refactor(resources): extend the axes for what every kind actually needs

[waleedlatif1]

Summary

Stacked on #6279. Three additions to apps/sim/resources/, each uniform across all four kinds, so tables and knowledge can land without four per-kind workarounds.

• grants.manage — admin-only governance of the resource, as distinct from writing its content. Table column locks are the first: an owner decides which columns an editor may not touch, and the settings an editor is locked out of are the ones that lock them out. grantsFromPermissions already received canAdmin and dropped it on the floor.
• grants.settled — whether write/run/manage are final. The one member that describes the value rather than the viewer, and it has to sit there: a resolving membership and a genuinely denied one produce identical booleans, so write === false could not be told from "not yet". This reduces behavior change — without it both migrations would have had to accept a first-paint flicker where a disabled control no longer appears while permissions load. It also fixes a worse case: the table's lock notice is a one-shot latched toast that permanently loses its action if it fires before manage resolves.
• ResourceLink { to: 'list' } — the index route a kind lives under. Every kind has one, every detail surface needs it (breadcrumb root, and where to go after the thing being shown is deleted), and five call sites across two route trees hand-built that path. hrefFor still returns null in share scope, so the list route can't be reached from a token either.

Knowledge's two list pushes now go through hrefFor. The table's two follow in its own PR, once it builds a source.

Type of Change

• Refactor (no functional change)

Testing

bun run type-check, bun run lint:check, bun run check:audits (23/23 including check:resources:strict), and the full suite — 1497 files / 20675 tests, 0 failures.

Verified the new tests can fail: breaking settled to a constant and pointing the list link at resourceHref turns three of them red.

Behavior-neutral by construction — the only production changes are two router.push calls resolving the same string through hrefFor, and one grants literal gaining two fields.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 7, 2026 11:45pm

[cursor]

PR Summary

Low Risk
Mostly type and documentation extensions plus two navigation call sites that resolve the same URLs; no auth or permission logic changes beyond surfacing canAdmin as manage.

Overview
Extends the resource grants axis so views can distinguish admin governance from content write, and loading from a real denial. manage maps from canAdmin (replacing per-view canAdmin). settled is !isLoading on grantsFromPermissions, so write === false is not read as final while membership is still resolving. Share grants and the streaming-file literal include manage: false and settled: true.

Adds ResourceLink { to: 'list' } and resourceListHref so each kind’s index route is resolved in one place. workspaceSource.hrefFor handles list; share sources still return null for list links. Knowledge base delete and breadcrumb navigation use source.hrefFor({ to: 'list' }) instead of hand-built /workspace/.../knowledge paths.

Docs in CLAUDE.md, sim-resource-views rules, and tests in grants.test.ts and source.test.ts are updated to match.

^{Reviewed by Cursor Bugbot for commit 9804ff9. Configure here.}

[greptile-apps]

Greptile Summary

The PR extends the resource-view axes with administrative and permission-resolution grants, adds kind-specific list destinations, and routes knowledge navigation through the shared source abstraction.

• Adds manage and settled fields to resource grants and updates constructors and tests.
• Adds { to: 'list' } resource links with exhaustive workspace route resolution.
• Replaces two hand-built knowledge-list navigations with source.hrefFor.
• Updates resource-view documentation for the expanded contracts.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/resources/grants.ts	Extends resource grants with administrative capability and permission-resolution state while preserving workspace and share semantics.
apps/sim/resources/source.ts	Adds exhaustive, encoded list-route resolution while retaining null navigation for share sources.
apps/sim/app/workspace/[workspaceId]/knowledge/[id]/knowledge-base.tsx	Routes deletion and breadcrumb navigation through the resource source’s list destination.
apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-content/resource-content.tsx	Expands the streaming-file grant literal to satisfy the new resource-grant contract.

_{Reviews (2): Last reviewed commit: "docs(resources): describe the extended a..." | Re-trigger Greptile}

[waleedlatif1]

On the as const finding — pushing back on both, with the sibling as evidence.

STREAMING_FILE_GRANTS: ResourceGrants and the test's expected: Record<ResourceKind, string> are both type-annotated constants. The repo's as const rule exists to preserve literal types on constants that have none; where an annotation is already present it does the same job, and ResourceGrants declares every member readonly on top of that, so as const would add nothing but noise.

The direct sibling settles it: RESOURCE_NOUN in apps/sim/resources/source.ts:21 is Record<ResourceKind, string> = { … } with no as const, and predates this PR. The test's map is the same shape against the same key type. Adding the assertion to mine and not to it would make the file inconsistent with itself.

STREAMING_FILE_GRANTS also isn't new here — it was { write: false, run: false } before this PR and I only added the two new fields, so the assertion was never part of its style.

No code change on this one.

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 9804ff9. Configure here.}