@agent-native/core 0.169.0 → 0.170.0

package/corpus/templates/analytics/server/lib/slack.ts

@@ -466,8 +466,10 @@ export async function resolveUsersWithCoverage(
   }
 
   const unresolvedUserIds = [...unresolvedUsers];
-  for (const id of unresolvedUserIds) {
-    results[id] = fallbackSlackUser(id);
+  if (!directoryError) {
+    for (const id of unresolvedUserIds) {
+      results[id] = fallbackSlackUser(id);
+    }
   }
 
   // Resolve bot users from messages that have bot_id but no user

package/corpus/templates/analytics/server/plugins/agent-chat.ts

@@ -31,6 +31,7 @@ import {
   needsCorpusWorkflowForCoverageSensitiveRequest,
   needsSourceRecordBodyWorkflowForCoverageSensitiveRequest,
   registerGroundingActions,
+  stripInjectedAnalyticsGuardContext,
 } from "../lib/real-data-actions";
 
 // Which actions return real data-source evidence is a fact each action states
@@ -107,7 +108,10 @@ function hasPartialDashboardBuild(
 }
 
 export const BOUNDED_STRUCTURED_LOOKUP_GUIDANCE =
-  "BOUNDED STRUCTURED LOOKUP FAST PATH — Treat existing analytics work like an engineer treats existing code: grep before writing. For an ordinary count, aggregate, grouped metric, trend, or record lookup, first call `search-analytics-query-catalog` once with focused metric/entity terms. It searches accessible dashboard names, chart titles/descriptions/saved queries, shipped dashboard patterns, and data-dictionary definitions together. Prefer the strongest approved dictionary or saved-chart match, preserve its source and business logic, adapt only the requested filters and explicit time window, then run one bounded query against that source. A user-named source wins, but still use a matching saved definition when it supplies the source's proven query shape. If there is no useful match, inspect only the most likely source schema or ask one clarification; do not fan out across providers. Do not separately list every dashboard, call data-source status, browse the whole dictionary, load provider catalogs/corpus tools, or query a second source after a strong match. Once the query succeeds, answer immediately with its source, time window, filters, row count, and only necessary caveats. Do not enrich, cross-check, retry, or add breakdowns unless the user requested them, the first query failed, or its result conflicts with the known definition. The words `all`, `total`, or `exact` in a structured aggregate do not by themselves make it a corpus investigation. Never repeat an identical invalid or failed tool call; correct its arguments once or surface the error. This does not waive the real-data requirement: never answer from a guess, stale value, or unverified result. ";
+  "BOUNDED STRUCTURED LOOKUP FAST PATH — Treat existing analytics work like an engineer treats existing code: grep before writing. For an ordinary count, aggregate, grouped metric, trend, or record lookup, first call `search-analytics-query-catalog` once with focused metric/entity terms. It searches accessible dashboard names, chart titles/descriptions/saved queries, shipped dashboard patterns, and data-dictionary definitions together. Prefer the strongest approved dictionary or saved-chart match, preserve its source and business logic, adapt only the requested filters and explicit time window, then run one bounded query against that source. A user-named source wins, but still use a matching saved definition when it supplies the source's proven query shape. If there is no useful match, inspect the most likely source schema before asking a clarification about business meaning; do not ask the user to provide internal dataset, table, column, or SQL identifiers. Do not fan out across providers. Do not separately list every dashboard, call data-source status, browse the whole dictionary, load provider catalogs/corpus tools, or query a second source after a strong match. Once the query succeeds, answer immediately with its source, time window, filters, row count, and only necessary caveats. Do not enrich, cross-check, retry, or add breakdowns unless the user requested them, the first query failed, or its result conflicts with the known definition. The words `all`, `total`, or `exact` in a structured aggregate do not by themselves make it a corpus investigation. Never repeat an identical invalid or failed tool call; correct its arguments once or surface the error. This does not waive the real-data requirement: never answer from a guess, stale value, or unverified result. ";
+
+export const INTERNAL_PRODUCT_USAGE_GUIDANCE =
+  "INTERNAL PRODUCT USAGE / CROSS-SOURCE ROUTING — Requests for product usage, AI credits, credit consumption, allowances, quotas, branch creation, branch creators, or user-level adoption by month are live data requests even when they say pull, export, or prepare a report. For workspace-wide internal Builder.io usage, route to Dispatch with `call-agent` and `list-dispatch-usage-metrics`; use its `monthlyByUser` and `workspaceAppCreationsByUserMonth` result. Do not ask for a user export or BigQuery schema on that path. For a named customer or account such as OCBC, preserve the customer scope and do not substitute workspace metrics. Start with `search-analytics-query-catalog`; if it has no usable definition, call `list-data-dictionary` with focused metric terms and `search-bigquery-schema` with the same terms. `search-bigquery-schema` can search the configured project without a dataset, so do not ask the user to name the dataset, table, columns, or SQL. Use the exact discovered schema in one bounded `bigquery` query, and resolve the named account identity before attributing rows to it. A table that contains limits, plans, or changelog metadata is not proof of actual consumption or creator identity. If the configured actions prove that the source or metric is unavailable, report that exact gap and the inspected coverage instead of asking the user to identify internal tables. ";
 
 export const ANALYTICS_ACCOUNT_HEALTH_GUIDANCE =
   "ACCOUNT HEALTH / CUSTOMER SCOPE GUARD — Use this for a named customer, organization ID, account-health, QBR, renewal, contract-usage, risk, or adoption request. Treat a prompt-supplied org ID as a lookup key, not proof of row ownership: resolve it against canonical account data first, carry the resolved customer name plus organization/root-organization identifiers through every usage query, and stop if results contain a different customer, mixed IDs, or an unresolved identity. Use the account-health skill. Account health is incomplete until verified usage queries cover each requested product or feature dimension separately. Before warehouse SQL, use the catalog/dictionary and schema metadata. Do not run definitions marked deprecated or retired, or use a source whose freshness cannot be verified; use the current approved definition instead. Do not call a current partial-period snapshot a completed period without proving the period/as-of row and freshness. Distinguish contract metrics from similarly named platform metrics, total distinct contracted users from DAU/WAU, and actual usage from contracted capacity. Always surface utilization at or above 100%, report adoption window and coverage, and state gaps instead of inferring them. ";
@@ -123,6 +127,7 @@ export const ANALYTICS_OBSERVABILITY_INCIDENT_GUIDANCE =
 
 export const ANALYTICS_CROSS_APP_ROUTING_GUIDANCE =
   "WORKSPACE APP ROUTING — Analytics is the sibling app for first-party product usage, app/template events, agent-native signups, conversions, and other curated product metrics. When another app delegates one of these questions with `call-agent`, answer it here using the built-in first-party source and query catalog; do not send the user back to another app or ask the caller to invent SQL. " +
+  'INTERNAL USAGE EXCEPTION — Builder.io or AI credit spend, LLM usage by workspace member or month, and workspace app or Builder branch creation history are Dispatch-owned internal metrics. For workspace-wide internal requests, call `call-agent` with agent `dispatch`, action `list-dispatch-usage-metrics`, and the exact read-only input `{ sinceDays, scope: "workspace" }` (add `userEmail` only when the user explicitly narrows the request). The result includes `monthlyByUser` and `workspaceAppCreationsByUserMonth` from the shared `token_usage` and Dispatch audit tables. Do not ask for a user export or BigQuery schema. A request scoped to a named customer or account, such as OCBC, is different: keep that customer scope and use the catalog, dictionary, configured warehouse schema, and one bounded query; do not substitute the current workspace metrics. ' +
   "WORKSPACE APP ROUTING — Brain is the sibling app that owns company knowledge and indexed Slack context. Brain is not an Analytics extension and will not appear in `list-extensions`. When the user asks about company knowledge, decisions, meeting context, or Slack messages/context such as a named channel or thread, use `call-agent` with agent `brain` and a narrow natural-language question. Use `describe-workspace-apps` only when you need to confirm the sibling capability. Do not use `list-extensions` to find Brain, and do not use `provider-api-request` to call Brain. If Brain reports an access or source error, preserve that exact error; do not infer that the Slack bot is absent from a channel or tell the user to re-invite it. Stay in Analytics for metrics and aggregates over a named provider. ";
 
 export const NON_ANALYTICS_REQUEST_GUIDANCE =
@@ -156,6 +161,7 @@ export function analyticsSourceGuidanceOpening(): string {
     // Measured in production: this ran in under 1% of data threads while the
     // equivalent instruction sat ~7000 words deep. Threads that did call it used
     // roughly a third the tool calls. Keep it first and keep it imperative.
+    "INTERNAL USAGE OVERRIDE — For workspace-wide Builder.io or AI credit spend, LLM usage by workspace member or month, or workspace app/Builder branch creation history, your FIRST tool call is `call-agent` for Dispatch with action `list-dispatch-usage-metrics`, scope `workspace`, and the requested `sinceDays`. Do not start with a user list, `search-bigquery-schema`, or a request for dataset/table/column names. If the request names a customer or account such as OCBC, preserve that customer scope and use the Analytics catalog/warehouse path instead of substituting workspace metrics. " +
     "START HERE — For an ordinary metric, cohort, list, count, or trend question, your FIRST tool call is `search-analytics-query-catalog`. For a request to replicate, clone, or adapt an existing dashboard, your FIRST tool call is `search-dashboard-references` instead; inspect the returned dashboard before choosing a source or writing anything. The catalog path is the analytics equivalent of grepping a codebase before writing new code: someone has very likely already built and saved the query you need, and its saved SQL tells you the exact source, table, and column names so you do not have to discover them. Adapt the closest saved query to the requested filters and time window, run it once, and stop. Only fall back to schema discovery or provider catalogs when the catalog search returns nothing usable — and never run more than one schema-discovery pass before querying. " +
     ANALYTICS_CROSS_APP_ROUTING_GUIDANCE +
     'ONE BOUNDED CALL — List, filter, count, and cohort questions ("which X, excluding Y") are a single query, not a loop. Express the include filter, the exclude filter, and the aggregation in one SQL statement or one `run-code` script that filters server-side. Never page through a cohort across separate tool calls and never fan out per item to apply a filter; that is what turns a ten-second answer into a twenty-minute one. ' +
@@ -163,6 +169,7 @@ export function analyticsSourceGuidanceOpening(): string {
     NON_ANALYTICS_REQUEST_GUIDANCE +
     DASHBOARD_REFERENCE_GUIDANCE +
     BOUNDED_STRUCTURED_LOOKUP_GUIDANCE +
+    INTERNAL_PRODUCT_USAGE_GUIDANCE +
     ANALYTICS_ACCOUNT_HEALTH_GUIDANCE +
     BUILT_IN_FIRST_PARTY_SOURCE_GUIDANCE +
     ANALYTICS_OBSERVABILITY_INCIDENT_GUIDANCE +
@@ -171,9 +178,18 @@ export function analyticsSourceGuidanceOpening(): string {
   );
 }
 
+const SCHEMA_DETAILS_REQUEST_PATTERN =
+  /\b(?:could you|can you|would you|please\s+(?:provide|share|send|tell)|provide|share|send(?: me)?|tell me|i need(?: you to)?|what (?:is|are)|which)\b[\s\S]{0,260}\b(?:bigquery\s+)?(?:dataset(?: name)?s?|table(?: name)?s?|column(?: name)?s?|field(?: name)?s?|schema|sql query)\b/i;
+
+function looksLikeSchemaDetailsRequest(text: string): boolean {
+  return SCHEMA_DETAILS_REQUEST_PATTERN.test(
+    stripInjectedAnalyticsGuardContext(String(text ?? "")),
+  );
+}
+
 export function analyticsDataDictionaryRoutingContext(): string {
   return `<data-dictionary-routing>
-Data-dictionary definitions are available through \`search-analytics-query-catalog\`, which combines focused dictionary lookup with a search over existing dashboard/chart SQL. Use that combined catalog search as the normal preflight for a bounded metric lookup. Call \`list-data-dictionary\` separately only when the user asks to browse definitions or filter them by department. Treat approved entries as canonical, verify unreviewed human entries when stakes are high, and treat AI-generated unapproved entries as suggestions only. After the catalog identifies one source and query shape, query that source once and stop on success. If no matching definition or chart exists, inspect only the most likely source schema or ask the user instead of fanning out across providers.
+Data-dictionary definitions are available through \`search-analytics-query-catalog\`, which combines focused dictionary lookup with a search over existing dashboard/chart SQL. Use that combined catalog search as the normal preflight for a bounded metric lookup. Call \`list-data-dictionary\` separately when the catalog has no usable match or when the user asks to browse definitions or filter them by department. Treat approved entries as canonical, verify unreviewed human entries when stakes are high, and treat AI-generated unapproved entries as suggestions only. After the catalog identifies one source and query shape, query that source once and stop on success. If no matching definition or chart exists, inspect the most likely source schema before asking a clarification about business meaning. Never ask the user to supply internal dataset, table, column, or SQL identifiers that the configured Analytics actions can discover.
 </data-dictionary-routing>`;
 }
 
@@ -782,8 +798,22 @@ export function realDataFinalGuard(
     };
   }
 
-  if (dataQueryAttempted) return null;
   const failedQueryMessage = failedDataQueryAttemptMessage(context.toolResults);
+  if (looksLikeSchemaDetailsRequest(context.text)) {
+    const failedQueryRecovery = failedQueryMessage
+      ? ` ${failedQueryMessage}`
+      : "";
+    return {
+      retryMessage:
+        "The draft asks the user to supply internal dataset, table, column, or SQL details. Do not ask the user for warehouse schema identifiers. Use the configured Analytics tools now: call `search-analytics-query-catalog`, then `list-data-dictionary` and `search-bigquery-schema` with focused metric terms when the catalog has no usable definition, and run one authoritative `bigquery` query using the exact discovered references. `search-bigquery-schema` searches the configured project without a dataset. For a named customer, verify identity and distinguish actual consumption from limits or changelog metadata. If the tools prove the source or metric is unavailable, state that exact evidence gap instead of asking the user to name internal tables." +
+        failedQueryRecovery,
+      fallbackMessage:
+        "I couldn't complete that lookup from the configured Analytics sources yet. Please retry and I'll inspect the catalog and warehouse schema directly rather than asking you to provide internal table names.",
+      maxRetries: 2,
+      expandToolSurface: true,
+    };
+  }
+  if (dataQueryAttempted) return null;
   // Whether the built-in source is worth trying is decided by tool evidence,
   // not by how the draft is worded, so it is asked once for every draft shape.
   // A source that already failed this turn is not an untried source: steering

package/corpus/templates/analytics/vitest.config.ts

@@ -14,7 +14,12 @@ export default mergeConfig(
     },
     test: {
       include: ["**/*.{test,spec}.?(c|m)[jt]s?(x)"],
-      exclude: ["**/node_modules/**", "**/.git/**", "**/dist/**"],
+      exclude: [
+        "**/node_modules/**",
+        "**/.git/**",
+        "**/dist/**",
+        "**/.react-router/**",
+      ],
     },
   }),
 );

package/corpus/templates/assets/.agents/skills/secrets/SKILL.md

@@ -19,10 +19,17 @@ data, and generated extension/app content may mention credential **names** such
 as `OPENAI_API_KEY`, but must not contain real API keys, tokens, webhook URLs,
 signing secrets, OAuth refresh tokens, or private Builder/customer data.
 
-Secret values are supplied at runtime through deployment configuration, the
-encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
-`${keys.NAME}` substitution. Examples must use obvious placeholders such as
-`<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
+Provider secret values are supplied at runtime through the encrypted
+`app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
+`${keys.NAME}` substitution. Deployment configuration is reserved for
+deploy-level secrets and non-provider configuration. Examples must use obvious
+placeholders such as `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not
+real-looking copied values.
+
+Provider credentials and provider account identifiers are workspace data. Use
+standard workspace connections and org/workspace vault scopes; never put them
+in `.env` or deployment environment variables, and never add a provider-specific
+action or startup bootstrap just to write a credential for one organization.
 
 ## Credential Modeling Preflight
 

package/corpus/templates/assets/app/routes/library.tsx

@@ -20,11 +20,13 @@ import {
 } from "@agent-native/core/client/host";
 import { useT } from "@agent-native/core/client/i18n";
 import {
-  AGENT_NATIVE_EMBED_MESSAGE_TYPES,
-  createAgentNativeEmbedEnvelope,
   createEmbeddedAppBridge,
   type EmbeddedAppBridge,
-} from "@agent-native/core/embedding";
+} from "@agent-native/core/embedding/bridge";
+import {
+  AGENT_NATIVE_EMBED_MESSAGE_TYPES,
+  createAgentNativeEmbedEnvelope,
+} from "@agent-native/core/embedding/protocol";
 import {
   EMBED_MODE_QUERY_PARAM,
   EMBED_TOKEN_QUERY_PARAM,

package/corpus/templates/assets/app/routes.ts

@@ -1,4 +1,6 @@
 import { type RouteConfig } from "@react-router/dev/routes";
 import { flatRoutes } from "@react-router/fs-routes";
 
-export default flatRoutes() satisfies RouteConfig;
+export default flatRoutes({
+  ignoredRouteFiles: ["**/*.test.{ts,tsx}", "**/*.spec.{ts,tsx}"],
+}) satisfies RouteConfig;

package/corpus/templates/assets/changelog/2026-08-22-library-page-loads-again-instead-of-crashing-on-open.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-22
+---
+
+Fixed the Library page (and the /brand-kits, /libraries, and /picker links that redirect to it) getting stuck on a loading spinner instead of showing your folders and assets.

package/corpus/templates/assets/vitest.config.ts

@@ -14,7 +14,12 @@ export default mergeConfig(
     },
     test: {
       include: ["**/*.{test,spec}.?(c|m)[jt]s?(x)"],
-      exclude: ["**/node_modules/**", "**/.git/**", "**/dist/**"],
+      exclude: [
+        "**/node_modules/**",
+        "**/.git/**",
+        "**/dist/**",
+        "**/.react-router/**",
+      ],
     },
   }),
 );

package/corpus/templates/brain/.agents/skills/secrets/SKILL.md

@@ -19,10 +19,17 @@ data, and generated extension/app content may mention credential **names** such
 as `OPENAI_API_KEY`, but must not contain real API keys, tokens, webhook URLs,
 signing secrets, OAuth refresh tokens, or private Builder/customer data.
 
-Secret values are supplied at runtime through deployment configuration, the
-encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
-`${keys.NAME}` substitution. Examples must use obvious placeholders such as
-`<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
+Provider secret values are supplied at runtime through the encrypted
+`app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
+`${keys.NAME}` substitution. Deployment configuration is reserved for
+deploy-level secrets and non-provider configuration. Examples must use obvious
+placeholders such as `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not
+real-looking copied values.
+
+Provider credentials and provider account identifiers are workspace data. Use
+standard workspace connections and org/workspace vault scopes; never put them
+in `.env` or deployment environment variables, and never add a provider-specific
+action or startup bootstrap just to write a credential for one organization.
 
 ## Credential Modeling Preflight
 

package/corpus/templates/brain/app/components/ui/pointer-lock.ts

@@ -0,0 +1 @@
+export * from "@agent-native/toolkit/ui/pointer-lock";

package/corpus/templates/brain/app/routes/sources.tsx

@@ -67,6 +67,7 @@ import {
 } from "@/components/ui/dropdown-menu";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
+import { afterBodyPointerUnlock } from "@/components/ui/pointer-lock";
 import { Progress } from "@/components/ui/progress";
 import {
   Select,
@@ -2253,7 +2254,11 @@ export default function SourcesRoute() {
         result,
         sourceKey: form.sourceKey,
       });
-      if (handoff) setIngestHandoff(handoff);
+      setSetupOpen(false);
+      if (handoff) {
+        afterBodyPointerUnlock(() => setIngestHandoff(handoff));
+      }
+      return;
     }
     setSetupOpen(false);
   }
@@ -2360,7 +2365,7 @@ export default function SourcesRoute() {
                     : undefined
                 }
                 onSync={() => syncSource.mutate({ sourceId: source.id })}
-                onTune={() => openEdit(source)}
+                onTune={() => afterBodyPointerUnlock(() => openEdit(source))}
                 onImportMarkdown={() => setMarkdownImportSource(source)}
                 onArchive={() => setArchiveSource(source)}
               />
@@ -2451,7 +2456,7 @@ export default function SourcesRoute() {
               }
               onAddSource={(provider) => {
                 setAdvancedOpen(false);
-                openCreate(provider);
+                afterBodyPointerUnlock(() => openCreate(provider));
               }}
             />
           </div>

package/corpus/templates/brain/changelog/2026-08-22-tuning-or-adding-a-source-no-longer-leaves-the-sources-page.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-22
+---
+
+Tuning or adding a source no longer leaves the Sources page unresponsive.

package/corpus/templates/brain/server/lib/brain.ts

@@ -643,8 +643,33 @@ export async function ensureManualSource(title = "Manual imports") {
 }
 
 function isUniqueConflict(error: unknown): boolean {
-  const message = error instanceof Error ? error.message : String(error);
-  return /unique constraint|duplicate key|unique/i.test(message);
+  if (!error || typeof error !== "object") {
+    return /unique constraint|duplicate key|duplicate entry|unique/i.test(
+      String(error),
+    );
+  }
+
+  const candidate = error as {
+    code?: unknown;
+    message?: unknown;
+    cause?: unknown;
+  };
+  if (
+    candidate.code === "23505" ||
+    candidate.code === "SQLITE_CONSTRAINT_UNIQUE"
+  ) {
+    return true;
+  }
+  if (typeof candidate.message === "string") {
+    if (
+      /unique constraint|duplicate key|duplicate entry|unique violation|unique/i.test(
+        candidate.message,
+      )
+    ) {
+      return true;
+    }
+  }
+  return candidate.cause !== error && isUniqueConflict(candidate.cause);
 }
 
 const UPSTREAM_DELETED_POLICY_VERSION = "upstream-deleted-v1";

package/corpus/templates/brain/vitest.config.ts

@@ -11,6 +11,7 @@ export default mergeConfig(
         "**/dist/**",
         "**/.output/**",
         "**/.{idea,git,cache,output,temp}/**",
+        "**/.react-router/**",
       ],
     },
   }),

package/corpus/templates/calendar/.agents/skills/secrets/SKILL.md

@@ -19,10 +19,17 @@ data, and generated extension/app content may mention credential **names** such
 as `OPENAI_API_KEY`, but must not contain real API keys, tokens, webhook URLs,
 signing secrets, OAuth refresh tokens, or private Builder/customer data.
 
-Secret values are supplied at runtime through deployment configuration, the
-encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
-`${keys.NAME}` substitution. Examples must use obvious placeholders such as
-`<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
+Provider secret values are supplied at runtime through the encrypted
+`app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
+`${keys.NAME}` substitution. Deployment configuration is reserved for
+deploy-level secrets and non-provider configuration. Examples must use obvious
+placeholders such as `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not
+real-looking copied values.
+
+Provider credentials and provider account identifiers are workspace data. Use
+standard workspace connections and org/workspace vault scopes; never put them
+in `.env` or deployment environment variables, and never add a provider-specific
+action or startup bootstrap just to write a credential for one organization.
 
 ## Credential Modeling Preflight
 

package/corpus/templates/calendar/actions/list-booking-links.ts

@@ -1,21 +1,100 @@
 import { defineAction } from "@agent-native/core";
-import { accessFilter } from "@agent-native/core/sharing";
-import { desc } from "drizzle-orm";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server/request-context";
+import {
+  accessFilter,
+  ROLE_RANK,
+  type ShareRole,
+} from "@agent-native/core/sharing";
+import { and, desc, eq, inArray, or, sql } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
 import { rowToBookingLink } from "../server/lib/booking-link-utils.js";
 
+type EffectiveRole = "owner" | ShareRole;
+
+function normalizeEmail(email: string | undefined): string | null {
+  const normalized = email?.trim().toLowerCase();
+  return normalized || null;
+}
+
+function strongerRole(current: ShareRole | null, next: ShareRole): ShareRole {
+  if (!current || ROLE_RANK[next] > ROLE_RANK[current]) return next;
+  return current;
+}
+
 export default defineAction({
   description: "List all booking links",
   schema: z.object({}),
   http: { method: "GET" },
   run: async () => {
-    const rows = await getDb()
+    const db = getDb();
+    const userEmail = normalizeEmail(getRequestUserEmail());
+    const orgId = getRequestOrgId();
+    const rows = await db
       .select()
       .from(schema.bookingLinks)
       .where(accessFilter(schema.bookingLinks, schema.bookingLinkShares))
       .orderBy(desc(schema.bookingLinks.updatedAt));
-    return rows.map(rowToBookingLink);
+
+    if (rows.length === 0) return [];
+
+    const principalClauses: NonNullable<ReturnType<typeof and>>[] = [];
+    if (userEmail) {
+      principalClauses.push(
+        and(
+          eq(schema.bookingLinkShares.principalType, "user"),
+          sql`lower(${schema.bookingLinkShares.principalId}) = ${userEmail}`,
+        )!,
+      );
+    }
+    if (orgId) {
+      principalClauses.push(
+        and(
+          eq(schema.bookingLinkShares.principalType, "org"),
+          eq(schema.bookingLinkShares.principalId, orgId),
+        )!,
+      );
+    }
+
+    const shareRoleById = new Map<string, ShareRole>();
+    if (principalClauses.length > 0) {
+      const shareRows = await db
+        .select({
+          resourceId: schema.bookingLinkShares.resourceId,
+          role: schema.bookingLinkShares.role,
+        })
+        .from(schema.bookingLinkShares)
+        .where(
+          and(
+            inArray(
+              schema.bookingLinkShares.resourceId,
+              rows.map((row) => row.id),
+            ),
+            or(...principalClauses),
+          ),
+        );
+      for (const share of shareRows) {
+        shareRoleById.set(
+          share.resourceId,
+          strongerRole(shareRoleById.get(share.resourceId) ?? null, share.role),
+        );
+      }
+    }
+
+    return rows.map((row) => {
+      let role: EffectiveRole = shareRoleById.get(row.id) ?? "viewer";
+      if (
+        userEmail &&
+        normalizeEmail(row.ownerEmail) === userEmail &&
+        (!row.orgId || row.orgId === orgId)
+      ) {
+        role = "owner";
+      }
+      return { ...rowToBookingLink(row), accessRole: role };
+    });
   },
 });

package/corpus/templates/calendar/actions/update-booking-link.ts

@@ -57,7 +57,7 @@ export default defineAction({
     isActive: z.boolean().optional().describe("Whether the link is active"),
   }),
   run: async (args) => {
-    await assertAccess("booking-link", args.id, "editor");
+    const access = await assertAccess("booking-link", args.id, "editor");
 
     const durationInput = normalizeBookingDurationInput({
       duration: args.duration,
@@ -90,6 +90,7 @@ export default defineAction({
       .select({
         slug: schema.bookingLinks.slug,
         ownerEmail: schema.bookingLinks.ownerEmail,
+        isActive: schema.bookingLinks.isActive,
       })
       .from(schema.bookingLinks)
       .where(eq(schema.bookingLinks.id, args.id));
@@ -116,7 +117,7 @@ export default defineAction({
           ? JSON.stringify(args.conferencing)
           : null,
         color: args.color ? args.color.trim() : null,
-        isActive: args.isActive ?? true,
+        isActive: args.isActive ?? current.isActive,
         updatedAt: new Date().toISOString(),
       })
       .where(eq(schema.bookingLinks.id, args.id));
@@ -140,6 +141,6 @@ export default defineAction({
       .where(eq(schema.bookingLinks.id, args.id));
 
     if (!updated) throw new Error("Booking link not found");
-    return rowToBookingLink(updated);
+    return { ...rowToBookingLink(updated), accessRole: access.role };
   },
 });

package/corpus/templates/calendar/app/components/calendar/EventDetailPanel.tsx

@@ -74,6 +74,7 @@ interface EventDetailPanelProps {
   onClose: () => void;
   onDelete: (eventId: string) => void;
   onTitleSave?: (eventId: string, title: string, accountEmail?: string) => void;
+  timezone?: string;
 }
 
 function formatDuration(start: string, end: string): string {
@@ -121,6 +122,7 @@ export function EventDetailPanel({
   onClose,
   onDelete,
   onTitleSave,
+  timezone,
 }: EventDetailPanelProps) {
   const t = useT();
   const workingLocationLabels = createWorkingLocationDisplayLabels(t);
@@ -451,7 +453,9 @@ export function EventDetailPanel({
                           {format(
                             getDisplayDateInTimezone(
                               event.start,
-                              event.startTimeZone ?? event.endTimeZone,
+                              timezone ??
+                                event.startTimeZone ??
+                                event.endTimeZone,
                             ),
                             "h:mm a",
                           )}
@@ -459,7 +463,9 @@ export function EventDetailPanel({
                           {format(
                             getDisplayDateInTimezone(
                               event.end,
-                              event.endTimeZone ?? event.startTimeZone,
+                              timezone ??
+                                event.endTimeZone ??
+                                event.startTimeZone,
                             ),
                             "h:mm a",
                           )}
@@ -471,7 +477,9 @@ export function EventDetailPanel({
                           {format(
                             getDisplayDateInTimezone(
                               event.start,
-                              event.startTimeZone ?? event.endTimeZone,
+                              timezone ??
+                                event.startTimeZone ??
+                                event.endTimeZone,
                             ),
                             "EEE MMM d",
                           )}

package/corpus/templates/calendar/app/components/calendar/EventDetailPopover.tsx

@@ -489,7 +489,7 @@ export function EventDetailPopover({
   const t = useT();
   const workingLocationLabels = createWorkingLocationDisplayLabels(t);
   const isMobile = useIsMobile();
-  const eventTimezone = event.startTimeZone || timezone || getLocalTimezone();
+  const eventTimezone = timezone || event.startTimeZone || getLocalTimezone();
   const [open, setOpen] = useState(defaultOpen);
   const [editingTitle, setEditingTitle] = useState(
     defaultOpen ? getEditableEventTitle(event) : "",