@agent-native/dispatch 0.40.30 → 0.40.33

package/src/actions/connect-external-agent.spec.ts

@@ -1,15 +1,15 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const mocks = vi.hoisted(() => ({
-  getDbExec: vi.fn(),
   resourcePutIfAbsent: vi.fn(),
   sharedResourceOwner: vi.fn(),
+  readOrgMemberRole: vi.fn(),
   currentOrgId: vi.fn(),
   currentOwnerEmail: vi.fn(),
 }));
 
-vi.mock("@agent-native/core/db", () => ({
-  getDbExec: mocks.getDbExec,
+vi.mock("@agent-native/core/server", () => ({
+  readOrgMemberRole: mocks.readOrgMemberRole,
 }));
 
 vi.mock("@agent-native/core/resources/store", () => ({
@@ -31,11 +31,9 @@ describe("connect-external-agent action", () => {
     vi.clearAllMocks();
     mocks.currentOrgId.mockReturnValue("org_1");
     mocks.currentOwnerEmail.mockReturnValue("owner@example.com");
+    mocks.readOrgMemberRole.mockResolvedValue("admin");
     mocks.sharedResourceOwner.mockReturnValue("shared-owner");
     mocks.resourcePutIfAbsent.mockResolvedValue({ id: "resource_1" });
-    mocks.getDbExec.mockReturnValue({
-      execute: vi.fn().mockResolvedValue({ rows: [{ role: "owner" }] }),
-    });
   });
 
   it("rejects a malformed endpoint URL with a clean validation error instead of an unhandled throw", async () => {
@@ -115,16 +113,14 @@ describe("connect-external-agent action", () => {
     }
 
     expect(isActionContractError(caught)).toBe(true);
-    expect(mocks.getDbExec).not.toHaveBeenCalled();
+    expect(mocks.readOrgMemberRole).not.toHaveBeenCalled();
     expect(mocks.sharedResourceOwner).not.toHaveBeenCalled();
     expect(mocks.resourcePutIfAbsent).not.toHaveBeenCalled();
   });
 
   it("requires an owner or admin actor for shared agents before writing", async () => {
     mocks.currentOrgId.mockReturnValue("org_1");
-    mocks.getDbExec.mockReturnValue({
-      execute: vi.fn().mockResolvedValue({ rows: [{ role: "member" }] }),
-    });
+    mocks.readOrgMemberRole.mockResolvedValue("member");
 
     let caught: unknown;
     try {
@@ -154,7 +150,7 @@ describe("connect-external-agent action", () => {
 
     expect(result.status).toBe("created");
     expect(result.scope).toBe("personal");
-    expect(mocks.getDbExec).not.toHaveBeenCalled();
+    expect(mocks.readOrgMemberRole).not.toHaveBeenCalled();
     expect(mocks.resourcePutIfAbsent).toHaveBeenCalledWith(
       "member@example.com",
       "remote-agents/personal-agent.json",
@@ -173,6 +169,24 @@ describe("connect-external-agent action", () => {
     expect(mocks.resourcePutIfAbsent).toHaveBeenCalled();
   });
 
+  it("does not let an asserted owner register a shared agent without an admin role", async () => {
+    mocks.currentOrgId.mockReturnValue("org-1");
+    mocks.currentOwnerEmail.mockReturnValue("owner@example.com");
+    mocks.readOrgMemberRole.mockResolvedValue("member");
+
+    await expect(
+      action.run({
+        url: "https://agent.example.com",
+        scope: "shared",
+      } as never),
+    ).rejects.toMatchObject({ statusCode: 403 });
+    expect(mocks.readOrgMemberRole).toHaveBeenCalledWith(
+      "org-1",
+      "owner@example.com",
+    );
+    expect(mocks.resourcePutIfAbsent).not.toHaveBeenCalled();
+  });
+
   it("rejects a concurrent duplicate connect as a clean 409, not an overwrite", async () => {
     mocks.resourcePutIfAbsent.mockResolvedValue(null);
 

package/src/actions/connect-external-agent.ts

@@ -1,9 +1,9 @@
 import { defineAction, fail } from "@agent-native/core/action";
-import { getDbExec } from "@agent-native/core/db";
 import {
   resourcePutIfAbsent,
   sharedResourceOwner,
 } from "@agent-native/core/resources/store";
+import { readOrgMemberRole } from "@agent-native/core/server";
 import { z } from "zod";
 
 import { normalizeConnectUrl } from "../lib/connect-apps.js";
@@ -30,14 +30,7 @@ async function assertCanManageSharedAgent() {
     });
   }
   const actor = currentOwnerEmail().trim().toLowerCase();
-  const result = await getDbExec().execute({
-    sql: `SELECT role FROM org_members
-          WHERE org_id = ? AND LOWER(email) = ?
-            AND federation_removal_pending_at IS NULL
-          LIMIT 1`,
-    args: [orgId, actor],
-  });
-  const role = result.rows[0]?.role;
+  const role = await readOrgMemberRole(orgId, actor);
   if (role !== "owner" && role !== "admin") {
     fail("Only organization owners and admins can connect agents.", {
       statusCode: 403,

package/src/actions/index.spec.ts

@@ -94,5 +94,8 @@ describe("dispatch action registry", () => {
       "workspaceAppCreationsByUserMonth",
     );
     expect(action.tool.description).toContain("app adoption metrics");
+    expect(action.tool.description).toContain(
+      "do not include customer/account/company usage or product data",
+    );
   });
 });

package/src/actions/list-connected-agents.spec.ts

@@ -3,7 +3,9 @@ import { describe, expect, it, vi } from "vitest";
 const mocks = vi.hoisted(() => ({
   discoverAgents: vi.fn(),
   getBuiltinAgents: vi.fn(),
-  getRequestUserEmail: vi.fn(() => "owner@example.test"),
+  getRequestUserEmail: vi.fn<() => string | undefined>(
+    () => "owner@example.test",
+  ),
   resourceGet: vi.fn(),
   resourceListAccessible: vi.fn(async (): Promise<unknown[]> => []),
   parseRemoteAgentManifest: vi.fn(),
@@ -141,4 +143,18 @@ describe("list-connected-agents", () => {
     expect(entry).toMatchObject({ id: "mail", source: "workspace" });
     expect(entry).not.toHaveProperty("homeUrl");
   });
+
+  it("returns a typed authentication error when the session has no user email", async () => {
+    mocks.discoverAgents.mockResolvedValue([]);
+    mocks.getBuiltinAgents.mockReturnValue([]);
+    mocks.loadWorkspaceAppsManifest.mockResolvedValue(null);
+    mocks.getRequestUserEmail.mockReturnValueOnce(undefined);
+
+    const { default: action } = await import("./list-connected-agents.js");
+
+    await expect(action.run({})).rejects.toMatchObject({
+      statusCode: 401,
+      errorCode: "dispatch_user_identity_missing",
+    });
+  });
 });

package/src/actions/list-connected-agents.ts

@@ -1,4 +1,4 @@
-import { defineAction } from "@agent-native/core/action";
+import { defineAction, fail } from "@agent-native/core/action";
 import {
   REMOTE_AGENT_RESOURCE_PREFIXES,
   parseRemoteAgentManifest,
@@ -45,7 +45,12 @@ export default defineAction({
       builtins.map((agent) => [agent.id, agent.url]),
     );
     const ownerEmail = getRequestUserEmail();
-    if (!ownerEmail) throw new Error("no authenticated user");
+    if (!ownerEmail) {
+      fail("Sign in to list connected agents.", {
+        errorCode: "dispatch_user_identity_missing",
+        statusCode: 401,
+      });
+    }
     const resources: Array<{ id: string; path: string; owner: string }> = [];
     for (const prefix of [...REMOTE_AGENT_RESOURCE_PREFIXES].reverse()) {
       resources.push(...(await resourceListAccessible(ownerEmail, prefix)));

package/src/actions/list-dispatch-usage-metrics.ts

@@ -5,7 +5,7 @@ import { listDispatchUsageMetrics } from "../server/lib/usage-metrics-store.js";
 
 export default defineAction({
   description:
-    "Get personal, workspace, or owner-authorized app adoption metrics for Dispatch, including LLM usage, spend or Builder.io credit spend, active users, tracked app actions, app attribution, prompt previews, and recent activity. billing.unit is unknown when historical usage lacks engine metadata or mixes billing sources; monthlyByUser credits are null in that case. Workspace results also include monthlyByUser credit rows and workspaceAppCreationsByUserMonth rows from the shared token_usage and Dispatch audit tables. App scope is aggregate-only and returns daily/weekly active users plus tracked action counts for the selected app.",
+    "Get personal or workspace-member agent usage and spend, or aggregate app adoption metrics for Dispatch. Workspace results do not include customer/account/company usage or product data; use the relevant workspace app for those. Results may include active users, tracked app actions, app attribution, prompt previews, and recent activity. billing.unit is unknown when historical usage lacks engine metadata or mixes billing sources; monthlyByUser credits are null in that case. Workspace results also include monthlyByUser credit rows and workspaceAppCreationsByUserMonth rows from the shared token_usage and Dispatch audit tables. App scope is aggregate-only and returns daily/weekly active users plus tracked action counts for the selected app.",
   schema: z.object({
     sinceDays: z.coerce
       .number()

package/src/actions/list-workspace-connections.spec.ts

@@ -10,6 +10,9 @@ const mocks = vi.hoisted(() => ({
   hasWorkspaceProviderOAuthCredentials: vi.fn(),
   isProviderApiId: vi.fn(() => false),
   listProviderApiCatalog: vi.fn(() => []),
+  listWorkspaceApps: vi.fn(async () => [
+    { id: "dispatch", name: "Dispatch", status: "ready" },
+  ]),
   listWorkspaceConnectionGrants: vi.fn(),
   listWorkspaceConnectionProviders: vi.fn(),
   listWorkspaceConnectionsForUser: vi.fn(),
@@ -54,9 +57,7 @@ vi.mock("@agent-native/core/workspace-connections", () => ({
 vi.mock("@agent-native/dispatch/actions", () => ({
   dispatchActions: {
     "list-workspace-apps": {
-      run: vi.fn(async () => [
-        { id: "dispatch", name: "Dispatch", status: "ready" },
-      ]),
+      run: mocks.listWorkspaceApps,
     },
   },
 }));
@@ -123,4 +124,14 @@ describe("list-workspace-connections", () => {
     expect(result.providers.map((provider) => provider.id)).toEqual(["github"]);
     expect(result.counts.providers).toBe(1);
   });
+
+  it("preserves workspace app lookup failures instead of returning partial grants", async () => {
+    const error = Object.assign(new Error("Workspace registry unavailable"), {
+      statusCode: 503,
+      errorCode: "workspace_gateway_org_a2a_secret_unavailable",
+    });
+    mocks.listWorkspaceApps.mockRejectedValueOnce(error);
+
+    await expect(action.run({})).rejects.toBe(error);
+  });
 });

package/src/actions/list-workspace-connections.ts

@@ -79,23 +79,19 @@ async function listGrantApps(): Promise<GrantApp[]> {
   const listWorkspaceApps = dispatchActions["list-workspace-apps"];
   if (!listWorkspaceApps) return [{ id: "dispatch", label: "Dispatch" }];
 
-  try {
-    const apps = (await listWorkspaceApps.run({
-      includeAgentCards: false,
-      audience: "all",
-    } as any)) as WorkspaceApp[];
-    const grantApps = apps
-      .filter((app) => !app.archived && app.status !== "pending")
-      .map((app) => ({
-        id: app.id,
-        label: app.name || humanizeAppId(app.id),
-      }));
-    return grantApps.length > 0
-      ? grantApps
-      : [{ id: "dispatch", label: "Dispatch" }];
-  } catch {
-    return [{ id: "dispatch", label: "Dispatch" }];
-  }
+  const apps = (await listWorkspaceApps.run({
+    includeAgentCards: false,
+    audience: "all",
+  } as any)) as WorkspaceApp[];
+  const grantApps = apps
+    .filter((app) => !app.archived && app.status !== "pending")
+    .map((app) => ({
+      id: app.id,
+      label: app.name || humanizeAppId(app.id),
+    }));
+  return grantApps.length > 0
+    ? grantApps
+    : [{ id: "dispatch", label: "Dispatch" }];
 }
 
 export default defineAction({

package/src/actions/provider-api-register.spec.ts

@@ -13,7 +13,7 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const mocks = vi.hoisted(() => ({
   getCredentialContext: vi.fn(),
-  execute: vi.fn(),
+  readOrgMemberRole: vi.fn(),
   upsertCustomProvider: vi.fn(),
   deleteCustomProvider: vi.fn(),
   listCustomProviders: vi.fn(),
@@ -22,10 +22,7 @@ const mocks = vi.hoisted(() => ({
 
 vi.mock("@agent-native/core/server", () => ({
   getCredentialContext: mocks.getCredentialContext,
-}));
-
-vi.mock("@agent-native/core/db", () => ({
-  getDbExec: () => ({ execute: mocks.execute }),
+  readOrgMemberRole: mocks.readOrgMemberRole,
 }));
 
 vi.mock("@agent-native/core/provider-api", async (importOriginal) => {
@@ -43,7 +40,7 @@ vi.mock("@agent-native/core/provider-api", async (importOriginal) => {
 const action = (await import("./provider-api-register.js")).default;
 
 function mockOrgRole(role: string | null): void {
-  mocks.execute.mockResolvedValue({ rows: role ? [{ role }] : [] });
+  mocks.readOrgMemberRole.mockResolvedValue(role);
 }
 
 const baseUpsertInput = {
@@ -136,7 +133,7 @@ describe("provider-api-register org-scope authorization", () => {
       "my-api",
       null,
     );
-    expect(mocks.execute).not.toHaveBeenCalled();
+    expect(mocks.readOrgMemberRole).not.toHaveBeenCalled();
   });
 
   it("allows an org-scope upsert/delete when the caller has no active org", async () => {
@@ -165,7 +162,7 @@ describe("provider-api-register org-scope authorization", () => {
       "my-api",
       "owner",
     );
-    expect(mocks.execute).not.toHaveBeenCalled();
+    expect(mocks.readOrgMemberRole).not.toHaveBeenCalled();
   });
 
   it("does not gate org-scope list/get reads on org role", async () => {
@@ -181,6 +178,15 @@ describe("provider-api-register org-scope authorization", () => {
       "org-a",
       "my-api",
     );
-    expect(mocks.execute).not.toHaveBeenCalled();
+    expect(mocks.readOrgMemberRole).not.toHaveBeenCalled();
+  });
+
+  it("rejects owner/admin writes when the shared resolver caps a delegated role", async () => {
+    mockOrgRole("member");
+
+    await expect(
+      action.run({ ...baseUpsertInput, scope: "org" }),
+    ).rejects.toThrow(/owners and admins/i);
+    expect(mocks.upsertCustomProvider).not.toHaveBeenCalled();
   });
 });

package/src/actions/provider-api-register.ts

@@ -1,23 +1,15 @@
-import { getDbExec } from "@agent-native/core/db";
 import { createCustomProviderRegistrationAction } from "@agent-native/core/provider-api/actions/custom-provider-registration";
-import { getCredentialContext } from "@agent-native/core/server";
+import {
+  getCredentialContext,
+  readOrgMemberRole,
+} from "@agent-native/core/server";
 
 async function resolveCallerOrgRole(
   orgId: string,
   email: string,
 ): Promise<string | null> {
   try {
-    const client = getDbExec();
-    const { rows } = await client.execute({
-      sql: `SELECT role FROM org_members
-            WHERE org_id = ? AND LOWER(email) = ?
-              AND federation_removal_pending_at IS NULL
-            LIMIT 1`,
-      args: [orgId, email.toLowerCase()],
-    });
-    if (rows.length === 0) return null;
-    const role = (rows[0] as { role?: unknown }).role;
-    return typeof role === "string" && role ? role : null;
+    return await readOrgMemberRole(orgId, email);
   } catch {
     return null;
   }

package/src/components/action-query-error.spec.tsx

@@ -53,4 +53,24 @@ describe("ActionQueryError", () => {
     });
     expect(onRetry).toHaveBeenCalledOnce();
   });
+
+  it("shows the query and safe HTTP diagnostic without exposing the message", () => {
+    act(() => {
+      root.render(
+        <ActionQueryError
+          error={Object.assign(new Error("secret database detail"), {
+            status: 401,
+            errorCode: "workspace_gateway_rejected",
+          })}
+          queryName="list-workspace-apps"
+          onRetry={() => {}}
+        />,
+      );
+    });
+
+    expect(container.textContent).toContain(
+      "list-workspace-apps · HTTP 401 · workspace_gateway_rejected",
+    );
+    expect(container.textContent).not.toContain("secret database detail");
+  });
 });

package/src/components/action-query-error.tsx

@@ -8,13 +8,48 @@ interface ActionQueryErrorProps {
   error?: unknown;
   onRetry: () => unknown;
   className?: string;
+  queryName?: string;
+}
+
+function actionQueryDiagnostic(
+  error: unknown,
+  queryName: string | undefined,
+): string | null {
+  const parts: string[] = [];
+  if (queryName) parts.push(queryName);
+
+  if (error && typeof error === "object") {
+    const details = error as Record<string, unknown>;
+    const status =
+      typeof details.statusCode === "number"
+        ? details.statusCode
+        : details.status;
+    if (
+      typeof status === "number" &&
+      Number.isInteger(status) &&
+      status >= 100 &&
+      status <= 599
+    ) {
+      parts.push(`HTTP ${status}`);
+    }
+
+    const code = details.errorCode ?? details.code;
+    if (typeof code === "string" && /^[a-zA-Z0-9_.-]{1,80}$/.test(code)) {
+      parts.push(code);
+    }
+  }
+
+  return parts.length > 0 ? parts.join(" · ") : null;
 }
 
 export function ActionQueryError({
+  error,
   onRetry,
   className,
+  queryName,
 }: ActionQueryErrorProps) {
   const t = useT();
+  const diagnostic = actionQueryDiagnostic(error, queryName);
 
   return (
     <Alert variant="destructive" className={className}>
@@ -22,6 +57,11 @@ export function ActionQueryError({
       <AlertTitle>{t("dispatch.pages.dataLoadFailed")}</AlertTitle>
       <AlertDescription className="flex flex-wrap items-center justify-between gap-3">
         <span>{t("dispatch.pages.dataLoadFailedDescription")}</span>
+        {diagnostic ? (
+          <code className="w-full break-all text-xs text-muted-foreground">
+            {diagnostic}
+          </code>
+        ) : null}
         <Button type="button" variant="outline" size="sm" onClick={onRetry}>
           <IconRefresh className="size-4" />
           {t("dispatch.pages.tryAgain")}

package/src/components/chat-home-apps.spec.tsx

@@ -25,7 +25,11 @@ const launcherState = vi.hoisted(() => ({
       },
     ],
     isLoading: false,
-    error: undefined,
+    error: undefined as unknown,
+    errorQueryName: undefined as
+      | "list-workspace-apps"
+      | "list-connected-agents"
+      | undefined,
     openApp: vi.fn(),
     retry: vi.fn(),
   },
@@ -89,6 +93,8 @@ describe("DispatchChatHomeApps", () => {
     ];
     launcherState.value.openApp.mockReset();
     launcherState.value.retry.mockReset();
+    launcherState.value.error = undefined;
+    launcherState.value.errorQueryName = undefined;
     container = document.createElement("div");
     document.body.appendChild(container);
     root = createRoot(container);
@@ -194,4 +200,29 @@ describe("DispatchChatHomeApps", () => {
     expect(container.textContent).toContain("Localized Calendar description");
     expect(container.textContent).not.toContain("Default English text");
   });
+
+  it.each([
+    ["list-workspace-apps", "Workspace apps failed"],
+    ["list-connected-agents", "Connected agents failed"],
+  ] as const)("identifies the failed %s query", async (queryName, message) => {
+    launcherState.value.workspaceApps = [];
+    launcherState.value.error = Object.assign(new Error(message), {
+      statusCode: 503,
+      errorCode: "workspace_gateway_unavailable",
+    });
+    launcherState.value.errorQueryName = queryName;
+
+    await act(async () => {
+      root.render(
+        <MemoryRouter initialEntries={["/chat"]}>
+          <DispatchChatHomeApps />
+        </MemoryRouter>,
+      );
+    });
+
+    expect(container.textContent).toContain(
+      `${queryName} · HTTP 503 · workspace_gateway_unavailable`,
+    );
+    expect(container.textContent).not.toContain(message);
+  });
 });

package/src/components/chat-home-apps.tsx

@@ -48,7 +48,11 @@ export function DispatchChatHomeApps() {
   if (launcher.error && launcher.workspaceApps.length === 0) {
     return (
       <div className="mx-auto w-full max-w-[1000px]">
-        <ActionQueryError error={launcher.error} onRetry={launcher.retry} />
+        <ActionQueryError
+          error={launcher.error}
+          onRetry={launcher.retry}
+          queryName={launcher.errorQueryName}
+        />
       </div>
     );
   }
@@ -61,6 +65,7 @@ export function DispatchChatHomeApps() {
           error={launcher.error}
           onRetry={launcher.retry}
           className="mb-3"
+          queryName={launcher.errorQueryName}
         />
       ) : null}
       <section aria-label={t("dispatch.nav.apps")}>

package/src/components/dispatch-control-plane.tsx

@@ -360,6 +360,7 @@ export function DispatchControlPlane() {
         <ActionQueryError
           error={appsQuery.error}
           onRetry={() => void appsQuery.refetch()}
+          queryName="list-workspace-apps"
         />
       ) : (
         <AppsPanel apps={workspaceApps ?? []} isLoading={appsLoading} />

package/src/components/layout/Layout.tsx

@@ -299,6 +299,7 @@ interface DispatchWorkspaceAppLauncher {
   workspaceApps: readonly WorkspaceAppSummary[];
   isLoading: boolean;
   error?: unknown;
+  errorQueryName?: "list-workspace-apps" | "list-connected-agents";
   openApp: (app: ChatFirstAppItem) => void;
   retry: () => void;
 }
@@ -1487,6 +1488,12 @@ function DispatchLayout({
   const chatFirstAppsFailed = chatFirstAppsQuery.isError;
   const chatFirstAppsError =
     chatFirstAppsQuery.error ?? chatFirstConnectedAppsQuery.error;
+  const chatFirstAppsErrorQueryName =
+    chatFirstAppsQuery.error != null
+      ? "list-workspace-apps"
+      : chatFirstConnectedAppsQuery.error != null
+        ? "list-connected-agents"
+        : undefined;
   const chatFirstResolvableApps = useMemo(
     () =>
       mergeChatFirstWorkspaceApps(
@@ -1574,6 +1581,7 @@ function DispatchLayout({
       workspaceApps: chatFirstWorkspaceApps,
       isLoading: chatFirstAppsLoading,
       error: chatFirstAppsError,
+      errorQueryName: chatFirstAppsErrorQueryName,
       openApp: openChatFirstApp,
       retry: () => {
         void chatFirstAppsQuery.refetch();
@@ -1582,6 +1590,7 @@ function DispatchLayout({
     }),
     [
       chatFirstAppsError,
+      chatFirstAppsErrorQueryName,
       chatFirstAppsLoading,
       chatFirstAppsQuery.refetch,
       chatFirstConnectedAppsQuery.refetch,

package/src/db/index.spec.ts

@@ -0,0 +1,74 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => {
+  let registeredResource: any;
+  return {
+    registerShareableResource: vi.fn((resource: any) => {
+      registeredResource = resource;
+    }),
+    readOrgMemberRole: vi.fn(),
+    getRegisteredResource: () => registeredResource,
+  };
+});
+
+vi.mock("@agent-native/core/db", () => ({
+  createGetDb: () => () => ({}),
+}));
+
+vi.mock("@agent-native/core/sharing", () => ({
+  registerShareableResource: mocks.registerShareableResource,
+}));
+
+vi.mock("@agent-native/core/server", () => ({
+  readOrgMemberRole: mocks.readOrgMemberRole,
+}));
+
+await import("./index.js");
+
+describe("Dispatch workspace app share access", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  const canManageAccess = () =>
+    mocks.getRegisteredResource().canManageAccess as (
+      resource: { orgId?: string },
+      ctx: { userEmail?: string; orgId?: string },
+    ) => Promise<boolean>;
+
+  it("uses the shared request-scoped role resolver for an admin", async () => {
+    mocks.readOrgMemberRole.mockResolvedValue("admin");
+
+    await expect(
+      canManageAccess()(
+        { orgId: "org-a" },
+        { userEmail: "admin@example.com", orgId: "org-a" },
+      ),
+    ).resolves.toBe(true);
+    expect(mocks.readOrgMemberRole).toHaveBeenCalledWith(
+      "org-a",
+      "admin@example.com",
+    );
+  });
+
+  it("denies org-member assertions whose stored owner role is capped to member", async () => {
+    mocks.readOrgMemberRole.mockResolvedValue("member");
+
+    await expect(
+      canManageAccess()(
+        { orgId: "org-a" },
+        { userEmail: "owner@example.com", orgId: "org-a" },
+      ),
+    ).resolves.toBe(false);
+  });
+
+  it("does not resolve a role for a resource outside the request org", async () => {
+    await expect(
+      canManageAccess()(
+        { orgId: "org-b" },
+        { userEmail: "member@example.com", orgId: "org-a" },
+      ),
+    ).resolves.toBe(false);
+    expect(mocks.readOrgMemberRole).not.toHaveBeenCalled();
+  });
+});

package/src/db/index.ts

@@ -1,4 +1,5 @@
-import { createGetDb, getDbExec } from "@agent-native/core/db";
+import { createGetDb } from "@agent-native/core/db";
+import { readOrgMemberRole } from "@agent-native/core/server";
 import { registerShareableResource } from "@agent-native/core/sharing";
 import type { PgDatabase, PgQueryResultHKT } from "drizzle-orm/pg-core";
 
@@ -24,14 +25,8 @@ registerShareableResource({
     if (!ctx.userEmail || !ctx.orgId || resource?.orgId !== ctx.orgId) {
       return false;
     }
-    const result = await getDbExec().execute({
-      sql: `SELECT 1 FROM org_members
-            WHERE org_id = ? AND LOWER(email) = LOWER(?)
-              AND federation_removal_pending_at IS NULL
-              AND role IN ('owner', 'admin') LIMIT 1`,
-      args: [ctx.orgId, ctx.userEmail],
-    });
-    return result.rows.length > 0;
+    const role = await readOrgMemberRole(ctx.orgId, ctx.userEmail);
+    return role === "owner" || role === "admin";
   },
 });
 

package/src/routes/pages/$appId.tsx

@@ -98,6 +98,7 @@ export default function WorkspaceAppCatchAllRoute() {
         <ActionQueryError
           error={appsQuery.error}
           onRetry={() => void appsQuery.refetch()}
+          queryName="list-workspace-apps"
         />
       </DispatchShell>
     );