@promptowl/contextnest-community 1.13.0 → 1.14.0

package/dist/{chunk-PAIP5KHB.js → chunk-MZ4IR5KH.js}

@@ -2,12 +2,13 @@ import {
   grantCoversNode,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-ZQS5W45U.js";
+} from "./chunk-IHGPZ6NY.js";
 import {
   createVersion,
   getApprovedVersion,
+  getCurrentVersion,
   setApprovedVersion
-} from "./chunk-EG77SQHO.js";
+} from "./chunk-JP67WXLA.js";
 import {
   buildDocContext,
   buildTitleMap,
@@ -17,8 +18,10 @@ import {
   engineCache,
   isPublicReader,
   isStewardshipEnabled,
-  resolveStewardsForNode
-} from "./chunk-Q5NRCDD4.js";
+  notifyEmailForNest,
+  resolveStewardsForNode,
+  sendEmailToRecipient
+} from "./chunk-KPK656BH.js";
 import {
   ConflictError,
   NotFoundError,
@@ -31,7 +34,7 @@ import {
 import {
   config,
   getDb
-} from "./chunk-5QQ7WKAI.js";
+} from "./chunk-I5KYGMIT.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid3 } from "uuid";
@@ -146,6 +149,25 @@ async function notifyReviewResolved(params) {
     return 0;
   }
 }
+async function notifyNestInvite(params) {
+  const { nestId, inviteeEmail, permission, nestName } = params;
+  try {
+    await getDb().run(
+      `INSERT INTO notifications (id, nest_id, user_email, kind, subject_id, message, created_at)
+       VALUES (?, ?, ?, 'nest_invite', ?, ?, ?)`,
+      [
+        uuid(),
+        nestId,
+        inviteeEmail.toLowerCase(),
+        nestId,
+        `You were added to "${nestName}" as ${permission}`,
+        (/* @__PURE__ */ new Date()).toISOString()
+      ]
+    );
+  } catch (err) {
+    console.error("[notify] invite inbox insert failed", nestId, inviteeEmail, err);
+  }
+}
 async function listNotifications(userEmail, opts = {}) {
   const limit = Math.min(opts.limit ?? 50, 200);
   return await getDb().all(
@@ -497,23 +519,158 @@ async function envValues(nestId) {
   return { ...base, ...Object.fromEntries(rows.map((r) => [r.key, r.value])) };
 }
 
-// src/notify/dispatch.ts
+// src/notify/webhook.ts
+async function resolveNestName(nestId) {
+  try {
+    const row = await getDb().get("SELECT name FROM nests WHERE id = ?", [
+      nestId
+    ]);
+    if (row?.name) return row.name;
+  } catch {
+  }
+  return nestId;
+}
+async function rawPost(url, body, timeoutMs) {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+  try {
+    return await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      signal: ctrl.signal
+    });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var warned = /* @__PURE__ */ new Set();
+async function postWebhook(url, body, who) {
+  try {
+    await rawPost(url, body, 3e3);
+  } catch (err) {
+    if (!warned.has(who)) {
+      warned.add(who);
+      console.warn(
+        `[notify] delivery failed for ${who} (muting further warnings):`,
+        err instanceof Error ? err.message : err
+      );
+    }
+  }
+}
+async function testWebhook(url, body) {
+  try {
+    const res = await rawPost(url, body, 5e3);
+    return res.ok ? { ok: true } : { ok: false, error: `Webhook responded ${res.status} ${res.statusText}.` };
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : "Request failed."
+    };
+  }
+}
+
+// src/notify/msteams.ts
+var EMOJI = {
+  ":memo:": "\u{1F4DD}",
+  ":white_check_mark:": "\u2705",
+  ":x:": "\u274C",
+  ":rotating_light:": "\u{1F6A8}",
+  ":key:": "\u{1F511}"
+  // collaborator added (sharing-service)
+};
+var BOLD_SPAN = /(^|\s)\*([^*\n]+)\*(?=\s|[.,;:!?)]|$)/g;
+function slackEmojiToUnicode(s) {
+  return s.replace(/:[a-z0-9_+-]+:/g, (m) => EMOJI[m] ?? m);
+}
+function escapeAdaptiveText(s) {
+  return s.replace(/\\/g, "\\\\").replace(/\[/g, "\\[").replace(/\]/g, "\\]");
+}
+function toAdaptiveText(s) {
+  return slackEmojiToUnicode(escapeAdaptiveText(s)).replace(BOLD_SPAN, "$1**$2**");
+}
+function toPlainText(s) {
+  return slackEmojiToUnicode(s).replace(BOLD_SPAN, "$1$2");
+}
+function msTeamsPayload(title, message) {
+  return {
+    type: "message",
+    attachments: [
+      {
+        contentType: "application/vnd.microsoft.card.adaptive",
+        contentUrl: null,
+        content: {
+          $schema: "http://adaptivecards.io/schemas/adaptive-card.json",
+          type: "AdaptiveCard",
+          version: "1.4",
+          msteams: { width: "Full" },
+          fallbackText: `[${toPlainText(title)}] ${toPlainText(message)}`,
+          body: [
+            {
+              // Same pipeline as the message: the nest name is user-
+              // controlled text too and must not carry link syntax.
+              type: "TextBlock",
+              text: toAdaptiveText(title),
+              weight: "Bolder",
+              size: "Medium",
+              wrap: true
+            },
+            {
+              type: "TextBlock",
+              text: toAdaptiveText(message),
+              wrap: true
+            }
+          ]
+        }
+      }
+    ]
+  };
+}
+async function notifyMsTeamsForNest(nestId, message) {
+  if (!config.MSTEAMS_WEBHOOK_URL) return;
+  const nestName = await resolveNestName(nestId);
+  return notifyMsTeams(nestName, message);
+}
+async function notifyMsTeams(title, message) {
+  const url = config.MSTEAMS_WEBHOOK_URL;
+  if (!url) return;
+  await postWebhook(url, msTeamsPayload(title, message), "msteams");
+}
+
+// src/notify/slack.ts
+async function notifySlackForNest(nestId, message) {
+  if (!config.SLACK_WEBHOOK_URL) return;
+  const nestName = await resolveNestName(nestId);
+  return notifySlack(`*[${nestName}]* ${message}`);
+}
 function escapeMrkdwn(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
+async function notifySlack(text) {
+  const url = config.SLACK_WEBHOOK_URL;
+  if (!url) return;
+  await postWebhook(url, { text: escapeMrkdwn(text) }, "slack");
+}
+
+// src/notify/dispatch.ts
 var EVENT_EMOJI = {
   review_requested: ":memo:",
   review_approved: ":white_check_mark:",
   review_rejected: ":x:",
   run_failed: ":rotating_light:"
 };
+var DIGEST_DELIVERED_KINDS = /* @__PURE__ */ new Set([
+  "review_requested",
+  "review_approved",
+  "review_rejected"
+]);
 function formatBody(channel, nestName, ev) {
   const line = `[${nestName}] ${ev.message}`;
   if (channel === "slack") {
     return { text: escapeMrkdwn(`${EVENT_EMOJI[ev.kind] ?? ""} *[${nestName}]* ${ev.message}`) };
   }
   if (channel === "teams") {
-    return { text: line };
+    return msTeamsPayload(nestName, `${EVENT_EMOJI[ev.kind] ?? ""} ${ev.message}`.trim());
   }
   return {
     kind: ev.kind,
@@ -557,46 +714,23 @@ async function resolveUrl(nestId, raw) {
   }
   return isSafeConnectorUrl(raw) ? raw : null;
 }
-var warned = /* @__PURE__ */ new Set();
-async function post(url, body, who) {
-  try {
-    const ctrl = new AbortController();
-    const timer = setTimeout(() => ctrl.abort(), 3e3);
-    try {
-      await fetch(url, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(body),
-        signal: ctrl.signal
-      });
-    } finally {
-      clearTimeout(timer);
-    }
-  } catch (err) {
-    if (!warned.has(who)) {
-      warned.add(who);
-      console.warn(
-        `[connectors] delivery failed for ${who} (muting further warnings):`,
-        err instanceof Error ? err.message : err
-      );
-    }
-  }
-}
 async function dispatchEvent(ev) {
   const db = getDb();
-  let nestName = ev.nestId;
-  try {
-    const row = await db.get("SELECT name FROM nests WHERE id = ?", [ev.nestId]);
-    if (row?.name) nestName = row.name;
-  } catch {
-  }
-  if (config.SLACK_WEBHOOK_URL) {
-    void post(
+  const nestName = await resolveNestName(ev.nestId);
+  if (config.SLACK_WEBHOOK_URL && !DIGEST_DELIVERED_KINDS.has(ev.kind)) {
+    void postWebhook(
       config.SLACK_WEBHOOK_URL,
       formatBody("slack", nestName, ev),
       "server-slack"
     );
   }
+  if (config.MSTEAMS_WEBHOOK_URL && !DIGEST_DELIVERED_KINDS.has(ev.kind)) {
+    void postWebhook(
+      config.MSTEAMS_WEBHOOK_URL,
+      formatBody("teams", nestName, ev),
+      "server-msteams"
+    );
+  }
   let rows = [];
   try {
     rows = await db.all(
@@ -615,308 +749,20 @@ async function dispatchEvent(ev) {
     if (!kinds.includes("*") && !kinds.includes(ev.kind)) continue;
     const url = await resolveUrl(ev.nestId, r.url);
     if (!url) continue;
-    void post(url, formatBody(r.channel, nestName, ev), `connector:${r.id}`);
+    void postWebhook(url, formatBody(r.channel, nestName, ev), `connector:${r.id}`);
   }
 }
-
-// src/notify/slack.ts
-var warnedOnce = false;
-async function notifySlackForNest(nestId, message) {
-  if (!config.SLACK_WEBHOOK_URL) return;
-  let nestName = nestId;
-  try {
-    const row = await getDb().get("SELECT name FROM nests WHERE id = ?", [
-      nestId
-    ]);
-    if (row?.name) nestName = row.name;
-  } catch {
-  }
-  return notifySlack(`*[${nestName}]* ${message}`);
-}
-function escapeMrkdwn2(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-async function notifySlack(text) {
-  const url = config.SLACK_WEBHOOK_URL;
-  if (!url) return;
-  try {
-    const ctrl = new AbortController();
-    const timer = setTimeout(() => ctrl.abort(), 3e3);
-    try {
-      await fetch(url, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ text: escapeMrkdwn2(text) }),
-        signal: ctrl.signal
-      });
-    } finally {
-      clearTimeout(timer);
-    }
-  } catch (err) {
-    if (!warnedOnce) {
-      warnedOnce = true;
-      console.warn(
-        "[slack] notification failed (suppressing further warnings):",
-        err instanceof Error ? err.message : err
-      );
-    }
-  }
-}
-
-// src/notify/email-render.ts
-function escapeHtml(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-var EVENT = {
-  ":white_check_mark:": { icon: "\u2705", color: "#16a34a" },
-  ":x:": { icon: "\u274C", color: "#dc2626" },
-  ":memo:": { icon: "\u{1F4DD}", color: "#d97706" },
-  ":key:": { icon: "\u{1F511}", color: "#2563eb" }
-};
-var ALL_EMOJI = Object.fromEntries(
-  Object.entries(EVENT).map(([code, m]) => [code, m.icon])
-);
-function renderText(message) {
-  return message.replace(/:[a-z_]+:/g, (m) => ALL_EMOJI[m] ?? "").replace(/\*/g, "").replace(/[ \t]{2,}/g, " ").trim();
-}
-var STATUS_META = {
-  approved: { subjectWord: "approved", label: "Approved", color: "#16a34a" },
-  rejected: { subjectWord: "rejected", label: "Rejected", color: "#dc2626" },
-  pending_review: {
-    subjectWord: "awaiting review",
-    label: "Pending review",
-    color: "#d97706"
-  },
-  shared: { subjectWord: "shared with you", label: "Shared", color: "#2563eb" }
-};
-function renderEmail(d) {
-  const meta = STATUS_META[d.status];
-  const title = d.docTitle.replace(/[\r\n]+/g, " ").trim();
-  const heading = d.status === "shared" ? `New collaborator on ${title}` : `${title} is ${meta.subjectWord}`;
-  const subject = heading.replace(/[\r\n]+/g, " ").trim();
-  const vLabel = d.version != null ? `v${d.version}` : "";
-  const detailsHeader = d.status === "shared" ? "Details" : "Document details";
-  const linkLabel = d.status === "shared" ? "Open nest" : "Open document";
-  const byT = d.actor ? ` by ${d.actor}` : "";
-  const noteT = d.note ? ` with the note: "${d.note}"` : "";
-  const vT = vLabel ? ` ${vLabel}` : "";
-  let lineT;
-  switch (d.status) {
-    case "approved":
-      lineT = `${title}${vT} has been approved${byT}${noteT}.`;
-      break;
-    case "rejected":
-      lineT = `${title}${vT} has been rejected${byT}${noteT}.`;
-      break;
-    case "pending_review":
-      lineT = `A review has been requested for ${title}${vT}${byT}${noteT}.`;
-      break;
-    case "shared":
-      lineT = `${d.actor || "A user"} was added to ${title} as ${d.permission || "a collaborator"}${d.by ? ` by ${d.by}` : ""}.`;
-      break;
-  }
-  const text = [
-    "Hi,",
-    "",
-    lineT,
-    "",
-    "Document details:",
-    `  Path: ${d.path}`,
-    `  Status: ${meta.label}`,
-    ...d.version != null ? [`  Version: v${d.version}`] : [],
-    ...d.link ? [`  Open: ${d.link}`] : [],
-    "",
-    "Regards,",
-    "ContextNest"
-  ].join("\n");
-  const doc = `<strong>${escapeHtml(title)}</strong>`;
-  const byH = d.actor ? ` by ${escapeHtml(d.actor)}` : "";
-  const noteH = d.note ? ` with the note: &ldquo;${escapeHtml(d.note)}&rdquo;` : "";
-  const vH = vLabel ? ` ${vLabel}` : "";
-  let lineH;
-  switch (d.status) {
-    case "approved":
-      lineH = `${doc}${vH} has been approved${byH}${noteH}.`;
-      break;
-    case "rejected":
-      lineH = `${doc}${vH} has been rejected${byH}${noteH}.`;
-      break;
-    case "pending_review":
-      lineH = `A review has been requested for ${doc}${vH}${byH}${noteH}.`;
-      break;
-    case "shared":
-      lineH = `${escapeHtml(d.actor || "A user")} was added to ${doc} as <strong>${escapeHtml(d.permission || "a collaborator")}</strong>${d.by ? ` by ${escapeHtml(d.by)}` : ""}.`;
-      break;
-  }
-  const detailRow = (label, valueHtml) => `<tr>
-      <td style="padding:5px 0;font-size:13px;color:#6b7280;width:90px;vertical-align:top;">${label}</td>
-      <td style="padding:5px 0;font-size:13px;color:#111827;vertical-align:top;">${valueHtml}</td>
-    </tr>`;
-  const detailRows = detailRow("Path", escapeHtml(d.path)) + detailRow(
-    "Status",
-    `<span style="display:inline-block;padding:2px 9px;border-radius:9999px;background:#f3f4f6;color:${meta.color};font-size:12px;font-weight:600;">${meta.label}</span>`
-  ) + (d.version != null ? detailRow("Version", `v${d.version}`) : "");
-  const buttonRow = d.link ? `<tr><td style="padding:20px 24px 0;">
-        <table role="presentation" cellpadding="0" cellspacing="0" border="0"><tr>
-          <td bgcolor="${meta.color}" style="border-radius:6px;">
-            <a href="${escapeHtml(d.link)}" target="_blank" style="display:inline-block;padding:10px 20px;font-size:14px;font-weight:600;color:#ffffff;text-decoration:none;">${linkLabel}</a>
-          </td>
-        </tr></table>
-      </td></tr>` : "";
-  const html = `<div style="margin:0;padding:24px;background:#f6f8fa;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;color:#111827;">
-  <table role="presentation" width="480" cellpadding="0" cellspacing="0" border="0" align="center" style="width:100%;max-width:480px;margin:0 auto;background:#ffffff;border:1px solid #e5e7eb;border-radius:12px;">
-    <tr><td style="padding:20px 24px 0;">
-      <div style="font-size:12px;font-weight:700;color:#6b7280;letter-spacing:0.06em;text-transform:uppercase;">ContextNest</div>
-    </td></tr>
-    <tr><td style="padding:10px 24px 0;">
-      <h1 style="margin:0;font-size:19px;line-height:1.35;font-weight:700;color:#111827;">${escapeHtml(heading)}</h1>
-    </td></tr>
-    <tr><td style="padding:16px 24px 0;font-size:14px;line-height:1.6;color:#374151;">
-      Hi,<br><br>${lineH}
-    </td></tr>
-    <tr><td style="padding:20px 24px 0;">
-      <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border:1px solid #eef0f2;border-radius:8px;">
-        <tr><td style="padding:12px 16px;">
-          <div style="font-size:11px;font-weight:600;color:#9ca3af;letter-spacing:0.04em;text-transform:uppercase;padding-bottom:4px;">${detailsHeader}</div>
-          <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0">${detailRows}</table>
-        </td></tr>
-      </table>
-    </td></tr>
-    ${buttonRow}
-    <tr><td style="padding:22px 24px 24px;font-size:14px;line-height:1.6;color:#374151;">
-      Regards,<br>ContextNest
-    </td></tr>
-    <tr><td style="padding:14px 24px;border-top:1px solid #f0f0f0;font-size:11px;line-height:1.5;color:#9ca3af;">
-      Automated governance notification from ContextNest. You received this because email notifications are enabled on this server.
-    </td></tr>
-  </table>
-</div>`;
-  return { subject, text, html };
-}
-function renderHtml(message, nestName) {
-  const lead = message.match(/^(:[a-z_]+:)\s*/);
-  const meta = lead && EVENT[lead[1]] || { icon: "\u{1F514}", color: "#475569" };
-  const rest = lead ? message.slice(lead[0].length) : message;
-  const body = escapeHtml(rest).replace(/\*([^*]+)\*/g, "<strong>$1</strong>").replace(/\n/g, "<br>");
-  const safeNest = escapeHtml(nestName);
-  return `<div style="background:#f6f8fa;padding:24px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">
-  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:480px;margin:0 auto;background:#ffffff;border:1px solid #e5e7eb;border-radius:12px;overflow:hidden;">
-    <tr><td style="padding:20px 24px 16px;border-bottom:1px solid #f0f0f0;">
-      <div style="font-size:15px;font-weight:700;color:#111827;letter-spacing:-0.01em;">ContextNest</div>
-      <div style="font-size:13px;color:#6b7280;margin-top:2px;">${safeNest}</div>
-    </td></tr>
-    <tr><td style="padding:24px;">
-      <table role="presentation" cellpadding="0" cellspacing="0"><tr>
-        <td valign="top" style="font-size:22px;line-height:1;padding-right:14px;">${meta.icon}</td>
-        <td valign="top" style="font-size:15px;line-height:1.55;color:#111827;border-left:3px solid ${meta.color};padding-left:14px;">${body}</td>
-      </tr></table>
-    </td></tr>
-    <tr><td style="padding:14px 24px;border-top:1px solid #f0f0f0;font-size:11px;line-height:1.5;color:#9ca3af;">
-      Automated governance notification from ContextNest. You received this because email notifications are enabled on this server.
-    </td></tr>
-  </table>
-</div>`;
-}
-
-// src/notify/email.ts
-var transporterPromise = null;
-var configuredUrl = null;
-var warnedOnce2 = false;
-var SMTP_TIMEOUT_DEFAULTS = [
-  ["connectionTimeout", 5e3],
-  ["greetingTimeout", 5e3],
-  ["socketTimeout", 1e4]
-];
-function withTimeouts(url) {
-  const query = url.includes("?") ? url.slice(url.indexOf("?") + 1) : "";
-  const missing = SMTP_TIMEOUT_DEFAULTS.filter(
-    ([name]) => !new RegExp(`(^|&)${name}=`, "i").test(query)
-  ).map(([name, ms]) => `${name}=${ms}`);
-  if (missing.length === 0) return url;
-  return url + (url.includes("?") ? "&" : "?") + missing.join("&");
-}
-async function verifySmtp(url) {
-  let transporter = null;
-  try {
-    const nodemailer = await import("nodemailer");
-    transporter = nodemailer.default.createTransport(withTimeouts(url), {
-      disableFileAccess: true,
-      disableUrlAccess: true
-    });
-    await transporter.verify();
-    return { ok: true };
-  } catch (err) {
-    return { ok: false, error: err instanceof Error ? err.message : String(err) };
-  } finally {
-    try {
-      transporter?.close?.();
-    } catch {
-    }
-  }
-}
-async function getTransporter() {
-  const url = config.SMTP_URL;
-  if (!url) return null;
-  if (!transporterPromise || configuredUrl !== url) {
-    configuredUrl = url;
-    transporterPromise = import("nodemailer").then(
-      (nodemailer) => nodemailer.default.createTransport(withTimeouts(url), {
-        // Per-message defaults (belt-and-braces; also set on each sendMail).
-        disableFileAccess: true,
-        disableUrlAccess: true
-      })
-    );
-    transporterPromise.catch(() => {
-      transporterPromise = null;
-      configuredUrl = null;
-    });
-  }
-  return transporterPromise;
-}
-async function notifyEmailForNest(nestId, message, details) {
-  const from = config.NOTIFY_EMAIL_FROM;
-  const to = config.NOTIFY_EMAIL_TO;
-  if (!config.SMTP_URL || !from || !to) return;
-  try {
-    const transporter = await getTransporter();
-    if (!transporter) return;
-    let subject;
-    let text;
-    let html;
-    if (details) {
-      ({ subject, text, html } = renderEmail(details));
-    } else {
-      let name = nestId;
-      try {
-        const row = await getDb().get("SELECT name FROM nests WHERE id = ?", [
-          nestId
-        ]);
-        if (row?.name) name = row.name;
-      } catch {
-      }
-      const safeName = name.replace(/[\r\n]+/g, " ").trim();
-      subject = `ContextNest \xB7 ${safeName}`;
-      text = renderText(message);
-      html = renderHtml(message, safeName);
-    }
-    await transporter.sendMail({
-      from,
-      to,
-      subject,
-      text,
-      html,
-      disableFileAccess: true,
-      disableUrlAccess: true
-    });
-  } catch (err) {
-    if (!warnedOnce2) {
-      warnedOnce2 = true;
-      console.warn(
-        "[email] notification failed (suppressing further warnings):",
-        err instanceof Error ? err.message : err
-      );
-    }
-  }
+async function sendTestNotification(channel) {
+  const url = channel === "slack" ? config.SLACK_WEBHOOK_URL : config.MSTEAMS_WEBHOOK_URL;
+  const label = channel === "slack" ? "Slack" : "Microsoft Teams";
+  if (!url)
+    return { ok: false, error: `Save a ${label} webhook URL first, then test.` };
+  const ev = {
+    kind: "test",
+    nestId: "",
+    message: "Test notification from ContextNest \u2014 your connector is working."
+  };
+  return testWebhook(url, formatBody(channel, "ContextNest", ev));
 }
 
 // src/notify/notify.ts
@@ -935,22 +781,46 @@ async function flush(nestId) {
   if (!buf) return;
   buffers.delete(nestId);
   const text = buildText(buf.events.map((e) => e.line));
-  const details = buf.events.length === 1 ? buf.events[0].details : void 0;
+  const emailEvents = buf.events.filter((e) => !e.skipEmail);
+  const emailText = buildText(emailEvents.map((e) => e.line));
+  const emailDetails = emailEvents.length === 1 ? emailEvents[0].details : void 0;
   await Promise.allSettled([
     notifySlackForNest(nestId, text),
-    notifyEmailForNest(nestId, text, details)
+    notifyMsTeamsForNest(nestId, text),
+    emailEvents.length > 0 ? notifyEmailForNest(nestId, emailText, emailDetails) : Promise.resolve()
   ]);
 }
-async function notifyNestEvent(nestId, message, details) {
-  if (!config.SLACK_WEBHOOK_URL && !config.SMTP_URL) return;
+async function notifyNestEvent(nestId, message, details, opts) {
+  if (!config.SLACK_WEBHOOK_URL && !config.MSTEAMS_WEBHOOK_URL && !config.SMTP_URL)
+    return;
   const buf = buffers.get(nestId);
   if (buf) {
-    buf.events.push({ line: message, details });
+    buf.events.push({ line: message, details, skipEmail: opts?.skipEmail });
     return;
   }
   const timer = setTimeout(() => void flush(nestId), config.NOTIFY_DEBOUNCE_MS);
   timer.unref?.();
-  buffers.set(nestId, { events: [{ line: message, details }], timer });
+  buffers.set(nestId, {
+    events: [{ line: message, details, skipEmail: opts?.skipEmail }],
+    timer
+  });
+}
+
+// src/shared/node-write-lock.ts
+var nodeWriteChains = /* @__PURE__ */ new Map();
+function nodeWriteKey(nestId, nodeId) {
+  return `${nestId}::${nodeId}`;
+}
+function withNodeWriteLock(key, fn) {
+  const prev = (nodeWriteChains.get(key) ?? Promise.resolve()).catch(() => {
+  });
+  const run = prev.then(fn);
+  nodeWriteChains.set(key, run);
+  void run.catch(() => {
+  }).finally(() => {
+    if (nodeWriteChains.get(key) === run) nodeWriteChains.delete(key);
+  });
+  return run;
 }
 
 // src/governance/safe-publish.ts
@@ -1036,187 +906,270 @@ async function submitForReview(params) {
     requestedBy: params.requestedBy,
     reviewId: id
   });
+  try {
+    const stewards = await resolveStewardsForNode(params.nestId, params.nodeId);
+    const reviewers = [
+      ...new Set(
+        stewards.filter((s) => s.steward.role === "reviewer").map((s) => s.steward.userEmail.toLowerCase())
+      )
+    ].filter((email) => email !== params.requestedBy.toLowerCase());
+    if (reviewers.length > 0) {
+      void sendEmailToRecipient(reviewers, {
+        status: "pending_review",
+        docTitle: reviewCtx.docTitle,
+        path: reviewCtx.path,
+        link: reviewCtx.link,
+        actor: params.requestedBy,
+        version: params.version,
+        note: params.note || null
+      });
+    }
+  } catch (err) {
+    console.error(
+      "[notify] reviewer email fan-out failed",
+      params.nestId,
+      params.nodeId,
+      err
+    );
+  }
   return await getReviewRequest(id);
 }
-async function approve(params) {
+async function repointPendingReview(params) {
   const db = getDb();
   const pending = await db.get(
-    "SELECT * FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending' ORDER BY requested_at DESC LIMIT 1",
+    "SELECT id, version FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending' ORDER BY requested_at DESC LIMIT 1",
     [params.nestId, params.nodeId]
   );
-  if (!pending) {
-    throw new Error("No pending review for this node");
-  }
-  if (!params.override) {
-    const check = await canUserApprove(
-      params.nestId,
-      params.nodeId,
-      params.approvedBy
+  if (!pending || pending.version === params.newVersion) return;
+  await db.transaction(async (tx) => {
+    await tx.run("UPDATE review_requests SET version = ? WHERE id = ?", [
+      params.newVersion,
+      pending.id
+    ]);
+    await tx.run(
+      "UPDATE node_versions SET status = 'draft' WHERE nest_id = ? AND node_id = ? AND version = ?",
+      [params.nestId, params.nodeId, pending.version]
     );
-    if (!check.allowed) {
-      throw new Error(check.reason);
+    await tx.run(
+      "UPDATE node_versions SET status = 'pending_review' WHERE nest_id = ? AND node_id = ? AND version = ?",
+      [params.nestId, params.nodeId, params.newVersion]
+    );
+  });
+}
+async function approve(params) {
+  return withNodeWriteLock(nodeWriteKey(params.nestId, params.nodeId), async () => {
+    const db = getDb();
+    const version = await getCurrentVersion(params.nestId, params.nodeId);
+    const pending = await db.get(
+      "SELECT * FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending' ORDER BY requested_at DESC LIMIT 1",
+      [params.nestId, params.nodeId]
+    );
+    if (!pending) {
+      throw new Error("No pending review for this node");
     }
-  }
-  await db.run(
-    `UPDATE review_requests
+    if (!params.override) {
+      const check = await canUserApprove(
+        params.nestId,
+        params.nodeId,
+        params.approvedBy
+      );
+      if (!check.allowed) {
+        throw new Error(check.reason);
+      }
+    }
+    await db.run(
+      `UPDATE review_requests
      SET status = 'approved', resolved_by = ?, resolved_at = ${nowExpr(db)},
          resolution_note = ?, is_override = ?
      WHERE id = ?`,
-    [params.approvedBy, params.note || null, params.override ? 1 : 0, pending.id]
-  );
-  void dispatchEvent({
-    kind: "review_approved",
-    nestId: params.nestId,
-    subjectId: params.nodeId,
-    actor: params.approvedBy,
-    message: `*${await describeNode(params.nestId, params.nodeId)}* v${params.version} approved by ${params.approvedBy}`
-  });
-  await notifyReviewResolved({
-    nestId: params.nestId,
-    nodeId: params.nodeId,
-    status: "approved",
-    resolvedBy: params.approvedBy,
-    requestedBy: pending.requested_by,
-    reviewId: pending.id
-  });
-  await db.run(
-    "UPDATE node_versions SET status = 'published' WHERE nest_id = ? AND node_id = ? AND version = ?",
-    [params.nestId, params.nodeId, params.version]
-  );
-  await db.run(
-    insertOrReplace(
-      db,
-      `INSERT INTO approved_versions (nest_id, node_id, approved_version, approved_by)
-       VALUES (?, ?, ?, ?)`,
-      ["nest_id", "node_id"],
-      `approved_version = excluded.approved_version, approved_by = excluded.approved_by, approved_at = ${nowExpr(db)}`
-    ),
-    [params.nestId, params.nodeId, params.version, params.approvedBy]
-  );
-  try {
-    const { storage } = await engineCache.get(params.nestId);
-    const result = await safePublishDocument(storage, params.nodeId, {
-      editedBy: params.approvedBy,
-      note: params.note || `Approved review request ${pending.id}`
+      [params.approvedBy, params.note || null, params.override ? 1 : 0, pending.id]
+    );
+    void dispatchEvent({
+      kind: "review_approved",
+      nestId: params.nestId,
+      subjectId: params.nodeId,
+      actor: params.approvedBy,
+      message: `*${await describeNode(params.nestId, params.nodeId)}* v${version} approved by ${params.approvedBy}`
     });
-    const engineVersion = result.versionEntry.version;
-    if (engineVersion !== params.version) {
-      const node = result.node;
-      const tags = node.frontmatter.tags || [];
-      await createVersion({
-        nestId: params.nestId,
-        nodeId: params.nodeId,
-        version: engineVersion,
-        content: node.body || "",
-        author: params.approvedBy,
-        status: "published",
-        tags,
-        changeNote: params.note || `Approved review request ${pending.id}`
+    await notifyReviewResolved({
+      nestId: params.nestId,
+      nodeId: params.nodeId,
+      status: "approved",
+      resolvedBy: params.approvedBy,
+      requestedBy: pending.requested_by,
+      reviewId: pending.id
+    });
+    await db.run(
+      "UPDATE node_versions SET status = 'published' WHERE nest_id = ? AND node_id = ? AND version = ?",
+      [params.nestId, params.nodeId, version]
+    );
+    await db.run(
+      insertOrReplace(
+        db,
+        `INSERT INTO approved_versions (nest_id, node_id, approved_version, approved_by)
+       VALUES (?, ?, ?, ?)`,
+        ["nest_id", "node_id"],
+        `approved_version = excluded.approved_version, approved_by = excluded.approved_by, approved_at = ${nowExpr(db)}`
+      ),
+      [params.nestId, params.nodeId, version, params.approvedBy]
+    );
+    try {
+      const { storage } = await engineCache.get(params.nestId);
+      const result = await safePublishDocument(storage, params.nodeId, {
+        editedBy: params.approvedBy,
+        note: params.note || `Approved review request ${pending.id}`
       });
-      await setApprovedVersion(
-        params.nestId,
-        params.nodeId,
-        engineVersion,
-        params.approvedBy
+      const engineVersion = result.versionEntry.version;
+      if (engineVersion !== version) {
+        const node = result.node;
+        const tags = node.frontmatter.tags || [];
+        await createVersion({
+          nestId: params.nestId,
+          nodeId: params.nodeId,
+          version: engineVersion,
+          content: node.body || "",
+          author: params.approvedBy,
+          status: "published",
+          tags,
+          changeNote: params.note || `Approved review request ${pending.id}`
+        });
+        await setApprovedVersion(
+          params.nestId,
+          params.nodeId,
+          engineVersion,
+          params.approvedBy
+        );
+      }
+    } catch (err) {
+      console.error(
+        `publishDocument failed for ${params.nestId}/${params.nodeId} on approve:`,
+        err
       );
     }
-  } catch (err) {
-    console.error(
-      `publishDocument failed for ${params.nestId}/${params.nodeId} on approve:`,
-      err
+    const approveCtx = await buildDocContext(params.nestId, params.nodeId, params.baseUrl);
+    void notifyNestEvent(
+      params.nestId,
+      `:white_check_mark: *${approveCtx.label}* v${version} approved by ${params.approvedBy}`,
+      {
+        status: "approved",
+        docTitle: approveCtx.docTitle,
+        path: approveCtx.path,
+        link: approveCtx.link,
+        actor: params.approvedBy,
+        version
+      },
+      // The verdict emails the submitter directly (below), not the shared
+      // NOTIFY_EMAIL_TO team inbox — skip the team-channel email; Slack/Teams fire.
+      { skipEmail: true }
     );
-  }
-  const approveCtx = await buildDocContext(params.nestId, params.nodeId, params.baseUrl);
-  void notifyNestEvent(
-    params.nestId,
-    `:white_check_mark: *${approveCtx.label}* v${params.version} approved by ${params.approvedBy}`,
-    {
-      status: "approved",
-      docTitle: approveCtx.docTitle,
-      path: approveCtx.path,
-      link: approveCtx.link,
-      actor: params.approvedBy,
-      version: params.version
+    if (pending.requested_by?.toLowerCase() !== params.approvedBy.toLowerCase()) {
+      void sendEmailToRecipient(pending.requested_by, {
+        status: "approved",
+        docTitle: approveCtx.docTitle,
+        path: approveCtx.path,
+        link: approveCtx.link,
+        actor: params.approvedBy,
+        version,
+        note: params.note || null
+      });
     }
-  );
-  return await getReviewRequest(pending.id);
+    return await getReviewRequest(pending.id);
+  });
 }
 async function reject(params) {
-  const db = getDb();
-  const pending = await db.get(
-    "SELECT * FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending' ORDER BY requested_at DESC LIMIT 1",
-    [params.nestId, params.nodeId]
-  );
-  if (!pending) {
-    throw new Error("No pending review for this node");
-  }
-  const check = await canUserApprove(
-    params.nestId,
-    params.nodeId,
-    params.rejectedBy
-  );
-  if (!check.allowed) {
-    throw new Error(check.reason);
-  }
-  await db.run(
-    `UPDATE review_requests
+  return withNodeWriteLock(nodeWriteKey(params.nestId, params.nodeId), async () => {
+    const db = getDb();
+    const version = await getCurrentVersion(params.nestId, params.nodeId);
+    const pending = await db.get(
+      "SELECT * FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending' ORDER BY requested_at DESC LIMIT 1",
+      [params.nestId, params.nodeId]
+    );
+    if (!pending) {
+      throw new Error("No pending review for this node");
+    }
+    const check = await canUserApprove(
+      params.nestId,
+      params.nodeId,
+      params.rejectedBy
+    );
+    if (!check.allowed) {
+      throw new Error(check.reason);
+    }
+    await db.run(
+      `UPDATE review_requests
      SET status = 'rejected', resolved_by = ?, resolved_at = ${nowExpr(db)}, resolution_note = ?
      WHERE id = ?`,
-    [params.rejectedBy, params.note, pending.id]
-  );
-  await db.run(
-    "UPDATE node_versions SET status = 'rejected' WHERE nest_id = ? AND node_id = ? AND version = ?",
-    [params.nestId, params.nodeId, params.version]
-  );
-  const rejectCtx = await buildDocContext(params.nestId, params.nodeId, params.baseUrl);
-  void dispatchEvent({
-    kind: "review_rejected",
-    nestId: params.nestId,
-    subjectId: params.nodeId,
-    actor: params.rejectedBy,
-    message: `*${rejectCtx.label}* v${params.version} rejected by ${params.rejectedBy}${params.note ? ` \u2014 "${params.note}"` : ""}`
-  });
-  void notifyNestEvent(
-    params.nestId,
-    `:x: *${rejectCtx.label}* v${params.version} rejected by ${params.rejectedBy} \u2014 "${params.note}"`,
-    {
-      status: "rejected",
-      docTitle: rejectCtx.docTitle,
-      path: rejectCtx.path,
-      link: rejectCtx.link,
+      [params.rejectedBy, params.note, pending.id]
+    );
+    await db.run(
+      "UPDATE node_versions SET status = 'rejected' WHERE nest_id = ? AND node_id = ? AND version = ?",
+      [params.nestId, params.nodeId, version]
+    );
+    const rejectCtx = await buildDocContext(params.nestId, params.nodeId, params.baseUrl);
+    void dispatchEvent({
+      kind: "review_rejected",
+      nestId: params.nestId,
+      subjectId: params.nodeId,
       actor: params.rejectedBy,
-      version: params.version,
-      note: params.note || null
+      message: `*${rejectCtx.label}* v${version} rejected by ${params.rejectedBy}${params.note ? ` \u2014 "${params.note}"` : ""}`
+    });
+    void notifyNestEvent(
+      params.nestId,
+      `:x: *${rejectCtx.label}* v${version} rejected by ${params.rejectedBy} \u2014 "${params.note}"`,
+      {
+        status: "rejected",
+        docTitle: rejectCtx.docTitle,
+        path: rejectCtx.path,
+        link: rejectCtx.link,
+        actor: params.rejectedBy,
+        version,
+        note: params.note || null
+      },
+      // Verdict emails the submitter directly (below), not the team inbox.
+      { skipEmail: true }
+    );
+    if (pending.requested_by?.toLowerCase() !== params.rejectedBy.toLowerCase()) {
+      void sendEmailToRecipient(pending.requested_by, {
+        status: "rejected",
+        docTitle: rejectCtx.docTitle,
+        path: rejectCtx.path,
+        link: rejectCtx.link,
+        actor: params.rejectedBy,
+        version,
+        note: params.note || null
+      });
     }
-  );
-  await notifyReviewResolved({
-    nestId: params.nestId,
-    nodeId: params.nodeId,
-    status: "rejected",
-    resolvedBy: params.rejectedBy,
-    requestedBy: pending.requested_by,
-    reviewId: pending.id
+    await notifyReviewResolved({
+      nestId: params.nestId,
+      nodeId: params.nodeId,
+      status: "rejected",
+      resolvedBy: params.rejectedBy,
+      requestedBy: pending.requested_by,
+      reviewId: pending.id
+    });
+    return await getReviewRequest(pending.id);
   });
-  return await getReviewRequest(pending.id);
 }
 async function cancelReview(params) {
-  const db = getDb();
-  const pending = await db.get(
-    "SELECT * FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending' ORDER BY requested_at DESC LIMIT 1",
-    [params.nestId, params.nodeId]
-  );
-  if (!pending) return null;
-  await db.run(
-    `UPDATE review_requests
+  return withNodeWriteLock(nodeWriteKey(params.nestId, params.nodeId), async () => {
+    const db = getDb();
+    const pending = await db.get(
+      "SELECT * FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending' ORDER BY requested_at DESC LIMIT 1",
+      [params.nestId, params.nodeId]
+    );
+    if (!pending) return null;
+    await db.run(
+      `UPDATE review_requests
      SET status = 'cancelled', resolved_by = ?, resolved_at = ${nowExpr(db)}
      WHERE id = ?`,
-    [params.cancelledBy, pending.id]
-  );
-  await db.run(
-    "UPDATE node_versions SET status = 'draft' WHERE nest_id = ? AND node_id = ? AND version = ?",
-    [params.nestId, params.nodeId, pending.version]
-  );
-  return await getReviewRequest(pending.id);
+      [params.cancelledBy, pending.id]
+    );
+    await db.run(
+      "UPDATE node_versions SET status = 'draft' WHERE nest_id = ? AND node_id = ? AND version = ?",
+      [params.nestId, params.nodeId, pending.version]
+    );
+    return await getReviewRequest(pending.id);
+  });
 }
 async function getReviewQueue(params) {
   const db = getDb();
@@ -1322,9 +1275,11 @@ function rowToReviewRequest(row) {
 
 export {
   safePublishDocument,
+  stripUndefinedDeep,
   listWatchers,
   addWatcher,
   removeWatcher,
+  notifyNestInvite,
   listNotifications,
   markNotificationsRead,
   resolveCallerEmail,
@@ -1340,9 +1295,12 @@ export {
   envValues,
   isSafeConnectorUrl,
   dispatchEvent,
-  verifySmtp,
+  sendTestNotification,
   notifyNestEvent,
+  nodeWriteKey,
+  withNodeWriteLock,
   submitForReview,
+  repointPendingReview,
   approve,
   reject,
   cancelReview,