organization and widens or narrows from there
 * on the caller's `scope`. That makes the request body, not the credential, the
 * ceiling — which is wrong for a public access token: it is minted for one
 * environment and handed to a browser, so anyone holding it could read the whole
 * organization's analytics by changing one field.
 *
 * A secret key is d

... (truncated -- full source via MCP)