feat(den): member library — everything you can use, with provenance, on any screen size (P3 PR3)

[benjaminshafii]

What

PR3 — the final P3 slice (program prds/skill-sharing/; designs: Paper pages "PR3 — Member library placement" + "Mobile treatment — A/B/C", user-approved).

• Member-visible dashboard/library (outside the admin gate, mirroring Your Connections — the gate itself untouched): audience tabs All / Mine / Shared with me / Team / Everyone, search, one card per plugin, stacked provenance chips (Yours / Shared by X / Team / Catalog / Everyone / From owner-repo). Members get cards; admins additionally get links into plugin detail.
• GET /v1/me/plugin-access — caller-scoped effective library: deduped edges (mine / person with sharedBy / team / org_wide / catalog), highest role with catalog edges capped at viewer.
• The program's only migration: plugin.source_repository_url, populated by GitHub import + connector discovery; feeds the source chip.
• Desktop filter lifted: /v1/resources/marketplace-capabilities now includes grant-only rows (marketplaceId: null); the apps/app consumer made null-tolerant. The last marketplace-only surface is gone.
• Copy debt retired: the forbidden message and provenance() no longer say "marketplace" for grant-native plugins (tests + wire spec updated).
• Mobile treatment per Page 4: library ships mobile-first; PR1's team grid and PR2's access rows retrofit to stacked cards below md; share picker becomes a centered dialog on small screens. Fixes the fixed-lane overflow shipped in PR1/PR2.

Tests (commands + results)

ee/apps/den-api: bun test me-access + marketplace-capabilities + grant-native + team-access + member-create suites → all green (26/26 on my rerun trio, 37/37 executor four-suite run); tsc clean
ee/packages/den-db: parity suite 16/16 (new migration in sync)
ee/apps/den-web: tsc + next build clean
evals: library-view.slow.test.ts → 3× pass (member API edges, desktop-filter lift asserted, browser leg AS A PLAIN MEMBER); skill-grant-access wire spec re-run green with retired copy; evals typecheck clean

Photo roll (sticky comment below): two frames — desktop and 375px mobile, vision-validated 4/4. The member browser leg caught a sharedBy parser mismatch during development — fixed before merge.

Notes for reviewers

The nav gains its first member-visible product surface beyond Your Connections. "Everyone" tab = org-wide grants ∪ accessible catalogs (per the open question on the canvas — flagged there for override).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-app	Ready	Preview	Aug 2, 2026 2:12pm
openwork-den	Ready	Preview	Aug 2, 2026 2:12pm
openwork-den-worker-proxy	Ready	Preview	Aug 2, 2026 2:12pm
openwork-diagnostics	Ready	Preview	Aug 2, 2026 2:12pm
openwork-landing	Ready	Preview, v0	Aug 2, 2026 2:12pm

[benjaminshafii]

Photo roll — p3-library

✅ 2/2 frames passed · 0 failed · 0 unvalidated · 4 expectations passed · 0 failed

1. A library page lists plugin cards with provenance chips

• ✅ PASS A library page lists plugin cards with provenance chips — The Library page shows plugin cards; the “AAA Spec Library Plugin 1785679831284” card has provenance chips including “Shared by Casey Spec” and “Team: Spec Library Provenance Team 1785679831284.”
• ✅ PASS A chip reading Shared by is visible — A blue chip labeled “Shared by Casey Spec” is visible on the first plugin card.

2. A narrow mobile layout shows library cards in a single column

• ✅ PASS A narrow mobile layout shows library cards in a single column — The narrow portrait viewport shows the AAA card with the customer-support card directly below it.
• ✅ PASS Provenance chips wrap and remain readable — The team provenance chip wraps onto two readable lines: “Team: Spec Library Provenance Team” and “1785679831284”.

---

Roll created 2026-08-02T14:10:32.462Z · Source: evals/results/rolls/2026-08-02T14-10-32-462Z-p3-library/roll.json · Repro: pnpm --dir evals run publish:pr -- --pr 3429 --roll 2026-08-02T14-10-32-462Z-p3-library

[diff-warden]

Warden security clearance: clear. No new security issues found in this diff (fa81152ee211f3f0801499191656cf93f06e7b87). Automated clearance satisfies the required-review gate only — a human still reviews and merges. Analysis run