@promptowl/contextnest-community 1.12.0 → 1.14.0

package/dist/index.js

@@ -17,18 +17,23 @@ import {
   listNotifications,
   listWatchers,
   markNotificationsRead,
+  nodeWriteKey,
   notifyNestEvent,
+  notifyNestInvite,
   parseConditionSchema,
   reject,
   removeWatcher,
+  repointPendingReview,
   requireWorkflowPlane,
   resolveCallerEmail,
   safeJson,
   safePublishDocument,
   seedDefaultEdgeTypes,
+  sendTestNotification,
+  stripUndefinedDeep,
   submitForReview,
-  verifySmtp
-} from "./chunk-XB7T3THE.js";
+  withNodeWriteLock
+} from "./chunk-MZ4IR5KH.js";
 import {
   createGrant,
   deleteGrant,
@@ -37,7 +42,7 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-ZMSU7BCC.js";
+} from "./chunk-IHGPZ6NY.js";
 import {
   generateApiKey,
   getKeyPrefix,
@@ -53,8 +58,9 @@ import {
   getCurrentVersion,
   getDisplayStatus,
   getVersions,
-  setApprovedVersion
-} from "./chunk-JHIU6RZU.js";
+  setApprovedVersion,
+  upsertVersion
+} from "./chunk-JP67WXLA.js";
 import {
   addMember,
   buildTitleMap,
@@ -63,7 +69,6 @@ import {
   canUserAccess,
   canUserApprove,
   canUserEdit,
-  collabPermToRole,
   createNest,
   createStewardRecord,
   createTeam,
@@ -98,6 +103,7 @@ import {
   listSharedNests,
   listStewards,
   listTeamsForUser,
+  listVisibleNests,
   loadAccessConfig,
   loadGrantedSuperAdmins,
   loadServerSettings,
@@ -111,13 +117,14 @@ import {
   renameNest,
   renameTeam,
   replaceTeamRoster,
+  resolveGrantRoles,
   resolveMemberIdentity,
   resolveNestPath,
   resolveNestPermission,
   resolveStewardsForNode,
   resolveStewardsWithFallback,
-  resolveTeamRolesForUser,
   resolveUserRoles,
+  sendEmailToRecipient,
   setAllowSelfApprove,
   setStewardshipEnabled,
   shareTeamWithNest,
@@ -129,8 +136,9 @@ import {
   unshareTeamFromNest,
   updateMemberRole,
   updateSteward,
-  validateLicense
-} from "./chunk-F7EKYNXG.js";
+  validateLicense,
+  verifySmtp
+} from "./chunk-KPK656BH.js";
 import {
   AppError,
   ConflictError,
@@ -153,7 +161,7 @@ import {
   initDb,
   isEmailListish,
   isEmailish
-} from "./chunk-3M7677XW.js";
+} from "./chunk-I5KYGMIT.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID
@@ -901,6 +909,9 @@ authRoutes.post("/register", async (c) => {
   if (!body.email || !body.password) {
     throw new ValidationError("email and password are required");
   }
+  if (!isEmailish(body.email)) {
+    throw new ValidationError("Enter a valid email address.");
+  }
   assertValidPassword(body.password);
   const email = normalizeEmail(body.email);
   const ip = clientIp(c);
@@ -1421,6 +1432,9 @@ authRoutes.delete("/users/:userId", async (c) => {
 authRoutes.post("/invite", async (c) => {
   const body = await c.req.json();
   if (!body.email) throw new ValidationError("email is required");
+  if (!isEmailish(body.email)) {
+    throw new ValidationError("Enter a valid email address.");
+  }
   const email = normalizeEmail(body.email);
   const callerId = await resolveCallerUserId(c);
   if (!callerId) {
@@ -1469,6 +1483,18 @@ authRoutes.post("/invite", async (c) => {
     );
   }
   trackEvent("admin.invite", { adminId: callerId, email });
+  const inviter = await db.get("SELECT email FROM users WHERE id = ?", [
+    callerId
+  ]);
+  void sendEmailToRecipient(email, {
+    status: "invited",
+    docTitle: "ContextNest",
+    path: "",
+    actor: email,
+    by: inviter?.email || void 0,
+    tempPassword,
+    link: requestBaseUrl(c.req.url)
+  });
   return c.json(
     {
       temporary_password: tempPassword,
@@ -1758,7 +1784,7 @@ async function approveExternalEdit(input) {
     const node = await storage.readDocument(input.documentId);
     const versionNum = result.versionEntry.version;
     const tags = node.frontmatter.tags || [];
-    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-YQIIQ7FN.js");
+    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-FGL47APL.js");
     await createVersion2({
       nestId: input.nestId,
       nodeId: input.documentId,
@@ -1867,18 +1893,6 @@ async function departmentTagFor(userEmail) {
     return null;
   }
 }
-var nodeWriteChains = /* @__PURE__ */ new Map();
-function withNodeWriteLock(key, fn) {
-  const prev = (nodeWriteChains.get(key) ?? Promise.resolve()).catch(() => {
-  });
-  const run = prev.then(fn);
-  nodeWriteChains.set(key, run);
-  void run.catch(() => {
-  }).finally(() => {
-    if (nodeWriteChains.get(key) === run) nodeWriteChains.delete(key);
-  });
-  return run;
-}
 function toSafeError(err, context, message) {
   if (err instanceof AppError) return err;
   console.error(`${context}:`, err);
@@ -2050,6 +2064,11 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
 async function listNodesForCallerByEmail(nestId, userEmail, filters = {}) {
   return listNodesForCaller(nestId, await userIdFromEmail(userEmail), filters);
 }
+async function actorAutoPublishes(nestId, userEmail) {
+  if (!await nestAllowsSelfApprove(nestId)) return false;
+  const roles = await resolveUserRoles(nestId, userEmail);
+  return roles.includes("owner") || roles.includes("admin");
+}
 async function createNode(nestId, input, userEmail) {
   const { storage, versions: versionManager } = await engineCache.get(nestId);
   const slug = slugify(input.title);
@@ -2084,8 +2103,9 @@ async function createNode(nestId, input, userEmail) {
     tags.push(deptTag);
   }
   const hasStewards = await isStewardshipEnabled(nestId);
-  const initialStatus = hasStewards ? "draft" : "published";
-  const initialVersion = hasStewards ? 1 : 0;
+  const autoPublish = !hasStewards || await actorAutoPublishes(nestId, userEmail);
+  const initialStatus = autoPublish ? "published" : "draft";
+  const initialVersion = autoPublish ? 0 : 1;
   let node = {
     id,
     filePath: "",
@@ -2109,7 +2129,7 @@ async function createNode(nestId, input, userEmail) {
   await storage.writeDocument(id, serializeDocument(node));
   await syncNodeTags(nestId, id, tags);
   let savedVersion = 1;
-  if (hasStewards) {
+  if (!autoPublish) {
     try {
       await versionManager.createVersion(node, userEmail);
     } catch (err) {
@@ -2128,7 +2148,7 @@ async function createNode(nestId, input, userEmail) {
     try {
       const result = await safePublishDocument(storage, id, {
         editedBy: userEmail,
-        note: "Auto-published on create (no stewards configured)"
+        note: hasStewards ? "Auto-published on create (owner/admin self-approve)" : "Auto-published on create (no stewards configured)"
       });
       savedVersion = result.node.frontmatter.version || 1;
       await createVersion({
@@ -2287,7 +2307,7 @@ async function registerImportedDocuments(nestId, userEmail, onProgress) {
   return registered;
 }
 async function updateNode(nestId, nodeId, patch, userEmail) {
-  return withNodeWriteLock(`${nestId}::${nodeId}`, async () => {
+  return withNodeWriteLock(nodeWriteKey(nestId, nodeId), async () => {
     try {
       const { storage, versions: versionManager } = await engineCache.get(
         nestId
@@ -2337,14 +2357,17 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
         node = { ...node, frontmatter: { ...node.frontmatter, metadata } };
       }
       const hasStewards = await isStewardshipEnabled(nestId);
+      const autoPublish = !hasStewards || await actorAutoPublishes(nestId, userEmail);
       const currentTags = node.frontmatter.tags || [];
-      if (hasStewards && await getPendingReview(nestId, nodeId)) {
+      const pendingReview = hasStewards ? await getPendingReview(nestId, nodeId) : null;
+      const isAuthorEditingOwnReview = !!pendingReview && pendingReview.requestedBy.toLowerCase() === userEmail.toLowerCase();
+      if (pendingReview && !isAuthorEditingOwnReview) {
         throw new LockedError(
           "This document is awaiting steward review and is locked. Approve or reject the pending review before editing."
         );
       }
       let responseVersion;
-      if (hasStewards) {
+      if (!autoPublish || isAuthorEditingOwnReview) {
         const currentVersion = await getCurrentVersion(nestId, nodeId);
         const newVersion = currentVersion + 1;
         node = {
@@ -2382,6 +2405,9 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
           tags: currentTags,
           changeNote: patch.changeNote
         });
+        if (isAuthorEditingOwnReview) {
+          await repointPendingReview({ nestId, nodeId, newVersion });
+        }
         responseVersion = newVersion;
       } else {
         node = {
@@ -2399,7 +2425,7 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
         try {
           const result = await safePublishDocument(storage, nodeId, {
             editedBy: userEmail,
-            note: patch.changeNote || "Auto-published on edit (no stewards)"
+            note: patch.changeNote || (hasStewards ? "Auto-published on edit (owner/admin self-approve)" : "Auto-published on edit (no stewards)")
           });
           publishedVersion = result.node.frontmatter.version || publishedVersion;
           node = result.node;
@@ -2410,7 +2436,7 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
           );
           throw err;
         }
-        await createVersion({
+        await upsertVersion({
           nestId,
           nodeId,
           version: publishedVersion,
@@ -2734,6 +2760,25 @@ async function syncUnsyncedFolder(userId, folderName, callerEmail) {
   }
   return { nest, documents };
 }
+function deleteUnsyncedFolder(folderName) {
+  console.log(`[unsynced] delete requested folder="${folderName}"`);
+  assertSafeFolderName(folderName);
+  const src = join3(config.DATA_ROOT, folderName);
+  if (isNestStorageRoot(src)) {
+    throw new ValidationError("Folder is not eligible for delete");
+  }
+  let stat;
+  try {
+    stat = statSync(src);
+  } catch {
+    throw new NotFoundError(`Folder not found: ${folderName}`);
+  }
+  if (!stat.isDirectory()) {
+    throw new ValidationError(`Not a directory: ${folderName}`);
+  }
+  rmSync(src, { recursive: true, force: true });
+  console.log(`[unsynced] deleted folder ${src}`);
+}
 
 // src/nests/routes.ts
 async function effectivePermission(nestId, userId) {
@@ -2759,54 +2804,42 @@ nestRoutes.get("/", async (c) => {
   const annotate = async (n) => {
     const permission = await effectivePermission(n.id, userId);
     const is_owner = permission === "owner";
-    let owner_email = null;
-    let roles;
-    if (is_owner) {
-      roles = ["owner"];
-    } else {
-      const grantRole = collabPermToRole(
-        await getCollaboratorRole(n.id, callerEmail)
-      );
-      const stewardRoles = await getStewardRolesForUser(n.id, callerEmail);
-      const teamRoles = await resolveTeamRolesForUser(n.id, userId);
-      roles = [
-        ...new Set(
-          [grantRole, ...stewardRoles, ...teamRoles].filter(Boolean)
-        )
-      ];
-    }
-    if (!is_owner && n.user_id !== ANON_USER_ID) {
-      const row = await db.get(ownerEmailSql, [n.user_id]);
-      owner_email = row?.email ?? null;
-    }
+    const needOwnerEmail = !is_owner && n.user_id !== ANON_USER_ID;
+    const [roles, owner_email] = await Promise.all([
+      is_owner ? Promise.resolve(["owner"]) : resolveGrantRoles(n.id, callerEmail, userId),
+      needOwnerEmail ? db.get(ownerEmailSql, [n.user_id]).then(
+        (row) => row?.email ?? null
+      ) : Promise.resolve(null)
+    ]);
     return {
       ...n,
       permission,
       is_owner,
       owner_email,
       roles,
-      stewardship_enabled: await isStewardshipEnabled(n.id)
+      stewardship_enabled: !!n.stewardship_enabled
     };
   };
   const seen = /* @__PURE__ */ new Set();
-  const out = [];
+  const deduped = [];
   for (const n of [...owned, ...shared, ...publicExtras]) {
     if (seen.has(n.id)) continue;
     seen.add(n.id);
-    out.push(await annotate(n));
+    deduped.push(n);
   }
+  const out = await Promise.all(deduped.map(annotate));
   const docRows = await db.all(
     "SELECT nest_id, COUNT(DISTINCT node_id) AS c FROM node_versions GROUP BY nest_id"
   );
-  const docByNest = new Map(docRows.map((r) => [r.nest_id, r.c]));
+  const docByNest = new Map(docRows.map((r) => [r.nest_id, Number(r.c)]));
   const collabRows = await db.all(
     "SELECT nest_id, COUNT(*) AS c FROM nest_collaborators GROUP BY nest_id"
   );
-  const collabByNest = new Map(collabRows.map((r) => [r.nest_id, r.c]));
+  const collabByNest = new Map(collabRows.map((r) => [r.nest_id, Number(r.c)]));
   const stewardRows = await db.all(
     "SELECT nest_id, COUNT(DISTINCT user_email) AS c FROM stewards WHERE is_active = 1 GROUP BY nest_id"
   );
-  const stewardByNest = new Map(stewardRows.map((r) => [r.nest_id, r.c]));
+  const stewardByNest = new Map(stewardRows.map((r) => [r.nest_id, Number(r.c)]));
   const stewardEmailRows = await db.all(
     `SELECT nest_id, user_email FROM stewards WHERE is_active = 1
       GROUP BY nest_id, user_email ORDER BY MIN(assigned_at)`
@@ -2913,6 +2946,21 @@ nestRoutes.post("/:nestId/sync", async (c) => {
   );
   return c.json(result, 201);
 });
+nestRoutes.delete("/:nestId/sync", async (c) => {
+  if (c.req.param("nestId") !== "unsynced") {
+    throw new NotFoundError("Not found");
+  }
+  const userId = c.get("userId");
+  if (config.AUTH_MODE !== "open" && !await isServerAdminUserId(userId)) {
+    throw new ForbiddenError("Only the server admin can delete folders");
+  }
+  const body = await c.req.json().catch(() => ({}));
+  if (!body?.name) {
+    throw new ValidationError("name is required");
+  }
+  deleteUnsyncedFolder(body.name);
+  return c.json({ ok: true });
+});
 nestRoutes.get("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
   if (nestId === "unsynced") return handleUnsyncedList(c);
@@ -3037,6 +3085,9 @@ async function addCollaborator(params) {
   const db = getDb();
   let userId = params.userId;
   if (!userId && params.email) {
+    if (!isEmailish(params.email)) {
+      throw new ValidationError("Enter a valid email address.");
+    }
     const email = normalizeEmail(params.email);
     const existing = await db.get(
       "SELECT id FROM users WHERE LOWER(email) = ?",
@@ -3104,8 +3155,30 @@ async function addCollaborator(params) {
       actor: params.email || userId,
       permission: params.permission,
       by: params.grantedByEmail || void 0
-    }
-  );
+    },
+    // Invite email goes to the invitee directly (below), NOT the shared
+    // NOTIFY_EMAIL_TO team inbox — so skip the team-channel email for this
+    // event. Slack/Teams still fire.
+    { skipEmail: true }
+  );
+  const inviteeEmail = params.email || (await db.get("SELECT email FROM users WHERE id = ?", [userId]))?.email;
+  if (inviteeEmail) {
+    void sendEmailToRecipient(inviteeEmail, {
+      status: "shared",
+      docTitle: shareNestName,
+      path: shareNestName,
+      link: docLink(nestId, void 0, params.baseUrl),
+      actor: inviteeEmail,
+      permission: params.permission,
+      by: params.grantedByEmail || void 0
+    });
+    void notifyNestInvite({
+      nestId,
+      inviteeEmail,
+      permission: params.permission,
+      nestName: shareNestName
+    });
+  }
   return await db.get(
     "SELECT * FROM nest_collaborators WHERE id = ?",
     [collabId]
@@ -3297,7 +3370,8 @@ nestTeamRoutes.post("/", async (c) => {
     nestId: c.req.param("nestId"),
     teamId: body.team_id,
     callerUserId: userId,
-    allowAdmin: await isLicenseAdminUserId(userId)
+    allowAdmin: await isLicenseAdminUserId(userId),
+    baseUrl: requestBaseUrl(c.req.url)
   });
   return c.json({ teams }, 201);
 });
@@ -4011,7 +4085,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-7BHI2YXB.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-G7IF7ZNP.js");
   const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -4032,7 +4106,7 @@ nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-YQIIQ7FN.js");
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-FGL47APL.js");
   const allVersions = await getVersions2(nestId, nodeId);
   const approved = await getApprovedVersion2(nestId, nodeId);
   const db = getDb();
@@ -4064,7 +4138,7 @@ nodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-DPN26C47.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-6G7MVTY6.js");
   const history = await getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -4479,7 +4553,7 @@ annotationRoutes.get("/:nodeId{.+}/hosted", async (c) => {
 
 // src/nodes/query-routes.ts
 import { Hono as Hono10 } from "hono";
-import { serializeDocument as serializeDocument2 } from "@promptowl/contextnest-engine";
+import { serializeDocument as serializeDocument3 } from "@promptowl/contextnest-engine";
 
 // src/tables/service.ts
 function splitCsvLine(line) {
@@ -4898,6 +4972,68 @@ async function resolveExportBody(nestId, nodeId, workingBody) {
   }
 }
 
+// src/nests/bundle-service.ts
+import { readdirSync as readdirSync2, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { join as join4, sep } from "path";
+import JSZip from "jszip";
+import { serializeDocument as serializeDocument2 } from "@promptowl/contextnest-engine";
+function walkFiles(root) {
+  const out = [];
+  let entries;
+  try {
+    entries = readdirSync2(root, { recursive: true });
+  } catch {
+    return out;
+  }
+  for (const rel of entries) {
+    try {
+      if (statSync2(join4(root, rel)).isFile()) out.push(rel.split(sep).join("/"));
+    } catch {
+    }
+  }
+  return out;
+}
+async function exportNestBundle(nestId, includeDrafts) {
+  const db = getDb();
+  const approvedRows = await db.all(
+    "SELECT node_id, approved_version FROM approved_versions WHERE nest_id = ?",
+    [nestId]
+  );
+  const approvedByNode = new Map(
+    approvedRows.map((r) => [r.node_id, r.approved_version])
+  );
+  const { storage } = await engineCache.get(nestId);
+  const docs = await storage.discoverDocuments();
+  const zip = new JSZip();
+  let count = 0;
+  for (const doc of docs) {
+    const approved = approvedByNode.get(doc.id);
+    const frontmatter = stripUndefinedDeep({ ...doc.frontmatter });
+    let body = doc.body || "";
+    if (approved != null) {
+      const approvedBody = await resolveExportBody(nestId, doc.id, body);
+      if (approvedBody == null) continue;
+      body = approvedBody;
+      frontmatter.status = "published";
+      frontmatter.version = approved;
+    } else {
+      if (!includeDrafts) continue;
+      frontmatter.status = "draft";
+    }
+    zip.file(`${doc.id}.md`, serializeDocument2({ ...doc, frontmatter, body }));
+    count++;
+  }
+  const nestPath = resolveNestPath(nestId);
+  for (const rel of walkFiles(nestPath)) {
+    const segs = rel.split("/");
+    const keep = segs.includes(".versions") || rel === ".context/config.yaml" || rel === "CONTEXT.md";
+    if (!keep) continue;
+    zip.file(rel, readFileSync2(join4(nestPath, rel)));
+  }
+  trackEvent("nest.export.bundle", { nestId, documents: count, includeDrafts });
+  return zip.generateAsync({ type: "arraybuffer" });
+}
+
 // src/nodes/graph-service.ts
 var MAX_GRAPH_NODES = 150;
 var WIKILINK_RE = /\[\[([^\]|]+)(?:\|([^\]]+))?\]\]/g;
@@ -5451,10 +5587,24 @@ queryRoutes.get("/context", async (c) => {
   return c.json({ content: content || "" });
 });
 queryRoutes.get("/export", async (c) => {
+  const nestId = c.req.param("nestId");
+  if (c.req.query("format") === "bundle") {
+    const perm = await resolveNestPermission(nestId, c.get("userId"));
+    if (perm !== "owner" && perm !== "admin") {
+      throw new ForbiddenError("Only the nest owner or an admin can export a bundle");
+    }
+    const draftsParam = c.req.query("includeDrafts");
+    const includeDrafts = draftsParam === "1" || draftsParam === "true";
+    const zip = await exportNestBundle(nestId, includeDrafts);
+    const filename = `nest-${nestId}.zip`;
+    return c.body(zip, 200, {
+      "Content-Type": "application/zip",
+      "Content-Disposition": `attachment; filename="${filename}"`
+    });
+  }
   if (!isMarkdownFormat(c)) {
-    throw new ValidationError("format=markdown is required");
+    throw new ValidationError("format=markdown or format=bundle is required");
   }
-  const nestId = c.req.param("nestId");
   const { storage, query: queryEngine } = await engineCache.get(nestId);
   const selector = c.req.query("selector")?.trim() || null;
   let documents;
@@ -5553,7 +5703,7 @@ queryRoutes.post("/publish", async (c) => {
       body: doc.content,
       rawContent: ""
     };
-    const serialized = serializeDocument2(node);
+    const serialized = serializeDocument3(node);
     await storage.writeDocument(id, serialized);
     await syncNodeTags(nestId, id, tags);
     created.push(id);
@@ -7358,17 +7508,15 @@ ${resolved.map((r) => `- ${r.steward.userEmail} (${r.source})`).join("\n")}` : "
         (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
       );
       if (!node) return `Node not found: ${args.title}`;
-      const currentVersion = await getCurrentVersion(ctx.nestId, node.id);
       try {
         const request = await approve({
           nestId: ctx.nestId,
           nodeId: node.id,
-          version: currentVersion,
           approvedBy: ctx.userEmail,
           note: args.note,
           baseUrl: ctx.baseUrl
         });
-        return `Approved "${args.title}" v${currentVersion}. This version is now live for AI queries.${args.note ? `
+        return `Approved "${args.title}" v${request.version}. This version is now live for AI queries.${args.note ? `
 Note: ${args.note}` : ""}`;
       } catch (err) {
         return `Cannot approve: ${err.message}`;
@@ -7380,17 +7528,15 @@ Note: ${args.note}` : ""}`;
         (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
       );
       if (!node) return `Node not found: ${args.title}`;
-      const currentVersion = await getCurrentVersion(ctx.nestId, node.id);
       try {
         const request = await reject({
           nestId: ctx.nestId,
           nodeId: node.id,
-          version: currentVersion,
           rejectedBy: ctx.userEmail,
           note: args.note,
           baseUrl: ctx.baseUrl
         });
-        return `Rejected "${args.title}" v${currentVersion}.
+        return `Rejected "${args.title}" v${request.version}.
 Reason: ${args.note}`;
       } catch (err) {
         return `Cannot reject: ${err.message}`;
@@ -7471,8 +7617,8 @@ ${list}`;
       if (!target) return "target is required (a node id or folder prefix).";
       if (!["read", "write"].includes(role)) return "role must be read or write.";
       try {
-        const { createGrant: createGrant2 } = await import("./grants-service-PS5RMMEA.js");
-        const db = (await import("./client-YUOEVUFU.js")).getDb();
+        const { createGrant: createGrant2 } = await import("./grants-service-5ZFISCBH.js");
+        const db = (await import("./client-3MGIP57D.js")).getDb();
         const { normalizeEmail: normalizeEmail2 } = await import("./email-R7DFS6E5.js");
         const e = normalizeEmail2(String(args.email || ""));
         if (!e) return "email is required.";
@@ -8559,7 +8705,7 @@ definitionRoutes.delete("/:id", async (c) => {
 import { Hono as Hono18 } from "hono";
 import { v4 as uuid13 } from "uuid";
 import { mkdir as mkdir2, readFile as readFile2, writeFile } from "fs/promises";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 var assetRoutes = new Hono18();
 var CONTENT_TYPES = {
   png: "image/png",
@@ -8572,7 +8718,7 @@ var CONTENT_TYPES = {
 };
 var VIDEO_EXTS = /* @__PURE__ */ new Set(["mp4", "webm"]);
 var IMAGE_MAX_BYTES = 10 * 1024 * 1024;
-var VIDEO_MAX_BYTES = 100 * 1024 * 1024;
+var VIDEO_MAX_BYTES = config.VIDEO_MAX_BYTES;
 var ASSET_MAX_REQUEST_BYTES = VIDEO_MAX_BYTES + 1024 * 1024;
 var SAFE_NAME = /^[0-9a-f-]{36}\.(png|jpe?g|gif|webp|mp4|webm)$/;
 assetRoutes.post("/", async (c) => {
@@ -8607,9 +8753,9 @@ assetRoutes.post("/", async (c) => {
     );
   }
   const name = `${uuid13()}.${ext === "jpeg" ? "jpg" : ext}`;
-  const dir = join4(resolveNestPath(nestId), "assets");
+  const dir = join5(resolveNestPath(nestId), "assets");
   await mkdir2(dir, { recursive: true });
-  await writeFile(join4(dir, name), Buffer.from(await file.arrayBuffer()));
+  await writeFile(join5(dir, name), Buffer.from(await file.arrayBuffer()));
   const url = `/nests/${nestId}/assets/${name}`;
   return c.json(
     {
@@ -8631,7 +8777,7 @@ assetRoutes.get("/:file", async (c) => {
   }
   let bytes;
   try {
-    bytes = await readFile2(join4(resolveNestPath(nestId), "assets", name));
+    bytes = await readFile2(join5(resolveNestPath(nestId), "assets", name));
   } catch {
     throw new NotFoundError("Asset not found");
   }
@@ -9386,8 +9532,8 @@ function rowToComment(row) {
 }
 
 // src/governance/stewards-parser.ts
-import { readFileSync as readFileSync2, existsSync } from "fs";
-import { join as join5 } from "path";
+import { readFileSync as readFileSync3, existsSync } from "fs";
+import { join as join6 } from "path";
 function parseStewardsYaml(content) {
   const result = { version: 1 };
   const lines = content.split("\n");
@@ -9453,13 +9599,13 @@ function parseEntry(str) {
 function loadStewardsConfig(nestId) {
   const nestPath = resolveNestPath(nestId);
   const candidates = [
-    join5(nestPath, "stewards.yaml"),
-    join5(nestPath, "stewards.yml"),
-    join5(nestPath, ".context", "stewards.yaml")
+    join6(nestPath, "stewards.yaml"),
+    join6(nestPath, "stewards.yml"),
+    join6(nestPath, ".context", "stewards.yaml")
   ];
   for (const candidatePath of candidates) {
     if (existsSync(candidatePath)) {
-      const content = readFileSync2(candidatePath, "utf-8");
+      const content = readFileSync3(candidatePath, "utf-8");
       return parseStewardsYaml(content);
     }
   }
@@ -9515,7 +9661,8 @@ governanceRoutes.post("/stewards", async (c) => {
       documentId: body.documentId,
       tagName: body.tagName,
       users: body.users,
-      assignedBy
+      assignedBy,
+      baseUrl: requestBaseUrl(c.req.url)
     });
     return c.json({ stewards: created2 }, 201);
   }
@@ -9533,7 +9680,8 @@ governanceRoutes.post("/stewards", async (c) => {
         role: body.role
       }
     ],
-    assignedBy
+    assignedBy,
+    baseUrl: requestBaseUrl(c.req.url)
   });
   return c.json({ steward: created[0] }, 201);
 });
@@ -9852,7 +10000,6 @@ governanceNodeRoutes.post("/:nodeId{.+}/approve", async (c) => {
     const request = await approve({
       nestId,
       nodeId,
-      version: await getCurrentVersion(nestId, nodeId),
       approvedBy: userEmail,
       note: body.note,
       override: body.override && isAdmin,
@@ -9875,7 +10022,6 @@ governanceNodeRoutes.post("/:nodeId{.+}/reject", async (c) => {
     const request = await reject({
       nestId,
       nodeId,
-      version: await getCurrentVersion(nestId, nodeId),
       rejectedBy: userEmail,
       note: body.note,
       baseUrl: requestBaseUrl(c.req.url)
@@ -9968,19 +10114,19 @@ async function ensureAnonymousUser() {
 // src/app.ts
 import { serveStatic } from "@hono/node-server/serve-static";
 import { fileURLToPath } from "url";
-import { dirname as dirname2, join as join6, relative as relative2 } from "path";
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname2, join as join7, relative as relative2 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync4 } from "fs";
 var HERE = dirname2(fileURLToPath(import.meta.url));
 var SERVICE_VERSION = (() => {
   try {
-    return JSON.parse(readFileSync3(join6(HERE, "..", "package.json"), "utf8")).version;
+    return JSON.parse(readFileSync4(join7(HERE, "..", "package.json"), "utf8")).version;
   } catch {
     return "unknown";
   }
 })();
 var UI_DIR_CANDIDATES = [
-  join6(HERE, "web3"),
-  join6(process.cwd(), "dist", "web3")
+  join7(HERE, "web3"),
+  join7(process.cwd(), "dist", "web3")
 ];
 var UI_DIR_ABS = UI_DIR_CANDIDATES.find((p) => existsSync2(p)) || UI_DIR_CANDIDATES[0];
 var UI_DIR_REL = relative2(process.cwd(), UI_DIR_ABS) || ".";
@@ -10016,6 +10162,22 @@ var flexAuthMiddleware = createMiddleware2(async (c, next) => {
   }
   return c.json({ error: "Missing or invalid credentials" }, 401);
 });
+var APPROVE_CACHE_TTL_MS = 3e4;
+var approveCache = /* @__PURE__ */ new Map();
+async function canApproveInNest(nestId, email) {
+  const key = `${nestId} ${email.toLowerCase()}`;
+  const now = Date.now();
+  const hit = approveCache.get(key);
+  if (hit && hit.exp > now) return hit.ok;
+  const roles = await resolveUserRoles(nestId, email);
+  let ok = roles.includes("admin") || roles.includes("reviewer");
+  if (!ok && roles.includes("owner")) ok = await nestAllowsSelfApprove(nestId);
+  if (approveCache.size > 500) {
+    for (const [k, v] of approveCache) if (v.exp <= now) approveCache.delete(k);
+  }
+  approveCache.set(key, { ok, exp: now + APPROVE_CACHE_TTL_MS });
+  return ok;
+}
 function createApp() {
   const app = new Hono21({ router: new LinearRouter() });
   const corsOrigins = config.CORS_ORIGINS;
@@ -10185,6 +10347,7 @@ function createApp() {
   });
   const serverAdminAllowed = async (c) => config.AUTH_MODE === "open" || await isServerAdminUserId(c.get("userId"));
   app.use("/admin/settings", flexAuthMiddleware);
+  app.use("/admin/settings/*", flexAuthMiddleware);
   const currentServerSettings = () => ({
     promptowl_sign_in_gate: config.PROMPTOWL_SIGN_IN_GATE,
     manual_sign_in: config.MANUAL_SIGN_IN,
@@ -10217,6 +10380,7 @@ function createApp() {
     // Server-wide runner default. NEVER the value — masked tail only.
     anthropic_api_key_masked: process.env.ANTHROPIC_API_KEY ? `\u2022\u2022\u2022\u2022${process.env.ANTHROPIC_API_KEY.slice(-4)}` : null,
     slack_webhook_url: config.SLACK_WEBHOOK_URL ?? "",
+    msteams_webhook_url: config.MSTEAMS_WEBHOOK_URL ?? "",
     smtp_url: config.SMTP_URL ?? "",
     notify_email_from: config.NOTIFY_EMAIL_FROM ?? "",
     notify_email_to: config.NOTIFY_EMAIL_TO ?? ""
@@ -10226,6 +10390,20 @@ function createApp() {
       return c.json({ error: "Only the server admin can view this." }, 403);
     return c.json(currentServerSettings());
   });
+  app.post("/admin/settings/test-notification", async (c) => {
+    if (!await serverAdminAllowed(c))
+      return c.json({ error: "Only the server admin can do this." }, 403);
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json({ error: "Invalid JSON body" }, 400);
+    }
+    if (body.channel !== "slack" && body.channel !== "teams")
+      return c.json({ error: "channel must be 'slack' or 'teams'" }, 400);
+    const result = await sendTestNotification(body.channel);
+    return result.ok ? c.json({ ok: true }) : c.json({ error: result.error }, 502);
+  });
   app.patch("/admin/settings", async (c) => {
     if (!await serverAdminAllowed(c))
       return c.json({ error: "Only the server admin can change this." }, 403);
@@ -10418,6 +10596,12 @@ function createApp() {
         addError("slack_webhook_url", "Slack webhook must be an https:// URL (or leave it empty to turn Slack notifications off).");
       else pending.push({ name: "SLACK_WEBHOOK_URL", value: v || null });
     }
+    if ("msteams_webhook_url" in body) {
+      const v = String(body.msteams_webhook_url ?? "").trim();
+      if (v && !/^https:\/\//i.test(v))
+        addError("msteams_webhook_url", "Microsoft Teams webhook must be an https:// URL (or leave it empty to turn Teams notifications off).");
+      else pending.push({ name: "MSTEAMS_WEBHOOK_URL", value: v || null });
+    }
     if ("smtp_url" in body) {
       const v = String(body.smtp_url ?? "").trim();
       if (v && !/^smtps?:\/\//i.test(v))
@@ -10633,12 +10817,16 @@ function createApp() {
     const userId = c.get("userId");
     const me = await resolveCallerEmail(userId);
     const nestName2 = /* @__PURE__ */ new Map();
-    for (const n of [
-      ...await listNests(userId),
-      ...await listSharedNests(userId)
-    ])
+    for (const n of await listVisibleNests(userId))
       nestName2.set(n.id, n.name ?? n.id);
-    const { requests } = await getReviewQueue({ status: "pending", limit: 200 });
+    const limit = Math.min(Math.max(Number(c.req.query("limit")) || 50, 1), 100);
+    const offset = Math.max(Number(c.req.query("offset")) || 0, 0);
+    const { requests, total } = await getReviewQueue({
+      status: "pending",
+      nestIds: [...nestName2.keys()],
+      limit,
+      offset
+    });
     const toItem = (r) => ({
       type: "review",
       nest_id: r.nestId,
@@ -10649,12 +10837,29 @@ function createApp() {
       requested_at: r.requestedAt,
       priority: r.priority
     });
-    const mine = requests.filter((r) => nestName2.has(r.nestId));
     const byNewest = (a, b) => a.requested_at < b.requested_at ? 1 : -1;
-    const items = mine.filter((r) => r.requestedBy !== me).map(toItem).sort(byNewest);
-    const waiting = mine.filter((r) => r.requestedBy === me).map(toItem).sort(byNewest);
+    const others = requests.filter((r) => r.requestedBy !== me);
+    const nestApprove = new Map(
+      await Promise.all(
+        [...new Set(others.map((r) => r.nestId))].map(
+          async (nestId) => [
+            nestId,
+            await canApproveInNest(nestId, me)
+          ]
+        )
+      )
+    );
+    const items = others.filter((r) => nestApprove.get(r.nestId)).map(toItem).sort(byNewest);
+    const waiting = requests.filter((r) => r.requestedBy === me).map(toItem).sort(byNewest);
     const notifications = await listNotifications(me, { unreadOnly: true, limit: 50 });
-    return c.json({ items, waiting, notifications });
+    return c.json({
+      items,
+      waiting,
+      notifications,
+      // total = all pending across visible nests (both buckets); has_more drives
+      // the "Load more" control on the client.
+      pagination: { total, limit, offset, has_more: offset + requests.length < total }
+    });
   });
   app.get("/me/notifications", async (c) => {
     const me = await resolveCallerEmail(c.get("userId"));
@@ -10672,9 +10877,7 @@ function createApp() {
     const db = getDb();
     const userId = c.get("userId");
     const userEmail = await resolveCallerEmail(userId);
-    const owned = await listNests(userId);
-    const sharedNests = await listSharedNests(userId);
-    const visibleNests = [...owned, ...sharedNests];
+    const visibleNests = await listVisibleNests(userId);
     let documents = 0;
     for (const nest of visibleNests) {
       try {