@agent-native/dispatch 0.0.0-beta-20260819155526

package/src/server/lib/workspace-resources-store.spec.ts

@@ -0,0 +1,1108 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  getDb: vi.fn(),
+  getDbExec: vi.fn(),
+  isPostgres: vi.fn(() => false),
+  currentOwnerEmail: vi.fn(() => "owner@example.test"),
+  currentOrgId: vi.fn(() => "org_123"),
+  getApprovalPolicy: vi.fn(async () => ({
+    enabled: false,
+    approverEmails: [],
+  })),
+  createApprovalRequest: vi.fn(async (input: any) => ({
+    id: "approval_1",
+    status: "pending",
+    ...input,
+  })),
+  recordAudit: vi.fn(async () => undefined),
+  resourcePut: vi.fn(async () => undefined),
+  resourceGetByPath: vi.fn(async () => null),
+  resourceListAllOwners: vi.fn(async () => []),
+  resourceEffectiveContext: vi.fn(async (_userEmail: string, path: string) => ({
+    path,
+    effectiveScope: "workspace",
+    effectiveResource: {
+      id: "resource_meta_1",
+      path,
+      owner: "__workspace__",
+      mimeType: "text/markdown",
+      size: 10,
+      createdAt: 1,
+      updatedAt: 2,
+      createdBy: "system",
+      visibility: "workspace",
+      threadId: null,
+      runId: null,
+      expiresAt: null,
+      metadata: null,
+    },
+    layers: [
+      {
+        scope: "workspace",
+        label: "Workspace default",
+        owner: "__workspace__",
+        resource: {
+          id: "resource_meta_1",
+          path,
+          owner: "__workspace__",
+          mimeType: "text/markdown",
+          size: 10,
+          createdAt: 1,
+          updatedAt: 2,
+          createdBy: "system",
+          visibility: "workspace",
+          threadId: null,
+          runId: null,
+          expiresAt: null,
+          metadata: null,
+        },
+        exists: true,
+        effective: true,
+        overridden: false,
+        canWrite: false,
+      },
+      {
+        scope: "shared",
+        label: "Organization/app override",
+        owner: "__shared__",
+        resource: null,
+        exists: false,
+        effective: false,
+        overridden: false,
+        canWrite: true,
+      },
+      {
+        scope: "personal",
+        label: "Personal override",
+        owner: "owner@example.test",
+        resource: null,
+        exists: false,
+        effective: false,
+        overridden: false,
+        canWrite: true,
+      },
+    ],
+  })),
+  resourceDeleteByPath: vi.fn(async () => undefined),
+  getOrgSetting: vi.fn(async () => null),
+  getUserSetting: vi.fn(async () => null),
+  putOrgSetting: vi.fn(async () => undefined),
+  putUserSetting: vi.fn(async () => undefined),
+}));
+
+vi.mock("@agent-native/core/db", () => ({
+  getDbExec: () => mocks.getDbExec(),
+  isPostgres: () => mocks.isPostgres(),
+}));
+
+vi.mock("../../db/index.js", async () => {
+  const schema = await import("../../db/schema.js");
+  return {
+    ...schema,
+    schema,
+    getDb: () => mocks.getDb(),
+  };
+});
+
+vi.mock("./dispatch-store.js", () => ({
+  createApprovalRequest: (...args: any[]) =>
+    mocks.createApprovalRequest(...args),
+  currentOwnerEmail: () => mocks.currentOwnerEmail(),
+  currentOrgId: () => mocks.currentOrgId(),
+  getApprovalPolicy: () => mocks.getApprovalPolicy(),
+  recordAudit: (...args: any[]) => mocks.recordAudit(...args),
+}));
+
+vi.mock("@agent-native/core/resources/store", () => ({
+  SHARED_OWNER: "__shared__",
+  WORKSPACE_OWNER: "__workspace__",
+  resourcePut: (...args: any[]) => mocks.resourcePut(...args),
+  resourceGetByPath: (...args: any[]) => mocks.resourceGetByPath(...args),
+  resourceListAllOwners: (...args: any[]) =>
+    mocks.resourceListAllOwners(...args),
+  resourceEffectiveContext: (...args: any[]) =>
+    mocks.resourceEffectiveContext(...args),
+  resourceDeleteByPath: (...args: any[]) => mocks.resourceDeleteByPath(...args),
+}));
+
+vi.mock("@agent-native/core/settings", () => ({
+  getOrgSetting: (...args: any[]) => mocks.getOrgSetting(...args),
+  getUserSetting: (...args: any[]) => mocks.getUserSetting(...args),
+  putOrgSetting: (...args: any[]) => mocks.putOrgSetting(...args),
+  putUserSetting: (...args: any[]) => mocks.putUserSetting(...args),
+}));
+
+vi.mock("@agent-native/core/server/agent-discovery", () => ({
+  discoverAgents: vi.fn(async () => []),
+}));
+
+import {
+  ensureStarterWorkspaceResources,
+  createWorkspaceResource,
+  deleteWorkspaceResource,
+  getWorkspaceResourceEffectiveContext,
+  listWorkspaceResourcesForApp,
+  previewWorkspaceResourceChange,
+  restoreStarterWorkspaceResources,
+  STARTER_GLOBAL_WORKSPACE_RESOURCES,
+  updateWorkspaceResource,
+} from "./workspace-resources-store.js";
+
+interface ResourceRow {
+  id: string;
+  ownerEmail: string;
+  orgId: string | null;
+  kind: string;
+  name: string;
+  description: string | null;
+  path: string;
+  content: string;
+  scope: string;
+  createdBy: string;
+  createdAt: number;
+  updatedAt: number;
+}
+
+interface GrantRow {
+  id: string;
+  ownerEmail: string;
+  orgId: string | null;
+  resourceId: string;
+  appId: string;
+  status: string;
+  syncedAt: number | null;
+  createdAt: number;
+  updatedAt: number;
+}
+
+function createFakeDb(state: {
+  resources: ResourceRow[];
+  grants?: GrantRow[];
+}) {
+  const latestResource = () => state.resources.at(-1);
+
+  return {
+    insert: vi.fn(() => ({
+      values: vi.fn(async (values: ResourceRow | GrantRow) => {
+        if ("kind" in values) state.resources.push(values);
+      }),
+    })),
+    select: vi.fn(() => ({
+      from: vi.fn((table: any) => {
+        const tableName = table?.[Symbol.for("drizzle:Name")] ?? "";
+        const rows =
+          tableName === "workspace_resource_grants"
+            ? (state.grants ?? [])
+            : state.resources;
+        return {
+          where: vi.fn(() => ({
+            limit: vi.fn(async () => {
+              const resource = latestResource();
+              return resource ? [resource] : [];
+            }),
+            orderBy: vi.fn(async () => rows),
+          })),
+          orderBy: vi.fn(async () => rows),
+        };
+      }),
+    })),
+    update: vi.fn(() => ({
+      set: vi.fn((updates: Partial<ResourceRow | GrantRow>) => ({
+        where: vi.fn(async () => {
+          const resource = latestResource();
+          if (resource) Object.assign(resource, updates);
+        }),
+      })),
+    })),
+    delete: vi.fn(() => ({
+      where: vi.fn(async () => {
+        state.resources.pop();
+      }),
+    })),
+  };
+}
+
+function createStarterFakeDb(state: { resources: ResourceRow[] }) {
+  let limitCall = 0;
+  return {
+    select: vi.fn(() => ({
+      from: vi.fn(() => ({
+        where: vi.fn(() => ({
+          limit: vi.fn(async () => {
+            limitCall += 1;
+            return limitCall % 2 === 0 && state.resources.length > 0
+              ? [state.resources.at(-1)]
+              : [];
+          }),
+        })),
+      })),
+    })),
+  };
+}
+
+function createStarterExec(state: { resources: ResourceRow[] }) {
+  return {
+    execute: vi.fn(async (query: { args?: unknown[] }) => {
+      const args = query.args ?? [];
+      state.resources.push({
+        id: String(args[0]),
+        ownerEmail: String(args[1]),
+        orgId: args[2] as string | null,
+        kind: String(args[3]),
+        name: String(args[4]),
+        description: args[5] as string | null,
+        path: String(args[6]),
+        content: String(args[7]),
+        scope: String(args[8]),
+        createdBy: String(args[9]),
+        createdAt: Number(args[10]),
+        updatedAt: Number(args[11]),
+      });
+      return { rows: [], rowsAffected: 1 };
+    }),
+  };
+}
+
+function dispatchMetadata(resource: Pick<ResourceRow, "id">) {
+  return JSON.stringify({
+    source: "dispatch-workspace-resource",
+    resourceId: resource.id,
+  });
+}
+
+beforeEach(() => {
+  mocks.getDb.mockReturnValue(createFakeDb({ resources: [] }));
+  mocks.getDbExec.mockReturnValue({ execute: vi.fn() });
+  mocks.isPostgres.mockReturnValue(false);
+  mocks.getApprovalPolicy.mockResolvedValue({
+    enabled: false,
+    approverEmails: [],
+  });
+  mocks.createApprovalRequest.mockImplementation(async (input: any) => ({
+    id: "approval_1",
+    status: "pending",
+    ...input,
+  }));
+  mocks.resourceListAllOwners.mockResolvedValue([]);
+  mocks.getOrgSetting.mockResolvedValue(null);
+  mocks.getUserSetting.mockResolvedValue(null);
+  mocks.putOrgSetting.mockResolvedValue(undefined);
+  mocks.putUserSetting.mockResolvedValue(undefined);
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
+describe("workspace resource materialization", () => {
+  it("seeds the starter global workspace resources once per org scope", async () => {
+    const state = { resources: [] as ResourceRow[] };
+    mocks.getDb.mockReturnValue(createStarterFakeDb(state));
+    mocks.getDbExec.mockReturnValue(createStarterExec(state));
+
+    await ensureStarterWorkspaceResources({
+      ownerEmail: "owner@example.test",
+      orgId: "org_123",
+    });
+
+    expect(state.resources.map((resource) => resource.path)).toEqual(
+      STARTER_GLOBAL_WORKSPACE_RESOURCES.map((resource) => resource.path),
+    );
+    expect(state.resources.every((resource) => resource.scope === "all")).toBe(
+      true,
+    );
+    expect(mocks.resourcePut).toHaveBeenCalledTimes(
+      STARTER_GLOBAL_WORKSPACE_RESOURCES.length,
+    );
+    expect(mocks.resourcePut).toHaveBeenCalledWith(
+      "__workspace__",
+      "context/company.md",
+      expect.stringContaining("# Company Profile"),
+      "text/markdown",
+      expect.objectContaining({ createdBy: "system" }),
+    );
+    expect(mocks.putOrgSetting).toHaveBeenCalledWith(
+      "org_123",
+      "dispatch-starter-workspace-resources",
+      expect.objectContaining({
+        version: 2,
+        resources: STARTER_GLOBAL_WORKSPACE_RESOURCES.map((resource) => ({
+          path: resource.path,
+          kind: resource.kind,
+          scope: resource.scope,
+        })),
+      }),
+    );
+  });
+
+  it("skips starter seeding after the scope marker exists", async () => {
+    mocks.getOrgSetting.mockResolvedValueOnce({ version: 2 });
+
+    await ensureStarterWorkspaceResources({
+      ownerEmail: "owner@example.test",
+      orgId: "org_123",
+    });
+
+    expect(mocks.getDbExec).not.toHaveBeenCalled();
+    expect(mocks.resourcePut).not.toHaveBeenCalled();
+    expect(mocks.putOrgSetting).not.toHaveBeenCalled();
+  });
+
+  it("restores a missing starter resource without rerunning automatic seeding", async () => {
+    mocks.getOrgSetting.mockResolvedValue({ version: 2 });
+    const state = { resources: [] as ResourceRow[] };
+    mocks.getDb.mockReturnValue(createStarterFakeDb(state));
+    mocks.getDbExec.mockReturnValue(createStarterExec(state));
+
+    const result = await restoreStarterWorkspaceResources({
+      paths: ["context/brand.md"],
+    });
+
+    expect(result.restored.map((resource) => resource.path)).toEqual([
+      "context/brand.md",
+    ]);
+    expect(state.resources).toHaveLength(1);
+    expect(state.resources[0]).toEqual(
+      expect.objectContaining({
+        path: "context/brand.md",
+        scope: "all",
+      }),
+    );
+    expect(mocks.putOrgSetting).not.toHaveBeenCalled();
+    expect(mocks.resourcePut).toHaveBeenCalledWith(
+      "__workspace__",
+      "context/brand.md",
+      expect.stringContaining("# Brand Guidelines"),
+      "text/markdown",
+      expect.objectContaining({ createdBy: "system" }),
+    );
+
+    mocks.getDb.mockReturnValue(createFakeDb({ resources: state.resources }));
+    const received = await listWorkspaceResourcesForApp("mail");
+
+    expect(received.resources).toEqual([
+      expect.objectContaining({
+        path: "context/brand.md",
+        source: "workspace",
+      }),
+    ]);
+  });
+
+  it("materializes scope=all starter resources into the core workspace resource store", async () => {
+    const created = await createWorkspaceResource({
+      kind: "instruction",
+      name: "Starter guardrails",
+      description: "Always-on workspace instructions",
+      path: "instructions/starter.md",
+      content: "# Starter\nUse the shared workspace context.",
+      scope: "all",
+    });
+
+    expect(created?.scope).toBe("all");
+    expect(mocks.resourcePut).toHaveBeenCalledWith(
+      "__workspace__",
+      "instructions/starter.md",
+      "# Starter\nUse the shared workspace context.",
+      "text/markdown",
+      {
+        createdBy: "system",
+        metadata: expect.objectContaining({
+          source: "dispatch-workspace-resource",
+          resourceId: created?.id,
+          kind: "instruction",
+          name: "Starter guardrails",
+          description: "Always-on workspace instructions",
+          updatedAt: created?.updatedAt,
+        }),
+      },
+    );
+  });
+
+  it("uses application/json when materializing global agent profile resources", async () => {
+    await createWorkspaceResource({
+      kind: "agent",
+      name: "Research agent",
+      path: "remote-agents/research.json",
+      content: '{"name":"Research"}',
+      scope: "all",
+    });
+
+    expect(mocks.resourcePut).toHaveBeenCalledWith(
+      "__workspace__",
+      "remote-agents/research.json",
+      '{"name":"Research"}',
+      "application/json",
+      expect.any(Object),
+    );
+  });
+
+  it("does not materialize selected-only resources", async () => {
+    await createWorkspaceResource({
+      kind: "knowledge",
+      name: "Launch notes",
+      path: "context/launch.md",
+      content: "# Launch",
+      scope: "selected",
+    });
+
+    expect(mocks.resourcePut).not.toHaveBeenCalled();
+    expect(mocks.resourceDeleteByPath).not.toHaveBeenCalled();
+  });
+
+  it("removes a previously materialized global resource when it becomes selected-only", async () => {
+    const state = {
+      resources: [
+        {
+          id: "resource_1",
+          ownerEmail: "owner@example.test",
+          orgId: "org_123",
+          kind: "instruction",
+          name: "Starter guardrails",
+          description: null,
+          path: "instructions/starter.md",
+          content: "# Starter",
+          scope: "all",
+          createdBy: "owner@example.test",
+          createdAt: 1,
+          updatedAt: 1,
+        },
+      ],
+    };
+    mocks.getDb.mockReturnValue(createFakeDb(state));
+    mocks.resourceGetByPath.mockResolvedValueOnce({
+      id: "shared_1",
+      owner: "__workspace__",
+      path: "instructions/starter.md",
+      metadata: dispatchMetadata(state.resources[0]),
+    });
+
+    await updateWorkspaceResource("resource_1", { scope: "selected" });
+
+    expect(mocks.resourceDeleteByPath).toHaveBeenCalledWith(
+      "__workspace__",
+      "instructions/starter.md",
+    );
+    expect(mocks.resourcePut).not.toHaveBeenCalled();
+  });
+
+  it("leaves shared resources alone when metadata does not match Dispatch ownership", async () => {
+    const state = {
+      resources: [
+        {
+          id: "resource_1",
+          ownerEmail: "owner@example.test",
+          orgId: "org_123",
+          kind: "instruction",
+          name: "Starter guardrails",
+          description: null,
+          path: "instructions/starter.md",
+          content: "# Starter",
+          scope: "all",
+          createdBy: "owner@example.test",
+          createdAt: 1,
+          updatedAt: 1,
+        },
+      ],
+    };
+    mocks.getDb.mockReturnValue(createFakeDb(state));
+    mocks.resourceGetByPath.mockResolvedValueOnce({
+      id: "shared_1",
+      owner: "__workspace__",
+      path: "instructions/starter.md",
+      metadata: JSON.stringify({
+        source: "manual",
+        resourceId: "resource_1",
+      }),
+    });
+
+    await updateWorkspaceResource("resource_1", { scope: "selected" });
+
+    expect(mocks.resourceDeleteByPath).not.toHaveBeenCalled();
+  });
+
+  it("removes a materialized global resource before deleting the workspace resource", async () => {
+    const state = {
+      resources: [
+        {
+          id: "resource_1",
+          ownerEmail: "owner@example.test",
+          orgId: "org_123",
+          kind: "knowledge",
+          name: "Positioning",
+          description: null,
+          path: "context/positioning.md",
+          content: "# Positioning",
+          scope: "all",
+          createdBy: "owner@example.test",
+          createdAt: 1,
+          updatedAt: 1,
+        },
+      ],
+      grants: [],
+    };
+    mocks.getDb.mockReturnValue(createFakeDb(state));
+    mocks.resourceGetByPath.mockResolvedValueOnce({
+      id: "shared_1",
+      owner: "__workspace__",
+      path: "context/positioning.md",
+      metadata: dispatchMetadata(state.resources[0]),
+    });
+
+    await deleteWorkspaceResource("resource_1");
+
+    expect(mocks.resourceDeleteByPath).toHaveBeenCalledWith(
+      "__workspace__",
+      "context/positioning.md",
+    );
+  });
+
+  it("lists the inherited and granted workspace resources an app receives", async () => {
+    mocks.getOrgSetting.mockResolvedValue({ version: 2 });
+    const state = {
+      resources: [
+        {
+          id: "global_1",
+          ownerEmail: "owner@example.test",
+          orgId: "org_123",
+          kind: "instruction",
+          name: "Guardrails",
+          description: null,
+          path: "instructions/guardrails.md",
+          content: "# Guardrails",
+          scope: "all",
+          createdBy: "owner@example.test",
+          createdAt: 1,
+          updatedAt: 2,
+        },
+        {
+          id: "selected_1",
+          ownerEmail: "owner@example.test",
+          orgId: "org_123",
+          kind: "knowledge",
+          name: "Analytics Messaging",
+          description: null,
+          path: "context/analytics.md",
+          content: "# Analytics",
+          scope: "selected",
+          createdBy: "owner@example.test",
+          createdAt: 1,
+          updatedAt: 3,
+        },
+        {
+          id: "selected_2",
+          ownerEmail: "owner@example.test",
+          orgId: "org_123",
+          kind: "knowledge",
+          name: "Mail Messaging",
+          description: null,
+          path: "context/mail.md",
+          content: "# Mail",
+          scope: "selected",
+          createdBy: "owner@example.test",
+          createdAt: 1,
+          updatedAt: 4,
+        },
+      ],
+      grants: [
+        {
+          id: "grant_1",
+          ownerEmail: "owner@example.test",
+          orgId: "org_123",
+          resourceId: "selected_1",
+          appId: "analytics",
+          status: "active",
+          syncedAt: 123,
+          createdAt: 1,
+          updatedAt: 1,
+        },
+        {
+          id: "grant_2",
+          ownerEmail: "owner@example.test",
+          orgId: "org_123",
+          resourceId: "selected_2",
+          appId: "analytics",
+          status: "revoked",
+          syncedAt: null,
+          createdAt: 1,
+          updatedAt: 1,
+        },
+      ],
+    };
+    mocks.getDb.mockReturnValue(createFakeDb(state));
+
+    const result = await listWorkspaceResourcesForApp("analytics");
+
+    expect(result.counts).toEqual({
+      total: 2,
+      workspace: 1,
+      global: 1,
+      granted: 1,
+      autoLoaded: 1,
+    });
+    expect(result.resources.map((resource) => resource.path)).toEqual([
+      "instructions/guardrails.md",
+      "context/analytics.md",
+    ]);
+    expect(result.resources[0]).toEqual(
+      expect.objectContaining({
+        source: "workspace",
+        autoLoaded: true,
+        grantId: null,
+      }),
+    );
+    expect(result.resources[1]).toEqual(
+      expect.objectContaining({
+        source: "grant",
+        autoLoaded: false,
+        grantId: "grant_1",
+      }),
+    );
+    expect(result.resources[1]).not.toHaveProperty("syncedAt");
+  });
+
+  it("previews all-app effective context without requiring a grant or sync", async () => {
+    mocks.getOrgSetting.mockResolvedValue({ version: 2 });
+    const state = {
+      resources: [
+        {
+          id: "global_1",
+          ownerEmail: "owner@example.test",
+          orgId: "org_123",
+          kind: "knowledge",
+          name: "Brand",
+          description: "Brand guidance",
+          path: "context/brand.md",
+          content: "# Brand",
+          scope: "all",
+          createdBy: "owner@example.test",
+          createdAt: 1,
+          updatedAt: 2,
+        },
+      ],
+      grants: [],
+    };
+    mocks.getDb.mockReturnValue(createFakeDb(state));
+
+    const result = await getWorkspaceResourceEffectiveContext({
+      resourceId: "global_1",
+      appId: "analytics",
+      userEmail: "person@example.test",
+    });
+
+    expect(result.availability).toBe("all-apps");
+    expect(result.availableToApp).toBe(true);
+    expect(result.path).toBe("context/brand.md");
+    expect(result.workspaceResource).toEqual(
+      expect.objectContaining({
+        id: "global_1",
+        path: "context/brand.md",
+        scope: "all",
+      }),
+    );
+    expect(mocks.resourceEffectiveContext).toHaveBeenCalledWith(
+      "person@example.test",
+      "context/brand.md",
+      { workspaceAppId: "analytics", orgId: "org_123" },
+    );
+    expect(mocks.resourcePut).toHaveBeenCalledWith(
+      "__workspace__",
+      "context/brand.md",
+      "# Brand",
+      "text/markdown",
+      expect.objectContaining({ createdBy: "system" }),
+    );
+  });
+
+  it("returns the winning layer from the runtime effective context stack", async () => {
+    mocks.getOrgSetting.mockResolvedValue({ version: 2 });
+    mocks.resourceEffectiveContext.mockResolvedValueOnce({
+      path: "instructions/guardrails.md",
+      effectiveScope: "personal",
+      effectiveResource: {
+        id: "personal_meta",
+        path: "instructions/guardrails.md",
+        owner: "person@example.test",
+        mimeType: "text/markdown",
+        size: 24,
+        createdAt: 1,
+        updatedAt: 4,
+        createdBy: "user",
+        visibility: "workspace",
+        threadId: null,
+        runId: null,
+        expiresAt: null,
+        metadata: null,
+      },
+      layers: [
+        {
+          scope: "workspace",
+          label: "Workspace default",
+          owner: "__workspace__",
+          resource: {
+            id: "workspace_meta",
+            path: "instructions/guardrails.md",
+            owner: "__workspace__",
+            mimeType: "text/markdown",
+            size: 16,
+            createdAt: 1,
+            updatedAt: 2,
+            createdBy: "system",
+            visibility: "workspace",
+            threadId: null,
+            runId: null,
+            expiresAt: null,
+            metadata: null,
+          },
+          exists: true,
+          effective: false,
+          overridden: true,
+          canWrite: false,
+        },
+        {
+          scope: "shared",
+          label: "Organization/app override",
+          owner: "__shared__",
+          resource: {
+            id: "shared_meta",
+            path: "instructions/guardrails.md",
+            owner: "__shared__",
+            mimeType: "text/markdown",
+            size: 20,
+            createdAt: 1,
+            updatedAt: 3,
+            createdBy: "user",
+            visibility: "workspace",
+            threadId: null,
+            runId: null,
+            expiresAt: null,
+            metadata: null,
+          },
+          exists: true,
+          effective: false,
+          overridden: true,
+          canWrite: true,
+        },
+        {
+          scope: "personal",
+          label: "Personal override",
+          owner: "person@example.test",
+          resource: {
+            id: "personal_meta",
+            path: "instructions/guardrails.md",
+            owner: "person@example.test",
+            mimeType: "text/markdown",
+            size: 24,
+            createdAt: 1,
+            updatedAt: 4,
+            createdBy: "user",
+            visibility: "workspace",
+            threadId: null,
+            runId: null,
+            expiresAt: null,
+            metadata: null,
+          },
+          exists: true,
+          effective: true,
+          overridden: false,
+          canWrite: true,
+        },
+      ],
+    });
+    const state = {
+      resources: [
+        {
+          id: "global_1",
+          ownerEmail: "owner@example.test",
+          orgId: "org_123",
+          kind: "instruction",
+          name: "Guardrails",
+          description: null,
+          path: "instructions/guardrails.md",
+          content: "# Workspace guardrails",
+          scope: "all",
+          createdBy: "owner@example.test",
+          createdAt: 1,
+          updatedAt: 2,
+        },
+      ],
+      grants: [],
+    };
+    mocks.getDb.mockReturnValue(createFakeDb(state));
+
+    const result = await getWorkspaceResourceEffectiveContext({
+      resourceId: "global_1",
+      appId: "analytics",
+      userEmail: "person@example.test",
+    });
+
+    expect(result.availability).toBe("all-apps");
+    expect(result.effectiveScope).toBe("personal");
+    expect(result.effectiveResource).toEqual(
+      expect.objectContaining({
+        id: "personal_meta",
+        owner: "person@example.test",
+      }),
+    );
+    expect(
+      result.layers.map((layer) => [layer.scope, layer.effective]),
+    ).toEqual([
+      ["workspace", false],
+      ["shared", false],
+      ["personal", true],
+    ]);
+  });
+
+  it("reports selected resources as app-specific exceptions", async () => {
+    mocks.getOrgSetting.mockResolvedValue({ version: 2 });
+    const state = {
+      resources: [
+        {
+          id: "selected_1",
+          ownerEmail: "owner@example.test",
+          orgId: "org_123",
+          kind: "knowledge",
+          name: "Analytics launch",
+          description: null,
+          path: "context/analytics-launch.md",
+          content: "# Launch",
+          scope: "selected",
+          createdBy: "owner@example.test",
+          createdAt: 1,
+          updatedAt: 2,
+        },
+      ],
+      grants: [
+        {
+          id: "grant_1",
+          ownerEmail: "owner@example.test",
+          orgId: "org_123",
+          resourceId: "selected_1",
+          appId: "analytics",
+          status: "active",
+          syncedAt: null,
+          createdAt: 1,
+          updatedAt: 1,
+        },
+      ],
+    };
+    mocks.getDb.mockReturnValue(createFakeDb(state));
+
+    const result = await getWorkspaceResourceEffectiveContext({
+      resourceId: "selected_1",
+      appId: "analytics",
+    });
+
+    expect(result.availability).toBe("selected-granted");
+    expect(result.availableToApp).toBe(true);
+    expect(result.activeGrantId).toBe("grant_1");
+    expect(mocks.resourcePut).not.toHaveBeenCalled();
+    expect(mocks.resourceEffectiveContext).toHaveBeenCalledWith(
+      "owner@example.test",
+      "context/analytics-launch.md",
+      { workspaceAppId: "analytics", orgId: "org_123" },
+    );
+  });
+
+  it("marks selected resources unavailable to apps without an active grant", async () => {
+    mocks.getOrgSetting.mockResolvedValue({ version: 2 });
+    const state = {
+      resources: [
+        {
+          id: "selected_1",
+          ownerEmail: "owner@example.test",
+          orgId: "org_123",
+          kind: "knowledge",
+          name: "Analytics launch",
+          description: null,
+          path: "context/analytics-launch.md",
+          content: "# Launch",
+          scope: "selected",
+          createdBy: "owner@example.test",
+          createdAt: 1,
+          updatedAt: 2,
+        },
+      ],
+      grants: [],
+    };
+    mocks.getDb.mockReturnValue(createFakeDb(state));
+
+    const result = await getWorkspaceResourceEffectiveContext({
+      resourceId: "selected_1",
+      appId: "analytics",
+    });
+
+    expect(result.availability).toBe("selected-not-granted");
+    expect(result.availableToApp).toBe(false);
+    expect(result.activeGrantId).toBeNull();
+  });
+
+  it("queues All-app updates for approval when approval policy is enabled", async () => {
+    mocks.getOrgSetting.mockResolvedValue({ version: 2 });
+    mocks.getApprovalPolicy.mockResolvedValue({
+      enabled: true,
+      approverEmails: ["admin@example.test"],
+    });
+    const state = {
+      resources: [
+        {
+          id: "global_1",
+          ownerEmail: "owner@example.test",
+          orgId: "org_123",
+          kind: "instruction",
+          name: "Guardrails",
+          description: null,
+          path: "instructions/guardrails.md",
+          content: "# Guardrails",
+          scope: "all",
+          createdBy: "owner@example.test",
+          createdAt: 1,
+          updatedAt: 2,
+        },
+      ],
+      grants: [],
+    };
+    mocks.getDb.mockReturnValue(createFakeDb(state));
+
+    const result = await updateWorkspaceResource("global_1", {
+      content: "# Updated guardrails",
+    });
+
+    expect(result).toEqual(
+      expect.objectContaining({
+        id: "approval_1",
+        status: "pending",
+        changeType: "workspace-resource.update",
+        targetType: "workspace-instruction",
+        targetId: "global_1",
+      }),
+    );
+    expect(mocks.createApprovalRequest).toHaveBeenCalledWith(
+      expect.objectContaining({
+        changeType: "workspace-resource.update",
+        beforeValue: expect.objectContaining({
+          content: "# Guardrails",
+          scope: "all",
+        }),
+        afterValue: expect.objectContaining({
+          content: "# Updated guardrails",
+          scope: "all",
+        }),
+      }),
+    );
+    expect(state.resources[0].content).toBe("# Guardrails");
+    expect(mocks.resourcePut).not.toHaveBeenCalled();
+  });
+
+  it("updates selected-only resources directly when approval policy is enabled", async () => {
+    mocks.getOrgSetting.mockResolvedValue({ version: 2 });
+    mocks.getApprovalPolicy.mockResolvedValue({
+      enabled: true,
+      approverEmails: ["admin@example.test"],
+    });
+    const state = {
+      resources: [
+        {
+          id: "selected_1",
+          ownerEmail: "owner@example.test",
+          orgId: "org_123",
+          kind: "knowledge",
+          name: "Launch",
+          description: null,
+          path: "context/launch.md",
+          content: "# Launch",
+          scope: "selected",
+          createdBy: "owner@example.test",
+          createdAt: 1,
+          updatedAt: 2,
+        },
+      ],
+      grants: [],
+    };
+    mocks.getDb.mockReturnValue(createFakeDb(state));
+
+    const result = await updateWorkspaceResource("selected_1", {
+      content: "# Updated launch",
+    });
+
+    expect(result).toEqual(
+      expect.objectContaining({
+        id: "selected_1",
+        content: "# Updated launch",
+      }),
+    );
+    expect(mocks.createApprovalRequest).not.toHaveBeenCalled();
+    expect(mocks.resourcePut).not.toHaveBeenCalled();
+  });
+
+  it("previews All-app impact, approval behavior, and overrides", async () => {
+    mocks.getOrgSetting.mockResolvedValue({ version: 2 });
+    mocks.getApprovalPolicy.mockResolvedValue({
+      enabled: true,
+      approverEmails: ["admin@example.test"],
+    });
+    mocks.resourceListAllOwners.mockResolvedValue([
+      {
+        id: "workspace_meta",
+        owner: "__workspace__",
+        path: "context/brand.md",
+        updatedAt: 1,
+      },
+      {
+        id: "shared_meta",
+        owner: "__shared__",
+        path: "context/brand.md",
+        updatedAt: 2,
+      },
+      {
+        id: "personal_meta",
+        owner: "person@example.test",
+        path: "context/brand.md",
+        updatedAt: 3,
+      },
+    ]);
+    const state = {
+      resources: [
+        {
+          id: "global_1",
+          ownerEmail: "owner@example.test",
+          orgId: "org_123",
+          kind: "knowledge",
+          name: "Brand",
+          description: null,
+          path: "context/brand.md",
+          content: "# Brand",
+          scope: "all",
+          createdBy: "owner@example.test",
+          createdAt: 1,
+          updatedAt: 2,
+        },
+      ],
+      grants: [],
+    };
+    mocks.getDb.mockReturnValue(createFakeDb(state));
+
+    const result = await previewWorkspaceResourceChange({
+      operation: "update",
+      resourceId: "global_1",
+      scope: "all",
+    });
+
+    expect(result.affectsAllApps).toBe(true);
+    expect(result.approval).toEqual({
+      policyEnabled: true,
+      willRequestApproval: true,
+    });
+    expect(result.overrides).toEqual(
+      expect.objectContaining({
+        count: 2,
+        sharedCount: 1,
+        personalCount: 1,
+      }),
+    );
+    expect(result.overrides.items.map((item) => item.owner)).toEqual([
+      "__shared__",
+      "person@example.test",
+    ]);
+  });
+});