feat(den): team access visibility — what can this team use, edge by edge (P3 PR1)

[benjaminshafii]

What

PR1 of P3 from the Grant-Native Skill Sharing program — built to the Paper design ("P3 — Access Visibility", den-primitive-annotated): the admin answer to what can this team use, and via which edge.

den-api — GET /v1/teams/:teamId/plugin-access: one item per (plugin, edge) — direct_team (with grantId for revoke), via_catalog (with marketplace), org_wide — role, server-resolved grantor names, grantedAt. Gated: org admin or member of the team; 404 unknown/foreign team. Active plugins only, componentCounts included.

den-web — team names in Members ▸ Teams now link to a new team detail page (members/teams/[teamId]): Overview (OrgMemberIdentity rows) + Access tab — members-grid pattern, edge badges on DenBadge tones, amber rows + bordered pill for editor grants (the 'this team can change it for everyone' warning), Revoke for direct grants (existing DELETE route), Open catalog for inherited ones, dashed empty state, edge legend. Hand-rolled Den* primitives only, per house rules (no shadows, UnderlineTabs, bracketed text sizes).

Tests (commands + results)

cd ee/apps/den-api
bun test test/plugin-system-team-access.test.ts test/plugin-system-access.test.ts \
  test/plugin-system-member-create.test.ts test/grant-native-capabilities.test.ts
# → 21 pass / 0 fail; pnpm exec tsc --noEmit clean
cd ee/apps/den-web && pnpm run build   # clean, new route generated
pnpm --dir evals exec vitest run --project nightly specs/team-access-view.slow.test.ts
# → 3× pass (executor 2× + orchestrator rerun) against live den-api + den-web from this branch:
#   admin/team-member 200 with direct_team row (grantor name), non-member 403,
#   then headless Chrome loads the real screen — vision validated 2/2 expectations
pnpm --dir evals run typecheck   # clean

Photo roll of the real screen follows as the sticky photo-roll comment (published via the evidence publisher). One test-infra fix rode along: the new bun suite seeded env after a hoisted value-import — made the schema import dynamic so the file is order-independent.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-app	Ready	Preview	Aug 2, 2026 8:30am
openwork-den	Ready	Preview	Aug 2, 2026 8:30am
openwork-den-worker-proxy	Ready	Preview	Aug 2, 2026 8:30am
openwork-diagnostics	Ready	Preview	Aug 2, 2026 8:30am
openwork-landing	Ready	Preview, v0	Aug 2, 2026 8:30am

[benjaminshafii]

Photo roll — p3-team-access

✅ 1/1 frames passed · 0 failed · 0 unvalidated · 2 expectations passed · 0 failed

1. A team access table lists a plugin with a direct team grant badge

• ✅ PASS A team access table lists a plugin with a direct team grant badge — The third plugin row shows a green “direct team grant” badge.
• ✅ PASS A role pill reading viewer is visible — Gray “viewer” role pills are visible in the Role column.

---

Roll created 2026-08-02T08:27:55.701Z · Source: evals/results/rolls/2026-08-02T08-27-55-701Z-p3-team-access/roll.json · Repro: pnpm --dir evals run publish:pr -- --pr 3424 --roll 2026-08-02T08-27-55-701Z-p3-team-access

[diff-warden]

Warden security clearance: clear. No new security issues found in this diff (8308d2cf3e65e3da80d99bf525f9da5132c73bae). Automated clearance satisfies the required-review gate only — a human still reviews and merges. Analysis run

[diff-warden]

Warden security clearance: clear. No new security issues found in this diff (d026df61d405e5197b76e3addf9beae58867fe2d). Automated clearance satisfies the required-review gate only — a human still reviews and merges. Analysis run